Commit Graph

16985 Commits

Author SHA1 Message Date
vogelheim@chromium.org
7b7bb25a24 Support external startup data in V8.
[Re-retry of r21696 and r21739]

If the embedder chooses, the 'natives' (library sources) and the
precompiled startup blob can be written to files during the build
process and handed over to V8 at startup. The main purpose would be
to reduce the size of the compiled binary for space constrained
platforms.

The build-time option is off by default. Nothing should change if
it's not enabled.

BUG=
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/334913004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21941 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:52:17 +00:00
ishell@chromium.org
d2f229bf9f Several methods moved from JSObject to Map.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/349203002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:46:49 +00:00
mvstanton@chromium.org
b3f8487726 Create a RegisterSpec class inside of the IC that provides:
1) symbolic names for the register (like, edx == receiver)
2) can return an array of registers
3) defines ordering when passed on the stack

Code that implements or uses the IC should use this RegisterSpec instead of "knowing" what the registers are. Or at least have the RegisterSpec to validate it's assumptions.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/340363002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:42:12 +00:00
jochen@chromium.org
23521436fb Partial revert of r21901 (2nd attempt)
Only disable runtime check for sse2 if __SSE2__ is not defined. This
is required for the x87 port

BUG=none
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/331803006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:30:03 +00:00
alph@chromium.org
f61854fe0a Support LiveEdit on Arm64
BUG=368580
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/339663007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21937 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:20:26 +00:00
yangguo@chromium.org
2411bc9447 Harden %FunctionBindArguments wrt optimized code cache.
R=jkummerow@chromium.org
BUG=387627
LOG=N

Review URL: https://codereview.chromium.org/345463005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:17:42 +00:00
rmcilroy@chromium.org
7f429e62c3 [Arm]: Simplify compile-time Arm feature detection.
Simplify the compile time feature detection on Arm:
 - Define CAN_USE_XXX definitions unconditionally for all target/host
   toolchain combinations
 - Rename arm_test / ARM_TEST to arm_test_noprob / ARM_TEST_NO_FEATURE_PROBE
 - Don't set ARM_TEST_NO_FEATURE_PROBE implicitly on the simulator to make
   make simulator / native more consistent
 - Unify CpuFeatures::PrintTarget for simulator and native builds
 - Remove unecessary CAN_USE_VFP_INSTRUCTIONS definition for android (this is
   the default for arm_fpu=default)
 - Add a CpuFeatures::Probe() before calling CpuFeatures::PrintFeatures() in PrintHelp
    to ensure we have probed features before printing them.

BUG=384474
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/340373002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 12:19:54 +00:00
rmcilroy@chromium.org
a818a3e7fa Special case ConstantPoolArray in MarkCompactCollector::MigrateObject.
Special case the ConstantPoolArray in MarkCompactCollector::MigrateObject since it could contain
integer value entires which look like tagged pointers.

R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/304223002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 12:18:13 +00:00
yangguo@chromium.org
9e3ba659d9 Run JS micro tasks in the appropriate context.
R=jochen@chromium.org
BUG=385349
LOG=Y

Review URL: https://codereview.chromium.org/332923003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 11:47:20 +00:00
rmcilroy@chromium.org
1b080a76c1 [Arm] Various cleanups to the Arm assembler backend.
A couple of cleanups to the Arm backend to enable support of extended
OOL constant pools in a following CL.

 - Remove instruction pattern extern const's and replace their use with IsXXX()
   functions.
 - Do calculation of the target address of a load from constant pool in one
   place.
 - A couple of other small cleanups.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/317653003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21932 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 11:27:24 +00:00
verwaest@chromium.org
b0d3b668dd Tiny cleanup, reduce direct usage of the LookupIterator
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/346233003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 10:44:08 +00:00
verwaest@chromium.org
e976bfa159 Don't bypass the global proxy as the global object should never escape into JS
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/334233003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 10:42:49 +00:00
verwaest@chromium.org
499ae77e18 Ensure the receiver for EnableAccessCheck is always a JSObject
BUG=
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/349923005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 10:35:58 +00:00
marja@chromium.org
5ef3f06029 Revert "Partial revert of r21901"
This reverts r21927.

Reason: broke the build.

