Commit Graph

4603 Commits

Author SHA1 Message Date
cbruni
cfd417202e [runtime-object]: part fix element key list on global object
BUG=v8:2764
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1378323003

Cr-Commit-Position: refs/heads/master@{#31099}
2015-10-05 14:23:26 +00:00
machenbach
e1743816d3 Reland [swarming] Isolate v8 testing.
This reverts commit 280a6f8ec8.

Reland of https://codereview.chromium.org/1380593002/

BUG=chromium:535160
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel;

Review URL: https://codereview.chromium.org/1390473003

Cr-Commit-Position: refs/heads/master@{#31094}
2015-10-05 09:48:42 +00:00
danno
280a6f8ec8 Revert of [swarming] Isolate v8 testing. (patchset #8 id:140001 of https://codereview.chromium.org/1380593002/ )
Reason for revert:
Prime suspect in breakage of V8 Linux -- no snap

Original issue's description:
> [swarming] Isolate v8 testing.
>
> Add gyp support and isolates for default test suites.
> Add two default isolates, one (default) for using the
> test suite collection we call "default" on the bots. One
> (developer_default) for also supporting the way developers
> call the driver (i.e. without argument, which includes
> the unittests).
>
> BUG=chromium:535160
> LOG=n
>
> Committed: https://crrev.com/9bd83f58f29ab0c7c5b71b00bcb1df3a9e641f05
> Cr-Commit-Position: refs/heads/master@{#31081}

TBR=tandrii@chromium.org,jochen@chromium.org,maruel@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:535160

Review URL: https://codereview.chromium.org/1370993008

Cr-Commit-Position: refs/heads/master@{#31084}
2015-10-02 15:45:13 +00:00
machenbach
9bd83f58f2 [swarming] Isolate v8 testing.
Add gyp support and isolates for default test suites.
Add two default isolates, one (default) for using the
test suite collection we call "default" on the bots. One
(developer_default) for also supporting the way developers
call the driver (i.e. without argument, which includes
the unittests).

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1380593002

Cr-Commit-Position: refs/heads/master@{#31081}
2015-10-02 15:15:39 +00:00
cbruni
1cb899046c [cross-context] create new function prototypes in the context of the function
BUG=v8:4217
LOG=Y

Review URL: https://codereview.chromium.org/1381543005

Cr-Commit-Position: refs/heads/master@{#31074}
2015-10-02 13:30:19 +00:00
jkummerow
ecf2327691 Fix FixedArrayBase cast in NumberOfOwnElements
The problem was harmless, but made --enable-slow-asserts unhappy.

BUG=chromium:538086
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1384673003

Cr-Commit-Position: refs/heads/master@{#31069}
2015-10-02 11:49:00 +00:00
ishell
aa6a654a0f Temporarily disable mjsunit/call-counts test until --vector-stores is prermanently enabled.
BUG=v8:4458
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1387533002

Cr-Commit-Position: refs/heads/master@{#31067}
2015-10-02 09:29:10 +00:00
machenbach
366dc81143 [Swarming] Presort tests - slowest first.
Swarming won't support an incremental data file. By just
sorting the lowest hanging fruits to the beginning we
already get a big bang for the buck (>80% of the improvement
we get otherwise).

This will require semi-regular manual updates of the
slowest tests.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1385443002

Cr-Commit-Position: refs/heads/master@{#31061}
2015-10-01 19:19:17 +00:00
ishell
898524afce Disable vector store ICs for mjsunit/call-counts because slot indices change when --vector-stores is enabled.
Review URL: https://codereview.chromium.org/1381073003

Cr-Commit-Position: refs/heads/master@{#31059}
2015-10-01 18:03:46 +00:00
bmeurer
2a0759d3ff [es6] Fix missing bits for full @@toPrimitive support.
Introduce %_ToNumber intrinsic, which just calls to the existing
ToNumberStub, and remove all uses of our custom JavaScript plus
intrinsics based ToNumber and friends.

Also replace the TO_NUMBER_INLINE macro with TO_NUMBER,
which is currently a wrapper for %_ToNumber. Newly written JS
code should use TO_NUMBER (similar to TO_STRING, TO_INT32,
and friends).

Also finally remove the DefaultString/DefaultNumber builtins, which
are basically the ES5 version of ToPrimitive. Now all code uses the
ES6 version, which is implemented in Object::ToPrimitive and
JSReceiver::ToPrimitive in C++.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1384443002

Cr-Commit-Position: refs/heads/master@{#31054}
2015-10-01 16:08:49 +00:00
neis
cf82eea6d7 Fix completion of try..finally.
R=rossberg
BUG=v8:2529
LOG=Y

Review URL: https://codereview.chromium.org/1375203004

Cr-Commit-Position: refs/heads/master@{#31051}
2015-10-01 13:59:56 +00:00
rossberg
2c2848dccf [es6] Scoping & initialization for var shadowing non-simple parameters
Var-bindings may shadow parameters from a non-simple parameter list. When that happens: they create separate bindings, but are initialised with the respective parameter value. Thus:

(function(x, f = () => x) { var x; var y = x; x = 2; return [x, y, f()] })(1) -->  [2, 1, 1]

This CL implements that by inserting a suitable assignment for every shadwowing var-variable (e.g., x = outer_x above) at the beginning of the function's body block.

R=adamk@chromium.org
BUG=v8:4440,v8:811
LOG=N

Review URL: https://codereview.chromium.org/1371333004

Cr-Commit-Position: refs/heads/master@{#31042}
2015-10-01 10:42:33 +00:00
littledan
76da493315 Extend Annex B 3.3 sloppy-mode block-scoped hoisting to scripts, eval
The ES2015 spec is missing an extension of sloppy-mode block-scoped function
behavior to the global scope in scripts, as well as to eval. This patch
brings that hoisting to those two areas. The behavior is not perfectly
spec-compliant since properties created on the global scope should be
set as enumerable even if they are non-enumerable previously, but the
attributes will not be modified if the property already exists under
this patch.

BUG=v8:4441
LOG=Y
R=adamk
TEST=reddit comment functionality seems to be fixed

Review URL: https://codereview.chromium.org/1376623002

Cr-Commit-Position: refs/heads/master@{#31037}
2015-09-30 23:48:34 +00:00
adamk
163419e8fa Remove --harmony-arrow-functions flag
Arrow functions have been enabled by default since the 4.5 branch.

Review URL: https://codereview.chromium.org/1373633002

Cr-Commit-Position: refs/heads/master@{#31031}
2015-09-30 19:50:40 +00:00
kozyatinskiy
ce54e16270 [V8] Add name of function for function's closure scope
Added ScopeDetails.name field for closure scopes. It contains function's debug name of current context of scope.

BUG=493156
LOG=Y
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1375813002

Cr-Commit-Position: refs/heads/master@{#31028}
2015-09-30 17:24:33 +00:00
dusan.m.milosavljevic
8bd431de92 MIPS64: Add big-endian support for mips64.
TEST=
BUG=

Review URL: https://codereview.chromium.org/1334793004

Cr-Commit-Position: refs/heads/master@{#31011}
2015-09-29 17:23:55 +00:00
neis
d3ef8f4b95 [es6] Ship rest parameters.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1371963002

Cr-Commit-Position: refs/heads/master@{#30970}
2015-09-28 11:19:35 +00:00
bmeurer
175edfb470 [turbofan] Rename --context-specialization to --function-context-specialization.
This name makes it clear that the flag (also the variant in the Compiler)
is talking about specializing to the function context instead of i.e. the
native context.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1372513003

Cr-Commit-Position: refs/heads/master@{#30934}
2015-09-25 11:33:38 +00:00
bmeurer
ff2c9eace4 [es6] Remove left-overs from Function.prototype.toMethod.
The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod.  This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.

The original removal of Function.prototype.toMethod was in February
2015 in 68e4897586.

R=jarin@chromium.org
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1366063002

Cr-Commit-Position: refs/heads/master@{#30925}
2015-09-25 04:04:36 +00:00
stefan.penner
ab9898980e Don’t smash globals used by the test helper itself.
Since https://codereview.chromium.org/366103005 the promise tests null out
various globals, to ensure the promise implementation doesn’t itself rely
on functions patchable by monkeys.

Unfortunately, doing so breaks test assertion failures which rely on
those globals.

This isn’t the ideal solution, but does improve the current state.

