AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
12,272 Commits 1 Branch 0 Tags 839 MiB
439a425676
Commit Graph

1065 Commits

Author SHA1 Message Date
verwaest@chromium.org
df57747fc4 Track heap objects. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14996004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14625 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-10 17:17:50 +00:00
verwaest@chromium.org
52008429b7 Use mutable heapnumbers to store doubles in fields. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14850006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-08 15:02:08 +00:00
verwaest@chromium.org
154719e8b3 Support merging with distinct attributes. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14756012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-08 14:40:36 +00:00
verwaest@chromium.org
abc0c2767e Always generalize all representations when no transition is inserted. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14696016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-08 14:19:48 +00:00
dslomov@chromium.org
b15bbfbe39 Implement TypedArray.set function. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/14581005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-07 14:42:17 +00:00
verwaest@chromium.org
0b1a9c9e3d Free up 11 bits in fast-mode PropertyDetails by removing the enumeration-index. 
The descriptors are nowadays ordered in order of addition, so that info was
duplicated.

Review URL: https://chromiumcodereview.appspot.com/14622005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-07 13:09:23 +00:00
verwaest@chromium.org
84fd96e4d1 Cleanup IC heuristics. 
Review URL: https://chromiumcodereview.appspot.com/14611006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-02 15:42:22 +00:00
verwaest@chromium.org
063ada2050 Adding fast path for generalizing maps. 
Review URL: https://chromiumcodereview.appspot.com/14629005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-02 15:41:02 +00:00
verwaest@chromium.org
fd9c82a618 Update deprecated maps before generating optimized code. 
Review URL: https://chromiumcodereview.appspot.com/14847008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-02 15:40:07 +00:00
mvstanton@chromium.org
6e4a8fecb7 Two bugfixes for hydrogen-based array constructors 
CacheInitialJSArrayMaps needs to be able to pick up where it left off,
as it can now be called from a handlfied context.

Disable incremental marking for CCTest SetJitCodeEventHandler, as it allocates
during compilation.

BUG=

Review URL: https://codereview.chromium.org/14642002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-30 13:43:45 +00:00
dslomov@chromium.org
3fd6bb51f0 First cut at API for native Typed Arrays. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/14195034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-29 11:09:03 +00:00
verwaest@chromium.org
99e17bb12a Track storage types of instance variables. 
Review URL: https://chromiumcodereview.appspot.com/14146005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 15:30:41 +00:00
dcarney@chromium.org
0a32b57594 HasOnlyAsciiChars can return incorrect results. Fixup usages and rename. 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14509012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 11:34:44 +00:00
mvstanton@chromium.org
c247ac4e51 Bootstrapper code for constructed arrays needs to be handlefied 
BUG=

Review URL: https://codereview.chromium.org/14008004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14451 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 10:10:36 +00:00
mvstanton@chromium.org
e751ad06d9 Constructed arrays can be created with Hydrogen code stubs. The feature is still off by default (--optimize-constructed-arrays). 
BUG=

Review URL: https://codereview.chromium.org/12385014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-25 16:00:32 +00:00
mstarzinger@chromium.org
a4ba7d6b65 Fix evaluation order problems in Object.observe hooks. 
R=rossberg@chromium.org
TEST=gcmole

Review URL: https://codereview.chromium.org/14493012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-25 10:23:19 +00:00
yangguo@chromium.org
d1df0e631d Clean up VMState a little bit. 
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/14139033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14421 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-24 14:44:08 +00:00
danno@chromium.org
f8ddf3a262 Add monomorphic CompareNilICs and Crankshaft support 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/14367018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-24 11:32:17 +00:00
yangguo@chromium.org
28bbe46a98 Disallow dereferencing deferred handles when generating optimized code. 
R=mvstanton@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/14403015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-23 09:23:07 +00:00
verwaest@chromium.org
6ada4790b7 Ensure callbacks transitions are actually followed. 
Review URL: https://chromiumcodereview.appspot.com/14371007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-22 14:46:55 +00:00
ulan@chromium.org
dcb3c6301b Propagate OOM exception instead of crashing in CALL_HEAP_FUNCTION_PASS_EXCEPTION macro. 
R=jkummerow@chromium.org
BUG=webkit/fast/js/concat-large-strings-crash.html

Review URL: https://chromiumcodereview.appspot.com/14365017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-19 15:55:34 +00:00
danno@chromium.org
bc04544f02 Replace math.h with cmath 
This will make it easier to use other STL headers in the future

Review URL: https://codereview.chromium.org/14362023

Patch from Jochen Eisinger <jochen@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14352 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-19 13:26:47 +00:00
ulan@chromium.org
1938b1de3b Handle retry-after-gc failures within LoadIC::Load and StoreIC::Store. 
Follow-up for r14321, makes the remaining unsafe calls to runtime functions during ic computation safe.

