yangguo@chromium.org
c61d07e03f
Correctly resolve forcibly context allocated parameters in debug-evaluate.
...
R=ulan@chromium.org
BUG=325676
LOG=Y
Review URL: https://codereview.chromium.org/107243006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-23 08:37:03 +00:00
rossberg@chromium.org
b882bddcfd
Make a strict function's "name" property non-writable.
...
Set [[Writable]] to false for the "name" property of strict
functions as well, mirroring what non-strict functions have
it as.
LOG=N
R=rossberg@chromium.org
TEST=mjsunit/regress/regress-270142
BUG=270142
Review URL: https://codereview.chromium.org/99203006
Patch from Sigbjorn Finne <sigbjornf@opera.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 12:06:11 +00:00
hpayer@chromium.org
f583b73b70
Revert "Remove flag track-allocation-sites."
...
This reverts commit 6c430da40efe388035504d3603756aa8c46ed1dc.
BUG=
Review URL: https://codereview.chromium.org/109303006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 12:04:34 +00:00
mvstanton@chromium.org
e654c88fab
Remove flag track-allocation-sites.
...
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/104923010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 11:46:31 +00:00
jkummerow@chromium.org
3c76ecd732
Fix switch statements with non-Smi integer labels and no type feedback
...
BUG=chromium:329709
LOG=Y
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/98643010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-19 14:25:58 +00:00
yangguo@chromium.org
213b05b5b9
Fix off-by-one error in AstTyper, part 2.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/112933002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 15:19:57 +00:00
jkummerow@chromium.org
48ff79a300
Fix polymorphic inlined calls with migrating prototypes
...
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/104793003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 14:57:00 +00:00
ulan@chromium.org
cc401095fb
Initialize Date parse cache with SMI instead of double to workaround sharing mutable heap numbers in snapshot.
...
This is the only field in the snapshot that was tracked as double.
R=verwaest@chromium.org
TEST=mjsunit/regress/regress-280531.js
BUG=280531
LOG=Y
Review URL: https://chromiumcodereview.appspot.com/112003005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 13:11:44 +00:00
yangguo@chromium.org
5bc64b9fa5
Fix off-by-one error in AstTyper.
...
This causes the first parameter to be confused with the first
stack local when we collect type information.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/105943007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 11:34:09 +00:00
hpayer@chromium.org
75a84eca0b
Added regression test for escape analysis.
...
BUG=
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/99133011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18290 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-10 15:54:20 +00:00
svenpanne@chromium.org
e1db6d86a9
Avoid FP exceptions when doing integer division.
...
BUG=v8:3039
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/104003004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-09 10:15:19 +00:00
mvstanton@chromium.org
b807f4f82f
Bugfix: HCheckInstanceType::GetCheckMaskAndTag used an incorrect mask.
...
The mask to check for an internalized string was incorrectly formed. Hat
tip to Weiliang Lin for discovering the bug.
BUG=v8:3038
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/108033002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-06 09:43:07 +00:00
verwaest@chromium.org
8a4df124a4
Fix loop side-effects of deoptimizing loops with a nested live OSR loop.
...
R=titzer@chromium.org
Review URL: https://chromiumcodereview.appspot.com/106723002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 18:31:06 +00:00
verwaest@chromium.org
d4eaae37d1
Check whether the receiver to a keyed-call is actually a heapobject.
...
BUG=325225
LOG=n
R=dslomov@chromium.org
Review URL: https://chromiumcodereview.appspot.com/101863004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 17:59:31 +00:00
bmeurer@chromium.org
aa83f2900a
Fix invalid assertion with OSR in BuildBinaryOperation.
...
BUG=v8:3032
LOG=n
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/98623004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 13:12:07 +00:00
mstarzinger@chromium.org
db915fe97e
Handle captured objects in OptimizedFrame::Summarize.
...
R=yangguo@chromium.org
BUG=v8:3029
TEST=mjsunit/regress/regress-3029
LOG=N
Review URL: https://codereview.chromium.org/96773002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18187 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 12:11:02 +00:00
mvstanton@chromium.org
5ba1304d60
Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects.
...
BUG=299979
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/80623002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 15:22:16 +00:00
yangguo@chromium.org
f235194518
Fix bug in inlining Function.apply.
...
R=jkummerow@chromium.org
BUG=323942
LOG=Y
Review URL: https://codereview.chromium.org/95123003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:30:17 +00:00
dslomov@chromium.org
7372596615
Ensure that length is Smi in TypedArrayFromArrayLike constructor.
...
R=jkummerow@chromium.org
BUG=324028
LOG=Y
Review URL: https://codereview.chromium.org/94473002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:22:36 +00:00
mstarzinger@chromium.org
d53e38777f
Fix missing bounds check in n-arguments Array constructor.
...
LOG=N
R=mvstanton@chromium.org
BUG=v8:3027
TEST=mjsunit/regress/regress-3027
Review URL: https://codereview.chromium.org/92103003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 09:29:57 +00:00
yangguo@chromium.org
ab96631177
Increase precision for base conversion for large integers.
...
R=jkummerow@chromium.org
BUG=v8:3025
LOG=Y
Review URL: https://codereview.chromium.org/88583002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 15:48:13 +00:00
yangguo@chromium.org
afd8e5a305
Speed up long-running test cases.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/85163003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 11:32:39 +00:00
yangguo@chromium.org
4716b292db
Make some ARM test cases faster.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/85473004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 10:43:44 +00:00
yangguo@chromium.org
aa3518a0f3
Make sure files end with exactly one new line and police this in presubmit.
...
The changes are (excluding presubmit.py) mechanical. I added the following
lines after the check and iterated the presubmit script until all errors
went away:
f = open(name, "w");
if contents.endswith('\n\n'):
f.write(contents[0:-1])
else:
f.write(contents + '\n')
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/82803005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 13:50:39 +00:00
ulan@chromium.org
21fb1401bd
Restore saved caller FP registers on stub failure
...
and preserve FP registers on NotifyStubFailure.
In debug mode, clobber FP registers on each runtime call to increase
chances of catching such bugs.
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/78283002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 10:21:47 +00:00
danno@chromium.org
06c7620302
Fixed crashes exposed though fuzzing.
...
The %_OneByteSeqStringSetChar intrinsic expects its arguments to be checked before being called for efficiency reasons, but the fuzzer provided no such checks. Now the intrinsic is robust to bad input if FLAG_debug_code is set.
R=yangguo@chromium.org
TEST=test/mjsunit/regress/regress-320948.js
BUG=chromium:320948
LOG=Y
Review URL: https://codereview.chromium.org/72813004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 16:41:07 +00:00
jkummerow@chromium.org
37443768bf
Fix register trashing in Emit*ByteSeqStringSetChar
...
This is currently not observable without --allow-natives-syntax because all internal usages are safe, but it deserves to be fixed nonetheless.
BUG=chromium:320922
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/67103003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 12:59:09 +00:00
mvstanton@chromium.org
bff41483dc
Bugfix: dependent code field in AllocationSite was keeping code objects alive even after context death.
...
BUG=320532
LOG=Y
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/62803008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 10:17:33 +00:00
dslomov@chromium.org
4228132e74
Use mock ArrayBuffer allocator to avoid really allocating 1Gb.
...
R=jkummerow@chromium.org
BUG=v8:3014
LOG=N
Review URL: https://codereview.chromium.org/61623009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17837 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-18 14:50:45 +00:00
danno@chromium.org
f27f2fa420
Match max property descriptor length to corresponding bit fields
...
BUG=v8:3010
R=verwaest@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/72333004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-18 11:44:06 +00:00
jkummerow@chromium.org
c9b41c6995
Limit size of dehoistable array indices
...
LOG=Y
BUG=chromium:319835,chromium:319860
R=dslomov@chromium.org
Review URL: https://codereview.chromium.org/74113002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 17:24:10 +00:00
dslomov@chromium.org
7936ca39be
Limit the size for typed arrays to MaxSmi.
...
R=jkummerow@chromium.org
LOG=Y
BUG=319722
Review URL: https://codereview.chromium.org/73943004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:37:15 +00:00
dslomov@chromium.org
c01aa1fc1f
Revert "Limit the size for typed arrays to MaxSmi."
...
