Commit Graph

5385 Commits

Author SHA1 Message Date
titzer
3e0b6daf54 [wasm] Add more extensive tests for asm->wasm translation.
R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1825333004

Cr-Commit-Position: refs/heads/master@{#35045}
2016-03-23 23:19:22 +00:00
bradnelson
c728dad8b8 Enable embenchen/copy for wasm.
This got fixed by this change:
    https://crrev.com/32a2ab0c724673961aa145ab63c79a29e6d28fa8

Adding a smaller mjsunit test capturing the issue (was with idiv register allocation).

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=593283
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N
TEST=asm-wasm-copy

Review URL: https://codereview.chromium.org/1820163002

Cr-Commit-Position: refs/heads/master@{#35041}
2016-03-23 17:50:05 +00:00
neis
7e3772713f Reenable and adapt long forgotten proxy test.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1823973002

Cr-Commit-Position: refs/heads/master@{#35020}
2016-03-23 09:14:58 +00:00
cbruni
2efc138131 [proxies] use [[GetPrototypeOf]] trap in for-in key accumulation
With the recent spec change removing the [[Enumerate]] internal method, we now
have to walk the complete prototype chain. This implies that we call the
[[GetPrototypeOf]] trap on proxies.

As a secondary change we now trigger the [[GetOwnProperty]] trap for the for-in
filter step to see whether the properties are still enumerable. Before we did this
in the key-accumulation phase. This way we slightly reduce the number of traps
invoked. Whilst this is not ideal, it comes closer to the Spec's example
implementation.

BUG=v8:1543, v8:4768
LOG=n

Review URL: https://codereview.chromium.org/1748923003

Cr-Commit-Position: refs/heads/master@{#35017}
2016-03-23 08:36:59 +00:00
adamk
ed18aa65ea Remove support for legacy const, part 1
Now that ES2015 const has shipped, in Chrome 49, legacy const declarations
are no more. This lets us remove a bunch of code from many parts of the
codebase.

In this patch, I remove parser support for generating legacy const variables
from const declarations. This also removes the special "illegal declaration"
bit from Scope, which has ripples into all compiler backends.

Also gone are any tests which relied on legacy const declarations.

Note that we do still generate a Variable in mode CONST_LEGACY in one case:
function name bindings in sloppy mode. The likely fix there is to add a new
Variable::Kind for this case and handle it appropriately for stores in each
backend, but I leave that for a later patch to make this one completely
subtractive.

Review URL: https://codereview.chromium.org/1819123002

Cr-Commit-Position: refs/heads/master@{#35002}
2016-03-22 17:52:13 +00:00
oth
9383d14b9f [interpreter] Disable mjsunit/ignition/elided-instruction
BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1821183002

Cr-Commit-Position: refs/heads/master@{#34991}
2016-03-22 14:40:45 +00:00
bmeurer
43fe7d6854 [builtins] Add support for JS builtins written in TurboFan.
This CL adds support for builtins with JavaScript linkage written using
the TurboFan CodeStubAssembler, but with a JSCall descriptor (which was
already supported thanks to a previous patch by Ben Smith). As a first
example, we convert the Math.sqrt builtin and thereby get rid of the
%_MathSqrt intrinsic, which causes trouble for the representation
selection pass in the JavaScript pipeline.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1824993002

Cr-Commit-Position: refs/heads/master@{#34989}
2016-03-22 13:25:54 +00:00
mythria
27338320f4 [Interpreter] Fixes CopyBytecodeArray to copy interrupt_budget field.
Fixes CopyBytecodeArray to set the interrupt_budget field.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1809123003

Cr-Commit-Position: refs/heads/master@{#34982}
2016-03-22 11:05:21 +00:00
bradnelson
cca5c3f630 Fix conversion to float32, typing issue, split apart asm-wasm tests.
Add missing conversions from other types to f32 in fround.
Restrict fround() to only float, double, signed, unsigned (no unions / intish).
Restrict Bitwise operations to intish, particularly |0, when not applied to a foreign function.