R=littledan@chromium.org,domenic@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1370583002

Cr-Commit-Position: refs/heads/master@{#30922}
2015-09-24 21:47:17 +00:00
bmeurer
7a7b692b30 [runtime] Replace %to_string_fun with %_ToString.
Introduce a new macro TO_STRING that maps to %_ToString and use that
instead of calling into any of the ToString/NonStringToString JavaScript
builtins. Also remove the TO_STRING_INLINE macro, which is basically
obsolete with %_ToString. We still have a few uses of ToString left (via
the utils export mechanism), where we need to investigate whether we
will tank badly if we replace them with TO_STRING as well.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1323543002

Cr-Commit-Position: refs/heads/master@{#30895}
2015-09-23 21:46:49 +00:00
jkummerow
afa60ff604 [field type tracking] Fix handling of cleared WeakCells
Whenever a generalization is computed, the inputs must be checked for being cleared, and if they are, the generalization must be Type::Any.

Hopefully this fixes Chromium issue 527994 as well.

BUG=v8:4325,chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1361103002

Cr-Commit-Position: refs/heads/master@{#30887}
2015-09-23 12:35:36 +00:00
ishell
f5dc276a2c Exclude test/mjsunit/regress/regress-4121.js from GC stress testing.
NOTRY=true

Review URL: https://codereview.chromium.org/1364583003

Cr-Commit-Position: refs/heads/master@{#30885}
2015-09-23 11:15:58 +00:00
ishell
4dd45e115b Share literals arrays per <NativeContext, SharedFunctionInfo> pair.
This CL also renames wrongly named test for v8:4173.

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1353363002

Cr-Commit-Position: refs/heads/master@{#30879}
2015-09-23 08:46:28 +00:00
adamk
7485da7ace Don't crash when preparsing destructured arguments
This adds the materialized literal count accumulated while parsing the
parameters (in the parser proper) to that accumulated by the preparser.

This should have been caught in cctest/test-parsing, but it's not covered
because the parsing tests call directly into the preparser rather than
using Parser::ParseFunctionLiteral (which fully-parses the parameters
and then calls into the preparser to skip over the function body).

Note that this further-inflates the materialized literal count for
functions with destructured arguments, since some of the counted
literals are actually binding patterns. But that's not specific to
binding patterns in formal parameters: it happens in function bodies, too.

BUG=v8:4400,v8:4407
LOG=n

Review URL: https://codereview.chromium.org/1350913005

Cr-Commit-Position: refs/heads/master@{#30868}
2015-09-22 17:43:43 +00:00
conradw
24ec2a0baa [strong] Implement revised strong class semantics
Weak classes can inherit from strong ones again, a strong base class makes
instances strong.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1347243004

Cr-Commit-Position: refs/heads/master@{#30867}
2015-09-22 16:34:52 +00:00
bmeurer
3d7c45371e [crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.
If @@toStringTag is an accessor property, we cannot assume that the result
of calling Object.prototype.toString() for objects with the same map.

R=adamk@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1360723002

Cr-Commit-Position: refs/heads/master@{#30856}
2015-09-22 04:08:08 +00:00
bmeurer
e56f265f6d [ic] Also collect known map for relational comparison.
Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.

For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1355113002

Cr-Commit-Position: refs/heads/master@{#30852}
2015-09-21 16:05:43 +00:00
littledan
e5ff10d767 Implement sloppy-mode block-defined functions (Annex B 3.3)
ES2015 specifies very particular semantics for functions defined in blocks.
In strict mode, it is simply a lexical binding scoped to that block. In sloppy
mode, in addition to that lexical binding, there is a var-style binding in
the outer scope, which is overwritten with the local binding when the function
declaration is evaluated, *as long as* introducing ths var binding would not
create a var/let conflict in the outer scope.

This patch implements the semantics by introducing a DelegateStatement, which
is initially filled in with the EmptyStatement and overwritten with the
assignment when the scope is closed out and it can be checked that there is
no conflict.

This patch is tested with a new mjsunit test, and I tried staging it and running
test262, finding that the tests that we have disabled due to lack of Annex B
support now pass.

R=adamk,rossberg
LOG=Y
BUG=v8:4285

Review URL: https://codereview.chromium.org/1332873003

Cr-Commit-Position: refs/heads/master@{#30842}
2015-09-21 04:31:09 +00:00
adamk
7462e99667 Remove on-by-default flag --harmony-object
It's been enabled since M45, which is now well into its stable period,
with no problems reported.

Review URL: https://codereview.chromium.org/1356793002

Cr-Commit-Position: refs/heads/master@{#30835}
2015-09-18 18:37:57 +00:00
ben
bfce677866 Pretenure builtin typed arrays.
Typed arrays from the snapshot start out in the young space but they
all seem to end up in the old space sooner or later anyway.  Let's
expedite that by allocating them in the old space right away.

Review URL: https://codereview.chromium.org/1347263003

Cr-Commit-Position: refs/heads/master@{#30804}
2015-09-17 14:47:56 +00:00
ishell
3d964e0b83 Disable tests that are known to be non-deterministic in --verify-predictable mode.
Review URL: https://codereview.chromium.org/1352803002

Cr-Commit-Position: refs/heads/master@{#30799}
2015-09-17 13:02:10 +00:00
jkummerow
9516dccd41 Reland "[test] Fix cctest path separators on Windows"
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Original review: https://codereview.chromium.org/1348653003/

This reverts commit 5f44a91059.

NOTRY=true

Review URL: https://codereview.chromium.org/1356613002

Cr-Commit-Position: refs/heads/master@{#30798}
2015-09-17 13:01:12 +00:00
jkummerow
5f44a91059 Revert of [test] Fix cctest path separators on Windows (patchset #2 id:20001 of https://codereview.chromium.org/1348653003/ )
Reason for revert:
mozilla tests are failing on Windows

Original issue's description:
> [test] Fix cctest path separators on Windows
>
> Now run-tests.py understands "suite/foo/bar" with forward slashes for
> command-line test selection on all test suites on all platforms.
>
> Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
> that behavior is sacrificed here in favor of unification. For the cctest
> suite, OTOH, it wasn't possible on Windows to select specific tests at all.
>
> Committed: https://crrev.com/b36cfdb39ae648b49a1396c4f669df9b1f57996c
> Cr-Commit-Position: refs/heads/master@{#30794}

TBR=machenbach@google.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1349163002

Cr-Commit-Position: refs/heads/master@{#30795}
2015-09-17 12:00:23 +00:00
jkummerow
b36cfdb39a [test] Fix cctest path separators on Windows
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Review URL: https://codereview.chromium.org/1348653003

Cr-Commit-Position: refs/heads/master@{#30794}
2015-09-17 11:24:09 +00:00
aperez
d4e1299f16 ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32
Defines a new --harmony-tolength flag, and a ToLengthFlagged() runtime function,
that is used where ES6 requires ToLength(), but a pre-ES6 conversion existed
before. When the flag is disabled, the function uses TO_UINT32(), which is
the pre-ES6 behaviour. When the flag enabled, the ES6-compliant ToLength()
conversion is used.

Based on a patch initially from Diego Pino <dpino@igalia.com>

BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1309243003

Cr-Commit-Position: refs/heads/master@{#30772}
2015-09-16 18:01:52 +00:00
caitpotter88
b444da41ad [es6] support get and set in shorthand properties
Add support for `get` and `set` as shorthand properties. Also
supports them for CoverInitializedName in BindingPatterns and (once implemented)
AssignmentPatterns.

BUG=v8:4412, v8:3584
LOG=N
R=adamk, aperez, wingo, rossberg

Review URL: https://codereview.chromium.org/1328083002

Cr-Commit-Position: refs/heads/master@{#30769}
2015-09-16 16:02:05 +00:00
binji
f5bec4bcd4 [Atomics] Remove support for atomic accesses on floating-point values.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1318713007

Cr-Commit-Position: refs/heads/master@{#30755}
2015-09-15 21:25:14 +00:00
adamk
f44efd6b31 Fix spread operator in ArrayLiterals when nested in other literals
Mark ArrayLiterals utilizing the spread operator as non-simple.
This causes them to return false for IsCompileTimeValue, and thus
causes spread to work as expected in nested literals.

