AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
7,069 Commits 1 Branch 0 Tags 839 MiB
48b5328bde
Commit Graph

1205 Commits

Author SHA1 Message Date
ager@chromium.org
6098abf46e Fix the debugger for strict-mode functions. 
undefined is passed unchanged as the receiver for strict-mode
functions through call and apply. Also, if a strict-mode function is
called without an explicit receiver, undefined is passed as the
receiver (not the global object as for other functions).

R=vegorov@chromium.org
BUG=89236
TEST=mjsunit/debug-scopes.js

Review URL: http://codereview.chromium.org/7388011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-18 14:29:50 +00:00
rossberg@chromium.org
5e62e325ac Implement sealing, freezing, and related functions for proxies. 
R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7391001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-18 13:04:52 +00:00
rossberg@chromium.org
75a2c49c1d Implement delete trap for proxies. 
R=ager@chromium.org
BUG=1543
TEST=

Review URL: http://codereview.chromium.org/7369001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-15 09:10:20 +00:00
jkummerow@chromium.org
d4779286b6 Add map check for COW elements to crankshaft array handling code. 
BUG=1560
TEST=mjsunit/regress/regress-1560.js

Review URL: http://codereview.chromium.org/7366008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-14 14:45:20 +00:00
danno@chromium.org
391ef3be33 Implement ICs for FastDoubleArray loads and stores 
Implemented on ia32, x64, ARM. Stubbed out with UNIMPLEMENTED on MIPS.

BUG=none
TEST=unbox-double-arrays.js

Review URL: http://codereview.chromium.org/7307030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 13:50:27 +00:00
sgjesse@chromium.org
be1eee7063 Support scope information and evaluation in optimized frames 
R=svenpanne@chromium.org

BUG=v8:1140
TEST=test/mjsunit/debug-evaluate-locals-optimized.js,test/mjsunit/debug-evaluate-locals-optimized-double.js

Review URL: http://codereview.chromium.org//7343005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8633 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 12:49:27 +00:00
rossberg@chromium.org
ddb782dcb8 Implement Object.getOwnPropertyDescriptor for proxies. 
Fix bug in compilation of calls with proxy receivers.

R=kmillikin@chromium.org,ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7237050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8630 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:57:15 +00:00
mikhail.naganov@gmail.com
5c57d0d643 Remove support for logging into a memory buffer. 
The only usage of it was in logging tests, I've switched them for
using a file.

I've left out support for "--logfile=*" for now, as Chromium uses it.
Will be removed after the next V8 roll.

R=sgjesse@chromium.org
BUG=859
TEST=mjsunit/log-*

Review URL: http://codereview.chromium.org/7310025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:31:22 +00:00
rossberg@chromium.org
6e2da733da Implement Object.keys for proxies. 
R=kmillikin@chromium.org,ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7321004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:01:17 +00:00
sgjesse@chromium.org
54e81c351f Add source position recording for variable loads 
This provides more precise source to generated code mapping as variable loads can be handled using IC calls.

R=kmillikin@chromium.org

BUG=v8:1527
TEST=test/message/regress/regress-1527

Review URL: http://codereview.chromium.org//7327038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8610 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 15:20:17 +00:00
kmillikin@chromium.org
890bc1607a Fix a potential crash in const declaration. 
Declaration of const lookup slots would trigger an assertion if there was a
setter somewhere in the prototype chain, and that setter was shadowed by a
non-readonly data property also in the prototype chain.

R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7324048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 14:07:12 +00:00
kmillikin@chromium.org
cbaf1bc98b Allow JSObject::PreventExtensions to work for arguments objects. 
R=karlklose@chromium.org

Review URL: http://codereview.chromium.org/7335002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 06:48:19 +00:00
danno@chromium.org
f894b7a3b3 Fix polymorphic array test 
R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7326009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8580 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 10:59:20 +00:00
danno@chromium.org
07def3cb1e Unify handling of element IC stubs. 
In the process, add shared stubs for DictionaryValue lookups that are handled in the same way as fast elements and external array elements.

Includes code for MIPS, which compiles and run polymorph-arrays.js successfully.