Adding more exhaustive tests of stdlib Math, move to a separate file.
Adding tests of interesting values for the stdlib asm.js functions.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1804243003

Cr-Commit-Position: refs/heads/master@{#34967}
2016-03-21 20:34:40 +00:00
adamk
249bf75e0c Remove runtime flags for Proxy and Reflect
Both of them shipped in Chrome 49 without incident.

Also move relevant tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1815773002

Cr-Commit-Position: refs/heads/master@{#34964}
2016-03-21 19:40:02 +00:00
ishell
e6dca379b6 [crankshaft] Check if the function is callable before generating a tail call via Call builtin.
This is necessary to ensure that "Called non callable" exception will get a proper message and stack trace even for calls at tail position.

BUG=chromium:595615, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818003002

Cr-Commit-Position: refs/heads/master@{#34962}
2016-03-21 19:24:28 +00:00
yangguo
5dedb164eb [regexp] require exact match for unicode property names.
R=littledan@chromium.org
BUG=v8:4810
LOG=N

Review URL: https://codereview.chromium.org/1824613002

Cr-Commit-Position: refs/heads/master@{#34961}
2016-03-21 19:22:24 +00:00
ishell
35a14c75e3 Disable ES6 tail call elimination for native functions.
We don't want them to disappear from the stack traces.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818063002

Cr-Commit-Position: refs/heads/master@{#34957}
2016-03-21 17:44:57 +00:00
oth
48d082af38 [interpreter] Add support for scalable operands.
This change introduces wide prefix bytecodes to support wide (16-bit)
and extra-wide (32-bit) operands. It retires the previous
wide-bytecodes and reduces the number of operand types.

Operands are now either scalable or fixed size. Scalable operands
increase in width when a bytecode is prefixed with wide or extra-wide.

The bytecode handler table is extended to 256*3 entries. The
first 256 entries are used for bytecodes with 8-bit operands,
the second 256 entries are used for bytecodes with operands that
scale to 16-bits, and the third group of 256 entries are used for
bytecodes with operands that scale to 32-bits.

LOG=N
BUG=v8:4747,v8:4280

Review URL: https://codereview.chromium.org/1783483002

Cr-Commit-Position: refs/heads/master@{#34955}
2016-03-21 17:09:49 +00:00
mstarzinger
02a015b1c1 [es6] Rebaseline tests of 'instanceof' error messages.
This rebaselines all our internal tests for error messages thrown by the
implementation of 'instanceof' to the new ES6 semantics. It also applies
a minor rephrasing to the messages in question.

R=rossberg@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1822663002

Cr-Commit-Position: refs/heads/master@{#34940}
2016-03-21 14:01:50 +00:00
ishell
1c34e5f822 Run some slow tail call tests only for fast configurations.
NOTRY=true

Review URL: https://codereview.chromium.org/1822683002

Cr-Commit-Position: refs/heads/master@{#34935}
2016-03-21 13:06:03 +00:00
ishell
ac83355748 [interpreter] Disable some slow tail call tests.
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1817993002

Cr-Commit-Position: refs/heads/master@{#34929}
2016-03-21 11:20:14 +00:00
ishell
acbb968ded [crankshaft] Fixing ES6 tail call elimination.
In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
Cr-Commit-Position: refs/heads/master@{#34830}

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34920}
2016-03-21 08:48:37 +00:00
bmeurer
cc04776632 [json] Allow any callable object for toJSON.
Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG=chromium:595738, chromium:535408
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}
2016-03-20 19:35:28 +00:00
adamk
6a8de15322 Several mjsunit cleanups
- Move default parameters tests from harmony/ to es6/ and remove
    non-existent --harmony-default-parameters flag.
  - Remove some non-existent tests from mjsunit.status

Review URL: https://codereview.chromium.org/1812313002

Cr-Commit-Position: refs/heads/master@{#34908}
2016-03-18 23:20:44 +00:00
littledan
0d2e28cb24 Revert of Restore per-TypedArray-class length accessors as a perf workaround (patchset #2 id:20001 of https://codereview.chromium.org/1624383003/ )
Reason for revert:
This patch actually seemed to cause a further GameBoy regression! Reverting it seems to address the regression.

