AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
12,409 Commits 1 Branch 0 Tags 839 MiB
2bd5405dc2
Commit Graph

4154 Commits

Author SHA1 Message Date
machenbach@chromium.org
16a487d963 Skip recently added test associated with bug id 
BUG=v8:2815
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21044005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-31 06:36:29 +00:00
bmeurer@chromium.org
64bfd42a4c Simplify implementation of Mutex. 
Also moves Mutex to its own file mutex.{cc,h}.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/21087012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 17:12:49 +00:00
mstarzinger@chromium.org
96fc677d25 Pipe a script's CORS status through V8 during compilation. 
In order to properly sanitize exception data during a 'window.onerror'
handler, we need to know whether a script was served with proper CORS
headers at the time it was loaded into V8. This patch adds a single bool
to ScriptOrigin, and pipes that through the compiler to land on the
Script object. We can then retrieve the parameter when calling the
embedder's exception callback.

BUG=crbug.com/159566
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20646006

Patch from Mike West <mkwst@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 17:05:50 +00:00
verwaest@chromium.org
2af164f4d9 Mark maps as unstable if their instances potentially transition away. 
Use this as a prerequisite for adding code dependencies.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21095005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 16:33:58 +00:00
mstarzinger@chromium.org
0627d433b0 Add new Harmony methods to String.prototype object. 
String.prototype.repeat
String.prototype.startsWith
String.prototype.endsWith
String.prototype.contains

http://people.mozilla.org/~jorendorff/es6-draft.html

BUG=v8:2796,v8:2797,v8:2798,v8:2799
TEST=mjsunit/string-repeat,mjsunit/string-startswith,mjsunit/string-endswith,mjsunit/string-contains
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21014007

Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15960 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 16:33:08 +00:00
titzer@chromium.org
45d4afbde5 Fix many tests that try to force an OSR by checking OptimizationStatus() to instead check OptimizationCount(). 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21221003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 09:28:55 +00:00
machenbach@chromium.org
7696139437 Run some skipped tests again after resolved issue. 
BUG=2795
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/21220002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 08:52:26 +00:00
mstarzinger@chromium.org
3202e1d795 Re-revert "Flush parallel recompilation queues on context dispose notification" (r15883). 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/21156009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 08:35:48 +00:00
machenbach@chromium.org
6475cb4d95 Repair test expectations for webkit test. 
When adding the new tests in https://codereview.chromium.org/21070002/ the tabs in .js files were automatically replaced with spaces (for presubmit to work).

This replaces the tabs also in a test expectation file for the output to match again.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/21156008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 07:15:29 +00:00
svenpanne@chromium.org
31e56df122 Prepare some ValueOf renamings. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20992005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 07:05:15 +00:00
yurys@chromium.org
6ba502fa4d Simplify sampling rate calculation 
Sampling rate is now calculated as total number of samples divided by profiling time in ms. Before the patch the sampling rate was updated once per 100ms which doesn't have any obvious advantage over the simpler method.

Also we are going to get rid of the profile node self and total time calculation in the v8 CPU profiler and only expose profiling start/end time for CpuProfile and number of ticks on each ProfileNode and let clients do all the math should they need it.

BUG=None
R=bmeurer@chromium.org, loislo@chromium.org

Review URL: https://codereview.chromium.org/21105003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15944 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 07:01:16 +00:00
machenbach@chromium.org
e26131f792 Migrate more tests from blink repository. 
All these tests had <script> tags with additional JS code. All embedded script code is (automatically) concatenated with existing .js files into one .js test file per test.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21070002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15943 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 06:36:48 +00:00
svenpanne@chromium.org
2fe3799b8f Added unit tests for the slightly confusing Boolean/BooleanObject API. 
Just for documenting the status quo. As discussed offline, we should
probably rename/deprecate a few things:

  NumberObject::NumberValue() => NumberObject::ValueOf()
  BooleanObject::BooleanValue() => BooleanObject::ValueOf()
  StringObject::StringValue => StringObject::ValueOf()

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21013003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:37:55 +00:00
titzer@chromium.org
37ee4a0369 Fix IsDeletable() for HStringAdd, HStringCharCodeAt, HStringCharFromCode. 
BUG=
R=mstarzinger@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/20241005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:35:43 +00:00
mvstanton@chromium.org
43e35a87e2 Fix: Need to remove function type feedback between stress stages in 
release build

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/20987005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:22:34 +00:00
bmeurer@chromium.org
e3901e919d Revert new OS and CC detection and related changes since r15923. 
Revert "Attempt to fix leftover test breakage on Mac."
Revert "Fix d8 build error when V8_SHARED is unset on Linux."
Revert "Fix V8_GNUC_PREREQ macro."
Revert "Fix typo."
Revert "Implement correct OS and CC detection."