R=jkummerow@chromium.org
BUG=none
TEST=test/mjsunit/polymorph-arrays.js

Review URL: http://codereview.chromium.org/7227010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 10:46:10 +00:00
sgjesse@chromium.org
7cbf0a4d48 Add inspection of whether frame is a construct frame to optimized frames 
Also avoid that calling Debug::IsBreakAtReturn causes a full doptimization when there are no break points set. The full deoptimization is caused by Debug::IsBreakAtReturn calling Debug::EnsureDebugInfo which will assume that a break point is now set.

R=svenpanne@chromium.org

BUG=v8:1140
TEST=test/mjsunit/debug-evaluate-locals-optimized.js,test/mjsunit/debug-
evaluate-locals-optimized-doubles.js

Review URL: http://codereview.chromium.org//7307035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 08:55:26 +00:00
kmillikin@chromium.org
fe23339bdd Fix a bug in for/in iteration of arguments objects. 
We did not properly combine the property names from the parameter map
and the arguments backing store.  They could overwrite each other and
be unsorted.

Also fix an unrelated bug: deleting from a dictionary-mode arguments
backing store could corrupt the parameter map.

R=rossberg@chromium.org
BUG=1531
TEST=mjsunit/regress/regress-1531.js

Review URL: http://codereview.chromium.org/7278033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 07:31:48 +00:00
sgjesse@chromium.org
8ccb47f57e Add inspection of arguments for optimized frames 
R=svenpanne@chromium.org

BUG=v8:1140
TEST=test/mjsunit/debug-evaluate-locals-optimized.js,test/mjsunit/debug-
evaluate-locals-optimized-doubles.js

Review URL: http://codereview.chromium.org//7310027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-07 14:29:16 +00:00
rossberg@chromium.org
58b913f9f0 Implement Object.defineProperty for proxies. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7314003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-07 12:41:20 +00:00
ricow@chromium.org
82e53270dc Ensure that regexps always have code object, even if GC happened while running multiple times in runtime. 
Review URL: http://codereview.chromium.org/7316018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8560 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-07 10:04:56 +00:00
sgjesse@chromium.org
53a5b07992 Add inspection of function for optimized frames 
R=svenpanne@chromium.org

BUG=none
TEST=test/mjsunit/debug-evaluate-locals-optimized.js,test/mjsunit/debug-evaluate-locals-optimized-doubles.js

Review URL: http://codereview.chromium.org//7227006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-06 13:02:17 +00:00
sgjesse@chromium.org
ca3787f395 Fix debug break on binary boolean operators 
The syntax checker finding breakable statements did not take into account that the right hand side of a boolean binary opration might never get evaluated.

R=svenpanne@chromium.org

BUG=v8:1523
TEST=test/mjsunit/regress/regress-1523.js

Review URL: http://codereview.chromium.org//7212027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8544 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-06 10:16:57 +00:00
ricow@chromium.org
1fff78036e In preperation of using d8 for running tests: Don't run d8-os when running with --isolates. 
When used with d8 this can potentially interfer with the writing,
reading and deletion of files is the isolates flags makes the same
test run concurrently.
Review URL: http://codereview.chromium.org/7308006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-06 08:20:30 +00:00
vitalyr@chromium.org
8f60208324 Fix bug 1529: check for NULL handle in v8::TryCatch::StackTrace. 
Internal HandleScope::CloseAndEscape crashes on NULL handles.

R=kmillikin@chromium.org
BUG=v8:1529
TEST=mjsunit/regress/regress-1529

Review URL: http://codereview.chromium.org/7309004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-04 13:29:56 +00:00
kmillikin@chromium.org
57c29c1f29 Fix a bug in with and catch context allocation. 
We were only looking one level up the scope chain to decide which
closure to use in the fresh context.  Instead, we should look to the
first non-catch scope.

R=vegorov@chromium.org
BUG=1528
TEST=regress-1528

Review URL: http://codereview.chromium.org/7309002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-04 09:34:47 +00:00
kmillikin@chromium.org
a48c03bb2a Fix an issue with optimization of functions inside catch. 
When optimizing a function defined inside a catch, we did not count
the catch context as part of the context chain.