Original issue's description:
> Restore per-TypedArray-class length accessors as a perf workaround
>
> This patch is a workaround to the performance regression caused by
> implementing the ES2015 TypedArray prototype chain: Include a
> per-TypedArray-subclass length getter so that the superclass getter does
> not become polymorphic. The patch appears to fix a regression in the
> Gameboy Octane benchmark.
>
> BUG=chromium:579905
> R=adamk
> LOG=Y
>
> Committed: https://crrev.com/03ce7711e474a0ef74f723b30ae1527c89dec010
> Cr-Commit-Position: refs/heads/master@{#33501}

R=adamk@chromium.org
BUG=chromium:579905,chromium:593634
LOG=Y

Review URL: https://codereview.chromium.org/1812143004

Cr-Commit-Position: refs/heads/master@{#34906}
2016-03-18 18:29:37 +00:00
yangguo
1e2d0e1136 [regexp] catch stack overflow when parsing back references.
R=jkummerow@chromium.org
BUG=chromium:595657
LOG=N

Review URL: https://codereview.chromium.org/1811913006

Cr-Commit-Position: refs/heads/master@{#34894}
2016-03-18 14:52:41 +00:00
verwaest
c6f9883d53 Remove oob elements collected from the prototype chain by trimming in GetArrayKeys
BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}
2016-03-18 14:37:36 +00:00
caitpotter88
17c92fe6bb [es7] implement exponentiation operator proposal
Implements Stage 4 proposal from http://rwaldron.github.io/exponentiation-operator/,
without adding any knowledge of the feature to compiler backends.

BUG=v8:3915
LOG=Y
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1678303002

Cr-Commit-Position: refs/heads/master@{#34890}
2016-03-18 13:54:05 +00:00
mvstanton
84af5e4426 ES6: instanceof error messages need updating.
We need one message in case the function is not an object, and
another if it was an object but not callable.

R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1814823002

Cr-Commit-Position: refs/heads/master@{#34883}
2016-03-18 10:39:28 +00:00
littledan
7acee1ef61 Throw the right exceptions from setting elements in Array.prototype.concat
This patch fixes two bugs in Array.prototype.concat in conjunction with
subclassing Arrays:
- Create a new property rather than calling Set when adding elements to
  the output array. This means setters are not called.
- If there is an exception thrown from DefineProperty, propagate it
  outwards properly, rather than swallowing it. This can occur, e.g., with
  a Proxy as the new output array.

R=adamk
LOG=Y
BUG=chromium:595319

Review URL: https://codereview.chromium.org/1814933002

Cr-Commit-Position: refs/heads/master@{#34876}
2016-03-17 22:42:00 +00:00
mvstanton
2aa070be4f InstanceOfStub incorrectly interprets the hole as a prototype.
Repair this to match what the runtime correctly does, by first checking if the
function is a constructor before we access the prototype.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1810953002

Cr-Commit-Position: refs/heads/master@{#34863}
2016-03-17 14:32:23 +00:00
balazs.kilvady
7b9dca76b8 MIPS: Disable asm-wasm mjsunit tests.
Port 879d254d54

Original commit message:
Landing this again, excluding arm as it fail and arm64
out of caution that other wasm arm64 tests are also disabled.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
LOG=N

Review URL: https://codereview.chromium.org/1778673004

Cr-Commit-Position: refs/heads/master@{#34860}
2016-03-17 14:03:27 +00:00
mvstanton
d47a4063c0 ES6: Object.setPrototypeOf(func, null) breaks instanceof
The way desugared instanceof called OrdinaryHasInstance if the lookup of
@@hasInstance failed was incorrect.

