Commit Graph

1233 Commits

Author SHA1 Message Date
mvstanton
3df0a9ae77 CallIC used an invalid mechanism to detect if it was in optimized code.
BUG=453481
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/885333002

Cr-Commit-Position: refs/heads/master@{#26361}
2015-01-30 15:07:14 +00:00
jarin
da90aabc07 Always emit bailout id for inlining property access (even for keyed access).
R=ulan@chromium.org
BUG=chromium:453805
LOG=n

Review URL: https://codereview.chromium.org/887023003

Cr-Commit-Position: refs/heads/master@{#26359}
2015-01-30 14:35:43 +00:00
ishell
32fe247d91 Layout descriptor sharing issue fixed.
BUG=chromium:437713, v8:3832
LOG=Y

Review URL: https://codereview.chromium.org/885003002

Cr-Commit-Position: refs/heads/master@{#26354}
2015-01-30 12:55:25 +00:00
aperez
91b87e7a28 Do not create unresolved variables when parsing arrow functions lazily
Arrow function parameter lists are parsed as expressions. When an identifier
is found a VariableProxy is created and added to the list of unresolved
variables for the scope. When parsing a function lazily, the scope has been
already resolved, so with this patch only the VariableProxy is created,
without adding it as an unresolved variable in the scope.

BUG=v8:3501
LOG=Y

Review URL: https://codereview.chromium.org/880253004

Cr-Commit-Position: refs/heads/master@{#26328}
2015-01-29 15:53:15 +00:00
mstarzinger
c5833e8596 Add missing FrameState to JSToName nodes.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451770
BUG=chromium:451770
LOG=N

Review URL: https://codereview.chromium.org/880963002

Cr-Commit-Position: refs/heads/master@{#26305}
2015-01-28 11:40:02 +00:00
yangguo
1e905469be Land test case for RegExp.source.
BUG=chromium:447561
LOG=N
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/878033003

Cr-Commit-Position: refs/heads/master@{#26297}
2015-01-27 15:17:37 +00:00
ishell
7f9b2fa699 Do not generalize field representations when making elements kind or observed transition.
BUG=chromium:448711
LOG=y

Review URL: https://codereview.chromium.org/861173004

Cr-Commit-Position: refs/heads/master@{#26289}
2015-01-27 11:19:06 +00:00
titzer
7c81161b97 [turbofan] Simplify reduction if IfTrue and IfFalse and fix bugs.
R=mstarzinger@chromium.org
BUG=chromium:451958
LOG=Y

Review URL: https://codereview.chromium.org/880533002

Cr-Commit-Position: refs/heads/master@{#26276}
2015-01-26 16:11:24 +00:00
mstarzinger
00f3f99221 Add missing FrameState for Runtime_CreateArrayLiteral.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451013
BUG=chromium:451013
LOG=N

Review URL: https://codereview.chromium.org/873973003

Cr-Commit-Position: refs/heads/master@{#26268}
2015-01-26 12:45:34 +00:00
svenpanne
a7d67a64f1 Fixed Hydrogen environment handling for mul-i on ARM and ARM64.
The whole logic in DoMul makes me cry, so I made only the minimal
change to fix the issue...

BUG=v8:451322
LOG=y

Review URL: https://codereview.chromium.org/873703002

Cr-Commit-Position: refs/heads/master@{#26261}
2015-01-26 08:35:58 +00:00
mstarzinger
d2e424afb8 Avoid unintentional optimization of hot builtins by TurboFan.
R=titzer@chromium.org
TEST=mjsunit/regress/regress-crbug-451016
BUG=chromium:451016
LOG=N

Review URL: https://codereview.chromium.org/817293005

Cr-Commit-Position: refs/heads/master@{#26229}
2015-01-22 18:52:15 +00:00
ishell
8ccc696bf6 Support concatenating with zero-size arrays with DICTIONARY_ELEMENTS in Runtime_ArrayConcat.
BUG=chromium:450895
LOG=y

Review URL: https://codereview.chromium.org/849693003

Cr-Commit-Position: refs/heads/master@{#26219}
2015-01-22 11:15:30 +00:00
mstarzinger
558efe21f0 Add missing BailoutId and FrameState to with statements.
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-450642
BUG=chromium:450642
LOG=N

Review URL: https://codereview.chromium.org/865833002

Cr-Commit-Position: refs/heads/master@{#26218}
2015-01-22 10:57:42 +00:00
bmeurer
0381acf7b3 Double field values need sNaN -> qNaN canonicalization.
Also fix mjsunit/regress/regress-undefined-nan to ensure that we are
testing transfer via xmm registers by forcing the transfer to be in an
optimized function.