This reverts commit r17798 for allocating too much memroy in tests.
TBR=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/74093002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:25:51 +00:00
dslomov@chromium.org
09ca1318ab
Limit the size for typed arrays to MaxSmi.
...
R=jkummerow@chromium.org
LOG=Y
BUG=319722
Review URL: https://codereview.chromium.org/73943004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:09:56 +00:00
verwaest@chromium.org
341d405301
Reland and fix "Add support for keyed-call on arrays of fast elements"
...
BUG=
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/71783003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 10:52:05 +00:00
bmeurer@chromium.org
2ee5aa951c
Fix missing type feedback check for Generic*String addition.
...
TEST=mjsunit/regress/regress-crbug-318671
BUG=318671
LOG=y
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/67473007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 09:13:36 +00:00
danno@chromium.org
28ed69b8fb
Fix overflow in TypedArray initialization function
...
BUG=chromium:319120
TEST=test/mjsunit/regress/regress-319120.js
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/61753013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 06:20:48 +00:00
mstarzinger@chromium.org
d5cb83f4aa
Fix invalid reuse of weak global handle in GetScriptWrapper.
...
This fixes a direct usage of a weak global handle in GetScriptWrapper
that just casted it to a strong local handle, while a subsequent GC
might clear it. Handlepocalypse anyone?
R=machenbach@chromium.org
BUG=v8:2988
TEST=mjsunit/regress/regress-2988
Review URL: https://codereview.chromium.org/67273004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-11 16:27:36 +00:00
ulan@chromium.org
bc4ad49b25
Do not add values to HGraph in Lithium.
...
Lithium uses indexes after the maximium value ID in the HGraph as indexes
of virtual registers and assumes that the maximum value ID does not change.
The IsStandardConstant and GetConstantXX functions could add constants to
HGraph, which aliased virtual registers with real values. This could confuse
the register allocator to think that a value in a virtual register is tagged
and to incorrectly set it in the pointer map.
BUG=298269
TEST=mjsunit/regress/regress-298269.js
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/66693002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 14:16:34 +00:00
mstarzinger@chromium.org
59536de77d
Make HCapturedObjects non-deletable for DCE.
...
R=jkummerow@chromium.org
BUG=v8:2987
TEST=mjsunit/regress/regress-2987
Review URL: https://codereview.chromium.org/64433002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-07 16:07:19 +00:00
yangguo@chromium.org
eb550c6da4
Fix y-umlaut to uppercase.
...
R=dcarney@chromium.org
BUG=v8:2984
Review URL: https://codereview.chromium.org/59853006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-07 09:08:34 +00:00
yangguo@chromium.org
a5ed9a71c8
Correctly load message from an Error object.
...
R=mstarzinger@chromium.org
BUG=306220
Review URL: https://codereview.chromium.org/46593010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 13:04:51 +00:00
jkummerow@chromium.org
2ebfd6e90e
Add missing negative dictionary lookup to NonexistentHandlerFrontend
...
BUG=v8:2980
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/57433003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-04 14:14:09 +00:00
jkummerow@chromium.org
316271fc35
Fix uint32-to-smi conversion in Lithium
...
BUG=chromium:309623
R=vegorov@google.com , yangguo@chromium.org
Review URL: https://codereview.chromium.org/54393002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-31 10:18:51 +00:00
yangguo@chromium.org
3f1a833524
Do not remove HAdd with zero if the other operand is a double.
...
The other operand might be minus zero, and -0 + 0 = +0
R=svenpanne@chromium.org
BUG=
Review URL: https://codereview.chromium.org/52173003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-30 10:22:52 +00:00
jkummerow@chromium.org
9e88c23cbf
ia32: Fix comparisons of two constant double operands when exactly one of them is in new space.
...
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/46883008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-29 14:34:07 +00:00
yangguo@chromium.org
7dd2d6c590
Reland "Make Array.prototype.pop throw if the last element is not configurable."
...
This relands r17346.
R=machenbach@chromium.org
BUG=311164
Review URL: https://codereview.chromium.org/43923002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 11:55:56 +00:00
svenpanne@chromium.org
7fb61a78d4
Tune mjsunit/regress/regress-2612.
...
Lower the bounds to something bearable which would still timeout if we
used a quadratic algorithm.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/39863003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 13:07:16 +00:00
svenpanne@chromium.org
f2122438e0
Removed long-running obselete test case.
...
The test was the 2nd longest-running test case in debug mode, and the
stuff it tests has already been moved long ago to some other place,
which is in turn heavily tested by far simpler and faster things
(%TruncateString etc.).
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/39233003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 08:09:32 +00:00
yangguo@chromium.org
0f564cb1b0
Revert "Make Array.prototype.pop throw if the last element is not configurable."
...
This reverts commit r17346.
R=bmeurer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/39593002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 07:48:23 +00:00
yangguo@chromium.org
e25920da19
Make Array.prototype.pop throw if the last element is not configurable.
...
Popping an element from an array should call [[Delete]] internal method
and pass true as the second argument (ECMA-262/5.1/#sec-15.4.4.6).
When the last element can't be deleted, throw a Type Error.
Not throwing the error would result in endless loop in the following test.
TEST=var a=[];Object.defineProperty(a,0,{});while(a.length)a.pop();
By the way fix another bug, or else i can't post any issues.
"presubmit.py" throw a "missing a correct copyright header" on windows.
Both the slash and the backslash are valid path separator on windows.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/29513004
Patch from Yanagi <admin@web-tinker.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 16:19:24 +00:00
jkummerow@chromium.org
8259439ae8
Fix HObjectAccess for loads from migrating prototypes
...
BUG=chromium:305309
R=danno@chromium.org
Review URL: https://codereview.chromium.org/35173005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17345 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 15:15:15 +00:00
svenpanne@chromium.org
dd74f5aa08
Removed obsolete unit tests.
...
As discussed offline, these tests don't test what they were supposed to
test anymore and were the longest running ones.
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/32433009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 11:26:07 +00:00
mstarzinger@chromium.org
0a2b4ecdcc
Add regression test for optimized count operation.
...
This is a regression test for a bug with handling of count operations
that target a JavaScript accessor on the prototype chain in Crankshaft.
R=jkummerow@chromium.org
BUG=chromium:306851
TEST=mjsunit/regress/regress-crbug-306851
Review URL: https://codereview.chromium.org/27702002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 12:48:28 +00:00
dslomov@chromium.org
5ccd697875
Do not look up ArrayBuffer on global object in typed array constructor.
...
BUG=v8:2931
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/27238009
Patch from Ben Noordhuis <info@bnoordhuis.nl>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 11:27:12 +00:00
yangguo@chromium.org
71ba8c5fb4
Retire concurrent recompilation delay for non-stress testing.
...
Instead, we block concurrent recompilation until unblocked. This makes
affected tests more predictable and run shorter.
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/26758003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 14:15:22 +00:00
mstarzinger@chromium.org
f878c1c359
Fix pre-parsing of 'use strict' directive after string literals.
...
R=ulan@chromium.org
TEST=mjsunit/regress/regress-parse-use-strict
Review URL: https://codereview.chromium.org/27025002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-11 14:03:54 +00:00
olivf@chromium.org
4b6d0e33f2
Only set binary operation side effects flags, when observable.
...
BUG=
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/26712002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 16:49:25 +00:00
mstarzinger@chromium.org
63d8abb6c6
Unify and fix checkers for duplicate object literal properties.
...
R=ulan@chromium.org
TEST=preparser/duplicate-property,mjsunit/regress/regress-parse-object-literal
Review URL: https://codereview.chromium.org/26375004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 11:58:16 +00:00
verwaest@chromium.org
7e0ea6ab46
Only fold polymorphic into monomorphic load if all load from either receiver or same prototype.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/25718002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-02 13:24:08 +00:00
olivf@chromium.org
d268078ce0
Fix flaky parallel recompilation test.
...
On very rare circumstances parallel recompilation would install
the optimized method earlier than expected and the test would fail.
BUG=
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/24495005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-25 08:23:14 +00:00
olivf@chromium.org
6fc2875d51
Fix Environment size mismatch in r6849.
...
TBR=svenpanne@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23983043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-20 08:34:23 +00:00
yangguo@chromium.org
cb10ceb19d
Reland "Clean up after r16292 (disable optimization for StringWrappers)."
