Commit Graph

3512 Commits

Author SHA1 Message Date
adamk
1f1329d960 Use SetOwnElement when creating splice records in array length setter
This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Review URL: https://codereview.chromium.org/820503005

Cr-Commit-Position: refs/heads/master@{#25908}
2014-12-19 19:39:35 +00:00
Benedikt Meurer
f7e4689061 [turbofan] Fix unsafe out-of-bounds check for checked loads/stores.
BUG=chromium:443744
LOG=y
TEST=mjsunit/compiler/regress-443744
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/804993004

Cr-Commit-Position: refs/heads/master@{#25901}
2014-12-19 12:53:29 +00:00
caitpotter88
233f2d2bf1 Simplify scanner and generate better error message for legacy octals in templates
LOG=N
BUG=
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/812163003

Cr-Commit-Position: refs/heads/master@{#25895}
2014-12-18 22:01:41 +00:00
arv
c05a4036b0 ES6 template literals should not use legacy octal strings
Correctly handle SyntaxErrors in escape sequences.

BUG=v8:3736
LOG=Y
R=dslomov@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/811113002

Cr-Commit-Position: refs/heads/master@{#25891}
2014-12-18 19:41:58 +00:00
ulan
83e6c7fe26 Temporarily disable mjsunit/debug-stepframe for GC stress until
crash is fixed.

BUG=v8:3776
LOG=N
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/812283004

Cr-Commit-Position: refs/heads/master@{#25883}
2014-12-18 14:05:04 +00:00
machenbach
7d48fd9dc2 Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/792233008/)
Reason for revert:
[sheriff] Still crashes on win32 (XP):
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1380

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f4.
>
> This changes to do an early bailout in
> HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
> loop.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org,arv@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/811593004

Cr-Commit-Position: refs/heads/master@{#25872}
2014-12-17 19:47:12 +00:00
arv
cc568d1b7a ES6 computed property names
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f4.

This changes to do an early bailout in
HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
loop.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/792233008

Cr-Commit-Position: refs/heads/master@{#25868}
2014-12-17 18:38:55 +00:00
caitpotter88
525385ab50 Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable
LOG=N
BUG=v8:3764, v8:3765
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/799803003

Cr-Commit-Position: refs/heads/master@{#25855}
2014-12-16 21:08:27 +00:00
arv
2639bfe993 ES6: Update unscopables to match spec
The spec ended up using Get(unscopables, propertyName) and
comparing the result to undefined instead of using Has.

BUG=v8:3632
LOG=Y
R=adamk, dslomov@chromium.org

Review URL: https://codereview.chromium.org/807893002

Cr-Commit-Position: refs/heads/master@{#25854}
2014-12-16 20:07:41 +00:00
arv
5f22fdd5ae Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/807173002/)
Reason for revert:
Crashes Win32. It was not flake.

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f4 with
> no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
> try again.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/807033003

Cr-Commit-Position: refs/heads/master@{#25853}
2014-12-16 19:38:59 +00:00
arv
a235b1076a ES6 computed property names
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f4 with
no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
try again.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/807173002

Cr-Commit-Position: refs/heads/master@{#25851}
2014-12-16 17:30:05 +00:00
svenpanne
cbf3b0bcc7 More -fsanitize=vptr fixes.
This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
2014-12-16 14:20:28 +00:00
marja
978f41a1da RegExpParser: Fix Reset()ting to the end.
The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}
2014-12-16 12:14:19 +00:00
caitpotter88
aed5d734e6 Use proper ToLength() operation in %ArrayConcat()
LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/799853003

Cr-Commit-Position: refs/heads/master@{#25828}
2014-12-15 19:08:41 +00:00
arv
a76419f0f4 Revert of ES6 computed property names (patchset #9 id:160001 of https://codereview.chromium.org/795573005/)
Reason for revert:
Crashes on Win32

http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1357

Test: mjsunit/harmony/computed-property-names
Flags: --stress-opt --always-opt
Command: build\Release\d8.exe --test --random-seed=-233815021 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --harmony-computed-property-names test\mjsunit\mjsunit.js test\mjsunit\harmony\computed-property-names.js