BUG=v8:4774
LOG=N

Review URL: https://codereview.chromium.org/1812793002

Cr-Commit-Position: refs/heads/master@{#34855}
2016-03-17 12:41:07 +00:00
jarin
c2e82d6e82 [crankshaft] Fix inlining to always connect both branches of test context.
BUG=v8:4839
LOG=n

Review URL: https://codereview.chromium.org/1811693002

Cr-Commit-Position: refs/heads/master@{#34848}
2016-03-17 10:00:21 +00:00
mythria
46fabc1ea5 [Interpreter] Skips debug-scope-on-return on ignition and msan.
Skips mjsunit/ignition/debug-scope-on-return on ignition and msan

TBR=rmcilroy@chromium.org,machenbach@chromium.org
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1808873002

Cr-Commit-Position: refs/heads/master@{#34841}
2016-03-16 20:41:12 +00:00
machenbach
d64b41ded6 Revert of [crankshaft] Fixing ES6 tail call elimination. (patchset #7 id:200001 of https://codereview.chromium.org/1780043004/ )
Reason for revert:
[Sheriff] Leads to mac gc stress crashes:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/4975

Original issue's description:
> [crankshaft] Fixing ES6 tail call elimination.
>
> In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
> Otherwise we will see G in a stack trace inside H.
>
> This CL also enables all existing tests related to ES6 tail call elimination.
>
> TBR=bmeurer@chromium.org
> BUG=v8:4698
> LOG=N
>
> Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
> Cr-Commit-Position: refs/heads/master@{#34830}

TBR=mstarzinger@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4698

Review URL: https://codereview.chromium.org/1814433002

Cr-Commit-Position: refs/heads/master@{#34835}
2016-03-16 18:13:48 +00:00
ishell
689980f7d4 [crankshaft] Fixing ES6 tail call elimination.
In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34830}
2016-03-16 17:06:41 +00:00
littledan
f9db79ebdb Ship ES2015 restrictions on function declaration locations
Function declarations were previously permitted by V8 in many locations
which no ECMAScript specification allowed; the ECMAScript 2015 spec
enumerates a few locations (in blocks, as well as after labels and in
conditionals when in sloppy mode). This patch ships the flag to restrict
the usage of function declarations to those contexts.

R=adamk
LOG=Y
BUG=v8:4824
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1799233003

Cr-Commit-Position: refs/heads/master@{#34828}
2016-03-16 16:39:23 +00:00
mythria
2fefc4827e [Interpreter] Pops the context to the correct level on return.
We need to pop the context to correct level on return as well. This was incorrectly
removed in this cl: https://codereview.chromium.org/1768123002/. For example
when we have a try-catch-finally block and catch does a return, the return
does not happen immediately. It should execute finally block before it
returns. Return statement should pop the context to the correct level as
expected by finally block.

BUG=594369,v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1796893002

Cr-Commit-Position: refs/heads/master@{#34822}
2016-03-16 15:52:53 +00:00
jkummerow
84dd29bb3c Fix polymorphic keyed load handler selection for string elements
The monomorphic case already carefully ensures that we don't try to use
a regular elements load stub on string wrapper elements. The polymorphic
path must perform an equivalent check.

BUG=chromium:594955
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1806543002

Cr-Commit-Position: refs/heads/master@{#34807}
2016-03-16 10:56:16 +00:00
machenbach
7f363d5d47 [test] Remove feature to mark flaky tests.
The feature was removed from the bots a while ago. It was
superseeded by the flaky-test detection which reruns tests.

Remaining tests still marked as flaky most certainly pass
since a while.

Referencing all the bugs whose expectations lines get
removed by this.

BUG=v8:3838,v8:3525,v8:3125
LOG=n

Review URL: https://codereview.chromium.org/1802983002

Cr-Commit-Position: refs/heads/master@{#34804}
2016-03-16 07:35:47 +00:00
adamk
108efd7f54 Remove Scope::scope_contains_with_ bit
This part of Scope has existed since V8's initial check in, but from what
I can tell it's not required to implement "with". The only tests that
depend upon it are tests of the debugger and the Scope mirrors, but the
resulting test behavior after removing the bit still seems perfectly
reasonable to me. In fact, with the included fix for scope name collection,
the scope mirror is actually improved with this change.

As a bi-product, this fixes the attached bug, about the contains_with
bit having inconsistent values in some arrow function compilation
scenarios.

BUG=chromium:592353
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1804783002

Cr-Commit-Position: refs/heads/master@{#34802}
2016-03-15 22:41:59 +00:00
littledan
80b1b2a45b Put RegExp js code in strict mode
src/js/regexp.js was one of the few files that was left in sloppy
mode. The ES2017 draft specification requires that writes to
lastIndex throw when the property is non-writable, and test262
tests enforce this behavior. This patch puts that file in strict
mode.

