mstarzinger@chromium.org
47aa3254c2
Fix rewriter to not treat throw as an expression.
...
Now we can correctly optimize top level code that contains a throw (or
return) as it's last statement.
R=ulan@chromium.org
BUG=v8:2054
TEST=mjsunit/regress/regress-2054
Review URL: https://chromiumcodereview.appspot.com/9969146
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-04 13:41:05 +00:00
mstarzinger@chromium.org
7b59b1d5ac
Fix array boilerplate object transitioning.
...
Array literal boilerplate objects can be transitioned while existing
un-transitioned clones are still being populated. This adds a check that
prevents us from performing the same transition twice.
R=danno@chromium.org
BUG=v8:2055
TEST=mjsunit/regress/regress-2055
Review URL: https://chromiumcodereview.appspot.com/9950095
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 16:54:28 +00:00
danno@chromium.org
8dc9bc962f
Don't crash on stack overflow entering the debugger.
...
R=ager@chromium.org , sgjesse@chromium.org
BUG=chromium:119429
TEST= test/mjsunit/regress/regress-119429.js
Review URL: https://chromiumcodereview.appspot.com/9965101
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 13:45:56 +00:00
danno@chromium.org
d9437722da
Properly support shrinking arrays in CopyDictionaryToObjectElements.
...
R=mstarzinger@chromium.org
BUG=chromium:121407
TEST=test/mjsunit/regress/regress-121407.js
Review URL: https://chromiumcodereview.appspot.com/9968056
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 08:13:59 +00:00
mstarzinger@chromium.org
5798bc27aa
Fix hidden properties to ignore [[Extensible]].
...
The [[Extensible]] property prevented the very first hidden property
from being added. If any hidden property was added to the object before
preventing extension, adding subsequent hidden properties would have
succeed however.
R=svenpanne@chromium.org
BUG=v8:2034
TEST=mjsunit/regress/regress-2034
Review URL: https://chromiumcodereview.appspot.com/9844025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-02 08:26:30 +00:00
vegorov@chromium.org
8360ec877e
Ensure that arguments object is materialized when deoptimizing from inlined function.
...
Lithium translation rebuilds hydrogen environments from scratch so we have to ensure that arguments object is correctly bound on function entry otherwise deoptimization will not materialize it.
This fix was implemented as part of r11109 and then reverted.
R=danno@chromium.org
BUG=v8:2045
TEST=test/mjsunit/regress/regress-2045.js
Review URL: https://chromiumcodereview.appspot.com/9963008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-30 13:22:39 +00:00
mstarzinger@chromium.org
552393c383
Add missing regression test for r11173.
...
R=svenpanne@chromium.org
BUG=chromium:12009
TEST=mjsunit/regress/regress-120099
Review URL: https://chromiumcodereview.appspot.com/9873027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-28 15:17:14 +00:00
mstarzinger@chromium.org
057371da13
Fix polymorphic load on named fields.
...
This fixes polymorphic loads to correctly compare in-object offsets
instead of indices, because indices might coincide even though the
actual slot is different because of different instance sizes.
R=danno@chromium.org
BUG=v8:2030
TEST=mjsunit/regress/regress-2030,mjsunit/mirror-array
Review URL: https://chromiumcodereview.appspot.com/9864028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 10:42:38 +00:00
erik.corry@gmail.com
6cb333cadf
Fix broken test.
...
Review URL: https://chromiumcodereview.appspot.com/9865019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 09:10:58 +00:00
erik.corry@gmail.com
bfb1e9e702
Fix edge case for case independent regexp character classes.
...
http://code.google.com/p/v8/issues/detail?id=2032
Review URL: https://chromiumcodereview.appspot.com/9860029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 08:42:37 +00:00
ulan@chromium.org
a47d1c0714
Fix the return type of the date set methods.
...
Date set methods (setMinutes, setHours, etc.) should return the time value as a number instead of JSDate.
R=jkummerow@chromium.org
TEST=test/mjsunit/regress/regress-2027.js
Review URL: https://chromiumcodereview.appspot.com/9809010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-26 10:13:03 +00:00
jkummerow@chromium.org
4e405b6945
Fix missing write barrier in CopyObjectToObjectElements.