R=verwaest@chromium.org
BUG=222301

Review URL: https://chromiumcodereview.appspot.com/13976015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-19 08:30:49 +00:00
danno@chromium.org
244fa50a80 Make it possible to Crankshaft all kinds of stubs. 
Review URL: https://codereview.chromium.org/14307006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-18 09:50:46 +00:00
dslomov@chromium.org
c1a19275d3 First cut at impementing ES6 TypedArrays in V8. 
BUG=

Review URL: https://codereview.chromium.org/13975012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-16 14:16:30 +00:00
jkummerow@chromium.org
586c4e74b6 Replace OS::MemCopy with OS::MemMove (just as fast but more flexible). 
Review URL: https://codereview.chromium.org/13932006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-16 12:30:51 +00:00
mstarzinger@chromium.org
591a8ec86c Calling a generator function returns a generator object 
* src/heap.h:
* src/heap.cc:
* src/objects-debug.cc:
* src/objects-inl.h:
* src/objects-printer.cc:
* src/objects-visiting.cc:
* src/objects.cc:
* src/objects.h: Define a new object type, JSGeneratorObject.

* src/factory.h:
* src/factory.cc (NewFunctionFromSharedFunctionInfo): Generator function
  inital maps construct the new JS_GENERATOR_OBJECT_TYPE objects, not
  generic JSObjects.

* src/runtime.h:
* src/runtime.cc (Runtime_CreateJSGeneratorObject):
* src/arm/full-codegen-arm.cc (Generate):
* src/ia32/full-codegen-ia32.cc (Generate):
* src/x64/full-codegen-x64.cc (Generate): Before visiting generator
  bodies, arrange to construct and return a generator object.

* test/mjsunit/harmony/generators-objects.js: Add tests for the
  properties and prototype of generator objects.

BUG=v8:2355
TEST=mjsunit/harmony/generators-objects

Review URL: https://codereview.chromium.org/13542002

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-15 12:29:44 +00:00
rossberg@chromium.org
8e8bbc0e6c * src/generator.js: Add methods and intialization for generator meta-objects. 
* src/contexts.h:
* src/bootstrapper.cc (InitializeExperimentalGlobal): Make generator
  meta-objects, and store maps for constructing generator functions
  and their prototypes.

* src/factory.h:
* src/factory.cc (MapForNewFunction): New helper.
  (NewFunctionFromSharedFunctionInfo): Use the new helper.

* src/heap.cc (AllocateFunctionPrototype, AllocateInitialMap): For
   generators, allocate appropriate prototypes and maps.

* src/code-stubs.h:
* src/arm/code-stubs-arm.h:
* src/arm/full-codegen-arm.h:
* src/ia32/code-stubs-ia32.h:
* src/ia32/full-codegen-ia32.h:
* src/x64/code-stubs-x64.h:
* src/x64/full-codegen-x64.h: Allow fast closure creation for generators,
using the appropriate map.

* test/mjsunit/harmony/builtins.js: Add a special case for
  GeneratorFunctionPrototype.prototype.__proto__.

BUG=
TEST=mjsunit/harmony/generators-runtime

Review URL: https://codereview.chromium.org/13192004

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-11 16:28:19 +00:00
yangguo@chromium.org
996a80df45 Fix OSR for nested loops. 
R=jkummerow@chromium.org
BUG=v8:2618

Review URL: https://chromiumcodereview.appspot.com/13811014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-10 09:24:31 +00:00
yangguo@chromium.org
cba3446d41 Use PrintF instead of fprintf. 
R=sven@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13811020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14200 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-10 09:18:41 +00:00
verwaest@chromium.org
64f34cb761 Eagerly parse expected transitions in JSON. 
Review URL: https://chromiumcodereview.appspot.com/13741010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 16:49:28 +00:00
adamk@chromium.org
759f4b37ce Remove code duplication in JSObject::HasRealElementProperty 
Review URL: https://codereview.chromium.org/13540003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 19:12:59 +00:00
mstarzinger@chromium.org
489135d632 Switch transition zapping to slower version. 
This is just an experiment to track down high crash rates on some
systems where third-party software corrupts memory regions.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/13630002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14134 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 10:52:53 +00:00
rossberg@chromium.org
b449691db2 ES6 symbols: fix corner cases of equality operators 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13552002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 17:06:22 +00:00
hpayer@chromium.org
2545774232 Move DeepCopy of JSObject from runtime to object. 
BUG=

Review URL: https://codereview.chromium.org/13527005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14121 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 11:42:03 +00:00
dslomov@chromium.org
a23868fb44 Fix CopyBytes to accept size_t for num_bytes 
BUG=

Review URL: https://codereview.chromium.org/13470008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14114 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-02 13:29:26 +00:00
dslomov@chromium.org
944c577c7b First steps towards implementing ArrayBuffer &co in V8 
BUG=

Review URL: https://codereview.chromium.org/13064003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 12:50:18 +00:00
rossberg@chromium.org
15ab3a0612 ES6 symbols: symbol properties should not cause going into slow mode. 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13042013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 12:01:46 +00:00
yangguo@chromium.org
bdc903b086 Improve SeqString::Truncate for latest allocated strings. 
R=hpayer@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12440061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14088 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 11:19:38 +00:00
rossberg@chromium.org
52aec4722d ES6 symbols: prevent reflection, proxy, and observe APIs from leaking symbols 
R=svenpanne@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12422019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 17:27:44 +00:00
rossberg@chromium.org
2657e432e4 ES6 symbols: implement name property 
Adds string-valued name property to symbols, and uses it for pretty-printing.