BUG=v8:4417
LOG=y

Review URL: https://codereview.chromium.org/1336123002

Cr-Commit-Position: refs/heads/master@{#30754}
2015-09-15 16:43:39 +00:00
bmeurer
e2f1c26982 [es6] Move builtin constructors for primitives to strict mode.
The ES6 specification says that "Built-in functions that are ECMAScript
function objects must be strict mode functions", which in particular
means that you can never test for them using the "caller" field of a
sloppy mode function.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:105
LOG=n

Review URL: https://codereview.chromium.org/1347663002

Cr-Commit-Position: refs/heads/master@{#30750}
2015-09-15 14:32:39 +00:00
mstarzinger
9e47ec6eda [turbofan] Fix JSInliner to handle non-returning bodies.
The assumption that every function body produces a value does not hold
for functions that e.g. unconditionally throw or endlessly loop. This
fixes the inlining logic to handle such cases.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-530598
BUG=chromium:530598
LOG=n

Review URL: https://codereview.chromium.org/1333193005

Cr-Commit-Position: refs/heads/master@{#30738}
2015-09-15 11:19:23 +00:00
cbruni
2f1df49a6c Fixing Sloppy Symbol.iterator setter
In certiain cases the ArgumentsIteratorSetter would trigger an invalid
state in the LookupIterator when being overridden. This is now solved
by bypassing the SetDataProperty and directly using
DefinePropertyOrElementIgnoringAttributes since we know exactly which
property we're going to install

LOG=N
BUG=chromium:521484

Review URL: https://codereview.chromium.org/1332873002

Cr-Commit-Position: refs/heads/master@{#30705}
2015-09-14 07:22:35 +00:00
conradw
33ec0b79b8 Parsing especially large nested functions takes up more memory than necessary.
Inner functions must be eagerly parsed for scope analysis, but the full AST is
also kept around even though it's not needed.

This CL mitigates this problem by allocating some AstNodes of the inner function
to a temporary Zone which is deallocated once the scope information has been
built. The remaining nodes (such as VariableProxy) must persist until scope
analysis actually happens, and have to be allocated to a parser-persistent Zone.

BUG=417697
LOG=N

Review URL: https://codereview.chromium.org/1304923004

Cr-Commit-Position: refs/heads/master@{#30685}
2015-09-10 14:41:14 +00:00
bmeurer
a1b2ec60b0 [runtime] Move binary operator fallbacks into the runtime.
Replace the ADD, SUB, etc. builtins with proper runtime implementations,
and expose them as runtime calls that can be used by the code stubs and
the interpreter (for now).

Also remove all the support runtime functions for ADD, SUB and friends,
namely %NumberAdd, %NumberSub, and so on.

R=mstarzinger@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg

Review URL: https://codereview.chromium.org/1333843002

Cr-Commit-Position: refs/heads/master@{#30680}
2015-09-10 13:04:33 +00:00
fedor
6da51b4b66 TypedArray accessor detection: consider entire prototype chain
When looking up a special accessor for known TypedArray fields
("length", "byteLength", "byteOffset"), consider the entire prototype
chain, not only the direct prototype.
This allows subclasses of TypedArrays to benefit from fast specialized
accesses.

Review URL: https://codereview.chromium.org/1313493005

Cr-Commit-Position: refs/heads/master@{#30678}
2015-09-10 12:21:55 +00:00
mstarzinger
5e15679809 [turbofan] Disable test that started to timeout.
The two tests in question got a lot slower and started to timeout now
that the C++ fallback implementation of the %Arguments intrinsics is
composable with respect to inlining.

R=bmeurer@chromium.org,machenbach@chromium.org

Review URL: https://codereview.chromium.org/1330203003

Cr-Commit-Position: refs/heads/master@{#30674}
2015-09-10 10:39:17 +00:00
mvstanton
164f92d206 Crankshaft: consolidated element loads always deopted on seeing the hole
Update the consolidated load case to carefully chose the load mode
based on the consolidated elements kind.

BUG=v8:4380
LOG=N

Review URL: https://codereview.chromium.org/1329793003

Cr-Commit-Position: refs/heads/master@{#30659}
2015-09-09 15:15:30 +00:00
mstarzinger
a504a184f6 [turbofan] Make %Arguments composable with inlining.
This makes the C++ fallback implementations for the two intrinsics,
%Arguments and %ArgumentsLength composable with respect to inlining.
Using deoptimization information gives us accurate data here.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4374
BUG=v8:4374
LOG=n

Review URL: https://codereview.chromium.org/1328363002

Cr-Commit-Position: refs/heads/master@{#30654}
2015-09-09 14:14:18 +00:00
mstarzinger
c505907dce [turbofan] Handle stack overflow exceptions in JSInliner.
R=bmeurer@chromium.org
BUG=chromium:527364
LOG=n

Review URL: https://codereview.chromium.org/1322203005

Cr-Commit-Position: refs/heads/master@{#30651}
2015-09-09 10:24:31 +00:00
mstarzinger
819b40aae8 Use baseline code to compute message locations.
This switches Isolate::ComputeLocation to use baseline code when
computing message locations. This unifies locations between optimized
and non-optimized code by always going through the FrameSummary for
location computation.

R=bmeurer@chromium.org
TEST=message/regress/regress-4266
BUG=v8:4266
LOG=n

Review URL: https://codereview.chromium.org/1331603002

Cr-Commit-Position: refs/heads/master@{#30635}
2015-09-08 14:14:59 +00:00
bmeurer
db2ba190db [runtime] Replace many buggy uses of %_CallFunction with %_Call.
The semantics of the %_CallFunction intrinsic seem to be very unclear,
which resulted in a lot of bugs. Especially the combination with
%IsSloppyModeFunction is always a bug, because the receiver would be
wrapped in the wrong context. So the %IsSloppyModeFunction helper is
gone now, and many of the buggy uses of %_CallFunction are also
eliminated.

If you ever need to call something with a different receiver, then
%_Call is your friend now. It does what you want and implements the
call sequence fully (and correct).

BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1325573004

Cr-Commit-Position: refs/heads/master@{#30634}
2015-09-08 13:35:32 +00:00
cbruni
cbdb13533e Adding ElementsAccessor::Concat
- Moving parts of ArrayConcat from builtins.cc to the ElementsAccessor
- Removing ArrayConcat Runtime Function

BUG=v8:4317
LOG=N

Review URL: https://codereview.chromium.org/1330483003

Cr-Commit-Position: refs/heads/master@{#30619}
2015-09-07 13:45:02 +00:00
bradnelson
12889b4ad2 Follow symlinks in test/mjsunit to allow linked test directories.
Wasm mjsunit tests aren't being detected when symlinked into
test/mjsunit/wasm. This causes symlinked directories in that
directory to be included.

BUG=None
TEST=local
R=dehrenberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1332463002

Cr-Commit-Position: refs/heads/master@{#30600}
2015-09-04 23:16:09 +00:00
karl
24d481165c Reland: Speedup stringsearch for two byte strings
Uses the lower byte with memchr which is
significantly faster than a naive compare

Performance difference with bench (http://hastebin.com/xuxexataso.js):

old                             new

single character                single character
Κ found at 922                  Κ found at 922
3324                            616
㎡ found at 13217               ㎡ found at 13217
42366                           4931
က found at 4096                 က found at 4096
13369                           9836
＀ found at 65280                ＀ found at 65280
207472                          36149
ᆬ found at 65445                ᆬ found at 65445
209344                          36666
  found at 8197                   found at 8197
26731                           11757
倂 found at 20482               倂 found at 20482
66071                           17193

linear search                   linear search
ΚΛ found at 922                 ΚΛ found at 922
4112                            504
㎡㎢ found at 13217             ㎡㎢ found at 13217
55105                           5119
ᆬᆭ found at 65445               ᆬᆭ found at 65445
268016                          35496

linear + bmh search             linear + bmh search
ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
2897                            522
ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445         ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445
167687                          35283

BUG=

Review URL: https://codereview.chromium.org/1324453007

Cr-Commit-Position: refs/heads/master@{#30597}
2015-09-04 19:58:44 +00:00
machenbach
df966cd287 Revert of Speedup stringsearch for two byte strings (patchset #3 id:40001 of https://codereview.chromium.org/1303033012/ )
Reason for revert:
[Sheriff] Breaks fuzzer and msan:
http://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/4773

Repro with:
tools/fuzz-harness.sh out/Debug/d8
(in a ninja Debug build)

Msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/4097

Original issue's description:
> Speedup stringsearch for two byte strings
>
> Uses the lower byte with memchr which is
> significantly faster than a naive compare
>
> Performance difference with bench (http://hastebin.com/xuxexataso.js):
>
> old                             new
>
> single character                single character
> Κ found at 922                  Κ found at 922
> 3324                            616
> ㎡ found at 13217               ㎡ found at 13217
> 42366                           4931
> က found at 4096                 က found at 4096
> 13369                           9836
> ＀ found at 65280                ＀ found at 65280
> 207472                          36149
> ᆬ found at 65445                ᆬ found at 65445
> 209344                          36666
>   found at 8197                   found at 8197
> 26731                           11757
> 倂 found at 20482               倂 found at 20482
> 66071                           17193
>
> linear search                   linear search
> ΚΛ found at 922                 ΚΛ found at 922
> 4112                            504
> ㎡㎢ found at 13217             ㎡㎢ found at 13217
> 55105                           5119
> ᆬᆭ found at 65445               ᆬᆭ found at 65445
> 268016                          35496
>
> linear + bmh search             linear + bmh search
> ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
> 2897                            522
> ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445         ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445
> 167687                          158465
>
> Committed: https://crrev.com/fced280f37588f8a232a414201276e053117e9ea
> Cr-Commit-Position: refs/heads/master@{#30587}

TBR=danno@chromium.org,mstarzinger@chromium.org,jkummerow@chromium.org,karl@skomski.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1331433002

Cr-Commit-Position: refs/heads/master@{#30588}
2015-09-04 13:00:35 +00:00
karl
fced280f37 Speedup stringsearch for two byte strings
Uses the lower byte with memchr which is
significantly faster than a naive compare

Performance difference with bench (http://hastebin.com/xuxexataso.js):

old                             new

single character                single character
Κ found at 922                  Κ found at 922
3324                            616
㎡ found at 13217               ㎡ found at 13217
42366                           4931
က found at 4096                 က found at 4096
13369                           9836
＀ found at 65280                ＀ found at 65280
207472                          36149
ᆬ found at 65445                ᆬ found at 65445
209344                          36666
  found at 8197                   found at 8197
26731                           11757
倂 found at 20482               倂 found at 20482
66071                           17193

linear search                   linear search
ΚΛ found at 922                 ΚΛ found at 922
4112                            504
㎡㎢ found at 13217             ㎡㎢ found at 13217
55105                           5119
ᆬᆭ found at 65445               ᆬᆭ found at 65445
268016                          35496

linear + bmh search             linear + bmh search
ΚΛΜΝΞΟΠΡ found at 922           ΚΛΜΝΞΟΠΡ found at 922
2897                            522
ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445         ᆬᆭᄃᄄᄅᆰᆱᆲ found at 65445
167687                          158465

Review URL: https://codereview.chromium.org/1303033012

Cr-Commit-Position: refs/heads/master@{#30587}
2015-09-04 12:37:48 +00:00
gdeepti
e1f38de76a [Tick processor] Add an option to the tick-processor to print the summary.
- Print the summary excluding other tick information
 - Add test to verify that summary is printed correctly.

BUG=None
LOG=N

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1318933004

Cr-Commit-Position: refs/heads/master@{#30573}
2015-09-03 18:01:48 +00:00
caitpotter88
510baeacba [es6] Re-implement rest parameters via desugaring.
Kills the kRestParameter bailout/disabled optimization, and fixes
lazily parsed arrow functions with rest parameters.

Supercedes https://crrev.com/1235153006/

BUG=chromium:508074, v8:2160, v8:2700
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1272673003

Cr-Commit-Position: refs/heads/master@{#30550}
2015-09-02 21:11:05 +00:00
cbruni
a369ab1838 Adding ElementsAccessor::Shift
- Use the new ElementsAccessor methods
- improve test coverage

BUG=

Review URL: https://codereview.chromium.org/1317053006

Cr-Commit-Position: refs/heads/master@{#30546}
2015-09-02 15:29:40 +00:00
conradw
db440dfe8d [strong] weak classes can't inherit from strong ones
Prerequisite for sealing strong class instances.

Depends on https://codereview.chromium.org/1314203002/

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1316333002

Cr-Commit-Position: refs/heads/master@{#30541}
2015-09-02 11:36:20 +00:00
ishell
85f6e16844 [arm64] Don't try convert binary operation to shifted form when both operands are the same.
BUG=chromium:523307
LOG=N

Review URL: https://codereview.chromium.org/1304923003

Cr-Commit-Position: refs/heads/master@{#30538}
2015-09-02 09:32:44 +00:00
binji
196d6aeec1 Remove harmony-atomics flag and collapse it into sharedarraybuffer flag
Having both flags is tedious, and it is unlikely you'd ever want them
separately.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1304163010

Cr-Commit-Position: refs/heads/master@{#30523}
2015-09-01 18:34:00 +00:00
conradw
05f01b3f8e [strong] Class constructor bodies cannot contain "use strong" directive
Since the constructor is also the class object itself, allowing it to
retroactively become a strong object would have unintuitive consequences
wrt the strength of the other functions of the class, and whether instances
would be considered instances of a strong class.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1314203002

Cr-Commit-Position: refs/heads/master@{#30519}
2015-09-01 18:29:35 +00:00
littledan
f65e61ef44 Make Date.prototype an ordinary object
This is a change for ES2015. Date objects have mutable state, so having
a mutable prototype is bad for SES requirements, and it is an
inconsistency from the typical ES2015 class style of objects

BUG=v8:4004
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1317403002

Cr-Commit-Position: refs/heads/master@{#30486}
2015-08-31 20:45:48 +00:00
bmeurer
3c164506f5 [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin.
This way we don't need to expose JSReceiver::OrdinaryToPrimitive
as runtime function, and we don't need the separate JS trampoline.

This also adds tests for ToPrimitive on date objects, which are
special.

R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1324713002

Cr-Commit-Position: refs/heads/master@{#30473}
2015-08-31 12:53:10 +00:00
cbruni
f68dcc924b Adding ElementsAccessor::Slice
- Move fast paths from builtins.cc ArraySlice to ElementsAccessor
- Handle more argument types in the fast path

BUG=

Review URL: https://codereview.chromium.org/1321773002

Cr-Commit-Position: refs/heads/master@{#30471}
2015-08-31 12:19:28 +00:00
machenbach
44a93bcbea [test] Skip slow test on no18n bot.
TBR=hablich@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1321063004

Cr-Commit-Position: refs/heads/master@{#30466}
2015-08-31 11:15:10 +00:00
littledan
6773e2961d Propagate switch statement value for 'eval'
This patch changes the switch scope desugaring to create blocks which
propagate their 'return value' for eval.

BUG=v8:4399
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1309303006

Cr-Commit-Position: refs/heads/master@{#30454}
2015-08-28 22:43:07 +00:00
littledan
d6fb6de709 Ensure hole checks take place in switch statement scopes
Switch statements introduce their own scope for cases, but this scope
is not necessarily executed in order, as the following function shows:

  switch (x) {
    case 1:
      let y = 1;
    case 2:
      y = 2;
    case 3:
      print(y);
  }

If x = 2 or x = 3, the code should throw a ReferenceError. However,
FullCodeGen's hole check elimination used the simple algorithm of
assuming that if the initializer was in the same scope, then it was
reached before the use, and therefore the hole check could be
eliminated.

This patch adds an extra bit to scopes, to track if they may
nonlinearly. The parser marks the scope that switch introduces as
nonlinear. FullCodeGen does not eliminate the hole check from
a scope which is nonlinear. This patch refactors FullCodeGen to
put the hole check elimination in one place, rather than in each
backend.

BUG=v8:3926
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1312613003

Cr-Commit-Position: refs/heads/master@{#30453}
2015-08-28 18:49:57 +00:00
littledan
decc7b092a Sloppy-mode let parsing
This patch makes 'let' a contextual keyword in both strict and sloppy mode.
It behaves as a keyword when used at the beginning of a StatementListItem
or lexical declaration at the beginning of a for statement, if it is followed
by an identifier, [ or {. Implementing this change requires an extra token
look-ahead by the parser which is only invoked in certain cases (so as to
avoid parsing RegExps as ECMAScript tokens). This might result in a slowdown
of the scanner, but performance testing of this patch hasn't yet found much
of a regression.

BUG=v8:3305
LOG=Y
R=adamk,vogelheim

Review URL: https://codereview.chromium.org/1315673009

Cr-Commit-Position: refs/heads/master@{#30451}
2015-08-28 18:47:40 +00:00
bmeurer
09de997b35 [runtime] Add %ToString and %_ToString and remove the TO_STRING builtin.
This adds a new ToString runtime function and a fast-path ToStringStub
(which is just a simple dispatcher for existing functionality), and also
implements %_ToName using the ToStringStub.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319973007

Cr-Commit-Position: refs/heads/master@{#30442}
2015-08-28 13:00:11 +00:00
Benedikt Meurer
eceaaf7d19 [test] Fix wrong mjsunit.status line.
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1325453002 .