...
BUG=
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/23619036
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 16:17:58 +00:00
yangguo@chromium.org
ad25a2969d
Revert "Clean up after r16292 (disable optimization for StringWrappers)."
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23600040
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 11:15:12 +00:00
yangguo@chromium.org
996813cca2
Clean up after r16292 (disable optimization for StringWrappers).
...
R=jochen@chromium.org
BUG=v8:2855
Review URL: https://codereview.chromium.org/22891028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 10:55:57 +00:00
titzer@chromium.org
49d9555a97
Generate a custom OSR entrypoint for OSR compiles on all platforms, and transition to optimized code using the special entrypoint, instead of through the deoptimizer. Do not install the OSR compiled code as _the_ optimized code for a function.
...
Remove OSR-related stuff from deoptimizer.
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/21340002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 16:34:40 +00:00
jkummerow@chromium.org
daee0d83db
Fix bitwise negation on x64
...
BUG=chromium:285355
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/24037003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-06 15:21:38 +00:00
yangguo@chromium.org
d9659da6f4
Fix bug in regexp result object construction.
...
R=verwaest@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23548018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 14:32:49 +00:00
verwaest@chromium.org
b41a7b9cea
Properly close the CountOperation value/effect context after leaving the store effect context.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23897003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 12:33:14 +00:00
yangguo@chromium.org
070e3b0af4
Introduce concurrent on-stack replacement.
...
Currently disabled behind --concurrent-osr.
R=titzer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23710014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 12:55:59 +00:00
verwaest@chromium.org
3f70c3b07b
Allow uncacheable identifiers to go generic.
...
BUG=v8:2867
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23453019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 16:32:11 +00:00
jkummerow@chromium.org
2c9ac9c7e1
Always visit branches during HGraph building
...
even if constant values indicate that they are unreachable.
BUG=chromium:280333
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/23623009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-29 14:55:45 +00:00
jkummerow@chromium.org
3747b5bc6d
Delete HAbnormalExit. It does more harm than good.
...
BUG=v8:2843
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/23462007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 15:00:30 +00:00
verwaest@chromium.org
652b174cfc
Merge verbatim descriptors from other (the descriptor of the map being updated) rather than this (descriptors of the most updated map found in the transition tree).
...
BUG=v8:2863
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23676003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 12:37:14 +00:00
jkummerow@chromium.org
11fd577261
Lower kInitialMaxFastElementArray constant to 95K
...
to work around erroneous "illegal access" error on x64.
BUG=v8:2790
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/22877039
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16324 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 13:04:05 +00:00
jochen@chromium.org
de7352db92
Temporarily disable optimization for StringWrappers to use native valueOf
...
V8 stores this information directly in the map of the wrapper, however,
it is not invalidated when the prototype of the wrapper is changed, so
once the bit is set, it is no longer possible to override valueOf.
This bug is currently hidden in Chrome since the i18n extension always
modifies the String.prototype, and so the optimization never kicks in.
Disabling the optimization temporarily allows for snapshotting i18n now.
BUG=v8:2855
R=yangguo@chromium.org
TEST=mjsunit/regress/regress-2855.js
Review URL: https://codereview.chromium.org/23060030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 11:31:18 +00:00
rossberg@chromium.org
971df386b3
Fix scoping of function declarations in eval inside non-trivial local scope
...
R=mstarzinger@chromium.org
BUG=v8:2594
Review URL: https://codereview.chromium.org/22901010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 09:25:37 +00:00
yangguo@chromium.org
be48c5ae26
Rename "parallel recompilation" to "concurrent recompilation".
...
Also introduced macros for flag aliases for temporary backwards compatibility.
R=hpayer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23014007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 16:14:37 +00:00
mstarzinger@chromium.org
0ecd03ab4c
Fix hidden properties on object with frozen prototype.
...
This fixes a corner-case where a frozen prototype with existing hidden
properties might prevent setting hidden properties on another object.
R=rossberg@chromium.org
BUG=v8:2829
Review URL: https://codereview.chromium.org/22799021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16276 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 13:51:32 +00:00
verwaest@chromium.org
eb6cbe1486
Never clear debug-stub call ICs. Make a clear distinction between is_debug_stub
...
used everywhere but the debugger, and IsDebugBreak, used by the debugger.
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23361014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 12:16:00 +00:00
jkummerow@chromium.org
e814a9b96b
Fix "Hole" leak in TryBuildConsolidatedElementLoad
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/23361007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-21 15:31:03 +00:00
olivf@chromium.org
383a167279
Add X87 implementations for Integer32ToDouble, DoubleToI, DoubleToSmi
...
Additionally refactor the X87Stack tracking
BUG=
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/20781007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16246 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-20 13:01:54 +00:00
verwaest@chromium.org
d81af53131
Store copied value rather than the original double.
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23262002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-16 15:43:42 +00:00
mstarzinger@chromium.org
3e4fbd0e85
Mark HStringCompareAndBranch as potentially causing GCs.
...
This also adds a %SetAllocationTimout runtime function which helps to
write regression tests that need to trigger a GC at a certain point in
program execution.
R=hpayer@chromium.org
BUG=chromium:274438
TEST=mjsunit/regress/regress-crbug-274438
Review URL: https://codereview.chromium.org/22933006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-16 15:10:07 +00:00
jkummerow@chromium.org
e71a91ca08
Fix Math.round/floor that had bogus Smi representation
...
BUG=chromium:272564
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/23022005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-14 12:14:08 +00:00
verwaest@chromium.org
169f5a9d7b
Never hchange nan-hole to hole or hole to nan-hole.
...
Only allow changing hole to nan if all uses allow undefined as nan.
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22152003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-14 08:54:27 +00:00
jkummerow@chromium.org
6f800f90ee
Fix overflow check computation for Smi Phis
...
BUG=v8:2836
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/22629011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 18:18:24 +00:00
yangguo@chromium.org
415b61e12e
Fix bug in HPhi::SimplifyConstantInput
...
R=jkummerow@chromium.org
BUG=269679
Review URL: https://codereview.chromium.org/23075003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 16:47:27 +00:00
verwaest@chromium.org
145f240060
Store doubles before calling into the elements transition stub on ARM
...
BUG=
R=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22854011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16172 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 15:06:17 +00:00
yangguo@chromium.org
c52b7bba05
Fix regressions triggered by map invalidation during graph creation.
...
BUG=
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/22807003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-12 14:10:25 +00:00
verwaest@chromium.org
ee53b0a5ed
Make all load-named-fields depend on their map-check, unless explicitly ignored.
...
BUG=
R=titzer@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22555004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 18:40:10 +00:00
verwaest@chromium.org
19659646ca
Fix smi-based math floor.
...
BUG=chromium:270268
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22623007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 11:21:03 +00:00
verwaest@chromium.org
e5afd32129
Fix Object.freeze, Object.observe wrt CountOperation and CompoundAssignment.
...
BUG=2774,2779
R=adamk@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22562004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16111 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 18:45:41 +00:00
jkummerow@chromium.org
371ac893f9
Check for empty handle in JSON stringifier
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/22420004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 16:34:13 +00:00
yangguo@chromium.org
ef8d394f12
Re-reland "Flush parallel recompilation queues on context dispose notification"
...
BUG=
R=hpayer@chromium.org , mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/22379002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 09:33:09 +00:00
ulan@chromium.org
3511f7a428
Fix Array index dehoisting.
...
BUG=264203
TEST=test/mjsunit/regress/regress-264203
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22314012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 16:38:39 +00:00
rossberg@chromium.org
5e121882c6
Remove test that causes illegal access now
...
TBR=mstarzinger@chromium.org
BUG=265369
Review URL: https://codereview.chromium.org/22428002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 14:34:25 +00:00
rossberg@chromium.org
f56ad9cab7
Turn assert into runtime assertion to make fuzzer happy
...
R=mstarzinger@chromium.org
BUG=265369
Review URL: https://codereview.chromium.org/22284009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 14:19:13 +00:00
jkummerow@chromium.org
232a2c0d88
Regression test for issue 2813 / r16008
...
BUG=v8:2813
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/21806002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-02 12:17:19 +00:00
verwaest@chromium.org
2af164f4d9
Mark maps as unstable if their instances potentially transition away.