Requires allocating symbols in pointer space, with a custom iterator to skip the unboxed hash.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12459026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 16:51:28 +00:00
rossberg@chromium.org
83d4a41dec ES6 symbols: turn symbols into a proper primitive type 
(qua last week's TC39)

Specifically:
- Install Symbol constructor function on the global object.
- Adjust code generation for typeof.
- Remove IsSymbol built-in, IS_SYMBOL macro now defined using typeof.
- Remove hack that allowed symbols as constructor results, and some other special cases.
- Remove symbol_delegate and GetDelegate function.
- Extend ToBoolean stub to handle symbols.
- Extend ToNumber to return NaN on symbols.
- Poison symbol's toString function, and thereby ToString on symbols.

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12957004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 16:33:50 +00:00
mstarzinger@chromium.org
788de160c5 Remove instrumentation for Code::CopyFrom crasher. 
R=jkummerow@chromium.org
BUG=chromium:196330

Review URL: https://codereview.chromium.org/12606009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14021 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-21 10:36:57 +00:00
mstarzinger@chromium.org
5d5ca10d24 Use internal memcpy when initializing code objects. 
R=jkummerow@chromium.org
BUG=chromium:196330

Review URL: https://codereview.chromium.org/12593014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14011 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-20 16:53:31 +00:00
mstarzinger@chromium.org
c5c5d35967 Add more instrumentation for Code::CopyFrom crasher. 
R=jkummerow@chromium.org
BUG=chromium:196330

Review URL: https://codereview.chromium.org/12937004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13991 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-19 16:48:45 +00:00
mstarzinger@chromium.org
291450547e Add instrumentation to track down Code::CopyFrom crasher. 
R=jkummerow@chromium.org
BUG=chromium:196330

Review URL: https://codereview.chromium.org/12916005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 14:31:21 +00:00
svenpanne@chromium.org
e4e4447305 Pass Isolates explicitly in Deoptimizer-related code. 
Removed a few ancient useless ASSERTs on the way. Reduced the number of train wrecks.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12917002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 13:57:49 +00:00
dcarney@chromium.org
9b4650e903 remove maynamedaccess checks 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12822002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13932 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-13 13:14:25 +00:00
danno@chromium.org
cfb957af15 Use IsRuntimeEntry for RUNTIME_ENTRY comparison 
Review URL: https://codereview.chromium.org/12702005
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-13 11:40:26 +00:00
yangguo@chromium.org
479e39a058 Parallel recompilation: remove interrupt for code generation. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12488006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 18:03:18 +00:00
svenpanne@chromium.org
1a2454d752 Consistently pass a Heap* to HashTable-related AsObject methods. 
This is basically a follow-up CL to https://code.google.com/p/v8/source/detail?r=13908.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12546024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 10:05:42 +00:00
svenpanne@chromium.org
e02315ef77 Added an Isolate parameter to some HashTable/Dictionary methods. TypeFeedbackOracle tweaks. 
BUG=v8:2487

Review URL: https://codereview.chromium.org/12764003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 07:06:36 +00:00
danno@chromium.org
8dc25d2b29 Use direct jump and call instruction for X64 when the deoptimization entries are in the code range. 
Review URL: https://codereview.chromium.org/11574027
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 14:11:03 +00:00
danno@chromium.org
19badfdda5 Revert r13901 to reland with proper credit to external contributor. 
TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/12638011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 14:09:21 +00:00
danno@chromium.org
d616baed77 Use direct jump and call instruction for X64 when the deoptimization entries are in the code range. 
Review URL: https://codereview.chromium.org/11574027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 14:05:49 +00:00
yangguo@chromium.org
5afa1a0d3a Avoid bool to Oddball conversions by being lazy. 
R=svenpanne@chromium.org
BUG=v8:2491

Review URL: https://chromiumcodereview.appspot.com/12459011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 16:22:19 +00:00
dcarney@chromium.org
da814adfeb fix uninitialized variable 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12566004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13861 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 14:01:42 +00:00
dcarney@chromium.org
25058ddd85 Runtime version of declarative native accessors. 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12297012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 11:42:58 +00:00
rossberg@chromium.org
bdc65b3e1e ES6 symbols: filter symbols form for-in loops and Object.keys 
R=verwaest@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12455002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-06 13:55:21 +00:00
verwaest@chromium.org
34697f5b12 Make IC patching resilient to flushing of the original target() ic. 
Review URL: https://chromiumcodereview.appspot.com/12451003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 17:38:35 +00:00
rossberg@chromium.org
5c93b18eb2 ES6 symbols: Allow symbols as property names 
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).

Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.

(Baseline CL: https://codereview.chromium.org/12296026/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12330012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 15:00:57 +00:00
verwaest@chromium.org
590a3f8811 Polymorphism support for load IC. 
Review URL: https://chromiumcodereview.appspot.com/12340112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 14:03:27 +00:00
mvstanton@chromium.org
c4caf766bf Allocation Info Tracking, continued. 
Addresses missing cases for array literals.
Adds support for "new Array()" call sites. This isn't complete yet, I have to run with --noinline_new.