R=vegorov@chromium.org
BUG=1521
TEST=regress-1521

Review URL: http://codereview.chromium.org/7285032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-01 14:05:46 +00:00
yangguo@chromium.org
77a3c7226b exposing a few boolean queries from objects.h 
TEST=start with ./d8 --allow-natives-syntax and try %ObjectHasFastElements({})

Review URL: http://codereview.chromium.org/7289010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8514 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-01 11:47:55 +00:00
lrn@chromium.org
ff9ce1abd4 Make date parser handle all ES5 Date Time Strings correctly. 
This means that ES5 Date Time Strings will default to UTC if timezone is absent.
Handle as many legacy strings as possible the same way as before

BUG=v8:1498
TEST=mjsunit/date

Review URL: http://codereview.chromium.org/7291022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-01 11:41:45 +00:00
jkummerow@chromium.org
f2a9026d9a Fix flakiness of optimization assertion on slow ARM builders 
(if the test ran too slow, optimization kicked in earlier than expected by the test)

TEST=mjsunit/assert-opt-and-deopt.js no longer flaky

Review URL: http://codereview.chromium.org/7298001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-01 11:12:27 +00:00
karlklose@chromium.org
c0e2268c8c Fix problem with arguments object ICs not checking for dictionary mode elements. 
R=kmillikin@chromium.org
BUG=1514
TEST=mjsunit/regress/regress-1513.js

Review URL: http://codereview.chromium.org/7282029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 14:56:06 +00:00
kmillikin@chromium.org
f4c4df2d9a Introduce scopes to keep track of catch blocks at compile time. 
The catch variable is bound in the catch scope.  For simplicity in this
initial implementation, it is always allocated even if unused and always
allocated to a catch context even if it doesn't escape.  The presence of
catch is no longer treated as a with.

In this change, care must be taken to distinguish between the scope where a
var declaration is hoisted to and the scope where the initialization occurs.

R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7280012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 14:37:55 +00:00
ager@chromium.org
8a3d8b41e8 Exclude %_IsNativeOrStrictMode from natives fuzzer. 
R=ricow@chromium.org

Review URL: http://codereview.chromium.org/7284032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 13:36:52 +00:00
ager@chromium.org
0d8c343c90 Do not pass the global object as the receiver to strict-mode and 
builtin replace and sort functions.

R=ricow@chromium.org
BUG=v8:1360
TEST=mjsunit/regress/regress-1360.js

Review URL: http://codereview.chromium.org/7283006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 12:29:19 +00:00
kmillikin@chromium.org
6543526a9d Remove failing test while working on a fix. 
TBR=ricow@chromium.org

Review URL: http://codereview.chromium.org/7283040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 12:07:33 +00:00
kmillikin@chromium.org
3f84fcf6c9 Fix a bug in Object.defineProperty. 
There was a bug in Object.defineProperty when used to add an indexed
property to an arguments object.  When converting the elements backing
store to dictionary mode, the parameter map in front of the backing
store does not change.

R=ager@chromium.org,karlklose@chromium.org

Review URL: http://codereview.chromium.org/7289011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-30 11:11:19 +00:00
sgjesse@chromium.org
7d2be7c0e0 Support debugger inspection of locals in optimized frames 
Optimized frames are now handled by the debugger. When discovering optimized frames during stack inspection in the debugger they are "deoptimized" using the normal deoptimization code and the deoptimizer output information is used to provide frame information to the debugger.

Before this change the debugger reported each optimized frame as one frame no matter the number of inlined functuions that might have been called inside of it. Also all locals where reported as undefined. Locals can still be reposted as undefined when their value is not "known" by the optimized frame.

As the structures used to calculate the output frames when deoptimizing are not GC safe the information for the debugger is copied to another structure (DeoptimizedFrameInfo) which is registered with the global deoptimizer data and processed during GC.

R=fschneider@chromium.org

BUG=v8:1140
TEST=test/mjsunit/debug-evaluate-locals-optimized*

Review URL: http://codereview.chromium.org//7230045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 13:02:00 +00:00
sgjesse@chromium.org
39ed137e10 ARM: Improve register allocation and constraints (try 2). 
Gives ~20% boost for Crypto benchmark on A9.

BUG=none
TEST=added to mjsunit/div-mod.js

Review URL: http://codereview.chromium.org//7276034
Patch from Martyn Capewell <m.m.capewell@googlemail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 10:51:06 +00:00
erik.corry@gmail.com
f8fdc62c19 Improvement to SmiLexicalCompare. Landing http://codereview.chromium.org/7261008 for Stephen Adams 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 08:35:10 +00:00
keuchel@chromium.org
3f70c456eb Fix "illegal access" when calling parseInt with a radix that is not a smi. 
BUG=v8:1246
TEST=regress-1246.js

Review URL: http://codereview.chromium.org/7206019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-28 12:31:42 +00:00
ager@chromium.org
89cc886ba7 Fix receiver check in arguments ICs. 
The receiver needs to be checked in the same way as all other KeyedLoadICs to take non-JSObject and objects that require access checks or has interceptors into account.