...
Use this as a prerequisite for adding code dependencies.
R=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/21095005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 16:33:58 +00:00
titzer@chromium.org
45d4afbde5
Fix many tests that try to force an OSR by checking OptimizationStatus() to instead check OptimizationCount().
...
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/21221003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 09:28:55 +00:00
mstarzinger@chromium.org
3202e1d795
Re-revert "Flush parallel recompilation queues on context dispose notification" (r15883).
...
R=danno@chromium.org
BUG=
Review URL: https://codereview.chromium.org/21156009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 08:35:48 +00:00
jkummerow@chromium.org
3619dcf868
Add regression test for recently fixed bug
...
BUG=chromium:258519
R=machenbach@chromium.org
Review URL: https://codereview.chromium.org/20732002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-26 14:58:30 +00:00
machenbach@chromium.org
53c95353c9
Disable mjsunit test when parallel recompilation is not available.
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/20573003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-26 12:34:46 +00:00
jkummerow@chromium.org
32e2e37230
Fix JSArray-specific length lookup in polymorphic array handling
...
BUG=chromium:263276
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/20295005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-25 15:04:21 +00:00
yangguo@chromium.org
14e205e9cf
Reland "Flush parallel recompilation queues on context dispose notification."
...
BUG=
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/19500022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-25 15:01:23 +00:00
ulan@chromium.org
b2dd5c67f7
ARM: Ensure space for lazy deoptimization before calling IC.
...
If IC triggers deoptimization, then subsequent patching might get invalid
target address that was overwritten.
R=verwaest@chromium.org
BUG=247688
TEST=mjsunit/regress/regress-247688.js
Review URL: https://chromiumcodereview.appspot.com/19972002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 17:21:41 +00:00
yangguo@chromium.org
cd41cb9b6d
Turn on parallel recompilation for tests that assert optimization status.
...
R=mvstanton@chromium.org
BUG=
Review URL: https://codereview.chromium.org/19807002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 09:16:33 +00:00
ulan@chromium.org
88a4b0d6ca
Fix deopt in store with effect context.
...
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/19693004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 13:45:26 +00:00
verwaest@chromium.org
be472d82fd
Fix wrong bailout id in polymorphic stores.
...
BUG=chromium:259787
R=titzer@chromium.org , ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/19528005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 08:45:47 +00:00
mstarzinger@chromium.org
3eded2c06c
Fix %NeverOptimizeFunction runtime call.
...
The current usage of this runtime function is broken as it does not
prevent inlining of the affected function but rather bails out from the
whole unit of compilation after trying to inline affected functions.
This simplifies said runtime function to avoid accidental misuse.
R=titzer@chromium.org
TEST=mjsunit/never-optimize
Review URL: https://codereview.chromium.org/19776006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 08:25:44 +00:00
svenpanne@chromium.org
b951f03cee
Fixed type feedback in presence of negative lookups.
...
To fix the issue at hand regarding constant function calls and perhaps
other hidden issues regarding negative lookups, we basically add a
"marker instruction", just for harvesting purposes. Our type feedback
oracle is really, really fragile, we should better switch to some more
explicit and robust scheme soon.
BUG=chromium:252797
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/19588002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 09:12:44 +00:00
yangguo@chromium.org
9d6445cf32
Do not materialize context-allocated values for debug-evaluate.
...
BUG=259300
R=ulan@chromium.org , verwaest@chromium.org
Review URL: https://codereview.chromium.org/19569003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 15:29:00 +00:00
jkummerow@chromium.org
22f2fd8397
Synchronize Compare-Literal behavior in FullCodegen and Hydrogen
...
BUG=chromium:260345
R=danno@chromium.org
Review URL: https://codereview.chromium.org/19582002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 13:13:38 +00:00
rossberg@chromium.org
db76aa2717
Fix sloppy-mode 'const' under Harmony flag.
...
R=yangguo@chromium.org
BUG=173361
Review URL: https://codereview.chromium.org/19199002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-15 14:12:20 +00:00
danno@chromium.org
c65f4f7f7b
Don't use StoreIC_ArrayLength on frozen arrays
...
The code previously assumed that an array with fast properties must have
a writable length property. But Object.freeze() now exposes a way to make
length read-only without moving the object into slow mode. This patch
simply adds a !is_frozen check to the IC code. Any future optimizations
to attribute-setting on JSArrays will need to make similar accomodations.
R=danno
BUG=v8:2711,259548
Review URL: https://chromiumcodereview.appspot.com/19115002
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-14 22:03:46 +00:00
titzer@chromium.org
9e7819fac4
Added %NeverOptimize runtime call that can disable optimizations for a method for tests.
...
BUG=
Review URL: https://codereview.chromium.org/18214005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-11 14:17:56 +00:00
yangguo@chromium.org
b99ca1ab12
Do not implicitly convert receivers for builtin functions when inspecting frames.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/18900004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15574 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-09 13:58:11 +00:00
danno@chromium.org
bd50e6d38f
Refactoring and cleanup of control instructions
...
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/18331004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:40:14 +00:00
danno@chromium.org
345cc98a25
Generate StoreGlobal stubs with Hydrogen
...
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.
R=rossberg@chromium.org , ulan@chromium.org
Committed: http://code.google.com/p/v8/source/detail?r=15419
Review URL: https://codereview.chromium.org/16925008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:34:02 +00:00
ulan@chromium.org
74d147a25d
Enable weak embedded maps in optimized code.
...
If the top optimized code in call stack is at the point that does not support
deoptimization, then treat the maps in the code as strong pointers.
Note that other optimized code in call stack must support deoptimization
because of the call instruction with side-effects.
BUG=217858,v8:2073
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16955008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15452 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-02 15:15:58 +00:00
danno@chromium.org
77c20c30a3
Revert r15419: "Generate StoreGlobal stubs with Hydrogen"
...
TBR=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/18357004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 15:12:21 +00:00
danno@chromium.org
a3bce19868
Generate StoreGlobal stubs with Hydrogen
...
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/16925008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15419 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 13:22:13 +00:00
yangguo@chromium.org
85d7a36ee0
Abort optimization when debugger is turned on.
...
BUG=v8:2751
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/18198003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15378 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-28 11:34:51 +00:00
dslomov@chromium.org
ef189ecd82
Do not allow invocation of ArrayBuffer and array buffer views' constructors as functions.
...
ES6 bug 695 (https://bugs.ecmascript.org/show_bug.cgi?id=695 ).
This never worked in WebKit, so no compatibility issues.
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/17904007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-27 07:42:08 +00:00
yangguo@chromium.org
b7b92bd9ac
Short-circuit embedded cons strings.
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/17418003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-21 09:24:30 +00:00
verwaest@chromium.org
2ca5c6cd03
Fix using monomorphic store instruction for polymorphic stores.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16875008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 18:07:35 +00:00
svenpanne@chromium.org
010d9aba16
Avoid relying on monkey-patchable things in String.prototype.split.
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/17391016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 12:25:40 +00:00
svenpanne@chromium.org
fb7310b1fd
Fixed read-only attribute of Function.length in strict mode.
...
R=cira@chromium.org
Review URL: https://codereview.chromium.org/17006006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-18 07:51:50 +00:00
wingo@igalia.com
09fcac5e39
Use keyed-call inline caches in delegating yield
...
Since we can't assume anything about the shape of the iterator in a
yield* (delegating yield), use an IC to do the next() and throw()
iterator method calls.
BUG=v8:2691
R=rossberg@chromium.org
TEST=mjsunit/regress/regress-2691
Review URL: https://codereview.chromium.org/15455002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15111 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-13 10:18:28 +00:00
mvstanton@chromium.org
75afb8ce79
Fix for bug 245480. Calling new Array(a) with a single argument could result in creating a holey array with a packed elements kind.
...
BUG=245480
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/16341004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 18:04:16 +00:00
jkummerow@chromium.org
9447014780
Skip some conditional deopts for Div/Mul when all uses are truncating.
...
- set "can be minus zero" flag properly so minus-zero checks are skipped
- skip "integer result?" check in division code when uses are truncating
- drive-by cleanup: consolidated computation of kCanOverflow flag for Add/Sub into range inference phase
BUG=v8:2132
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/16741002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:43:57 +00:00
wingo@igalia.com
f68d6a10f8
Fix crasher when checking for "of", but next token has no literal buffer
...