BUG=v8:3839
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863153002

Cr-Commit-Position: refs/heads/master@{#26213}
2015-01-22 08:36:12 +00:00
Benedikt Meurer
ee86227600 [arm] Fix sNaN quietening in the ARM simulator on IA-32.
TEST=msjunit/regress/regress-undefined-nan2
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/802243004

Cr-Commit-Position: refs/heads/master@{#26185}
2015-01-21 13:01:23 +00:00
Benedikt Meurer
9eace97bba Use signaling NaN for holes in fixed double arrays.
TEST=mjsunit,cctest,unittests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863633002

Cr-Commit-Position: refs/heads/master@{#26180}
2015-01-21 08:52:25 +00:00
ishell
33994b4a22 Massive renaming of PropertyType values and other implied stuff.
PropertyKind:
  DATA -> kData
  ACCESSOR -> kAccessor

PropertyType:
  FIELD -> DATA
  CONSTANT -> DATA_CONSTANT
  ACCESSOR_FIELD -> ACCESSOR
  CALLBACKS -> ACCESSOR_CONSTANT

PropertyLocation:
  IN_OBJECT -> kField
  IN_DESCRIPTOR -> kDescriptor

StoreMode:
  FORCE_IN_OBJECT -> FORCE_FIELD

FieldDescriptor -> DataDescriptor
ConstantDescriptor -> DataConstantDescriptor
CallbacksDescriptor -> AccessorConstantDescriptor

Review URL: https://codereview.chromium.org/856503002

Cr-Commit-Position: refs/heads/master@{#26146}
2015-01-19 17:49:22 +00:00
mvstanton
173b69f041 ClusterFuzz fix: %NormalizeElements shouldn't process the global proxy.
BUG=449070
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/859713002

Cr-Commit-Position: refs/heads/master@{#26126}
2015-01-19 09:31:19 +00:00
Sven Panne
e5184734b3 Another attempt to fix regress-crbug-178790.
This time we simply undo the change introduced by the PPC port for
this test. No idea why it should be necessary, and Windows XP
obviously doesn't give us that much stack, anyway.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/826833003

Cr-Commit-Position: refs/heads/master@{#26093}
2015-01-16 10:12:15 +00:00
Sven Panne
54570cfa74 PPC aftermath: Fix regress-crbug-178790.
The test fails on XP only, so let's tentatively raise the stack limit more. We probably need to investigate what a tighter limit might be and (more importantly) what the underlying reason for the failure is.

Hopefully 1800kB is enough, we can't test this via try jobs, because we don't have XP try bots. :-/

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/791693005

Cr-Commit-Position: refs/heads/master@{#26092}
2015-01-16 09:45:31 +00:00
Sven Panne
e4c5b84652 Contribution of PowerPC port (continuation of 422063005)
Contribution of PowerPC port (continuation of 422063005). The inital patch
covers the core changes to the common files.  Subsequent patches will cover
changes to common files to support AIX and to update the ppc directories so
they are current with the changes in the rest of the project.

This is based off of the GitHub repository
https://github.com/andrewlow/v8ppc

BUG=
R=svenpanne@chromium.org, danno@chromium.org, sevnpanne@chromium.org

Review URL: https://codereview.chromium.org/817143002

Cr-Commit-Position: refs/heads/master@{#26091}
2015-01-16 07:42:15 +00:00
bmeurer
e1d878d16f Add proper support for proxies to HType.
TEST=mjsunit/regress/regress-crbug-448730
BUG=chromium:448730
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/847373002

Cr-Commit-Position: refs/heads/master@{#26056}
2015-01-14 13:57:09 +00:00
dslomov
a4124b3bfc Map -0 to integer 0 for typed array constructors.
R=bmeurer@chromium.org
BUG=chromium:447756
LOG=Y