BUG=

Review URL: https://codereview.chromium.org/11818021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 16:06:34 +00:00
rossberg@chromium.org
090d09d685 ES6 symbols: Implement Symbol intrinsic and basic functionality 
- Add --harmony-symbols flag.
- Add Symbol constructor; allow symbols as (unreplaced) return value from constructors.
- Introduce %CreateSymbol and %_IsSymbol natives and respective instructions.
- Extend 'typeof' code generation to handle symbols.
- Extend CompareIC with a UNIQUE_NAMES state that (uniformly) handles internalized strings and symbols.
- Property lookup delegates to SymbolDelegate object for symbols, which only carries the toString method.
- Extend Object.prototype.toString to recognise symbols.

Per the current draft spec, symbols are actually pseudo objects that are frozen with a null prototype and only one property (toString). For simplicity, we do not treat them as proper objects for now, although typeof will return "object". Only property access works as if they were (frozen) objects (via the internal delegate object).

(Baseline CL: https://codereview.chromium.org/12223071/)

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12296026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 13:28:55 +00:00
rossberg@chromium.org
764e1a0fcf ES6 symbols: Introduce Symbol class, along with abstract Name class 
The new instance type 'Symbol' represents ES6 symbols (a.k.a. private/unique names). Currently, symbols are simple data objects that only carry a hash code, random-generated upon allocation.

The new type 'Name' now serves as the common super class for strings and symbols, and is supposed to represent property names. We will eventually migrate APIs from String to Name for the standard key type.

Strings and symbols share the same hash field representation, via the Name class. This way, we should be able to use the same code paths for symbols and internalized strings in most cases. Also, Symbol's instance type code is allocated adjacent to internalized string codes in the enum, allowing a simple range check for the common case.

Baseline CL: https://codereview.chromium.org/12210083/

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12223071

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 10:34:31 +00:00
rossberg@chromium.org
55f93b5532 Renamed "symbols" to "internalized strings" throughout the code base, 
in preparation of the introduction of ES6 'symbols' (aka private/unique names).

The SymbolTable became the StringTable. I also made sure to adapt all comments. The only remaining use of the term "symbol" (other than unrelated uses in the parser and such) is now 'NewSymbol' in the API and the 'V8.KeyedLoadGenericSymbol' counter, changing which might break embedders.

The one functional change in this CL is that I removed the former 'empty_string' constant, since it is redundant given the 'empty_symbol' constant that we also had (and both were used inconsistently).

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12210083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-28 17:03:34 +00:00
rossberg@chromium.org
8924d03e16 Minor cleanup of CompareIC state 
Allow transitioning from KNOWN_OBJECT to KNONW_OBJECT or OBJECT.
Also, rename HEAP_NUMBER IC states to NUMBER, since they handle Smis, too.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12254036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-28 14:43:57 +00:00
mstarzinger@chromium.org
ea5e9edac4 Fix materialization of arguments objects with unknown values. 
This fixes the deoptimizer to materialize arguments objects of correct
length even in cases where the actual argument values are unknown and
were optimized away by Crankshaft. This can happen if only the length
property or the identity of an arguments object is used.

R=svenpanne@chromium.org
BUG=chromium:163530
TEST=mjsunit/regress/regress-crbug-163530

Review URL: https://codereview.chromium.org/12335132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 14:37:51 +00:00
svenpanne@chromium.org
c26d100b10 Avoid TLS accesses in Object::Lookup and Object::GetPrototype. 
Both methods were among the top causes for TLS accesses.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12319144

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 13:22:29 +00:00
jkummerow@chromium.org
b3cb955c4f Normalized map copies should not share code caches 
Review URL: https://codereview.chromium.org/12328136

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 12:17:50 +00:00
adamk@chromium.org
deeddc7e76 Remove duplication and unnecessary HandleScope from HasElement helper functions 
Review URL: https://codereview.chromium.org/12328064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13736 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-26 17:20:21 +00:00
mstarzinger@chromium.org
ce1e10f5fc Make __proto__ a foreign callback on Object.prototype. 
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.

The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.

R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262

Review URL: https://codereview.chromium.org/12212011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-26 10:46:00 +00:00
svenpanne@chromium.org
fb6776e84a Made Isolate a mandatory parameter for everything Handle-related. 
Unified parameter order of CreateHandle with the rest of v8 on the way. A few
Isolate::Current()s had to be introduced, which is not nice, and not every place
will win a beauty contest, but we can clean this up later easily in smaller steps.