BUG=
TBR=jochen@chromium.org, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/347423002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21928 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 10:31:12 +00:00
jochen@chromium.org
2880181fb8 Partial revert of r21901
Only disable runtime check for sse2 if __SSE2__ is not defined. This
is required for the x87 port

BUG=none
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/350693005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 10:18:43 +00:00
verwaest@chromium.org
064885b62d Turn assert into RUNTIME_ASSERT
TBR=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/350683003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:52:05 +00:00
jochen@chromium.org
ce02221828 Add a use counter API
This lets embedders track certain features of v8 and the number of times
they are used

BUG=none
R=svenpanne@chromium.org, marja@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/346233002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:46:58 +00:00
rodolph.perfetta@arm.com
ec22430733 ARM64: updated literal pool implementation.
Currently the literal pool implemetation is inherited from the arm 32-bit port
and it shares the same limitations: 4k of range and 1000 entries max. In arm64
the load literal has a 1MB range giving us more flexibility.

Immutable entries are now shared.

BUG=
R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/338523005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:30:45 +00:00
weiliang.lin@intel.com
16d5587c6d X87: Introduce intrinsic to expose debug state to generated code.
port r21908.

original commit message:

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/349183002

Patch from Chunyang Dai <chunyang.dai@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:17:04 +00:00
verwaest@chromium.org
bd5f13ebc3 Remove specialized access checks and overwrites altogether. They are already handled by GetOwnPropertyAttributes (and GetPropertyAttributesWithFailedAccessChecks)
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/331693006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:11:45 +00:00
jochen@chromium.org
e369c9e75e Simplify Object::GetElementWithReceiver
Don't inline GetPrototype() to avoid code duplication

BUG=none
R=dcarney@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/331313010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:09:36 +00:00
mvstanton@chromium.org
c0179a50da Re-land "Clusterfuzz identified overflow check needed in dehoisting."
BUG=380092
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/335063005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:09:05 +00:00
verwaest@chromium.org
702167b107 Simplify {Enable|Disable}AccessCheck
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/334243003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:04:17 +00:00
verwaest@chromium.org
d06afb3ce0 Remove AccessControl from AccessorPairs, as it's an invalid usecase of AllCan*
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/332863003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:02:16 +00:00
verwaest@chromium.org
d611bd896b Simplify access checks performed by GetOwnProperty
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/339553002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 08:53:27 +00:00
svenpanne@chromium.org
996eed315e Make our FOO::cast methods const.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/347073003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21916 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 08:51:13 +00:00
hpayer@chromium.org
100b9d836f An object should only be promoted to the old generation if it survived a scavenge operation.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/345523002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 08:50:54 +00:00
marja@chromium.org
2c8eef08ca Revert "Set host_arch to ia32 on machines with a 32bit userland but a 64bit kernel."
This reverts r21909.

Reason: breaks NaCL build.

BUG=
TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/346223004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 08:47:07 +00:00
jochen@chromium.org
1ef52275d5 Set host_arch to ia32 on machines with a 32bit userland but a 64bit kernel.
I don't know if there are any v8 bots with that configuration, but it seems
like a good idea to have v8 be consistent with chromium and nacl here, so that
this works fine if such a bot is ever set up.

This is similar to https://codereview.chromium.org/342493002/ , but with a
detect_v8_host_arch.py script that handles the additional machine types that
standalone.gypi used to handle.

BUG=368384 possibly?
LOG=Y
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/346643002

Patch from Nico Weber <thakis@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 08:19:54 +00:00
yangguo@chromium.org
ba2d7da5a9 Introduce intrinsic to expose debug state to generated code.
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/332673002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 07:10:25 +00:00
jarin@chromium.org
e56faa9909 Add missing map check to optimized f.apply(...)
This is a cutdown version of https://codereview.chromium.org/346473002/, which aimed to fix f.call and f.apply. Optimized f.call was removed by r21887, this is what was left.

BUG=386034
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/348623002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 05:50:06 +00:00
plind44@gmail.com
b6b57605ed MIPS: Fix big-endian after r21774/r21803.
Fix big-endian ordering of InstanceType and BitField by always loading
the pair as a 16-bit value, even in the API accessor. Clean up some
assertions.

R=danno@chromium.org, mtbrandy@gmail.com

Review URL: https://codereview.chromium.org/334403003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 23:02:36 +00:00
palfia@homejinni.com
57d0b53eed MIPS: Support LiveEdit.
Port r21895 (210f7aa)

BUG=368580
LOG=Y
R=jkummerow@chromium.org, palfia@homejinni.com

Review URL: https://codereview.chromium.org/349703002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 20:52:57 +00:00
palfia@homejinni.com
a07e8ff631 MIPS: Make object accessors more const-correct.
Port r21897 (1b152ae)

Fix MIPS implementation of READ_DOUBLE_FIELD() to use const parameter.

Original commit message:
Getting closer to making our IsFOO and FOO::cast methods
const-correct...