Also fix a typo in an assertion in scanner.h.
R=mstarzinger@chromium.org
BUG=248025
TEST=mjsunit/regress/regress-crbug-248025.js
Review URL: https://codereview.chromium.org/16549003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:30:03 +00:00
mstarzinger@chromium.org
ecc41e30c0
Fix re-initialization of existing double field.
...
R=verwaest@chromium.org
BUG=v8:2717
TEST=mjsunit/regress/regress-2717
Review URL: https://codereview.chromium.org/16735003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-10 11:55:47 +00:00
verwaest@chromium.org
3588aa45cd
Take all uses into account to clear int32 truncation.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16656002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 17:28:46 +00:00
verwaest@chromium.org
5e8679beea
Remove the optimized construct stub.
...
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15993016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-05 08:43:25 +00:00
mvstanton@chromium.org
3d3c6b1599
Special Array constructor type feedback erroneously recorded when Array
...
was called as a function. Issue was found with optimize_constructed_array
turned on. This patch makes the fix, and turns the flag back on.
BUG=244461
R=danno@chromium.org
Review URL: https://codereview.chromium.org/16057005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-03 14:46:23 +00:00
jkummerow@chromium.org
b4058a3bd4
Fast literals: fixed initialization of non-copied in-object property fields
...
BUG=chromium:245424
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/16190008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-31 15:50:19 +00:00
verwaest@chromium.org
5b08a1a119
Fix DeferredTaggedToINoSSE2 to not unconditionally untag undefined to 0.
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16228002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-31 08:37:34 +00:00
verwaest@chromium.org
1a4a904bef
Replace DeoptimizeOnUndefined with whitelisting AllowUndefinedAsNan
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15952007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-30 09:11:06 +00:00
yurys@chromium.org
09959efe41
Add support for //# sourceURL similar to deprecated //@ sourceURL one.
...
BUG=v8:2702
R=yangguo@chromium.org , yurys@chromium.org
Review URL: https://codereview.chromium.org/15859010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-29 12:40:21 +00:00
mstarzinger@chromium.org
3b114cdd64
Fix IfBuilder::Deopt to clear the current block.
...
R=jkummerow@chromium.org
BUG=chromium:243868
TEST=mjsunit/regress/regress-crbug-243868
Review URL: https://codereview.chromium.org/16155003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-28 15:30:49 +00:00
verwaest@chromium.org
aa2444269b
Fix the hole loading optimization.
...
- Holes are only ever loaded as double or tagged.
- Change to tagged has to deoptimize on undefined (no implicit
conversions from double the hole NaN -> tagged undefined).
BUG=
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16099006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-27 17:33:14 +00:00
yangguo@chromium.org
3e41834721
Regexp parser: reset flag after scanning ahead for capture groups.
...
When the regexp pattern parser encounters an unbound reference to a
capturing group, it needs to scan ahead to decide whether it really
is a reference. The scan advances to the end of the pattern string
and sets has_more_ to false, but fails to reset it to true so that
later on, parsing a character class wrongly fails.
R=ulan@chromium.org
BUG=v8:2690
Review URL: https://chromiumcodereview.appspot.com/15712006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-27 10:53:37 +00:00
yangguo@chromium.org
7c2a1346d6
Fix edge case in stack trace formatting.
...
Bug description: in strict mode, null as receiver is not implicitly converted
to the global object, so that when formatting the stack trace, the receiver of
the stack frame is null. The IS_OBJECT check returns true for null, but
%GetDataProperty expected a JSObject, which results in a failed RUNTIME_ASSERT.
R=mvstanton@chromium.org
BUG=237617
Review URL: https://chromiumcodereview.appspot.com/15670003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-24 11:33:46 +00:00
yangguo@chromium.org
1d39355405
Add belated test for the SeqStringSetChar bug.
...
R=titzer@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/15849003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-24 08:37:27 +00:00
mstarzinger@chromium.org
8fb2086847
Fix embedded new-space pointer in LCmpObjectEqAndBranch.
...
R=mvstanton@chromium.org
BUG=chromium:240032
TEST=mjsunit/regress/regress-crbug-240032
Review URL: https://codereview.chromium.org/15779004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 14:06:28 +00:00
mstarzinger@chromium.org
b704cb9139
Fix bogus deopt in BuildEmitDeepCopy for holey arrays.
...
R=verwaest@chromium.org
BUG=chromium:242924
TEST=mjsunit/regress/regress-crbug-242924
Review URL: https://codereview.chromium.org/15735012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 17:58:21 +00:00
verwaest@chromium.org
b353b1d131
Don't allow copying holes to fields.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15745006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 15:33:53 +00:00
mstarzinger@chromium.org
bf413b5122
Fix VisitLogicalExpression for empty blocks on RHS.
...
R=jkummerow@chromium.org
BUG=chromium:242870
TEST=mjsunit/regress/regress-crbug-242870
Review URL: https://codereview.chromium.org/15744002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 13:27:00 +00:00
yangguo@chromium.org
9960b24694
Fix unexpected elements transition in JSON.parse
...
R=verwaest@chromium.org
BUG=241344
Review URL: https://chromiumcodereview.appspot.com/15739003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 13:24:18 +00:00
mstarzinger@chromium.org
db4a770c3f
Add regression test for fix from r14732.
...
R=verwaest@chromium.org
BUG=chromium:242502
TEST=mjsunit/regress/regress-crbug-242502
Review URL: https://codereview.chromium.org/15288008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-21 14:20:42 +00:00
titzer@chromium.org
5746d38351
Fix code gen bug on arm and mips; SeqStringSetChar overwrites a register; Add better default PrintDataTo for HInstruction
...
BUG=
Review URL: https://codereview.chromium.org/14895019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-16 14:27:39 +00:00
wingo@igalia.com
d6fa1d8ad9
Function constructor should avoid String.prototype methods
...
Replace a use of .indexOf with a call to StringIndexOf. As always,
lexical scoping to the rescue.
R=mstarzinger@chromium.org
TEST=mjsunit/regress/regress-2686
BUG=v8:2686
Review URL: https://codereview.chromium.org/14668013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-15 10:52:06 +00:00
wingo@igalia.com
1634369af7
Don't flush code for generator functions.
...
R=mstarzinger@chromium.org
BUG=v8:2681
TEST=mjsunit/regress/regress-2681
Review URL: https://codereview.chromium.org/14731023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 17:36:26 +00:00
jkummerow@chromium.org
7636fdec27
Fix missing hole check for loads from Smi arrays when all uses are changes
...
BUG=chromium:233737
Review URL: https://codereview.chromium.org/14978004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 11:58:10 +00:00
ulan@chromium.org
cd4e9866b7
Fix environment in HOptimizedGraphBuilder::VisitCountOperation. Follow-up for r14584.
...
R=danno@chromium.org
BUG=v8:2671
TEST=mjsunit/regress/regress-2671-1.js
Review URL: https://chromiumcodereview.appspot.com/14972009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 14:58:06 +00:00
ulan@chromium.org
e5a29e8ff9
Do not change environment between simulate and scope with no observable side-effects in HandlePropertyAssignment.
...
LChunkBuilder reconstructs the environment by applying simulates. A scope with no observable side-effects has no simulates. If the scope deoptimizes, then LChunkBuilder would miss the changes to the environment between the last simulate and the scope.
R=danno@chromium.org
BUG=v8:2671
TEST=mjsunit/regress/regress-2671.js
Review URL: https://chromiumcodereview.appspot.com/14793009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 07:40:28 +00:00
danno@chromium.org
528792e39b
Fix beyond-heap load on x64 Crankshafted StringCharFromCode
...
BUG=chromium:235311
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/14387008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-29 14:34:24 +00:00
jkummerow@chromium.org
628875475e
Fix overflow check in mul-i which was missing since r14322
...
Review URL: https://codereview.chromium.org/14471012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14430 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-25 07:36:59 +00:00
dslomov@chromium.org
852f90339a
Adds EXTERNAL_DOUBLE_ARRAY to a list of instance types
...