Review URL: https://codereview.chromium.org/12300018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-25 14:46:09 +00:00
ulan@chromium.org
7dd0b1ca77 Zap holes in dependent code array after deoptimizing a code group. 
BUG=crash on GC stress builder

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12315077

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-25 12:27:28 +00:00
ulan@chromium.org
3a1eca4242 Remove prototype checks for leaf maps in optimized code. 
Review URL: https://chromiumcodereview.appspot.com/12225099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-20 11:49:54 +00:00
svenpanne@chromium.org
71a26c928a Make the Isolate parameter mandatory for internal HandleScopes. 
Improved Frames and their iterators on the way, too.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12254007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13674 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-15 09:27:10 +00:00
dcarney@chromium.org
0da6e525b7 Split AccessorInfo into DeclaredAccessorInfo and ExecutableAccessorInfo 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12213012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-12 14:33:08 +00:00
danno@chromium.org
a77daae9f8 Add additional flags to control array abuse tracing 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12211095

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-08 14:32:38 +00:00
danno@chromium.org
9cb3a2e97d Add --trace-array-abuse to help find OOB accesses. 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/12220040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-07 07:56:11 +00:00
adamk@chromium.org
dbf50cf948 Object.observe: change array truncation logic to efficiently handle large sparse arrays 
Review URL: https://codereview.chromium.org/12041084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-04 21:03:08 +00:00
ulan@chromium.org
744d61ebe7 Fix clearing of dead dependent codes and verify weak embedded maps on full GC. 
BUG=172488,172489
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12094036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-04 10:56:50 +00:00
verwaest@chromium.org
672056ac88 Only mark the descriptor that is valid for the map in question. If this map 
transitioned from a map with a different descriptor array (or has no back
pointer), mark all valid descriptors from the start.

This fixes the following memory leak: Map A shares a descriptor array
with map B. Map B adds constant function c that in its scope holds on to
an instance of B. If the descriptor array of A would keep all the shared
descriptors alive, including c, this keeps alive both A and c
indefinitely.

This CL also fixes a bug in descriptor array trimming. When trimming
descriptor arrays we need to trim off the slack as well (thus the entire
storage); and since we are trimming a descriptor array, we need to trim
* kDescriptorSize.

Review URL: https://chromiumcodereview.appspot.com/12084066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-31 10:50:42 +00:00
adamk@chromium.org
c001d928df Object.observe: don't unnecessarily emit oldValue for reconfigurations of data properties 
When a data property has its attributes changed but its value remains the same,
don't emit an oldValue. This makes the API more consistent by only emitting
oldValue when the value of a property has actually changed (or been removed,
in the case of a reconfiguration as an accessor property or a deletion).

Review URL: https://codereview.chromium.org/11820004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-30 21:07:28 +00:00
verwaest@chromium.org
e7420f65bc Also allow the empty object map to keep transitions. 
With the old implementation, due to the map-check being inadequate, such
transitions were already added for cross-context field stores. It is not
necessary anymore to not store transitions, since we properly clear
non-live transitions. Globally enabling this feature will help find more
bugs.

BUG=v8:2518
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12092063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13558 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-30 15:07:58 +00:00
ulan@chromium.org
e6224d275f Make embedded maps in optimized code weak. 
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-24 11:55:05 +00:00
mvstanton@chromium.org
7884216804 Additional work to get array literal allocation tracking working, even with --always-opt 
BUG=

Review URL: https://codereview.chromium.org/11817017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-17 08:41:27 +00:00
verwaest@chromium.org
36a26b5394 Separate MEGAMORPHIC and GENERIC ic states 
Review URL: https://chromiumcodereview.appspot.com/11824063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-16 15:02:58 +00:00
svenpanne@chromium.org
b5e4485a34 Add some runtime checks to MayNamedAccess 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11877027
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-16 08:54:04 +00:00
mstarzinger@chromium.org
b93b2b98b8 Fix shared function info code replacement. 
This fixes a corner case when the unoptimized code for a shared function
info is replaced while the function is enqueued as a flushing candidate.
Since the link field is stored within the code object, the candidates
list got destroyed.

R=hpayer@chromium.org
BUG=v8:169209
TEST=cctest/test-heap/Regress169209

Review URL: https://codereview.chromium.org/11818052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-11 13:13:11 +00:00
verwaest@chromium.org
7cb764b780 Combine DEBUG_BREAK and DEBUG_PREPARE_STEP_IN into one IC stub kind DEBUG_STUB, encoding DEBUG_BREAK and DEBUG_PREPARE_STEP_IN as extra ic state. 
Review URL: https://chromiumcodereview.appspot.com/11821049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13352 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-10 14:15:12 +00:00
yangguo@chromium.org
e41c17084f Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag. 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 15:47:53 +00:00
jkummerow@chromium.org
aee9febccc Some more instrumentation to narrow down Failure leaks. 
The basic idea is to tag OOM-Failure objects with an ID indicating where they were created. This requires changes to equality comparisons.

Note to MIPS folks: I'm planning to revert this CL in a couple of days, so feel free to skip porting the platform-specific changes.

BUG=chromium:156010

Review URL: https://codereview.chromium.org/11818023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 12:29:06 +00:00
yangguo@chromium.org
45f20e366a Introduce ENABLE_LATIN_1 compile flag 
Mostly a bunch of renaming when flag is disabled.