R=sgjesse@chromium.org
BUG=87478
TEST=mjsunit/regress/regress-crbug-87478.js

Review URL: http://codereview.chromium.org/7259015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8429 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-27 13:02:51 +00:00
keuchel@chromium.org
ab3d4cf7b8 Proper handling of future reserved words in strict and normal mode. 
BUG=86442
TEST=mjsunit/keywords-and-reserved_words.js

Review URL: http://codereview.chromium.org/7207007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8421 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-24 14:59:51 +00:00
ricow@chromium.org
840e31a0b3 Add regression test for optimized version of Math.abs. 
This issue was already fixed on bleeding edge, but adding regression
test to get coverage and to make sure it works on the branches.
Review URL: http://codereview.chromium.org/7237022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-24 07:46:57 +00:00
fschneider@chromium.org
4bc671c2b0 Add missing write barrier for arguments store ICs. 
Review URL: http://codereview.chromium.org/7207006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8390 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-23 09:20:07 +00:00
karlklose@chromium.org
c5a24f64c4 Fix wrong bounds check on arguments object. 
TEST=added to test/mjsunit/arguments.js

Review URL: http://codereview.chromium.org/7217005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-21 09:27:38 +00:00
ager@chromium.org
a96b9156a3 Correctly handle non-array receivers in Array length setter. 
BUG=v8:1491
TEST=mjsunit/regress/regress-1491.js

Review URL: http://codereview.chromium.org/7206038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8343 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-21 08:07:45 +00:00
lrn@chromium.org
480ec43c4e Make "native" not a keyword. 
We now only recognize "native function" when it occurs in extension scripts
(parsing with a non-NULL extension), and only if there is no line-terminator
between "native" and "function" (so that it would otherwise be a Syntax Error).
Preparsing never recognizes native functions, which is acceptable since we
never preparse extension scripts (because we don't allow lazy functions
anyway).

BUG=v8:1097

Review URL: http://codereview.chromium.org/7206020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-20 10:20:57 +00:00
kasperl@chromium.org
5a547ac413 Generalized Stephen's patch from http://codereview.chromium.org/7044100/ and 
added a few test cases.
Review URL: http://codereview.chromium.org/7212006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-20 07:40:42 +00:00
erik.corry@gmail.com
c95ecb1fcd Refix issue 1472. The previous fix worked for the example in the bug 
report, but was not general enough to catch all cases.  This is a new
approach.  Includes regression test!
Review URL: http://codereview.chromium.org/7193007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-17 08:01:12 +00:00
lrn@chromium.org
ee59eff127 Make line-terminators inside multi-line comments count. 
Now follows the specification. Follows WebKit change in revision 89100.

BUG=86431
TEST=regress-892742

Review URL: http://codereview.chromium.org/7184034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-17 07:23:07 +00:00
karlklose@chromium.org
f4e4bc43a8 Merge arguments branch to bleeding edge (second try). 
Review URL: http://codereview.chromium.org/7187007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 14:12:58 +00:00
karlklose@chromium.org
cc19d1e278 Revert "Merge arguments branch to bleeding merge." 
This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d.

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7172030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 06:37:49 +00:00
vegorov@chromium.org
14bf246dfa Add missing branches in code generated for LModI with power-of-2 divisor. 
BUG=v8:1476
TEST=test/mjsunit/regress/regress-1476.js

Review URL: http://codereview.chromium.org/7097015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 19:57:39 +00:00
karlklose@chromium.org
6cfeb2d400 Merge arguments branch to bleeding merge. 
Review URL: http://codereview.chromium.org/7167006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 15:09:28 +00:00
ricow@chromium.org
4032d2165e Make name and message non-enumerable on Error object (this is a partial fix for issue 1215) 
Review URL: http://codereview.chromium.org/7172011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 13:54:40 +00:00
ager@chromium.org
939011bb25 Add a number of old tests to the mjsunit test suite. 
R=kasperl@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7171016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 13:33:10 +00:00
ricow@chromium.org
23d0aa614b Ensure that bound functions does not have a prototype (fixes issue 794) 
Review URL: http://codereview.chromium.org/7148014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 10:47:37 +00:00
ager@chromium.org
aa7ad8ee9d Fix issue 1447 by not redefining properties unneccesarily in seal and freeze. 
This avoids attempting to redefine function.arguments with a different
value than the current one. function.arguments returns a new copy on
each invocation.