BUG=
R=gergely@homejinni.com, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/344203005

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 20:36:49 +00:00
jkummerow@chromium.org
1d35d6d871 Array.concat: properly go to dictionary mode when required
BUG=chromium:387031
LOG=y
R=danno@chromium.org

Review URL: https://codereview.chromium.org/342333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 15:40:21 +00:00
wingo@igalia.com
b7d18d0eff Fix stack capture on overflow for Error.stackTraceLimit == Infinity
Bug found by Andrew Paprocki <andrew@ishiboo.com>.

R=mstarzinger@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/345533002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 14:27:55 +00:00
jkummerow@chromium.org
8a9406017c Clean up unused stuff in atomicops_internals_{tsan,x86_gcc}.h
This ports crrev.com/278081 and crrev.com/271506 to V8.

R=glider@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/342323002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 12:58:48 +00:00
marja@chromium.org
0f8251e1b8 test-parsing: Add functionality to specify "always true flags".
Many parsing tests need to pin a certain flag, and apart from the pinned flag,
we want to keep the "test with all combinations" behavior for the non-pinned
flags.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/349603004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 12:28:13 +00:00
rodolph.perfetta@arm.com
736a17f8f4 ARM: Avoid duplicate vmla when merging vmul and vadd
Avoid generating duplicate vmla instructions for vmul/vadd sequences where the
vmul has more than one use.

For example: function f(a, b, c) { return (a * b) + c + (a * b); }

Previously, this would produce a vmul for the subexpression (a * b), then vmla
for (a * b) + c, then vmla for (a * b) + [(a * b) + c].

Now it produces vmul, vadd, vadd, as expected.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/323423003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 11:26:17 +00:00
mstarzinger@chromium.org
5eb7ce9040 Remove obsolete --harmony-promises flag from tests.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/345053002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 10:47:50 +00:00
svenpanne@chromium.org
dda110fd77 Make object accessors more const-correct.
Getting closer to making our IsFOO and FOO::cast methods const-correct...

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/349623002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 10:31:17 +00:00
marja@chromium.org
1fd638e284 Parser: Refactor strict mode checks for functions
Moves the strict mode checks and error reporting for the function and
parameter names into a separate CheckStrictFunctionNameAndParameters()
function in ParserBase. Parsing of arrow functions will then use this
new function instead of duplicating the error code.

BUG=
R=marja@chromium.org

Review URL: https://codereview.chromium.org/332053004

Patch from Adrián Pérez de Castro <aperez@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 09:45:05 +00:00
alph@chromium.org
969759fd3f Support LiveEdit on ARM
BUG=368580
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/344573004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21895 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 09:41:14 +00:00
mstarzinger@chromium.org
fec6e62dfb Check alpha-sorting of includes during presubmit.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/333013002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 08:40:11 +00:00
yurys@chromium.org
a862f7819b Added Message::GetScripOrigin.
Replaced Message::GetResourceName with GetScriptOrigin().ResourceName().

Now, GetScriptOrigin().ResourceName() function returns the resource name or sourceURL (from //# sourceURL=) for the script from where the function causing the error originates.

Method GetScriptResourceName() deprecated. Use GetScriptOrigin()->ResourceName() instead.

Function used in Blink: https://codereview.chromium.org/260513004/

R=yangguo@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/265593002

Patch from Alexey Kozyatinskiy <kozyatinskiy@google.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 07:44:05 +00:00
ishell@chromium.org
a685c2e005 --verify-predictable mode added for ensuring that GC behaves deterministically.
In order to be able to use it one should pass verifypredictable=on to the make tool or specify v8_enable_verify_predictable=1 in GYP_DEFINES.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/325553002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21892 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 07:35:48 +00:00
svenpanne@chromium.org
48e1ae334f Make the internal parts of our external API a bit more const-correct.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/343583002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 07:20:44 +00:00
dcarney@chromium.org
bd3f8a524e Revert "Optimize Function.prototype.call"
This reverts commit r21840.

R=danno@chromium.org
LOG=y
BUG=chromium:385565

Review URL: https://codereview.chromium.org/347573002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-18 14:04:41 +00:00
yangguo@chromium.org
0be13a7719 Move invalid string length check to the factory.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/347503003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-18 13:26:02 +00:00
jarin@chromium.org
1a138034bd Fix LStoreCodeEntry to treat the code_object parameter as input.
The bug seems to trigger only with array_index_dehoisting off in
the snapshot, so it is hard to test for (ideas?).

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/347523002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-18 11:17:52 +00:00