Cr-Commit-Position: refs/heads/master@{#30437}
2015-08-28 10:22:19 +00:00
Benedikt Meurer
03541141b9 [test] Properly disable test that doesn't work in GC stress.
The magic "print(i)" work-around was no longer work-arounding correctly,
so we do the right thing instead now.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1306843004 .

Cr-Commit-Position: refs/heads/master@{#30436}
2015-08-28 10:20:46 +00:00
bmeurer
c403ede42a [es6] Implement spec compliant ToName (actually ToPropertyKey).
This adds a %ToName runtime entry that uses the previously introduced
Object::ToName, which is based on the new Object::ToPrimitive method.
Also removes the need to expose ToName in various way via the builtins
and/or context.

Drive-by-fix: Let %HasProperty do the ToName conversion implicitly as
required.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319133002

Cr-Commit-Position: refs/heads/master@{#30435}
2015-08-28 09:46:51 +00:00
bmeurer
f6c6d713b4 [es6] Implement spec compliant ToPrimitive in the runtime.
This is the first step towards a spec compliant ToPrimitive
implementation (and therefore spec compliant ToNumber, ToString,
ToName, and friends).  It adds support for the @@toPrimitive
symbol that was introduced with ES2015, and also adds the new
Symbol.prototype[@@toPrimitive] and Date.prototype[@@toPrimitive]
initial properties.

There are now runtime functions for %ToPrimitive, %ToNumber and
%ToString, which do the right thing and should be used as fallbacks
instead of the hairy runtime.js implementations.  I will do the
same for the other conversion operations mentioned by the spec in
follow up CLs.  Once everything is in place we can look into
optimizing things further, so that we don't always call into the
runtime.

Also fixed Date.prototype.toJSON to be spec compliant.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=y

Review URL: https://codereview.chromium.org/1306303003

Cr-Commit-Position: refs/heads/master@{#30434}
2015-08-28 09:21:43 +00:00
cbruni
8198610d5d Adding ElementsAccessor Splice
- remove the Backing-Store specific code from builtins.cc and put it in elements.cc.
- adding tests to improve coverage of the splice method

BUG=

Review URL: https://codereview.chromium.org/1312033003

Cr-Commit-Position: refs/heads/master@{#30410}
2015-08-27 13:06:05 +00:00
conradw
77394fa05a [parser] disallow language mode directive in body of function with non-simple parameters
TC39 agreed to disallow "use strict" directives in function body when
non-simple parameter lists are used.

This is a continuation of caitp's CL https://codereview.chromium.org/1281163002/
with some refactorings removed for now.

Still TODO: there is a lot of duplication between the is_simple field of
FormalParametersBase and the NonSimpleParameter property ExpressionClassifier
keeps track of. It should be possible to remove the former with a minor
refactoring of arrow function parsing. This will be attempted in a follow-up CL.

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1300103005

Cr-Commit-Position: refs/heads/master@{#30388}
2015-08-26 14:59:19 +00:00
bmeurer
b4c7399464 [runtime] Remove the redundant %_IsObject intrinsic.
%_IsObject(foo) is equivalent to typeof foo === 'object' and has
exactly the same optimizations, so there's zero need for %_IsObject
in our code base.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1313903003

Cr-Commit-Position: refs/heads/master@{#30380}
2015-08-26 11:28:06 +00:00
yangguo
299f775cf4 Call JS functions via native context instead of js builtins object.
We look up %-functions in the context if not found in the runtime.

R=bmeurer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1306993003

Cr-Commit-Position: refs/heads/master@{#30379}
2015-08-26 11:16:57 +00:00
mstarzinger
cbd4f5aa98 [turbofan] Fix broken dynamic TDZ check for let and const.
This fixes broken dynamic hole-checks for the temporal dead zone of
non-initializing assignments to {let} and {const} declared variables.
Also note that this exemplifies a case where the dynamic check for such
assignments to {let} declared variables can no longer be elided as the
comment suggested.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4388
BUG=v8:4388
LOG=n

Review URL: https://codereview.chromium.org/1318693002

Cr-Commit-Position: refs/heads/master@{#30375}
2015-08-26 09:53:11 +00:00
ishell
590b3bed5c Do not inline array resize operations for outdated prototype maps.
BUG=chromium:523213
LOG=N

Review URL: https://codereview.chromium.org/1313303002

Cr-Commit-Position: refs/heads/master@{#30374}
2015-08-26 09:37:53 +00:00
wingo
79e74db3e0 Parse arrow functions at proper precedence level
BUG=v8:4211
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1315823002

Cr-Commit-Position: refs/heads/master@{#30373}
2015-08-26 09:36:45 +00:00
rossberg
089592ad33 [es6] Remaining cases of parameter scopes for sloppy eval
R=littledan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1303013007

Cr-Commit-Position: refs/heads/master@{#30363}
2015-08-25 22:24:29 +00:00
adamk
233d62f8e3 [es6] Fix computed property names in nested literals
Make ObjectLiteral::is_simple() false for literals containing computed
property names, which causes IsCompileTimeValue() to return false and
thus force code to be generated for setting up such properties. This
mirrors the handling of '__proto__' in literals.

BUG=v8:4387
LOG=y

Review URL: https://codereview.chromium.org/1307943007

Cr-Commit-Position: refs/heads/master@{#30362}
2015-08-25 21:10:44 +00:00
rossberg
0b3b72671e [es6] Correct length for functions with default parameters
R=adamk@chromium.org
BUG=v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1311163002

Cr-Commit-Position: refs/heads/master@{#30361}
2015-08-25 18:52:13 +00:00
bbudge
8a278a4cc4 [simd.js] Update to spec version 0.8.2.
Adds Uint32x4, Uint16x8, and Uint8x16 types.
Adds all functions in the current spec, except for loads and stores.

LOG=Y
BUG=v8:4124

Committed: https://crrev.com/4be6d37fd1ad0a6e0ea37da8863ae5169c2b89ba
Cr-Commit-Position: refs/heads/master@{#30322}

Review URL: https://codereview.chromium.org/1294513004

Cr-Commit-Position: refs/heads/master@{#30353}
2015-08-25 12:35:19 +00:00
hablich
cfdcc874a9 Revert of Moving ArraySplice Builtin to ElementsAccessor (patchset #8 id:140001 of https://codereview.chromium.org/1293683005/ )
Reason for revert:
Fails layout tests: http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/1450

Original issue's description:
> - remove the Backing-Store specific code from builtins.cc and put it in elements.cc.
> - adding tests to improve coverage of the splice method
>
> BUG=
>
> Committed: https://crrev.com/8533d4b5433d3a9e9fb1015f206997bd6d869fe3
> Cr-Commit-Position: refs/heads/master@{#30269}
>
> Committed: https://crrev.com/07a4a6cb8e2ab940b28a7151a925c796da023524
> Cr-Commit-Position: refs/heads/master@{#30326}

TBR=mvstanton@chromium.org,cbruni@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1315823004

Cr-Commit-Position: refs/heads/master@{#30351}
2015-08-25 11:18:39 +00:00
bmeurer
fef38c21e8 [crankshaft] DCE must not eliminate (observable) math operations.
The HUnaryMathOperation cannot be eliminated in general, because the
spec requires a ToNumber conversion on the input, which is observable
of course.

BUG=v8:4389
LOG=y

Review URL: https://codereview.chromium.org/1307413003

Cr-Commit-Position: refs/heads/master@{#30343}
2015-08-25 06:24:55 +00:00
bmeurer
5d875a57fa Correctify instanceof and make it optimizable.
The previous hack with HInstanceOfKnownGlobal was not only slower,
but also very brittle and required a lot of weird hacks to support it. And
what's even more important it wasn't even correct (because a map check
on the lhs is never enough for instanceof).

The new implementation provides a sane runtime implementation
for InstanceOf plus a fast case in the InstanceOfStub, combined with
a proper specialization in the case of a known global in CrankShaft,
which does only the prototype chain walk (coupled with a code
dependency on the known global).

As a drive-by-fix: Also fix the incorrect Object.prototype.isPrototypeOf
implementation.

BUG=v8:4376
LOG=y

Review URL: https://codereview.chromium.org/1304633002

Cr-Commit-Position: refs/heads/master@{#30342}
2015-08-25 04:48:54 +00:00
littledan
45e2628df7 Add a separate scope for switch
The ES2015 specification for switch statements 13.12.11 specifies that
they get their own lexical scope. This patch introduces such a scope
through a complex desugaring in terms of blocks, done so that Crankshaft
does not have to be updated to support multiple constructs providing
scopes.