Review URL: https://codereview.chromium.org/790813005

Cr-Commit-Position: refs/heads/master@{#26021}
2015-01-12 11:42:57 +00:00
titzer
7e98658e31 [turbofan] Fix control reducer for degenerate cases of self-loop branches.
R=jarin@chromium.org
BUG=chromium:447526

Review URL: https://codereview.chromium.org/828823006

Cr-Commit-Position: refs/heads/master@{#26009}
2015-01-09 12:28:14 +00:00
Yang Guo
2050994d80 Correctly parse line ends for debugging.
Instead of using only \n as line terminator, we now use the definition
in http://www.ecma-international.org/ecma-262/5.1/#sec-7.3

R=marja@chromium.org
BUG=v8:2825
LOG=Y

Review URL: https://codereview.chromium.org/821383009

Cr-Commit-Position: refs/heads/master@{#25989}
2015-01-08 10:46:13 +00:00
ishell
0d6785805c Correct handling of exceptions occured during getting of exception stack trace.
BUG=chromium:444805
LOG=Y

Review URL: https://codereview.chromium.org/793333003

Cr-Commit-Position: refs/heads/master@{#25978}
2015-01-07 14:50:16 +00:00
titzer
d77d3ba9a3 Fix bug in Runtime_CompileOptimized resulting from stack overflow.
R=jarin@chromium.org
BUG=chromium:446389
LOG=Y

Review URL: https://codereview.chromium.org/844503002

Cr-Commit-Position: refs/heads/master@{#25974}
2015-01-07 13:43:44 +00:00
svenpanne
cbf3b0bcc7 More -fsanitize=vptr fixes.
This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
2014-12-16 14:20:28 +00:00
marja
978f41a1da RegExpParser: Fix Reset()ting to the end.
The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}
2014-12-16 12:14:19 +00:00
jkummerow
c060f4e26c Internalize strings being stored into uninitialized property cells
Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}
2014-12-15 15:46:11 +00:00
dslomov
e6198a0fed Update tests in preparation for shipping classes.
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}
2014-12-11 15:54:09 +00:00
ishell
7d13ca278a Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."
Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}
2014-12-10 15:18:52 +00:00
svenpanne
c16b8f6cbb Fixed environment handling for LFlooringDivI on ARM.
Beautiful code... :-}

BUG=chromium:437765
LOG=y

Review URL: https://codereview.chromium.org/775613002

Cr-Commit-Position: refs/heads/master@{#25613}
2014-12-02 13:47:19 +00:00
ishell
1a2e4b265a Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map.
BUG=chromium:436820
LOG=N

Review URL: https://codereview.chromium.org/759823004

Cr-Commit-Position: refs/heads/master@{#25530}
2014-11-26 17:37:05 +00:00
titzer
9da4998204 Abort optimization in corner case.
The %OptimizeFunctionOnNextCall sledgehammer can cause a function to be
marked for optimization before it's ever been compiled by fullcode.
This can lead to the situation where a function doesn't have optimization
disabled until we try to compile it optimized.

Basically, the assert should just handle this case more gracefully.

R=yangguo@chromium.org
BUG=436893
LOG=Y

Review URL: https://codereview.chromium.org/760063002

Cr-Commit-Position: refs/heads/master@{#25528}
2014-11-26 16:57:52 +00:00
jarin
97cab985b8 Do not try to inline if the function has an illegal redeclaration.
R=mvstanton@chromium.org
BUG=chromium:436896
LOG=n

Review URL: https://codereview.chromium.org/755333003

Cr-Commit-Position: refs/heads/master@{#25527}
2014-11-26 16:32:46 +00:00
dslomov
626f110f0b Introduce legacy const slots in correct context.
R=rossberg@chromium.org
BUG=chromium:410030
LOG=Y

Review URL: https://codereview.chromium.org/756293004

Cr-Commit-Position: refs/heads/master@{#25519}
2014-11-26 12:16:30 +00:00
dslomov
6ac4de87a8 harmony-scoping: make assignment to 'const' a late error.
Per TC39 Nov 2014 decision.

This patch also changes behavior for "legacy const": assignments to sloppy const in strict mode is now also a type error. This fixes v8:2243 and also brings us in compliance with other engines re assignment to function names (see updated webkit test), but might have bigger implications.
That change can easily be reverted by changing Variable::IsSignallingAssignmentToConst.