Run #1
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #2
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #3
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> BUG=v8:3754
> LOG=Y

TBR=dslomov@chromium.org,wingo@igalia.com
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/809433002

Cr-Commit-Position: refs/heads/master@{#25825}
2014-12-15 16:38:42 +00:00
jkummerow
c060f4e26c Internalize strings being stored into uninitialized property cells
Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}
2014-12-15 15:46:11 +00:00
arv
6e38caf8d3 ES6 computed property names
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

BUG=v8:3754
LOG=Y

Review URL: https://codereview.chromium.org/795573005

Cr-Commit-Position: refs/heads/master@{#25821}
2014-12-15 15:27:19 +00:00
fedor.indutny
f6e68d2c2c Hydrogen: fix keyed loads with string keys
Keyed loads should not unconditionally be compiled to element loads. Update KeyedLoadICs to keep track of the key type, so that Hydrogen can emit ICs for string-keyed loads it doesn't have inline support for.

BUG=v8:3167
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/755513003

Cr-Commit-Position: refs/heads/master@{#25817}
2014-12-15 13:36:23 +00:00
mathiasb
b24f04d4c3 Make RegExp.prototype.flags getter configurable
TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/788053003

Cr-Commit-Position: refs/heads/master@{#25809}
2014-12-13 22:36:29 +00:00
caitpotter88
48054170e9 Implement ES6 @@isConcatSpreadable / Array.prototype.concat
Add support for Symbol.isConcatSpreadable in Array.prototype.concat. This enables spreading non-Array objects with the symbol.

LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/771483002

Cr-Commit-Position: refs/heads/master@{#25808}
2014-12-12 18:38:48 +00:00
Benedikt Meurer
14409abc22 [turbofan] Quickfix for invalid number truncation of typed array loads.
TEST=mjsunit/compiler/regress-int32array-outofbounds-nan
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/803483002

Cr-Commit-Position: refs/heads/master@{#25793}
2014-12-12 10:45:38 +00:00
caitpotter88
17ba366bb8 Implement Array.from()
A helpful utility which converts iterables and array-like objects into Arrays

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.from

LOG=Y
BUG=v8:3336
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/363833006

Cr-Commit-Position: refs/heads/master@{#25785}
2014-12-11 17:16:27 +00:00
dslomov
e6198a0fed Update tests in preparation for shipping classes.
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}
2014-12-11 15:54:09 +00:00
yangguo
dae6dfe08b Implement Math.log2 via ported extract from fdlibm.
Adapted from Raymond Toy's (rtoy@chromium.org) port, extracted from fdlibm's pow implementation.

R=rtoy@chromium.org
BUG=v8:3579
LOG=N

Review URL: https://codereview.chromium.org/786823003

Cr-Commit-Position: refs/heads/master@{#25768}
2014-12-11 11:23:37 +00:00
kozyatinskiy
affe4c03b6 [V8] Report v8::AfterCompile and v8::CompileError to listener on pause
V8 didn't report compile events on pause before this patch. These events can be important for listener. For example, DevTools allows user to execute some JS code on pause and needs to show correct stack trace in message from it.

BUG=396013
R=yurys@chromium.org

Review URL: https://codereview.chromium.org/781623004

Cr-Commit-Position: refs/heads/master@{#25767}
2014-12-11 10:59:00 +00:00
mathiasb
33f0cf5acd Implement the RegExp.prototype.flags getter
TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/770333005

Cr-Commit-Position: refs/heads/master@{#25762}
2014-12-10 20:41:10 +00:00
adamk
4fa7ae1c07 Optimize Object.seal and Object.preventExtensions
They both now run fast (due to utilizing transitions instead of always
creating new maps) and sealed or non-extensible objects can stay in
fast mode after transitioning.