...
Passing the write barrier mode as a parameter does not make sense, as the elements kind specific copiers know best whether a write barrier is needed or not.
BUG=119926
TEST=mjsunit/regress/regress-crbug-119926
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9808111
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11134 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-25 15:16:06 +00:00
danno@chromium.org
8833c99552
Check double array bounds in HasElementImpl.
...
R=jkummerow@chromium.org
BUG=chromium:119925
TEST=test/mjsunit/regress/regress-119925.js
Review URL: https://chromiumcodereview.appspot.com/9808110
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-25 14:21:51 +00:00
mstarzinger@chromium.org
79a98de9f7
Fix declarations escaping global strict eval.
...
According to ES5 10.4.2(3), eval calls of strict code always require
their own lexical and variable environment. For now we just add a new
scope when we parse the strict mode directive. The clean solution would
be to always have this sope present (even for global eval calls) and
adapt variable binding to cope with that.
R=rossberg@chromium.org
BUG=v8:1624
TEST=mjsunit/regress/regress-1624,test262/S10.4.2.1_A1
Review URL: https://chromiumcodereview.appspot.com/9703021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-15 13:02:21 +00:00
mstarzinger@chromium.org
2c7f0edd48
Fix wrapping of receiver for non-strict callbacks.
...
R=rossberg@chromium.org
BUG=v8:1973
TEST=mjsunit/regress/regress-1973
Review URL: https://chromiumcodereview.appspot.com/9705020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 17:42:19 +00:00
rossberg@chromium.org
46001aa54c
Function declarations shall not overwrite read-only global properties.
...
R=mstarzinger@chromium.org
BUG=115452
TEST=mjsunit/regress/regress-115452
Review URL: https://chromiumcodereview.appspot.com/9696035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 13:51:00 +00:00
kmillikin@chromium.org
7d6fd56fd5
Ensure there is a smi check of the receiver for global load and call ICs.
...
There was a comment that, for such ICs specialized to the global object,
they were always contextual loads. This is very brittle. It is a
micro-optimization that relies too much on the way that things happen to
work today.
Instead, never omit the smi check because it's safer.
R=vegorov@chromium.org
BUG=117794
TEST=regress-117794.js
Review URL: https://chromiumcodereview.appspot.com/9691038
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-13 11:39:30 +00:00
yangguo@chromium.org
7659beafb1
Ensure consistency of Math.sqrt on Intel platforms.
...
BUG=
TEST=regress-sqrt.js
Review URL: https://chromiumcodereview.appspot.com/9690010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-12 14:56:04 +00:00
yangguo@chromium.org
13689a4f13
Set debug break slot at init of loop variable in a for loop.
...
BUG=102153
TEST=regress-102153.js
Review URL: https://chromiumcodereview.appspot.com/9625011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-08 10:21:43 +00:00
yangguo@chromium.org
67540abe08
Fix compile with debuggersupport=off.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9546051
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-07 10:57:36 +00:00
mstarzinger@chromium.org
8c2708de6d
Fix Error.prototype.toString to throw TypeError.
...
R=rossberg@chromium.org
BUG=v8:1980
TEST=mjsunit/function-call,mjsunit/regress/regress-1980
Review URL: https://chromiumcodereview.appspot.com/9568005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-05 13:57:48 +00:00
yangguo@chromium.org
f2699b66cf
Revert r10908 due to flakiness and crashes.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9580007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 15:00:52 +00:00
yangguo@chromium.org
12f2099993
Ensure consistent result of transcendental functions.
...
BUG=
TEST=regress-transcendental.js
Review URL: https://chromiumcodereview.appspot.com/9572009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 14:33:15 +00:00
mstarzinger@chromium.org
fb8eb04bfd
Implement inlining of constructor calls.
...
R=vegorov@chromium.org ,kmillikin@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9304001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-28 09:05:55 +00:00
yangguo@chromium.org
32e2b0319e
Update break points set with partial file name after compile.