TBR=svenpanne@chromium.org,danno@chromium.org

Review URL: https://codereview.chromium.org/21022003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15932 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:12:39 +00:00
mvstanton@chromium.org
e9cc78af7e Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow 
(https://code.google.com/p/v8/issues/detail?id=2795)

The reason is when allocating and building arrays in hydrogen we need to ensure
we do any int32-to-smi conversions BEFORE the allocation. These conversions can
at least theoretically deoptimize. If this happens before all the fields of the
newly allocated object are filled in, we will have a corrupted heap.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/20726002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 11:50:39 +00:00
bmeurer@chromium.org
2e7193f897 Implement correct OS and CC detection. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/20734002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 09:19:10 +00:00
bmeurer@chromium.org
709012021a The compiled_transitions flag was enabled for quite some time now and seems to work out quite well, so time has come to remove the obsolete code paths and remove the unused methods. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/18034024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 09:12:16 +00:00
jkummerow@chromium.org
3619dcf868 Add regression test for recently fixed bug 
BUG=chromium:258519
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/20732002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 14:58:30 +00:00
yurys@chromium.org
630999d1a2 Remove --prof-auto flag 
There is already --prof-lazy flag which should be enough.

BUG=None
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20482003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 13:18:56 +00:00
machenbach@chromium.org
53c95353c9 Disable mjsunit test when parallel recompilation is not available. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20573003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 12:34:46 +00:00
yangguo@chromium.org
b62a6d0e2e Do not allow external strings in old pointer space. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/20723002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 12:32:06 +00:00
verwaest@chromium.org
565699669e Fix Smi-based MathMinMax on x64, and reenable smi mode. 
BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/20706002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 12:06:22 +00:00
machenbach@chromium.org
2aab929806 Add webkit tests to deopt fuzzer portfolio. 
Two failing tests are skipped and added to an existing bug report.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/20708002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 11:39:58 +00:00
mstarzinger@chromium.org
ce1553ffdc Regression test for existing bug in String::MakeExternal. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 11:37:54 +00:00
yangguo@chromium.org
372763897d Lazy call to custom stack trace formatting using Error.prepareStackTrace. 
This enables custom stack trace formatting for stack overflow.
A consequence is that stack trace formatting is now easily observable,
but we already established that the default stack trace formatting can
be observed anyways. It is only triggered by the .stack getter, and
it has to be explicitly called, (e.g. not implicitly after GC).

R=mstarzinger@chromium.org
BUG=v8:2559

Review URL: https://codereview.chromium.org/20692002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 11:28:08 +00:00
machenbach@chromium.org
4bf2e5be3a Rebaseline webkit test with correct assumptions. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/20691002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 11:22:25 +00:00
machenbach@chromium.org
3c9efdeeb4 Migrate more tests from blink repository. 
The stand-alone test driver is changed a bit:
- Don't use the errorMessage list. It is used differently in the embedded driver. There it collects parser errors - instead of failure messages.
- Remove html links in description texts. Some test descriptions print a web reference.

The migrated tests fall into 3 categories:
1. Tests outside fast/js
2. Tests that print FAIL messages (and also expect those) - these tests should be examined later if they make sense at all
3. Tests with html links in the test description

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/20280003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 19:54:24 +00:00
m.m.capewell@googlemail.com
cc9398cd42 ARM: Make double registers low/high safe 
This patch prevents taking the low/high part of a double-precision VFP register that has no corresponding single-precision VFP registers.

BUG=none
TEST=Added to test-disasm-arm.cc, test-assembler-arm.cc

Review URL: https://codereview.chromium.org/19560003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 15:04:38 +00:00
jkummerow@chromium.org
32e2e37230 Fix JSArray-specific length lookup in polymorphic array handling 
BUG=chromium:263276
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20295005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 15:04:21 +00:00
yangguo@chromium.org
14e205e9cf Reland "Flush parallel recompilation queues on context dispose notification." 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19500022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 15:01:23 +00:00
dslomov@chromium.org
a418b36b75 Make DataView setters throw when only offset is provided. 
Also fix typo in error message id.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/20030004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 17:35:15 +00:00
yangguo@chromium.org
eaedafad4b Restore test and behavior prior to deferred stack trace formatting. 
R=mstarzinger@chromium.org
TEST=stack-traces-overflow.js

Review URL: https://codereview.chromium.org/19805003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 12:16:02 +00:00
machenbach@chromium.org
a0734ba3af Add deopt fuzzer tool. 
Can be run as a stand-alone script like run-tests.