This almost entirely reuses the code for transitioning objects
frozen by Object.freeze(), with the added benefit of freeing
up a bit on the map (we no longer keep track of frozen-ness,
as that bit wasn't used for anything interesting).

BUG=v8:3662,chromium:115960
LOG=y

Review URL: https://codereview.chromium.org/776143005

Cr-Commit-Position: refs/heads/master@{#25759}
2014-12-10 20:02:59 +00:00
Adam Klein
986e7cefe1 Ensure class prototype objects have the right Map::constructor field
The null constructor they had previously could be observed as crashes in
the V8 API's Object::CreationContext() method and in Object.observe.

BUG=v8:3750
LOG=n
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/787763005

Cr-Commit-Position: refs/heads/master@{#25757}
2014-12-10 18:25:55 +00:00
ishell
7d13ca278a Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."
Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}
2014-12-10 15:18:52 +00:00
titzer
9a823cf612 Reland "[turbofan] Fix control reducer bug with NTLs."
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/789083004

Cr-Commit-Position: refs/heads/master@{#25740}
2014-12-10 11:45:35 +00:00
d
4161b54d58 Add Array.prototype.includes
Requires adding a SameValueZero implementation.

LOG=Y
BUG=v8:3575
R=dslomov@chromium.org, arv@chromium.org
TEST=added to test262

Review URL: https://codereview.chromium.org/771863002

Cr-Commit-Position: refs/heads/master@{#25735}
2014-12-10 08:58:15 +00:00
dslomov
008405f0b9 Pass --noharmony-scoping to tests validating that we throw on 'const' in strict mode.
R=marja@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/784323002

Cr-Commit-Position: refs/heads/master@{#25733}
2014-12-10 08:55:53 +00:00
Benedikt Meurer
19418d76df [x64] Fix optimization for certain checked load/stores.
BUG=chromium:439743
LOG=y
TEST=mjsunit
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/733893008

Cr-Commit-Position: refs/heads/master@{#25731}
2014-12-10 07:49:12 +00:00
Ben L. Titzer
a068503b45 Revert "[turbofan] Fix control reducer bug with NTLs."
This reverts commit aeda76c5cf.

Reason: exposed other TurboFan bugs.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/785233003

Cr-Commit-Position: refs/heads/master@{#25730}
2014-12-09 16:28:20 +00:00
titzer
aeda76c5cf [turbofan] Fix control reducer bug with NTLs.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/789773002

Cr-Commit-Position: refs/heads/master@{#25725}
2014-12-09 15:09:59 +00:00
Benedikt Meurer
48a6766e78 [x86] Disable invalid checked load/store optimization.
TEST=mjsunit/compiler/regress-lena
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/784153006

Cr-Commit-Position: refs/heads/master@{#25722}
2014-12-09 14:16:34 +00:00
dslomov
1954ad8bc1 Do not reflect uninitialized 'let' and 'const' in scope mirrors.
R=yangguo@chromium.org,aandrey@chromium.org
BUG=v8:3743
LOG=N

Review URL: https://codereview.chromium.org/758603004

Cr-Commit-Position: refs/heads/master@{#25712}
2014-12-08 14:59:28 +00:00
jochen
97c1f4b15c Turn on DCHECKs and other debugging code if dcheck_always_on is 1
When compiling with the macro DCHECK_ALWAYS_ON defined, DCHECKs and
supporting code gets compiled and enabled.

This increases test coverage for chromium release buildbots

BUG=v8:3731
R=jkummerow@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/760213005

Cr-Commit-Position: refs/heads/master@{#25701}
2014-12-08 09:26:16 +00:00
dslomov
293f898a6f Make sure that individual shipping features can be disabled.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/779203005

Cr-Commit-Position: refs/heads/master@{#25690}
2014-12-05 15:35:37 +00:00
dslomov
bd04e6cdad Fix the order of context binding/simulate insertion for BlockContexts.
R=jarin@chromium.org
BUG=v8:3741
LOG=N

Review URL: https://codereview.chromium.org/762393008

Cr-Commit-Position: refs/heads/master@{#25684}
2014-12-05 13:06:50 +00:00
arv
edf3dab466 ES6 template literals: Fix issue with template after rbrace
If we hade }` the right brace was always treated as part of the
template literal. We should only treat the right brace as part of
the literal when we continue to parse the template literal after a
placeholder.