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 10:30:54 +00:00
mvstanton@chromium.org
467b75208f Test fix: missing check for JSArray. 
BUG=

Review URL: https://codereview.chromium.org/11801036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-08 10:22:12 +00:00
mvstanton@chromium.org
529f801fde Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array, 
we store an AllocationSiteInfo object right after the JSArray, with a pointer to the
boilerplate object. Later, if the array transitions we check for the continued existence
of the temporary AllocationSiteInfo object (has no roots). If found, we'll use it to
transition the boilerplate array as well.

Danno's original changeset: https://codereview.chromium.org/10615002/

Review URL: https://codereview.chromium.org/11663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-08 09:03:16 +00:00
verwaest@chromium.org
50d82ca796 Introduce POLYMORPHIC 
Review URL: https://chromiumcodereview.appspot.com/11747022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13329 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-07 15:36:26 +00:00
yangguo@chromium.org
61f4012989 Use C++ style type casts. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11644097

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-07 15:02:56 +00:00
yangguo@chromium.org
4ee20d857b Check for read-only-ness when preparing for array sort. 
R=verwaest@chromium.org
BUG=v8:2419

Review URL: https://chromiumcodereview.appspot.com/11759022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-04 15:24:47 +00:00
yangguo@chromium.org
04ccb975f4 Remove InputBuffer 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11727004
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-03 09:18:01 +00:00
verwaest@chromium.org
537d1d89b0 Move CopyElements to the accessor of the target. 
Review URL: https://chromiumcodereview.appspot.com/11416238

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-02 10:09:42 +00:00
yangguo@chromium.org
bccef0c712 Reland r13275 and 13276 (Remove most uses of StringInputBuffer). 
R=dcarney@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11727003
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13291 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-31 11:13:50 +00:00
yangguo@chromium.org
121f3f6020 Revert r13275 and 13276 (Remove most uses of StringInputBuffer). 
This is due to test failures in test-mark-compact/BootUpMemoryUse.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11688003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-27 10:03:17 +00:00
yangguo@chromium.org
6e6140728b Fix build warnings. 
TBR=dcarney@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11669020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13276 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-24 08:52:32 +00:00
yangguo@chromium.org
7f074acd8d Remove most uses of StringInputBuffer 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11638037
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-24 08:29:48 +00:00
svenpanne@chromium.org
3cff9a2a4a Refactored deopt tracing and FindOptimizedCode. Fixed a bug when printing stubs. 
Review URL: https://codereview.chromium.org/11636046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-21 07:18:56 +00:00
svenpanne@chromium.org
9b00a57a92 Refactoring only: Extracted method to print deopt location. 
Review URL: https://codereview.chromium.org/11640041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13251 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 11:53:42 +00:00
yangguo@chromium.org
eedcaf1866 Remove Utf8InputBuffer 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11649018
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13248 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 09:20:37 +00:00
rossberg@chromium.org
75dac95604 Fix treatment of hidden prototypes in SetProperty. 
R=svenpanne@chromium.org
BUG=v8:2457

Review URL: https://codereview.chromium.org/11644021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 15:17:01 +00:00
yangguo@chromium.org
9569b20db2 Replace the use CharacterStreams in Heap::AllocateSymbolInternal and String::ComputeHash 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11593007
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 13:27:20 +00:00
danno@chromium.org
1f4b4625ff Re-land Crankshaft-generated KeyedLoad stubs. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11528003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-18 16:25:45 +00:00
yangguo@chromium.org
19a6575ea3 Rename LookupSymbol calls to use Utf8 or OneByte in names. 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11597007
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-17 15:56:16 +00:00
rossberg@chromium.org
fb5a5e22ec Object.observe: Make array length and other magic data properties work correctly. 
Also, disable TestFastElementsLength test for now, since it flakes on buildbots for yet unknown reasons.

R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11554019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-13 09:31:44 +00:00
rossberg@chromium.org
76375de29d Object.observe: prevent observed objects from using fast elements. 
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.

R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11477006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-12 11:38:24 +00:00
mstarzinger@chromium.org
4e42a3295a Clear optimized code map during incremental marking. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11458011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 17:28:40 +00:00
mstarzinger@chromium.org
ca3ea142be Fix missing printing of deoptimizer input data. 
R=rossberg@chromium.org
TEST=mjsunit/compiler/inline-arguments --print-all-code

Review URL: https://codereview.chromium.org/11537005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13192 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 12:19:19 +00:00
yangguo@chromium.org
f02af74575 Cleanup StringCharacterStream and add initial test cases. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11438046
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 10:22:15 +00:00
danno@chromium.org
64fc1f99cb Revert 13157, 13145 and 13140: Crankshaft code stubs. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11498006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 11:09:12 +00:00
rossberg@chromium.org
9a0623f296 Object.observe support for Function 'prototype' property 
BUG=v8:2409

Review URL: https://codereview.chromium.org/11416353
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 10:53:57 +00:00
rossberg@chromium.org
4d73627313 Handlify JSObject::SetDictionaryElement, which may call back into JS. 
Fixes flaky crasher in proxies.js test.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11471028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-07 12:58:09 +00:00
yangguo@chromium.org
a2d0b05a11 Add StringBufferStream 
add a class StringBufferStream which will replace
StringInputBuffer and SafeStringInputBuffer and requires no
ascii/two byte encoding scheme

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11428106
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-06 11:49:15 +00:00
yangguo@chromium.org
c75ca45000 Improve array to string conversion. 
BUG=v8:2435

Review URL: https://chromiumcodereview.appspot.com/11348349

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 15:49:22 +00:00
rossberg@chromium.org
6b16d0bcae Make Object.observe on the global object functional 
The approach in this change is to handle the unwrapping/wrapping of the global object transparently with respect to the JS implementation of Object.observe. An alternate approach would be to add a runtime method like %IsJSGlobalProxy and %UnwrapJSGlobalProxy, but it seems ugly to give JS (even implementation JS) access to the unwrapped global.