...
BUG=v8:1853
Review URL: https://chromiumcodereview.appspot.com/9460059
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-27 11:52:08 +00:00
yangguo@chromium.org
baabb87dae
Fix HConstant's hash function for smis on x64.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9466003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-24 10:59:12 +00:00
yangguo@chromium.org
671084074d
Lazy removal of dead HValues in GVN from use lists.
...
BUG=v8:1969
TEST=regress/regress-1969
Review URL: https://chromiumcodereview.appspot.com/9455011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-23 13:59:35 +00:00
vegorov@chromium.org
f5c8ac9839
On ia32 LFunctionLiteral instruction should get context from esi register instead of stack slot.
...
This makes LFunctionLiteral safe even when it is used from inside inlined function.
All other architectures were implementing LFunctionLiteral correctly.
R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-inlining-function-literal-context.js
Review URL: https://chromiumcodereview.appspot.com/9425061
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-21 12:10:04 +00:00
mstarzinger@chromium.org
e423637898
Fix sequence of element access in array builtins.
...
R=rossberg@chromium.org
BUG=v8:1790
TEST=mjsunit/regress/regress-1790,test262/15.4.4.22-9-9
Review URL: https://chromiumcodereview.appspot.com/9419044
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-17 10:06:26 +00:00
yangguo@chromium.org
cc2780403a
Ensure using byte registers for byte instructions on ia32 and x64.
...
BUG=v8:1945
TEST=regress-1945.js
Review URL: https://chromiumcodereview.appspot.com/9418005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-16 12:48:02 +00:00
yangguo@chromium.org
01e46b955f
Initialize internal arrays with the correct map.
...
BUG=v8:1878
TEST=regress-1878.js
Review URL: https://chromiumcodereview.appspot.com/9402009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-15 13:45:42 +00:00
danno@chromium.org
71cd77e22c
Fix crashing bugs in store-and-grow IC for double values.
...
R=jkummerow@chromium.org
BUG=chromium:113924
TEST=test/mjsunit/regress/regress-113924.js
Review URL: https://chromiumcodereview.appspot.com/9365055
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-14 15:09:49 +00:00
yangguo@chromium.org
3e58827710
Fix elements transition bug related to array.concat.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9358018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-08 09:50:13 +00:00
lrn@chromium.org
f0a87d7c34
Fix handling of 'c: if (0) break c; else ()' where a parser optimization
...
leaves a trailing ";" after removing the break.
Review URL: https://chromiumcodereview.appspot.com/9159043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-08 08:40:11 +00:00
ulan@chromium.org
8093e397e4
Do not ignore an empty context with extension when creating a scope object.
...
Runtime_DebugEvaluate creates an empty context which is not correctly handled in FullCodeGenerator::ContextSlotOperandCheckExtensions because the corresponding scope indicates that it has no context.
BUG=crbug.com/107996
TEST=test/mjsunit/regress/regress-crbug-107996.js
Review URL: https://chromiumcodereview.appspot.com/9310027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10582 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-02 09:35:12 +00:00
mstarzinger@chromium.org
5dc4859fa4
Fix test case to correctly check expected result.
...
R=vegorov@chromium.org
TEST=mjsunit/regress/regress-1229
Review URL: https://chromiumcodereview.appspot.com/9303032
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-31 12:31:24 +00:00
vegorov@chromium.org
67d72eab45
When preparing heap for breakpoints make sure not to flush away non-optimized code for inlined functions.
...
Debug::PrepareForBreakPoints was not fully populating active_functions list.
R=erik.corry@gmail.com
TEST=test/mjsunit/regress/regress-debug-code-recompilation.js
Review URL: https://chromiumcodereview.appspot.com/9290013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-25 15:11:59 +00:00
vegorov@chromium.org
04289e8d17
Support inlining at call-sites with mismatched number of arguments.
...
Review URL: https://chromiumcodereview.appspot.com/9265004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10483 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-24 08:43:12 +00:00
vegorov@chromium.org
704c92ce95
Ensure that LRandom restores rsi after call to the C function on x64.
...