BUG=v8:4504
R=yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1776883005

Cr-Commit-Position: refs/heads/master@{#34801}
2016-03-15 22:27:09 +00:00
cbruni
96a2bd8ae8 [builtins] Fix Array.prototype.concat bug
Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y

Review URL: https://codereview.chromium.org/1804963002

Cr-Commit-Position: refs/heads/master@{#34798}
2016-03-15 20:29:28 +00:00
jyan
3b5e84ab0e S390: Initial test changes and files checkin.
R=danno@chromium.org,jkummerow@chromium.org,jochen@chromium.org,joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,mbrandy@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1805533002

Cr-Commit-Position: refs/heads/master@{#34795}
2016-03-15 18:09:36 +00:00
rmcilroy
6cfa6c7108 [Interpreter] Add two skips back for a flaky test and failure on msan.
BUG=v8:4680
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1801033002

Cr-Commit-Position: refs/heads/master@{#34788}
2016-03-15 13:21:04 +00:00
yangguo
d0d73999a1 [interpreter, debugger] fix remaining cctest failures.
R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1802903002

Cr-Commit-Position: refs/heads/master@{#34781}
2016-03-15 11:01:09 +00:00
machenbach
ecc70d69d4 [Ignition] Skip tests.
BUG=v8:4280
LOG=n
TBR=rmcilroy@chromium.org, mstarzinger@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1804013002

Cr-Commit-Position: refs/heads/master@{#34774}
2016-03-15 10:25:42 +00:00
machenbach
1f33d80292 [Ignition] Skip tests.
BUG=v8:4280
LOG=n
TBR=rmcilroy@chromium.org, mstarzinger@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1797203002

Cr-Commit-Position: refs/heads/master@{#34773}
2016-03-15 10:05:14 +00:00
machenbach
6d44d1db66 [Ignition] Skip tests.
BUG=v8:4280
LOG=n
TBR=rmcilroy@chromium.org, mstarzinger@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1799423004

Cr-Commit-Position: refs/heads/master@{#34772}
2016-03-15 09:27:45 +00:00
yangguo
3c1dc424d3 [ignition, debugger] correctly set position for return with elided bytecode.
We may not emit bytecode for the evaluation of the to-be-returned
expression. In that case we cannot set two return positions for a return
statement (one before and one after the expression evaluation). This
sets the interpreter apart from full-codegen.

Make sure that we always have the second of the two return positions.

Note that we end up with separate test cases for ignition and FCG.

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1801473003

Cr-Commit-Position: refs/heads/master@{#34771}
2016-03-15 08:28:03 +00:00
adamk
5a202cce6e Remove --harmony-modules flag and let embedder decide when modules are used
Modules already have a separate entrypoint into the engine (at the moment,
this is v8::ScriptCompiler::CompileModule, though that will change to
something like ParseModule). This meant that requiring a commandline flag
simply added an extra complexity burden on embedders. By removing the v8
flag, this lets embedders use their own flagging mechanism (such as d8's
"--module", or Blink's RuntimeEnabledFeatures) to control whether
modules are to be used.

Also remove old modules tests that were being skipped (since they test
very old, pre-ES2015 modules syntax).

R=littledan@chromium.org
BUG=v8:1569, chromium:594639
LOG=y

Review URL: https://codereview.chromium.org/1804693002

Cr-Commit-Position: refs/heads/master@{#34764}
2016-03-15 00:45:00 +00:00
bradnelson
ace6f1364a Fixing +fround(x) in asm typer.
The rules for handling foreign functions were interfering with handling
of standard functions (such as fround).

Adding more tests around abs()

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1794303002

Cr-Commit-Position: refs/heads/master@{#34756}
2016-03-14 17:29:25 +00:00
caitpotter88
3088979d5c [runtime] fix getting element keys from SLOW_SLOPPY_ARGUMENTS_ELEMENTS
BUG=v8:4825
LOG=N
R=jkummerow@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1778023004

Cr-Commit-Position: refs/heads/master@{#34754}
2016-03-14 17:10:50 +00:00