BUG=v8:2409

Review URL: https://codereview.chromium.org/11414094
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 12:03:57 +00:00
danno@chromium.org
f19959cd22 Enable stub generation using Hydrogen/Lithium (again) 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Committed: https://code.google.com/p/v8/source/detail?r=13105

Committed: https://code.google.com/p/v8/source/detail?r=13117

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 11:04:10 +00:00
yangguo@chromium.org
e6d4b7709f Remove some dead code. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11412322

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-04 15:30:22 +00:00
danno@chromium.org
9598ccd851 Remove extraneous forced rejuvenations in code aging 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/11421219

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-04 08:58:59 +00:00
danno@chromium.org
66f6a8182c Revert 13117: "Enable stub generation using Hydrogen/Lithium (again)" 
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/11415261

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-03 17:16:51 +00:00
danno@chromium.org
78b09625d5 Enable stub generation using Hydrogen/Lithium (again) 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Committed: https://code.google.com/p/v8/source/detail?r=13105

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-03 15:51:05 +00:00
rossberg@chromium.org
45f42b04c1 When notifying observers of a truncated array, don't call getters on deleted element indices 
BUG=v8:2409

Review URL: https://codereview.chromium.org/11414177

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-03 13:34:08 +00:00
danno@chromium.org
0a3bcc8c05 Revert 13105: "Enable stub generation using Hydrogen/Lithium." 
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11414262

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-30 17:45:45 +00:00
danno@chromium.org
c115ff4e33 Enable stub generation using Hydrogen/Lithium. 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13105 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-30 17:31:30 +00:00
danno@chromium.org
5a40f006f9 Remove unused private member variables found by clang -Wunused-private-field 
Review URL: https://codereview.chromium.org/11414207
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-29 15:13:49 +00:00
svenpanne@chromium.org
5a4e0f1c79 Simplify and fix code aging. 
Making the code size predictable is hard, and to make things even more
complicated, the start of a function can contain various stuff like calls to a
profiling hook, receiver adjustment or dynamic frame alignment. Instead of
tackling all these problems separately, we now simply record the offset where
patching should happen later in the Code object itself.

Review URL: https://codereview.chromium.org/11316218

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13081 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-29 07:38:00 +00:00
vegorov@chromium.org
18d987e505 Relax restrictions on CONSTANT_FUNCTION descriptors in TransformPropertiesToFastFor. 
Since r10174 they are not required to be in new space.

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11418181

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-28 14:02:30 +00:00
verwaest@chromium.org
e4be39edef Properly handle-ify method calls to map() and GetLocalElementAccessorPair() 
These are likely causing some of the flaky crashes in Object.observe code. I've reorganized some of the code to minimize the number of necessary calls to map() (by saving the result of map()->is_observed() in a local bool).

Also move down an unnecessarily early call to Uint32ToString when sending an element deletion notification.

Review URL: https://chromiumcodereview.appspot.com/11316202

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-28 08:35:46 +00:00
verwaest@chromium.org
1b0e373f09 Avoid double initialization of arrays. 
Review URL: https://chromiumcodereview.appspot.com/11413179

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-27 12:01:14 +00:00
rossberg@chromium.org
93579d9d3e Make indexed intercepted methods enumerable by default. 
R=ulan@chromium.org
BUG=162606

Review URL: https://codereview.chromium.org/11348222

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-26 12:55:47 +00:00
verwaest@chromium.org
2c1ac55213 - Initialize the result array with holes if we concat a double array into an object array, since it may cause a marking step while boxing a double. 
- Ensure we go holey if we are concatting any holey array.

Review URL: https://chromiumcodereview.appspot.com/11413142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-22 16:22:57 +00:00
rossberg@chromium.org
ce05280bfc Get rid of static module allocation, do it in code. 
Modules now have their own local scope, represented by their own context.
Module instance objects have an accessor for every export that forwards
access to the respective slot from the module's context. (Exports that are
modules themselves, however, are simple data properties.)

All modules have a _hosting_ scope/context, which (currently) is the
(innermost) enclosing global scope. To deal with recursion, nested modules
are hosted by the same scope as global ones.

For every (global or nested) module literal, the hosting context has an
internal slot that points directly to the respective module context. This
enables quick access to (statically resolved) module members by 2-dimensional
access through the hosting context. For example,

  module A {
    let x;
    module B { let y; }
  }
  module C { let z; }

allocates contexts as follows:

[header| .A | .B | .C | A | C ]  (global)
          |    |    |
          |    |    +-- [header| z ]  (module)
          |    |
          |    +------- [header| y ]  (module)
          |
          +------------ [header| x | B ]  (module)

Here, .A, .B, .C are the internal slots pointing to the hosted module
contexts, whereas A, B, C hold the actual instance objects (note that every
module context also points to the respective instance object through its
extension slot in the header).