R=ulan@chromium.org
BUG=http://crbug.com/110509
TEST=test/mjsunit/regress/regress-110509.js
Review URL: https://chromiumcodereview.appspot.com/9265003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-19 08:43:34 +00:00
yangguo@chromium.org
ddc0144490
Fixing issue 1898 (using HChange outside the insert-representation-changes phase).
...
BUG=v8:1898
TEST=mjsunit/regress/regress-1898.js
Review URL: http://codereview.chromium.org/9190047
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-13 07:48:44 +00:00
vegorov@chromium.org
c4d3a110a2
Adjust position recorded for call expressions.
...
For calls of the form ident(...) record position of the identifier as the position of the call. For other calls record positions of the opening parenthesis.
This guarantees that for expressions of the form function(){}() call position will not intersect with positions recorded for function literal which is used by the debugger for scope chain resolution.
R=kmillikin@chromium.org
BUG=http://crbug.com/109195
TEST=test/mjsunit/regress/regress-109195.js
Review URL: http://codereview.chromium.org/9125001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-01-06 10:26:17 +00:00
danno@chromium.org
f648626eb9
Reland 10309: Ensure large Smi-only arrays don't transition to FAST_DOUBLE_ARRAY
...
TBR=jkummerow@chromium.org
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/9051014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-30 14:28:14 +00:00
danno@chromium.org
5d85a04472
Rollback 10309
...
TBR=jkummerow@chromium.org
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/8968042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-30 13:42:21 +00:00
danno@chromium.org
dff0e36d2d
Ensure large Smi-only arrays don't transition to FAST_DOUBLE_ARRAY
...
BUG=v8:1849
TEST=test/mjsunit/regress/regress-1849.js
Review URL: http://codereview.chromium.org/8968028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-30 12:54:23 +00:00
danno@chromium.org
aa38094bf0
Ensure that InternalArrays remain InternalArrays regardless of how they are constructed.
...
R=whesse@chromium.org
BUG=v8:1878
TEST=test/mjsunit/regress/regress-1878.js
Review URL: http://codereview.chromium.org/9016041
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-27 15:12:12 +00:00
vegorov@chromium.org
3947056c03
Avoid embedding new space objects into code objects in the lithium gap resolver.
...
R=danno@chromium.org
BUG=http://crbug.com/108296
TEST=test/mjsunit/regress/regress-108296.js
Review URL: http://codereview.chromium.org/8960004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-23 10:39:01 +00:00
mstarzinger@chromium.org
04f0e33229
Fix handling of foreign callbacks in DefineOwnProperty.
...
We use foreign callbacks to make some properties shadow internal values
but still behave as data properties from within JavaScript. This means
when a value is passed to Object.defineProperty() on such a property,
it should update the internal value instead of redefinind the property
and destroying the shadowing.
R=rossberg@chromium.org
BUG=v8:1530
TEST=mjsunit/regress/regress-1530,test262/S15.3.3.1_A4
Review URL: http://codereview.chromium.org/8996008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-20 08:49:51 +00:00
jkummerow@chromium.org
91efb313eb
Fix crash in d8 when external array ctor hits stack overflow
...
BUG=100859
TEST=mjsunit/regress/regress-crbug-100859
Review URL: http://codereview.chromium.org/8898021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-13 13:51:58 +00:00
vegorov@chromium.org
a457040ca6
Ensure that non-optimized code objects are not flushed for inlined functions.
...
Collector was flushing them if optimized code was reachable only through the stack (not through the JSFunction object) which happens when you have a pending lazy deoptimization.
Also prevent v8::Script::New from leaking internal objects allocated by the compiler into outer HandleScope.
R=kmillikin@chromium.org
BUG=http://crbug.com/97116
TEST=test/mjsunit/regress/regress-97116.js
Review URL: http://codereview.chromium.org/8888011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-08 16:07:07 +00:00
yangguo@chromium.org
929c619101
Quickfix for DoMathPowHalf.
...
TEST=regress-397.js
Review URL: http://codereview.chromium.org/8769037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-12-02 13:16:49 +00:00