R=lrn@chromium.org
BUG=v8:1447
TEST=mjsunit/regress/regress-1447.js

Review URL: http://codereview.chromium.org/7044104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-10 09:45:02 +00:00
ager@chromium.org
8ec22db350 Correct the limit of local variables in a optimized functions. 
The encoding constraint is that we have 128 values. We use [-64,0] for
parameters and [0,63] for locals. However, for locals we restricted to
64 and not 63.

R=kmillikin@chromium.org
TEST=mjsunit/compiler/regress-max-locals-for-osr.js

Review URL: http://codereview.chromium.org/6995108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 14:52:58 +00:00
whesse@chromium.org
c40aa827bf Add boolean flag to HChange and LNumberUntagD to not convert undefined to NaN. 
This is needed so that HCompare, optimized for double inputs, works correctly on undefined inputs.
BUG=v8:1434
TEST=mjsunit/bugs/bug-1434.js

Review URL: http://codereview.chromium.org/7044049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 12:27:28 +00:00
kmillikin@chromium.org
c8b9f3ab7b Update the blacklist in fuzz-natives. 
Runtime functions were renamed in r8231.

R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7129040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 11:40:22 +00:00
fschneider@chromium.org
68eab4a8d8 Fix bug with GVN on array loads. 
This fixes a bug where an array load was incorrectly hoisted by GVN.

BUG=85177
TEST=mjsunit/regress/regress-85177.js
Review URL: http://codereview.chromium.org/7003054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 11:15:03 +00:00
danno@chromium.org
4de3bb500c Implement core support for FixedDoubleArrays. 
Under a flag without IC or Crankshaft support.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7089002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 10:03:35 +00:00
ager@chromium.org
626cdffaef Fix Array.prototype.{reduce,reduceRight} to pass undefined as receiver for strict mode callbacks. 
Propagate strict mode information from pre-parser to parser for lazily compiled functions.

R=lrn@chromium.org
BUG=v8:1436
TEST=mjsunit/regress/regress-1436.js

Review URL: http://codereview.chromium.org/7044054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 09:05:15 +00:00
lrn@chromium.org
bd826d54f5 Fix bug in Object.defineProperty where a growing lements dictionary was ignored. 
TEST=mjsunit/object-define-property

Review URL: http://codereview.chromium.org/7129017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-08 08:13:31 +00:00
danno@chromium.org
ad98d142cc Add failing test case for bug 1434 
BUG=1434
TEST=test/mjsunit/bugs/bug-1434.js

Review URL: http://codereview.chromium.org/7131006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-08 07:45:37 +00:00
whesse@chromium.org
1ea14c2041 Limit the number of arguments in a function call to 32766. 
Limit the number of arguments in a function call to 32766.  This is identical
to the limit on the number of parameters to a function.

BUG=v8:1413
TEST=

Review URL: http://codereview.chromium.org/7054074

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-07 08:15:47 +00:00
fschneider@chromium.org
7c9cf0b3a1 Re-land r8140: Deoptimize on never-executed code-paths. 
Original cl: http://codereview.chromium.org/7105015

I'm removing the test GlobalLoadICGC test that was introduced for testing
inlined global cell loads (in the classic backend) and has an invalid assumption
about the number of global objects referenced from a v8 context. We don't have
this feature with Crankshaft anymore.
Review URL: http://codereview.chromium.org/7112032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-06 14:57:25 +00:00
kmillikin@chromium.org
6a81642f31 Fix a bug in Lithium environment iteration. 
The Advance() function of the class responsible for iterating
environment uses didn't always advance as far as it could (relying on
the HasNext predicate to finish advancing).  This is brittle.

The HasNext predicate also didn't advance as far as it could when it
was at the end of an environment level.  This is a bug.