To deal with arbitrary recursion and aliases between modules,
they are created and initialized in several stages. Each stage applies to
all modules in the hosting global scope, including nested ones.

1. Allocate: for each module _literal_, allocate the module contexts and
   respective instance object and wire them up. This happens in the
   PushModuleContext runtime function, as generated by AllocateModules
   (invoked by VisitDeclarations in the hosting scope).

2. Bind: for each module _declaration_ (i.e. literals as well as aliases),
   assign the respective instance object to respective local variables. This
   happens in VisitModuleDeclaration, and uses the instance objects created
   in the previous stage.
   For each module _literal_, this phase also constructs a module descriptor
   for the next stage. This happens in VisitModuleLiteral.

3. Populate: invoke the DeclareModules runtime function to populate each
   _instance_ object with accessors for it exports. This is generated by
   DeclareModules (invoked by VisitDeclarations in the hosting scope again),
   and uses the descriptors generated in the previous stage.

4. Initialize: execute the module bodies (and other code) in sequence. This
   happens by the separate statements generated for module bodies. To reenter
   the module scopes properly, the parser inserted ModuleStatements.

R=mstarzinger@chromium.org,svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11093074

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-22 10:25:22 +00:00
yangguo@chromium.org
36f5b6d41f Rename IsAsciiRepresentation 
This is a straight rename:

IsAsciiRepresentation -> IsOneByteRepresentation
IsAsciiRepresentationUnderneath -> IsOneByteRepresentationUnderneath
AllocateRawAsciiString -> AllocateRawOneByteString
AllocateStringFromAscii -> AllocateStringFromOneByte

R=yangguo@chromium.org,
BUG=

Review URL: https://chromiumcodereview.appspot.com/11308066
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-21 10:01:05 +00:00
rossberg@chromium.org
0f6d0d28dd Fix and clean up treatment of hidden prototypes. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11413068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-20 12:32:29 +00:00
rossberg@chromium.org
8d79ff46d0 Clean-up refactoring to eliminate GetLocalElementKind. 
Eliminates substantial amounts of fragile code duplication and special casing.

Also fixes "a".propertyIsEnumerable(0) to correctly return true.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11420011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12990 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-16 13:28:34 +00:00
svenpanne@chromium.org
d5f589808d Removed a bunch of GetExistingThreadLocal calls by threading the Isolate. 
For Octane, the number of calls go down from 7341629 to 1947880, i.e. they are
reduced by more than 73%. TLS access is not especially cheap, so this exercise
seems worthwhile.

Review URL: https://codereview.chromium.org/11412007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12979 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-16 08:38:11 +00:00
yangguo@chromium.org
3699616609 Rename SeqAsciiString 
This is a straight rename:

NewRawAsciiString -> NewRawOneByteString
SeqAscii -> SeqOneByte

SeqOneByteString cannot yet take non-ascii data.

R=yangguo@chromium.org,
BUG=

Review URL: https://chromiumcodereview.appspot.com/11411005
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 13:31:27 +00:00
rossberg@chromium.org
4fb992a872 Object.observe: Handle oldValue for elements with accessors properly. 
Extended ElementAccessor interface to allow querying PropertyType and
AccessorPair. Also added respective functionality to JSObject.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358234

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12967 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 11:31:40 +00:00
rossberg@chromium.org
5e7b796479 Object.observe: Move notification of JSArray length changes to JSArray::SetElementsLength 
The previous implementation in Accessors::ArraySetLength failed when array length was set through StoreIC_ArrayLength. But that stub and the accessor both delegate to JSArray::SetElementsLength, so moving the code there allows notifications to be sent in both cases.

Review URL: https://codereview.chromium.org/11275292
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 16:51:21 +00:00
jkummerow@chromium.org
1c086d1202 Lattice-based representation inference, powered by left/right specific type feedback for BinaryOps and comparisons 
Review URL: https://chromiumcodereview.appspot.com/10837165

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 15:59:45 +00:00
rossberg@chromium.org
dcb6abd460 Restructure JSObject::SetElement for performance. 
Wins back ~1500 points on Octane/Gameboy that we lost with
https://codereview.chromium.org/11365111 (CL 12900), presumably
by lowering register pressure and/or handlification overhead.
Hopefully benefits other regressions as well.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11275283

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 15:47:46 +00:00
mmassi@chromium.org
ce682a2489 Allow property indexes to refer to slots inside the object header. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11365221

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12944 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 11:07:04 +00:00
svenpanne@chromium.org
073dfc0a6f Fixed Code::FindCodeAgeSequence logic, removing a dead method on the way. 
Review URL: https://codereview.chromium.org/11364177

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 13:27:36 +00:00
rossberg@chromium.org
92e783bc28 Minor cleanup and optimisation of element methods. 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11365175

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 11:08:34 +00:00