BUG=v8:2646
Patch by Andrei Kashcha <anvaka@gmail.com>
Review URL: https://codereview.chromium.org/14042008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 17:02:09 +00:00
ulan@chromium.org
bc4d7878e6
Do not emit Simulates in HandlePolymorphicElementAccess.
...
BUG=v8:2653
R=jkummerow@chromium.org
TEST=mjsunit/regress/regress-2653.js
Review URL: https://chromiumcodereview.appspot.com/14081025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 15:28:44 +00:00
svenpanne@chromium.org
cd34acdae3
Do not emit double values at their use sites.
...
Revert part of r14179. From the regression test's comment:
Currently, the gap resolver doesn't handle moves from a ConstantOperand to a
DoubleRegister, but these kind of moves appeared when HConstant::EmitAtUses
was changed to allow special double values (-0, NaN, hole). So we should
either enhance the gap resolver or make sure that such moves don't happen.
BUG=chrome:234101
Review URL: https://codereview.chromium.org/14429002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 13:08:10 +00:00
mstarzinger@chromium.org
adf9afc09e
Fix missing Smi check in grow mode keyed stores.
...
R=danno@chromium.org
TEST=mjsunit/regress/regress-grow-store-smi-check
Review URL: https://codereview.chromium.org/14352011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14332 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-18 14:18:27 +00:00
yangguo@chromium.org
d7b78dc230
Fix OOB write in --print-code.
...
R=jkummerow@chromium.org
BUG=v8:2624
Review URL: https://chromiumcodereview.appspot.com/14018010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-15 15:19:51 +00:00
yangguo@chromium.org
da5c11a44a
Fix JSON.stringify's slow path wrt sliced strings.
...
R=mvstanton@chromium.org
BUG=229923
Review URL: https://chromiumcodereview.appspot.com/14107004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-11 09:53:00 +00:00
yangguo@chromium.org
996a80df45
Fix OSR for nested loops.
...
R=jkummerow@chromium.org
BUG=v8:2618
Review URL: https://chromiumcodereview.appspot.com/13811014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-10 09:24:31 +00:00
verwaest@chromium.org
79d18ea332
Let ComputeTarget fail if it skips over NORMAL objects.
...
BUG=v8:2595
Review URL: https://chromiumcodereview.appspot.com/13862008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 16:38:51 +00:00
yangguo@chromium.org
fe6fc554b0
Fix slow path of JSON.stringifier when GC strikes.
...
FlatContent is not GC-safe.
R=verwaest@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/13782002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 08:12:59 +00:00
verwaest@chromium.org
98d8c9e452
Always check global property cells for readonliness before storing.
...
Add check when the global object is the last in the chain.
Review URL: https://chromiumcodereview.appspot.com/13730002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 08:09:05 +00:00
yangguo@chromium.org
9559181b0e
Fix worst-case behavior of MergeRemovableSimulates().
...
Currently, when a long series of removable simulates are merged, we do
this by merging them one by one as we find them. As we merge the value
value lists of the simulates, those lists snowball so that we get a
quadratic complexity wrt runtime and memory consumption.
Instead, we gather simulates that need to be merged, and merge them
backwards starting from the last simulate.
R=jkummerow@chromium.org
BUG=v8:2612
Review URL: https://chromiumcodereview.appspot.com/13649003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-08 17:37:22 +00:00
yangguo@chromium.org
e33b68817b
Fix Array.prototype.concat when exceeding array size limit.
...
R=verwaest@chromium.org
BUG=v8:581
Review URL: https://chromiumcodereview.appspot.com/13465008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-05 15:12:59 +00:00
yangguo@chromium.org
deecbb2e01
Do not implicitly convert non-object receivers for strict mode functions.
...
This was still the case for Array.prototype.* builtin functions.
R=rossberg@chromium.org
BUG=v8:2273
Review URL: https://chromiumcodereview.appspot.com/13473009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-05 11:57:02 +00:00
mstarzinger@chromium.org
9e757a604c
Make __proto__ a real JavaScript accessor property.
...
This turns the __proto__ callback from a foreign callback into a real
JavaScript accessor. It makes the accessor behavior of this property
explicit.
R=rossberg@chromium.org
BUG=v8:1949,v8:2606
TEST=mjsunit/regress/regress-2606
Review URL: https://codereview.chromium.org/13533004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 12:10:23 +00:00
ulan@chromium.org
eee5884f8d
Add extra flag for load-ic stubs in code cache.
...
This allows to distinguish between stubs compiled for the current object from
stubs compiled for objects that have the current object as a prototype.
BUG=v8:2593
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/13552003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 08:29:25 +00:00
danno@chromium.org
98281c62f0
Ensure UseRegisterAtStart not used with fixed temp/return register
...
R=vegorov@chromium.org
BUG=chromium:201590
Review URL: https://codereview.chromium.org/13527007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14124 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-03 14:45:39 +00:00
yangguo@chromium.org
443f85eed9
Add test to check that Function.caller must not expose native functions.
...
R=svenpanne@chromium.org
BUG=v8:105
Review URL: https://chromiumcodereview.appspot.com/13166002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 14:31:48 +00:00
dslomov@chromium.org
47d8af7616
Canonicalize NaNs on store to Fast(Float|Double) arrays
...
Also treat holey NaN coming from external float/double arrays correctly
BUG=2596
Review URL: https://codereview.chromium.org/12918028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 13:30:16 +00:00
yangguo@chromium.org
9155d20282
Stack trace API: poison stack frames below the first strict mode frame.
...
Function and receiver objects are not accessible for poisoned frames.
R=rossberg@chromium.org
BUG=v8:2564
Review URL: https://chromiumcodereview.appspot.com/13150003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 10:40:07 +00:00
yangguo@chromium.org
a942fcd984
Add test case for missing deopt sequence after forced deopt.
...
R=danno@chromium.org
BUG=217858
Review URL: https://chromiumcodereview.appspot.com/13042005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-27 09:58:32 +00:00
yangguo@chromium.org
bb632dc49d
Only copy with, block and catch scopes in DebugEvaluate.
...
R=ulan@chromium.org
BUG=171715
Review URL: https://chromiumcodereview.appspot.com/13093003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-26 17:46:16 +00:00
danno@chromium.org
c3486bc4eb
Remove bogus test flags
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/12872007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 17:59:15 +00:00
danno@chromium.org
dfd9ea8087
Fix store_mode bug involving polymorphism with external and JS arrays.
...
Review URL: https://codereview.chromium.org/12987014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 15:19:22 +00:00
verwaest@chromium.org
a8b3215afa
Change LookupForWrite to always do a full lookup and check the result.
...
If we find a property in the prototype-chain that we can overwrite, and
we have a transition, keep the holder in the lookup-result as the actual
holder. We will need it for the consistency-check in GenerateStoreField.
By directly checking the entire chain we avoid having to lazily bail out
to a copy of the miss stub while generating the Field Store IC.
Currently this CL disallows a normal non-receiver holder, given that
that would require a positive lookup + details verification to ensure
the property did not become read-only. This fixes the regressions in the
attached tests.
Review URL: https://chromiumcodereview.appspot.com/12810006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 12:55:27 +00:00
yangguo@chromium.org
b347a0dcae
Correctly materialize arguments object in Runtime_DebugEvaluate.
...
The problem was that if the # arguments specified in the function
declaration and the # arguments passed to the function are not
the same, we use an arguments adapter frame to make it work. This
confuses the existing implementation to materialize the arguments
object.
R=peter.rybin@gmail.com
BUG=222893
Review URL: https://chromiumcodereview.appspot.com/12674027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 10:01:53 +00:00
yangguo@chromium.org
27b0979347
Restore correct regression test for crbug/146910.
...
For some reason (rebase conflicts?) the regression test introduced
in r12547 was overwritten by r13340.
The test in question already exists in regress-latin-1
R=dcarney@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/13023003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 09:04:36 +00:00
yangguo@chromium.org
b522319a98
Extend test coverage for JSON.stringify's slow path.
...
R=verwaest@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12702009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-20 14:07:30 +00:00
verwaest@chromium.org
002ba9c76d
Turn Flags into a uint32_t typedef.
...
We cannot rely on C++ compilers inferring the int-type from the enum
value range. Whereas Linux/OSX find uint32_t as type for [0,MaxUInt32],
Windows insists it's int.