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/6993023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-06 11:30:17 +00:00
erik.corry@gmail.com
0023cacc22 Fix traversal of the map transition tree to take the prototype 
transitions into account.
Review URL: http://codereview.chromium.org/7074052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 14:48:09 +00:00
ager@chromium.org
22b5dfd395 Reapply: "Make instanceof and Object.getPrototypeOf work for proxies, 
plus a few other tweaks."

The problem with the original patch was that it did not take hidden
prototype objects into account in Runtime_GetPrototype.

R=kmillikin@chromium.org,rossberg@chromium.org
TEST=es5conform

Review URL: http://codereview.chromium.org/7056041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 10:15:49 +00:00
ager@chromium.org
ece7700d7c Revert "Make instanceof and Object.getPrototypeOf work for proxies, plus a few other tweaks." 
This change caused errors in es5conform tests for getPrototypeOf.

TBR=rossberg@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7109004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8159 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-02 10:12:00 +00:00
rossberg@chromium.org
2255860992 Make instanceof and Object.getPrototypeOf work for proxies, plus a few other tweaks. 
R=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7080053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-01 17:44:08 +00:00
fschneider@chromium.org
ff76d1ab0c Revert r8140. 
It breaks test when running with nosnapshot.
TBR=ager@chromium.org
Review URL: http://codereview.chromium.org/7027029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-01 13:34:15 +00:00
fschneider@chromium.org
0aa422923c Eagerly deoptimize on never-executed code-paths. 
If type-feedback indicates that an expression was never executed in
the non-optimized code, we insert a forced deoptimization right away
to enable re-optimization if we ever hit this path.

With this change we still continue to build the graph. As a next step, we
should remove the dead code after the deoptimize.

I had to remove one assert about the optimization status in a test since
we now immediately deoptimize after exiting the loop that triggers OSR.

Also remove a restriction that control-flow from an inlined function in a
test context always reaches both true- and false-target.
Review URL: http://codereview.chromium.org/7105015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-01 11:04:40 +00:00
rossberg@chromium.org
670f947a5c Implement set trap for proxies, and revamp class hierarchy in preparation: 
- Introduce a class JSReceiver, that is a common superclass of JSObject and
  JSProxy. Use JSReceiver where appropriate (probably lots of places that we
  still have to migrate, but we will find those later with proxy test suite).

- Move appropriate methods to JSReceiver class (SetProperty,
  GetPropertyAttribute, Get/SetPrototype, Lookup, and so on).

- Introduce new JSFunctionProxy subclass of JSProxy. Currently only a stub.

- Overhaul enum InstanceType:
  * Introduce FIRST/LAST_SPEC_OBJECT_TYPE that ranges over all types that
    represent JS objects, and use that consistently to check language types.
  * Rename FIRST/LAST_JS_OBJECT_TYPE and FIRST/LAST_FUNCTION_CLASS_TYPE
    to FIRST/LAST_[NON]CALLABLE_SPEC_OBJECT_TYPE for clarity.
  * Eliminate the overlap over JS_REGEXP_TYPE.
  * Also replace FIRST_JS_OBJECT with FIRST_JS_RECEIVER, but only use it where
    we exclusively talk about the internal representation type.
  * Insert JS_PROXY and JS_FUNCTION_PROXY in the appropriate places.

- Fix all checks concerning classification, especially for functions, to
  use the CALLABLE_SPEC_OBJECT range (that includes funciton proxies).

- Handle proxies in SetProperty (that was the easiest part :) ).

- A few simple test cases.

R=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/6992072

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8126 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-31 16:38:40 +00:00
ager@chromium.org
544191e718 Update apply with arguments optimization for strict mode functions and builtins. 
Do not convert to object for values for strict-mode functions and
builtins.

R=ricow@chromium.org
BUG=v8:1412
TEST=mjsunit/regress/regress-1412.js

Review URL: http://codereview.chromium.org/7096006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-31 10:38:41 +00:00
ager@chromium.org
a01b45df58 Fix a number of tests that incorrectly used assertUnreachable. 
Our testing infrastructure uses exceptions to indicate
errors. assertUnreachable therefore throws an exception to indicate
that it was reached. Therefore, it cannot be used to check that an
exception was thrown using the pattern:

try {
  shouldThrow();
  assertUnreachable();
} catch(e) {
}

Such a test will always pass because assertUnreachable will throw an
exception if shouldThrow does not.