Recommitting this patch after a bug fix in Crankshaft to allow a
desugaring with certain elements missing a source location:
https://codereview.chromium.org/1313443002

BUG=v8:4377
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1309163003

Cr-Commit-Position: refs/heads/master@{#30340}
2015-08-24 18:57:20 +00:00
mstarzinger
7fb31bdba4 Make Simulator respect C stack limits as well.
The simulator uses a separate JS stack, exhaustion of the C stack
however is not caught by JS limit checks. This change now lowers the
limit of the JS stack accordingly on function calls.

R=mvstanton@chromium.org
BUG=chromium:522380
TEST=mjsunit/regress/regress-crbug-522380
LOG=n

Review URL: https://codereview.chromium.org/1314623002

Cr-Commit-Position: refs/heads/master@{#30334}
2015-08-24 15:55:40 +00:00
yangguo
24544698ef Message formatting: handle unexpected case of failing property lookup.
R=cbruni@chromium.org
BUG=chromium:523308
LOG=N

Review URL: https://codereview.chromium.org/1314543004

Cr-Commit-Position: refs/heads/master@{#30330}
2015-08-24 13:40:27 +00:00
yangguo
e8ce7acf53 Debugger: use correct position for for-next expression statement.
R=rossberg@chromium.org
BUG=chromium:523543
LOG=N

Review URL: https://codereview.chromium.org/1310213002

Cr-Commit-Position: refs/heads/master@{#30328}
2015-08-24 13:08:22 +00:00
cbruni
07a4a6cb8e - remove the Backing-Store specific code from builtins.cc and put it in elements.cc.
- adding tests to improve coverage of the splice method

BUG=

Committed: https://crrev.com/8533d4b5433d3a9e9fb1015f206997bd6d869fe3
Cr-Commit-Position: refs/heads/master@{#30269}

Review URL: https://codereview.chromium.org/1293683005

Cr-Commit-Position: refs/heads/master@{#30326}
2015-08-24 10:55:13 +00:00
hablich
86016622b4 Revert of [simd.js] Update to spec version 0.8.2. (patchset #11 id:200001 of https://codereview.chromium.org/1294513004/ )
Reason for revert:
Fails tests:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20deadcode/builds/5073/steps/steps/logs/stdio

Original issue's description:
> [simd.js] Update to spec version 0.8.2.
>
> Adds Uint32x4, Uint16x8, and Uint8x16 types.
> Adds all functions in the current spec, except for loads and stores.
>
> LOG=Y
> BUG=v8:4124
>
> Committed: https://crrev.com/4be6d37fd1ad0a6e0ea37da8863ae5169c2b89ba
> Cr-Commit-Position: refs/heads/master@{#30322}

TBR=littledan@chromium.org,bbudge@google.com,bmeurer@chromium.org,hpayer@chromium.org,bbudge@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review URL: https://codereview.chromium.org/1309513005

Cr-Commit-Position: refs/heads/master@{#30323}
2015-08-24 10:06:43 +00:00
bbudge
4be6d37fd1 [simd.js] Update to spec version 0.8.2.
Adds Uint32x4, Uint16x8, and Uint8x16 types.
Adds all functions in the current spec, except for loads and stores.

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1294513004

Cr-Commit-Position: refs/heads/master@{#30322}
2015-08-24 09:13:08 +00:00
yangguo
cc97e524a1 Revert of Parse arrow functions at proper precedence level (patchset #2 id:60001 of https://codereview.chromium.org/1286383005/ )
Reason for revert:
Breaks layout test. Please change test expectation on blink first.

--- /mnt/data/b/build/slave/V8-Blink_Linux_64/build/layout-test-results/inspector/sources/debugger-pause/debugger-pause-in-internal-expected.txt
+++ /mnt/data/b/build/slave/V8-Blink_Linux_64/build/layout-test-results/inspector/sources/debugger-pause/debugger-pause-in-internal-actual.txt
@@ -1,4 +1,4 @@
-CONSOLE ERROR: line 9: Uncaught SyntaxError: Expected () to start arrow function, but got '}' instead of '=>'
+CONSOLE ERROR: line 9: Uncaught SyntaxError: Unexpected token )
 Tests that pause on exception in internal script does not crash.

 Script source was shown.

Original issue's description:
> Parse arrow functions at proper precedence level
>
> BUG=v8:4211
> LOG=Y
> R=rossberg@chromium.org
>
> Committed: https://crrev.com/9271b0ccf9ddb217deb1f0b9ef9b59b64dc40214
> Cr-Commit-Position: refs/heads/master@{#30298}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,fennyfanny655@gmail.com,machenbach@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4211

Review URL: https://codereview.chromium.org/1315503002

Cr-Commit-Position: refs/heads/master@{#30318}
2015-08-24 06:57:12 +00:00
littledan
31b8018029 Revert of Add a separate scope for switch (patchset #7 id:120001 of https://codereview.chromium.org/1293283002/ )
Reason for revert:
Breaks cctest/test-cpu-profiler/SourceLocation on nosnap

Original issue's description:
> Add a separate scope for switch
>
> The ES2015 specification for switch statements 13.12.11 specifies that
> they get their own lexical scope. This patch introduces such a scope
> through a complex desugaring in terms of blocks, done so that Crankshaft
> does not have to be updated to support multiple constructs providing
> scopes.
>
> BUG=v8:4377
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/9edbc1f21eb1050cabbe3b8bc9aebf89ada7ebd7
> Cr-Commit-Position: refs/heads/master@{#30314}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4377

Review URL: https://codereview.chromium.org/1309043004

Cr-Commit-Position: refs/heads/master@{#30316}
2015-08-22 01:24:33 +00:00
littledan
9c79e69e6c Fix function scoping issue
The parser has special behavior with respect to the bindings
of inner functions in sloppy mode which are not at the top
level of scopes. This behavior should be turned off when the
--harmony-sloppy-function flag is set, as lexical scoping
rules are used instead. Previously, the incorrect flag
--harmony-sloppy was used, resulting in a crashing bug.

BUG=chromium:520029
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1303033003

Cr-Commit-Position: refs/heads/master@{#30315}
2015-08-22 00:18:23 +00:00
littledan
9edbc1f21e Add a separate scope for switch
The ES2015 specification for switch statements 13.12.11 specifies that
they get their own lexical scope. This patch introduces such a scope
through a complex desugaring in terms of blocks, done so that Crankshaft
does not have to be updated to support multiple constructs providing
scopes.

BUG=v8:4377
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1293283002

Cr-Commit-Position: refs/heads/master@{#30314}
2015-08-21 23:54:36 +00:00
wingo
9271b0ccf9 Parse arrow functions at proper precedence level
BUG=v8:4211
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1286383005

Cr-Commit-Position: refs/heads/master@{#30298}
2015-08-21 11:33:42 +00:00
rossberg
365fd7bc35 [es6] Parameter scopes for sloppy eval
This CL is a nightmare! For the utterly irrelevant edge case of a sloppy function with non-simple parameters and a call to direct eval, like here,

  let x = 1;
  function f(g = () => x) {
    var y
    eval("var x = 2")
    return g() + x  // f() = 3
  }

we have to do all of the following, on top of the declaration block ("varblock") contexts we already introduce around the body:

- Introduce the ability for varblock contexts to have both a ScopeInfo and an extension object (e.g., the body varblock in the example will contain both a static var y and a dynamic var x). No other scope needs that. Since there are no context slots left, a special new struct is introduced that pairs up scope info and extension object.

- When declaring lookup slots in the runtime, this new struct is allocated in the case where an extension object has to be added to a block scope (at which point the block's extension slot still contains a plain ScopeInfo).

- While at it, introduce some abstraction to access context extension slots in a more controlled manner, in order to keep special-casing to a minimum.

- Make sure that even empty varblock contexts do not get optimised away when they contain a sloppy eval, so that they can host the potential extension object.

- Extend dynamic search for declaration contexts (used by sloppy direct eval) to recognize varblock contexts.

- In the parser, if a function has a sloppy direct eval, introduce an additional varblock scope around each non-simple (desugared) parameter, as required by the spec to contain possible dynamic var bindings.

- In the pattern rewriter, add the ability to hoist the named variables the pattern declares to an outer scope. That is required because the actual destructuring has to be evaluated inside the protecting varblock scope, but the bindings that the desugaring introduces are in the outer scope.

- ScopeInfos need to save the information whether a block is a varblock, to make sloppy eval calls work correctly that deserialise them as part of the scope chain.