Update the test to execute its original intent on all platforms: 1 value
larger than max arguments, 1 smaller than max arguments (on all
platforms). This makes the test run a lot faster.
BUG=chromium:194749
Review URL: https://chromiumcodereview.appspot.com/12507010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-19 13:11:49 +00:00
verwaest@chromium.org
010f36f94b
Raise the limit since it is 2**16 (65536) on x64.
...
Review URL: https://chromiumcodereview.appspot.com/12700012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13973 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 15:49:33 +00:00
jkummerow@chromium.org
e2cd7aa423
Fix detection of |handle_smi| case in HOptimizedGraphBuilder::HandlePolymorphicCallNamed
...
BUG=chromium:196583
Review URL: https://codereview.chromium.org/12620014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 12:41:52 +00:00
yangguo@chromium.org
b85237a0bc
Fix white space matching in latin-1 strings wrt \u00a0.
...
R=dcarney@chromium.org
BUG=181422
Review URL: https://chromiumcodereview.appspot.com/12644008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-11 11:52:11 +00:00
mstarzinger@chromium.org
d70523dce6
Restore Function()'s expected string representation.
...
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470
Review URL: https://codereview.chromium.org/12687002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-08 11:47:20 +00:00
mstarzinger@chromium.org
4b0395cc23
Harden Function()'s parsing of function literals.
...
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470
Review URL: https://codereview.chromium.org/12613007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 15:46:14 +00:00
yangguo@chromium.org
3a497dfd51
Insert missing type cast in JSON.stringify.
...
R=dcarney@chromium.org
BUG=v8:2570
Review URL: https://chromiumcodereview.appspot.com/12599003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 09:58:27 +00:00
yangguo@chromium.org
a62cfd1db0
Fix Array.length, String.length and Function.prototype LoadICs on x64.
...
R=jkummerow@chromium.org
BUG=v8:2568
Review URL: https://chromiumcodereview.appspot.com/12545004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-06 18:19:35 +00:00
adamk@chromium.org
7fe9bd5a09
Properly handle misses for StoreArrayLengthStub on ia32 and x64
...
Both failed to generate a miss if the key wasn't "length".
ARM and MIPS were already correct.
BUG=v8:2566
Review URL: https://codereview.chromium.org/12378085
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-05 16:31:11 +00:00
mstarzinger@chromium.org
2aabf6257d
Add workaround for redefinition of __proto__ property.
...
This is a temporary workaround when the __proto__ property is being
redefined (e.g. by Object.freeze()) to not loose the foreign callback.
Once the __proto__ property is a real JavaScript accessor this hack is
no longer necessary. This change also makes __proto__ configurable.
R=rossberg@chromium.org
BUG=v8:2565
TEST=mjsunit/regress/regress-2565
Review URL: https://codereview.chromium.org/12398010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 17:53:40 +00:00
yangguo@chromium.org
358311e8ec
Limit EatAtLeast recursion by a budget.
...
BUG=178790
Review URL: https://chromiumcodereview.appspot.com/12380026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 14:50:14 +00:00
yangguo@chromium.org
2a3063a7c3
Handle negative input in inlined Math.round on Intel CPUs.
...
R=jkummerow@chromium.org
BUG=v8:2451
Review URL: https://chromiumcodereview.appspot.com/12342037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:44:57 +00:00
mstarzinger@chromium.org
ea5e9edac4
Fix materialization of arguments objects with unknown values.
...
This fixes the deoptimizer to materialize arguments objects of correct
length even in cases where the actual argument values are unknown and
were optimized away by Crankshaft. This can happen if only the length
property or the identity of an arguments object is used.
R=svenpanne@chromium.org
BUG=chromium:163530
TEST=mjsunit/regress/regress-crbug-163530
Review URL: https://codereview.chromium.org/12335132
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:37:51 +00:00
dcarney@chromium.org
52a015b1af
Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString
...
R=yangguo@chromium.org
BUG=
Review URL: https://codereview.chromium.org/12326120
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 11:02:39 +00:00
mstarzinger@chromium.org
ce1e10f5fc
Make __proto__ a foreign callback on Object.prototype.
...
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.
The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.
R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262
Review URL: https://codereview.chromium.org/12212011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 10:46:00 +00:00
mstarzinger@chromium.org
300413b5a9
Fix f.apply() optimization when declared arguments are mutated.
...
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539
Review URL: https://codereview.chromium.org/12255033
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 15:12:49 +00:00
jkummerow@chromium.org
19dab057b4
Fix NegateCompareOp and InvertCompareOp
...
BUG=v8:2537
Review URL: https://codereview.chromium.org/12217136
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-13 14:36:19 +00:00
jkummerow@chromium.org
e83ff197bf
Add regression test for r13617
...
Many thanks to Vyacheslav Egorov for coming up with this test!
BUG=173907
Review URL: https://codereview.chromium.org/12212066
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:38:24 +00:00
mstarzinger@chromium.org
79607d20e6
Make the GC stress builder go green.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/12218034
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-06 13:21:28 +00:00
verwaest@chromium.org
aca87c2fcd
Tag stubs that rely on instance types as MEGAMORPHIC.
...
BUG=chromium:173974
Review URL: https://chromiumcodereview.appspot.com/12178017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 13:12:03 +00:00
verwaest@chromium.org
c8636a2809
Do not try to collect the map if the monomorphic IC stub has no map.
...
This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.
BUG=chromium:172345
Review URL: https://chromiumcodereview.appspot.com/12082023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-28 13:19:53 +00:00
yangguo@chromium.org
24ec13cbd2
Fix additional spec violations wrt RegExp.lastIndex.
...
R=svenpanne@chromium.org
BUG=v8:2437
Review URL: https://chromiumcodereview.appspot.com/12033099
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 10:53:26 +00:00
ulan@chromium.org
e6224d275f
Make embedded maps in optimized code weak.
...
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.
BUG=v8:2073
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11575007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 11:55:05 +00:00
ulan@chromium.org
d29826544e
Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.
...
After r13289 the divisor can be non-constant, so we should check for zero.
BUG=171641
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 15:58:49 +00:00
yangguo@chromium.org
9296975c04
Correctly reset lastIndex in an RegExp object.
...
R=svenpanne@chromium.org
BUG=170856
Review URL: https://chromiumcodereview.appspot.com/11896060
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 12:28:16 +00:00
ulan@chromium.org
79a0e3b017
Fix pattern detection for replacing shifts by rotation.
...
BUG=2499
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047015
Patch from Hirofumi Mako <mkhrfm@gmail.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 13:55:22 +00:00
mvstanton@chromium.org
c3746b4388
allocation-site-info.js broken on arm with new changes. Reverting to previous version until diagnosed.
...
Regress-2185.js test takes too long on slow path when allocation site info is discovered.
BUG=
Review URL: https://codereview.chromium.org/12049003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:15:08 +00:00
yangguo@chromium.org
0c822b21cb
Fix some latin-1 webkit units tests
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11962035
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:11:31 +00:00
mstarzinger@chromium.org
0484ddcf50
Fix arguments materialization for inlined apply().
...
This fixes materialization of the arguments object in case the constant
function check if TryCallApply() inside an inlined frame fails.
R=svenpanne@chromium.org
BUG=v8:2489
TEST=mjsunit/regress/regress-2489
Review URL: https://codereview.chromium.org/11931012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-16 09:25:45 +00:00
yangguo@chromium.org
f15f294127
Sync laziness between BuildFunctionInfo and MakeFunctionInfo.
...
BuildFunctionInfo compiles the function eagerly when there are debug
break points. However, the AST may have been parsed lazily since
MakeFunctionInfo does not check for debug break points.
This fixes a regression introduced in r11866.
BUG=147497
Review URL: https://chromiumcodereview.appspot.com/11661008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-15 10:16:52 +00:00
mstarzinger@chromium.org
c5cff2c75a
Make recent regression test resilient against GC stress.
...
R=danno@chromium.org
TEST=mjsunit/regress/regress-165637
Review URL: https://codereview.chromium.org/11824062
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 14:21:27 +00:00
mstarzinger@chromium.org
1079642c97
Fix missing exception check in typed array constructor (2).
...