BUG=v8:3713,v8:2243
LOG=N

Review URL: https://codereview.chromium.org/749633002

Cr-Commit-Position: refs/heads/master@{#25516}
2014-11-26 11:21:23 +00:00
jarin
d9cabb9b22 [turbofan] Fix matching of the lea instruction.
Resets the scaled exponent to 0 when the scaling match fails.

BUG=

Review URL: https://codereview.chromium.org/756643002

Cr-Commit-Position: refs/heads/master@{#25491}
2014-11-24 17:45:33 +00:00
yangguo
270dccf6db Correctly find shared function info for debugging when compiling eagerly.
R=ulan@chromium.org
BUG=v8:3717
LOG=N

Review URL: https://codereview.chromium.org/758523004

Cr-Commit-Position: refs/heads/master@{#25486}
2014-11-24 15:43:35 +00:00
yangguo
14a3b9188d Fix RegExp.source for uncompiled regexp.
R=jkummerow@chromium.org
BUG=435825
LOG=N

Review URL: https://codereview.chromium.org/753983002

Cr-Commit-Position: refs/heads/master@{#25476}
2014-11-24 11:21:52 +00:00
yangguo
5414c39974 Slightly improve tests that rely on lazy compilation.
R=rossberg@chromium.org
BUG=v8:3712
LOG=N

Review URL: https://codereview.chromium.org/743843003

Cr-Commit-Position: refs/heads/master@{#25463}
2014-11-21 12:41:06 +00:00
yangguo
61bee5c898 Correctly escape RegExp source.
R=ulan@chromium.org
BUG=v8:3229
LOG=N

Review URL: https://codereview.chromium.org/736003002

Cr-Commit-Position: refs/heads/master@{#25457}
2014-11-21 10:50:24 +00:00
Michael Stanton
cf572694fe Assert to protect against polymorphic string loads fires on valid stores.
BUG=435477
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/751513002

Cr-Commit-Position: refs/heads/master@{#25456}
2014-11-21 10:29:08 +00:00
Michael Stanton
3d58b82add Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed.
The bug was an error when copying arrays in crankshaft. If it's a holey smi
array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation
changes from being inserted that deopt on encountering the hole.

Also, prevent inlining array pop() and shift() if the length is read-only.

BUG=435073
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/737383002

Cr-Commit-Position: refs/heads/master@{#25455}
2014-11-21 10:14:19 +00:00
ulan
dc88962350 Do not bailout from optimizing functions that use f(x, arguments)
if there is not enough type-feedback to detect that f is Function.prototype.apply.

BUG=v8:3709
LOG=N
TEST=mjsunit/regress/regress-3709

Review URL: https://codereview.chromium.org/736043002

Cr-Commit-Position: refs/heads/master@{#25447}
2014-11-20 17:07:44 +00:00
Andreas Rossberg
4f63564700 Fix lower bound violation
R=jarin@chromium.org
BUG=433332
LOG=N

Review URL: https://codereview.chromium.org/739563002

Cr-Commit-Position: refs/heads/master@{#25436}
2014-11-20 11:22:49 +00:00
yangguo
5bea77f786 Fix disabling all break points from within the debug event callback.
BUG=chromium:432493
LOG=Y

Review URL: https://codereview.chromium.org/728103008

Cr-Commit-Position: refs/heads/master@{#25400}
2014-11-18 14:57:48 +00:00
Jakob Kummerow
bf22724e0d Fix one more missing c0_ < 0 check in scanner
BUG=chromium:433766
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/731953003

Cr-Commit-Position: refs/heads/master@{#25371}
2014-11-17 09:43:31 +00:00
Jaroslav Sevcik
c3af691e72 [turbofan] Remove int32 narrowing during typed lowering.
With Int32Add we lose the int/uint distinction, so later, in simplified lowering we can make a wrong decision. E.g., see the attached test case, where we lower NumberAdd -> Int32Add because inputs are Uint32, but during simplified lowering we change the inputs to Int32, so we get a wrong result.

Simplified lowering will lower the NumberAdd operations anyway, so we should lose performance.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/721723004

Cr-Commit-Position: refs/heads/master@{#25368}
2014-11-17 09:04:52 +00:00