BUG=v8:3734
LOG=Y

Review URL: https://codereview.chromium.org/778813003

Cr-Commit-Position: refs/heads/master@{#25661}
2014-12-04 14:50:17 +00:00
arv
d67e573dbe Simplify template literal raw string creation
BUG=v8:3710
LOG=Y
R=dslomov@chromium.org, marja@chromium.org

Review URL: https://codereview.chromium.org/768203002

Cr-Commit-Position: refs/heads/master@{#25640}
2014-12-03 14:17:23 +00:00
ulan
2ac522ab15 Reland parts of 'Use weak cells in map checks in polymorphic ICs'
This relands macroassembler instructions and weak cell caching and
does not include parts that caused "Linux ASan LSan" test failures.

BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/764003003

Cr-Commit-Position: refs/heads/master@{#25615}
2014-12-02 14:25:26 +00:00
svenpanne
c16b8f6cbb Fixed environment handling for LFlooringDivI on ARM.
Beautiful code... :-}

BUG=chromium:437765
LOG=y

Review URL: https://codereview.chromium.org/775613002

Cr-Commit-Position: refs/heads/master@{#25613}
2014-12-02 13:47:19 +00:00
marja
0a0e6c8c81 ES6 unicode extensions, part 1.
Allows \u{xxxxx} in variable names and string literals (not yet in regexps).

Everything's behind the --harmony-unicode flag.

BUG=

Review URL: https://codereview.chromium.org/716423002

Cr-Commit-Position: refs/heads/master@{#25603}
2014-12-02 10:58:19 +00:00
machenbach
d9c83f6bd0 Revert of Use weak cells in map checks in polymorphic ICs. (patchset #8 id:140001 of https://codereview.chromium.org/753993003/)
Reason for revert:
[Sheriff] Speculative revert for breaking chromium asan (roll blocker):
http://build.chromium.org/p/client.v8/builders/Linux%20ASan%20LSan%20Tests%20%281%29/builds/1683

Original issue's description:
> Use weak cells in map checks in polymorphic ICs.
>
> BUG=v8:3663
> LOG=N

TBR=mvstanton@chromium.org,akos.palfi@imgtec.com,weiliang.lin@intel.com,ulan@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3663

Review URL: https://codereview.chromium.org/771033003

Cr-Commit-Position: refs/heads/master@{#25597}
2014-12-02 08:17:05 +00:00
dslomov
573401a422 harmony-classes: Fix some issues with syntactic restriction on super(...).
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/770843002

Cr-Commit-Position: refs/heads/master@{#25589}
2014-12-01 20:13:54 +00:00
ulan
45a36948e1 Use weak cells in map checks in polymorphic ICs.
BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/753993003

Cr-Commit-Position: refs/heads/master@{#25581}
2014-12-01 10:41:14 +00:00
dslomov
9e02e98771 Introduce a kill-switch for shipping features.
R=rossberg@chromium.org
TBR=hpayer@chromium.org

Committed: d628562086

Review URL: https://codereview.chromium.org/763273002

Cr-Commit-Position: refs/heads/master@{#25577}
2014-11-28 20:07:18 +00:00
dslomov
557bf53b79 Revert of Introduce a kill-switch for shipping features. (patchset #2 id:20001 of https://codereview.chromium.org/763273002/)
Reason for revert:
Reverted for breaking nosnap: http://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20nosnap/builds/1003/steps/Check/logs/Threading3

Original issue's description:
> Introduce a kill-switch for shipping features.
>
> R=rossberg@chromium.org
>
> Committed: d628562086

TBR=rossberg@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/763353002

Cr-Commit-Position: refs/heads/master@{#25574}
2014-11-28 18:27:55 +00:00