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11791052
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 11:45:29 +00:00
yangguo@chromium.org
e41c17084f
Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag.
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 15:47:53 +00:00
yangguo@chromium.org
45f20e366a
Introduce ENABLE_LATIN_1 compile flag
...
Mostly a bunch of renaming when flag is disabled.
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 10:30:54 +00:00
svenpanne@chromium.org
0aacbf9619
Added %FlattenString and use it to speed up a regression test.
...
Flattening strings is relatively costly and by doing it after every duplication
we avoid combinatorial explosion.
Note that flattening could have been done by e.g. using a regular expression,
too, but this is just another implementation detail and %FlattenString seems
general enough to be useful in other tests, too.
Review URL: https://codereview.chromium.org/11828014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 09:32:12 +00:00
mstarzinger@chromium.org
0e46919c32
Fix missing exception check in typed array constructor.
...
The typed array constructor might fail if the first argument is an
object with a length property. Accessing the property can cause an
exception to be thrown and an explicit check needs to be performed.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11777014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 14:01:04 +00:00
yangguo@chromium.org
4ee20d857b
Check for read-only-ness when preparing for array sort.
...
R=verwaest@chromium.org
BUG=v8:2419
Review URL: https://chromiumcodereview.appspot.com/11759022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-04 15:24:47 +00:00
ulan@chromium.org
b64f834383
Fix x64 MathMinMax for negative untagged int32 arguments.
...
An untagged int32 has zeros in the upper half even if it is negative.
Using cmpq to compare such numbers will incorrectly ignore the sign.
BUG=164442
R=mvstanton@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11665007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-21 17:52:00 +00:00
yangguo@chromium.org
362218a037
Deopt on overflow in integer mod.
...
R=ulan@chromium.org
BUG=166379
Review URL: https://chromiumcodereview.appspot.com/11618017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-19 12:01:22 +00:00
ulan@chromium.org
8574054b59
Correctly handle negative codes in String.fromCharCode()
...
BUG=166553
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11576069
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:37:57 +00:00
rossberg@chromium.org
c6bb497437
Simplify implementation of assignment-to-const checks.
...
Also, add test that assignment to function name is a syntax error with harmony scoping.
Does not fix issue 2243 directly, but with ES6, the required behaviour will change to what is implemented already anyway.
R=yangguo@chromium.org
BUG=v8:2243
Review URL: https://codereview.chromium.org/11607016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:00:50 +00:00
danno@chromium.org
facad070e9
Remove over-zealous hole checking in Array.slice()
...
R=jkummerow@chromium.org
BUG=chromium:165637
TEST=regress-165637.js
Review URL: https://codereview.chromium.org/11442054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 15:20:45 +00:00
rossberg@chromium.org
76375de29d
Object.observe: prevent observed objects from using fast elements.
...
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.
R=mstarzinger@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11477006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 11:38:24 +00:00
rossberg@chromium.org
3348b5c2b4
Allow lazy compilation (and thus optimisation) of functions inside eval.
...
For strict-mode eval, this requires _disabling_ lazy parsing of inner functions,
because we need to collect their free variables to do allocation for the
eval scope properly.
R=mstarzinger@chromium.org
BUG=v8:2315
Review URL: https://codereview.chromium.org/11438042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:35:50 +00:00
yangguo@chromium.org
3388f92e63
Fix spec violations in methods of Number.prototype.
...
R=svenpanne@chromium.org
BUG=v8:2443
Review URL: https://chromiumcodereview.appspot.com/11465005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:20:35 +00:00
yangguo@chromium.org
276c790c61
Iterate through all arguments for side effects in Math.min/max.
...
R=svenpanne@chromium.org
BUG=v8:2444
Review URL: https://chromiumcodereview.appspot.com/11444030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-06 13:13:38 +00:00
yangguo@chromium.org
c75ca45000
Improve array to string conversion.
...
BUG=v8:2435
Review URL: https://chromiumcodereview.appspot.com/11348349
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 15:49:22 +00:00
yangguo@chromium.org
6c92aba643
Fix spec violations related to regexp.lastIndex
...
BUG=v8:2437, v8:2438
Review URL: https://chromiumcodereview.appspot.com/11451005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 12:32:25 +00:00
verwaest@chromium.org
7553f0d68e
CopyPackedSmiToDoubleElements should fill the FixedDoubleArray with holes
...
BUG=v8:2433
Review URL: https://chromiumcodereview.appspot.com/11280223
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-29 08:34:19 +00:00
verwaest@chromium.org
09b1574baa
Make ElementsAccessors more tolerant of varying backing store types
...
This avoids bogus calls to Fixed*Array::cast() when FastElements-backed objects are empty (and thus backed by empty_fixed_array).
Review URL: https://chromiumcodereview.appspot.com/11299190
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-28 08:41:45 +00:00
verwaest@chromium.org
1b0e373f09
Avoid double initialization of arrays.
...
Review URL: https://chromiumcodereview.appspot.com/11413179
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-27 12:01:14 +00:00
verwaest@chromium.org
beeb751278
Ensure we do not clobber the register holding the elements backing store.
...
Review URL: https://chromiumcodereview.appspot.com/11316168
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-26 15:58:27 +00:00
verwaest@chromium.org
ebeaad6cb5
Ensure double arrays are filled with holes when extended from variations of empty arrays.
...
BUG=162085
Review URL: https://chromiumcodereview.appspot.com/11414155
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-26 14:29:21 +00:00
jkummerow@chromium.org
a956594fc2
Fix corner case in x64 compare stubs.
...
BUG=v8:2416
Review URL: https://codereview.chromium.org/11413087
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13019 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-20 15:57:10 +00:00
rossberg@chromium.org
8d79ff46d0
Clean-up refactoring to eliminate GetLocalElementKind.
...
Eliminates substantial amounts of fragile code duplication and special casing.
Also fixes "a".propertyIsEnumerable(0) to correctly return true.
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/11420011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12990 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-16 13:28:34 +00:00
mstarzinger@chromium.org
3d1582c474
Fix Array.prototype.join evaluation order.
...
R=yangguo@chromium.org
BUG=v8:2263
TEST=mjsunit/regress/regress-2263
Review URL: https://codereview.chromium.org/11280025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12989 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-16 12:45:23 +00:00
rossberg@chromium.org
af824eab8f
When using an Object as a set in Object.getOwnPropertyNames, null out the proto
...
Also apply the same fix elsewhere in v8natives.js
BUG=v8:2410
Review URL: https://codereview.chromium.org/11364237
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12982 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-16 09:32:39 +00:00
yangguo@chromium.org
4783d3c31b
Remove 'type' and 'arguments' properties from Error object.
...
R=svenpanne@chromium.org
BUG=v8:2397
Review URL: https://chromiumcodereview.appspot.com/11358214
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-14 09:14:47 +00:00
yangguo@chromium.org
4cca6c6081
Make formatting error message side-effect-free.
...
BUG=v8:2398
Review URL: https://chromiumcodereview.appspot.com/11359130
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-12 10:33:20 +00:00
yangguo@chromium.org
ef1b3d3a76
Fix length check in JSON.stringify.
...
R=verwaest@chromium.org
BUG=160010
Review URL: https://chromiumcodereview.appspot.com/11410031
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-12 10:20:07 +00:00
mstarzinger@chromium.org
a31889e2de
Fix slack tracking when instance prototype changes.
...
This fixes a corner case when the instance prototype of a function is
changed while inobject slack tracking is still in progress. This caused
the intial map to be unrelated for functions with the same shared info
and hence the shared construct stub is no longer generic enough to work
for all those functions.
R=danno@chromium.org
BUG=chromium:157019
TEST=mjsunit/regress/regress-crbug-157019
Review URL: https://codereview.chromium.org/11293059
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-08 11:56:44 +00:00
yangguo@chromium.org
e8d91b424c
Handle edge cases in basic JSON.stringify.
...
BUG=
Review URL: https://chromiumcodereview.appspot.com/11315009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-02 14:46:57 +00:00
verwaest@chromium.org
14abf05bd5
Ensure reducing the length of an array doesn't make it go holey.
...
Also only transition and/or change anything to the backing store if we are
actually going to delete anything.
BUG=
Review URL: https://chromiumcodereview.appspot.com/11358011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-02 10:24:56 +00:00