- Add the ability to materialize block scopes with extension objects in the debugger. Likewise, enable setting extension variables in block scopes via the debugger interface.

- While at it, refactor and unify some respective code in the debugger.

Sorry, this CL is large. I could try to split it up, but everything is rather entangled.

@mstarzinger: Please review the changes to contexts.
@yangguo: Please have a look at the debugger stuff.

R=littledan@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:811,v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1292753007

Cr-Commit-Position: refs/heads/master@{#30295}
2015-08-21 10:58:47 +00:00
yangguo
a683f83dec Fix bug in Code::VerifyRecompiledCode.
The code should do what the comment says :)

R=mstarzinger@chromium.org
BUG=chromium:522895
LOG=N

Review URL: https://codereview.chromium.org/1300363002

Cr-Commit-Position: refs/heads/master@{#30278}
2015-08-20 17:20:02 +00:00
cbruni
6d67f7db37 Revert of Moving ArraySplice Builtin to ElementsAccessor (patchset #6 id:100001 of https://codereview.chromium.org/1293683005/ )
Reason for revert:
failing bot http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/3827

Original issue's description:
> - remove the Backing-Store speficic code from builtins.cc and put it in elements.cc.
> - adding tests to improve coverage of the splice method
>
> BUG=
>
> Committed: https://crrev.com/8533d4b5433d3a9e9fb1015f206997bd6d869fe3
> Cr-Commit-Position: refs/heads/master@{#30269}

TBR=mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1305763002

Cr-Commit-Position: refs/heads/master@{#30271}
2015-08-20 13:51:15 +00:00
cbruni
8533d4b543 - remove the Backing-Store speficic code from builtins.cc and put it in elements.cc.
- adding tests to improve coverage of the splice method

BUG=

Review URL: https://codereview.chromium.org/1293683005

Cr-Commit-Position: refs/heads/master@{#30269}
2015-08-20 12:55:05 +00:00
adamk
de26ce051f [api] Relax CHECK for ArrayBuffer API abuse
Zero-length ArrayBuffers are allowed to have NULL backing stores.

BUG=522496
LOG=n

Review URL: https://codereview.chromium.org/1302803003

Cr-Commit-Position: refs/heads/master@{#30259}
2015-08-19 21:53:17 +00:00
Ben Smith
14495ba64a Re-enable regress-crbug-501711 and regress-4279 for --isolates tests
BUG=v8:4378
TBR=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1305583002 .

Cr-Commit-Position: refs/heads/master@{#30258}
2015-08-19 20:59:59 +00:00
Ben Smith
7d706b6b74 Remove regress-crbug-518748. It's too hard to make this non-flaky
BUG=chromium:518748
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1297403002 .

Cr-Commit-Position: refs/heads/master@{#30257}
2015-08-19 18:58:20 +00:00
Ben Smith
8f441181a5 Disable regress-crbug-518748. It is failing/flaking on many bots
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1306443002 .

Cr-Commit-Position: refs/heads/master@{#30256}
2015-08-19 17:48:49 +00:00
jarin
bb869374fe Fix variable decl register collision on ARM.
BUG=chromium:455207
LOG=n
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1040703003

Cr-Commit-Position: refs/heads/master@{#30249}
2015-08-19 12:50:14 +00:00
yangguo
22cf0b5919 Ignore test failure for mjsunit/for-in-opt in gc stress.
TBR=hablich@chromium.org
BUG=v8:4381

Review URL: https://codereview.chromium.org/1295513004

Cr-Commit-Position: refs/heads/master@{#30245}
2015-08-19 10:03:50 +00:00
ejcaruso
df999c9790 Only evaluate length once in %TypedArray%.prototype.set
The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.

R=littledan@chromium.org
LOG=N
BUG=v8:4218

Review URL: https://codereview.chromium.org/1237583005

Cr-Commit-Position: refs/heads/master@{#30240}
2015-08-19 01:33:06 +00:00
Ben Smith
f644b71e75 Disable regress-crbug-518748 on ARM
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1290683004 .

Cr-Commit-Position: refs/heads/master@{#30238}
2015-08-18 18:55:58 +00:00
Ben Smith
49d1004bfb Disable regress-crbug-518748 on debug
Seems to fail only on V8 Linux - debug - code serializer
(See http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20code%20serializer/builds/3762)

BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1294163003 .

Cr-Commit-Position: refs/heads/master@{#30233}
2015-08-18 18:16:29 +00:00
binji
29e441422e [d8 Workers] Add max worker count, throw an exception if too many.
BUG=chromium:518748
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1284683004

Cr-Commit-Position: refs/heads/master@{#30230}
2015-08-18 17:12:17 +00:00
yangguo
54f18db864 Skip regress-4279 for --isolates tests.
R=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1290383004

Cr-Commit-Position: refs/heads/master@{#30223}
2015-08-18 14:36:13 +00:00
yangguo
1ecc6715bb Skip regress-crbug-501711 for --isolates tests.
TBR=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1295813006

Cr-Commit-Position: refs/heads/master@{#30216}
2015-08-18 11:14:43 +00:00
rossberg
6dda11ff81 [es6] Implement default parameters
Based on caitp's https://codereview.chromium.org/1127063003/

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1287063004

Cr-Commit-Position: refs/heads/master@{#30192}
2015-08-17 12:02:08 +00:00
yangguo
d281688ae5 Do not use js builtins object when constructing an error.
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1295093002

Cr-Commit-Position: refs/heads/master@{#30189}
2015-08-17 11:02:38 +00:00
caitpotter88
9b15445e6d [parser] make kInvalidLhsInFor a SyntaxError
Second item in section 13.7.5.1 states that the error should be a
SyntaxError, when previously CheckAndRewriteReferenceExpression
would always emit a ReferenceError.

BUG=v8:4373
R=adamk, rossberg
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1292393002

Cr-Commit-Position: refs/heads/master@{#30184}
2015-08-15 17:57:16 +00:00
adamk
ef52836cd8 [es6] Make assignment to new.target an early ReferenceError
In doing so, fix calls CheckAndRewriteReferenceExpression to take proper
start and end positions (instead of just pointing at the first token in
the LHS expression).

BUG=v8:4370
LOG=n

Review URL: https://codereview.chromium.org/1290013002

Cr-Commit-Position: refs/heads/master@{#30166}
2015-08-13 18:06:13 +00:00
littledan
e261540b9e Add class to existing lexical scoping tests
This patch strengthens testing of classes by verifying that the binding
that they export externally follows block scoping, as opposed to var-style
scoping. The tests are based on existing tests for let and const.

R=adamk
LOG=N
BUG=v8:3305

Review URL: https://codereview.chromium.org/1286923002

Cr-Commit-Position: refs/heads/master@{#30140}
2015-08-12 18:43:06 +00:00
yangguo
5df7d689eb Debugger: load debugger builtins as normal native JS.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1282793002

Cr-Commit-Position: refs/heads/master@{#30136}
2015-08-12 14:22:22 +00:00
littledan
1ebf0d7c5d Split function block scoping into a separate flag
In an initial attempt to implement sloppy mode lexical bindings,
functions were made lexically scoped in sloppy mode. However, the
ES2015 spec says that they need an additional hoisted var binding,
and further, it's not clear when we'll implement that behavior
or whether it's web-compatible.

This patch splits off function block scoping into a new, separate
flag called --harmony_sloppy_function. This change will enable the
possibility of testing and shipping this feature separately from
other block scoping-related features which don't have the same risks.

BUG=v8:4285
R=adamk
LOG=N

Review URL: https://codereview.chromium.org/1282093002

Cr-Commit-Position: refs/heads/master@{#30122}
2015-08-12 00:00:01 +00:00
littledan
d03191beb1 Use a new lexical context for sloppy-mode eval
In ES6, direct eval() in sloppy mode uses the enclosing function-level
("var") scope for var-style bindings and a new lexical scope for lexical
bindings like let and class. This patch implements that feature by making
lexical bindings that are directly within an EVAL_SCOPE be on the local
scope rather than the enclosing one.

BUG=v8:4288
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1274193004

Cr-Commit-Position: refs/heads/master@{#30120}
2015-08-11 21:30:40 +00:00
domenic
8934b9eae7 Add includes method to typed arrays
R=littledan@chromium.org, adamk@chromium.org
BUG=v8:3575
LOG=Y

Review URL: https://codereview.chromium.org/1283703004

Cr-Commit-Position: refs/heads/master@{#30117}
2015-08-11 17:55:24 +00:00
yangguo
2e2765a6eb Rewrite Error.prototype.toString in C++.
This avoids many back-and-forth calls to the runtime.