Executes first all tests of a given test suite to collect the maximum number of possible deopt points. Runs then a fuzzing phase with artificial deoptimizations triggered during testing.

Works for now with mjsunit and ia32 only.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19931005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 12:04:29 +00:00
yangguo@chromium.org
6cbe01edae Revert "Flush parallel recompilation queues on context dispose notification." 
This reverts r15833.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/19647018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15841 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 07:45:54 +00:00
hpayer@chromium.org
c3c0be7160 Simplified large object allocation strategy. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19934006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 20:01:38 +00:00
hpayer@chromium.org
6c83b7d6c1 Support double allocations when folding allocation. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19956002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 19:27:00 +00:00
yangguo@chromium.org
f70cc6e114 Flush parallel recompilation queues on context dispose notification. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/19956004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 15:15:00 +00:00
yurys@chromium.org
97f8f91bb5 Fix call stack sampling for the case when native callback invokes JS function 
The SafeStackFrameIterator used by CPU profiler checked if Isolate::c_entry_fp is null and if it is not it would think that the control flow currently is in some native code. This assumption is wrong because the native code could have called a JS function but JSEntryStub would not reset c_entry_fp to NULL in that case. This CL adds a check in SafeStackFrameIterator::IsValidTop for the case when there is a JAVA_SCRIPT frame on top of EXIT frame.

Also this CL changes ExternalCallbackScope behavior to provide access to the whole stack of the scope objects instead of only top one. This allowed to provide exact callback names for those EXIT frames where external callbacks are called. Without this change it was possible only for the top most native call.

BUG=None
R=loislo@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/19775017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 15:01:38 +00:00
yurys@chromium.org
682a0d65c6 Deprecate v8::V8::Pause/ResumeProfiler 
The methods were added to the public API in r1185 when Chrome DevTools were using the same output as produced for tick processor when --prof option is specified.

I don't see any existing clients of these methods and since they add a noticeable complexity to the profiler code I'd like to remove them.

BUG=None
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19591006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 13:44:15 +00:00
verwaest@chromium.org
7e08f81e6d Also eliminate map checks with transitions. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19888006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15821 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 10:01:06 +00:00
verwaest@chromium.org
babce318d1 Eliminate map checks of constant values. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19954005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 09:18:42 +00:00
mstarzinger@chromium.org
232c55854f Add test case for issue 2793 about experimental natives. 
R=yangguo@chromium.org
BUG=v8:2793

Review URL: https://codereview.chromium.org/19948002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 18:18:55 +00:00
ulan@chromium.org
b2dd5c67f7 ARM: Ensure space for lazy deoptimization before calling IC. 
If IC triggers deoptimization, then subsequent patching might get invalid
target address that was overwritten.

R=verwaest@chromium.org
BUG=247688
TEST=mjsunit/regress/regress-247688.js

Review URL: https://chromiumcodereview.appspot.com/19972002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 17:21:41 +00:00
yangguo@chromium.org
cd41cb9b6d Turn on parallel recompilation for tests that assert optimization status. 
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/19807002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 09:16:33 +00:00
mstarzinger@chromium.org
ce81b0d3a8 ES6: Implement WeakSet 
WeakSets work similar to ordinary Sets but the value (which must be an
object) is held weakly.

This is available under --harmony-collections

BUG=v8:2785
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19678023

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 08:32:24 +00:00
rossberg@chromium.org
ac2b8c04f3 Proxies: Make 'with' work, plus minor other fixes 
Also fixes internal exception handling in several places of the runtime.

R=yangguo@chromium.org
BUG=v8:1543

Review URL: https://codereview.chromium.org/19384004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 14:07:23 +00:00
ulan@chromium.org
88a4b0d6ca Fix deopt in store with effect context. 
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19693004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 13:45:26 +00:00
mvstanton@chromium.org
ec8c6f4692 Rename AllocationSiteInfo to AllocationMemento 
This is just a rename change with the exception of a bug found along the way in
CodeStubGraphBuilder<FastCloneShallowArrayStub>::BuildCodeStub(). There, the
intent is to get the boilerplate object from an AllocationSite. But the wrong
HObjectAccess was used. It only succeeds because it happened to be the same
offset :).

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19595004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 13:30:49 +00:00