This also slightly changes the way we avoid getters. Previously, we circumvent getting the name property of ReferenceError, SyntaxError and TypeError due to crbug/69187 (in order to avoid leaking information from those errors through a 'name' getter installed on their prototypes). Now we do that for all errors created by V8.

R=jkummerow@chromium.org, rossberg@chromium.org
BUG=crbug:513472, crbug:69187
LOG=N

Review URL: https://codereview.chromium.org/1281833002

Cr-Commit-Position: refs/heads/master@{#30105}
2015-08-11 09:15:41 +00:00
yangguo
a68ad56c50 Debugger: correctly find closure to recompile eval for debugging.
R=mstarzinger@chromium.org
BUG=chromium:517592
LOG=N

Review URL: https://codereview.chromium.org/1285793002

Cr-Commit-Position: refs/heads/master@{#30104}
2015-08-11 08:20:40 +00:00
binji
cd9293445e [d8 Workers] Make Worker prototype read-only
BUG=chromium:518747
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1277543006

Cr-Commit-Position: refs/heads/master@{#30099}
2015-08-11 00:17:13 +00:00
bmeurer
d0bbd54282 [runtime] Remove obsolete %GetPropertyNames runtime entry.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1281533003

Cr-Commit-Position: refs/heads/master@{#30086}
2015-08-10 11:18:31 +00:00
rossberg
73ae23b5dc [es6] Fix parsing of expressions in patterns
Fixes the use of eval calls in strict parameter lists in particular.

R=adamk@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1276273002

Cr-Commit-Position: refs/heads/master@{#30074}
2015-08-07 21:56:00 +00:00
rossberg
651f55c573 Regression test for crbug 517455
Was fixed by 826f8da55f

R=mstarzinger@chromium.org
BUG=517455
LOG=N

Review URL: https://codereview.chromium.org/1280953002

Cr-Commit-Position: refs/heads/master@{#30069}
2015-08-07 13:32:46 +00:00
rossberg
826f8da55f [es6] Use strict arguments objects for destructured parameters
Plus some renaming for consistency.

R=adamk@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1278783002

Cr-Commit-Position: refs/heads/master@{#30064}
2015-08-07 11:38:39 +00:00
yangguo
2e0d55a5b9 Fix Array.prototype.concat for arguments object with getter.
R=adamk@chromium.org
BUG=chromium:516775
LOG=N

Review URL: https://codereview.chromium.org/1270403002

Cr-Commit-Position: refs/heads/master@{#30042}
2015-08-06 10:28:36 +00:00
jkummerow
087ae1b08a Fix off-by-one in Array.concat's max index check
The maximum valid index is strictly smaller than the maximum valid length.

BUG=chromium:516592
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1278703003

Cr-Commit-Position: refs/heads/master@{#30040}
2015-08-06 09:57:19 +00:00
adamk
b7726c447a Delete --harmony-computed-property-names flag
It was shipped in V8 4.4.

Review URL: https://codereview.chromium.org/1273543002

Cr-Commit-Position: refs/heads/master@{#30038}
2015-08-05 21:32:38 +00:00
Adam Klein
eeb1149df9 Try turning object-observe test back on in gc-stress
Also remove obsolete reference to harmony/object-observe in deopt fuzzer
skip section.

BUG=chromium:478788
LOG=n
TBR=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1272193004 .

Cr-Commit-Position: refs/heads/master@{#30037}
2015-08-05 21:26:32 +00:00
adamk
cd455055a0 Delete --harmony-unicode flag
It was shipped in V8 4.4.

Review URL: https://codereview.chromium.org/1271073002

Cr-Commit-Position: refs/heads/master@{#30035}
2015-08-05 19:08:42 +00:00
conradw
24e1bcbfea [strong] dot prototypes of strong class literals should be strong objects
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1270423003

Cr-Commit-Position: refs/heads/master@{#30032}
2015-08-05 15:38:06 +00:00
yangguo
6a2d3ad606 Remove serializer-specific hash table size heuristic.
The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
Cr-Commit-Position: refs/heads/master@{#30019}

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30026}
2015-08-05 12:51:49 +00:00
rossberg
4273f66e98 [es6] Implement proper TDZ for parameters
Previously, examples like (({a = x}, x) => {})({}, 0) did not throw a ReferenceError like they should. This CL

- Splits up DeclareFormalParameters such that the formals can be recorded first and declared later.

- Declaration then takes the complete parameter list into account. If it is not simple, temporaries are introduced for all parameters.

- BuildParameterInitializationBlock desugars all parameters from non-simple lists into let-bindings.

- Refactored Pre/ParserFormalParameters, so that the arity information is no longer duplicated in Parser.

- Rest is currently handled specially, until rest-via-destructuring has landed.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1259283002

Cr-Commit-Position: refs/heads/master@{#30025}
2015-08-05 12:02:23 +00:00
mstarzinger
899c4284d5 Cleanup unnecessary duplication of runtime functions.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1269323003

Cr-Commit-Position: refs/heads/master@{#30023}
2015-08-05 11:22:21 +00:00
adamk
2e4efcfac2 Add a --harmony-object-observe runtime flag (on by default)
To avoid tanking context startup performance, only the actual installation of the
JS-exposed API is flag-guarded. The remainder of the implementation still
resides in the snapshot.

Review URL: https://codereview.chromium.org/1257063003

Cr-Commit-Position: refs/heads/master@{#30017}
2015-08-04 20:53:32 +00:00
binji
890c4d9dc6 [d8 Workers] Throw when calling Worker constructor without new
BUG=4399
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1260813008

Cr-Commit-Position: refs/heads/master@{#30016}
2015-08-04 20:40:12 +00:00
mstarzinger
bcad9b547d Introduce safe interface to "copy and grow" FixedArray.
This introduces a CopyFixedArrayAndGrow method on Factory that takes
the "grow amount" instead of the "new size" as an argument. The new
interface is safer because it allows for mutations by the GC that
potentially trim the source array.

This also fixes a bug in SharedFunctionInfo::AddToOptimizedCodeMap
where the aformentioned scenario led to unused entries within the
optimized code map.

Note that FixedArray::CopySize is hereby deprecated because it is
considered unsafe and should no longer be used.

R=hpayer@chromium.org
TEST=mjsunit/regress/regress-crbug-513507
BUG=chromium:513507
LOG=n

Review URL: https://codereview.chromium.org/1255173006

Cr-Commit-Position: refs/heads/master@{#30012}
2015-08-04 17:49:42 +00:00
adamk
c4247c1bc2 [es6] new.target should not be shadowable in a with scope
BUG=v8:3887
LOG=n

Review URL: https://codereview.chromium.org/1259183005

Cr-Commit-Position: refs/heads/master@{#30010}
2015-08-04 17:15:40 +00:00
binji
df1f72bbf1 [d8 worker] Fix regression when serializing very large arraybuffer
BUG=chromium:514081
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1264723002

Cr-Commit-Position: refs/heads/master@{#29982}
2015-08-03 17:08:00 +00:00
bbudge
7b9670b63b SIMD.js Add the other SIMD Phase 1 types.
Adds Int32x4, Bool32x4, Int16x8, Bool16x8, Int8x16, Bool8x16.
Adds Simd128Value base heap object class.
Changes heap/factory construction pattern to use arrays.
Adds replaceLane functions to facilitate testing.

NOPRESUBMIT=true
(presubmit checks erroneously interpret array declaration in macro definition as variable size array.)

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1250733005

Cr-Commit-Position: refs/heads/master@{#29974}
2015-08-03 13:02:56 +00:00
jarin
156a155be3 [deoptimizer] Fix the frame size calculation for debugger-inspectable frame construction.
The calculation now takes into account the size of the arguments object
if it is present in the optimized frame.

(Yang, many thanks for the awesome repro!)

BUG=chromium:514362
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1264483008

Cr-Commit-Position: refs/heads/master@{#29973}
2015-08-03 12:59:59 +00:00
jarin
f8dcbf4695 [deoptimizer] Do not pass arguments markers to the debugger.
This fixes a bug introduced by r28826 (Unify decoding of deoptimization
translations, https://codereview.chromium.org/1136223004), where we
started leaking arguments marker sentinel to the debugger, which would
then cause crashes. This change replaces the sentinel with the undefined
value in the debugger-inspectable frame.

BUG=chromium:514362
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1263333002

Cr-Commit-Position: refs/heads/master@{#29971}
2015-08-03 10:43:31 +00:00