R=ricow@chromium.org

Review URL: http://codereview.chromium.org/7053035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-31 08:08:42 +00:00
ager@chromium.org
bfa2ef1f11 Fix receiver for calls to strict-mode and builtin functions that are 
potentially shadowed by eval.

R=sgjesse@chromium.org
TEST=mjsunit/regress/regress-124.js

Review URL: http://codereview.chromium.org/7096004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-31 07:57:22 +00:00
ager@chromium.org
017935408d Reapply change to Pass undefined to JS builtins when called with 
implicit receiver.

A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=fschneider@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7085034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 13:49:22 +00:00
ager@chromium.org
cc4a2d7e76 Fix a number of IC stubs to correctly set the call kind. 
Make the call kind and call wrapper arguments explicit to force
developers to make a choice. This would have avoided the bug in the
first case.

R=fschneider@chromium.org
TEST=mjsunit/strict-mode-implicit-receiver.js

Review URL: http://codereview.chromium.org/7086029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 13:23:17 +00:00
fschneider@chromium.org
5083dec67f Fix timeout and a small bug in a regression test. 
Review URL: http://codereview.chromium.org/7085031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 12:48:35 +00:00
fschneider@chromium.org
e0985887bf Simple support for const variables in Crankshaft. 
The approach is to handle the common case in the optimizing
compiler and to bailout for the rare corner cases.

This is done by initializing all local const-variables with
the hole value and disallowing any use of the hole value statically.
Review URL: http://codereview.chromium.org/6026006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 11:31:41 +00:00
sandholm@chromium.org
ba229754ea Fix JSON issue with arrays. 
Review URL: http://codereview.chromium.org/7089003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8100 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 10:47:38 +00:00
ricow@chromium.org
7eb6f5c1ba Correctly set the length of string before creating filler object in the json parser (fixes crbug 84186). 
Testcase created based on the supplied test case from the bug report, but using json parse directly instead of through the chrome javascript console. 
Review URL: http://codereview.chromium.org/7084023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 06:04:36 +00:00
danno@chromium.org
c2394e0a71 Prevent deopt on double value assignment to typed arrays 
Implement truncation of double and tagged values when assigning to an element of a typed arrays in order to avoid depots.

BUG=1313
TEST=test/mjsunit/external-array.js

Review URL: http://codereview.chromium.org/6961019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 12:07:22 +00:00
ager@chromium.org
c832c467a4 Revert "Pass undefined to JS builtins when called with implicit receiver." 
Presubmit and failing test.

TBR=lrn@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7071009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 11:22:29 +00:00
kmillikin@chromium.org
f8b01f369e Add a simple test for inlining of arguments accesses. 
R=whesse@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7062018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 11:17:15 +00:00
ager@chromium.org
19b718fe73 Pass undefined to JS builtins when called with implicit receiver. 
A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=lrn@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7068009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 11:07:48 +00:00
lrn@chromium.org
02c4e8bfcb Make RegExp objects not callable. 
Review URL: http://codereview.chromium.org/6930006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 07:35:09 +00:00
erik.corry@gmail.com
fbf76fc86a Fix GC-unsafe corner case in bit-not on ARM 
Review URL: http://codereview.chromium.org/6987009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-25 10:35:00 +00:00
ricow@chromium.org
f675db651d Change calls to undefined property setters to not throw (fixes issue 1355). 
We currently throw when there is only a getter defined on the
property, but this should only be the case in strict mode.
Review URL: http://codereview.chromium.org/7064027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-25 08:37:38 +00:00
ager@chromium.org
6f775f2fb0 Fix calls of strict mode function with an implicit receiver. 
Only IA32 version for now. I'll start porting.

Strict mode functions are to get 'undefined' as the receiver when
called with an implicit receiver. Modes are bad! It forces us to have
checks on all function calls.

This change attempts to limit the cost by passing information about
whether or not a call is with an implicit or explicit receiver in ecx
as part of the calling convention. The cost is setting ecx on all
calls and checking ecx on entry to strict mode functions.

Implicit/explicit receiver state has to be maintained by ICs. Various
stubs have to not clobber ecx or save and restore it.

CallFunction stub needs to check if the receiver is implicit when it
doesn't know from the context.

Review URL: http://codereview.chromium.org/7039036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-24 14:01:36 +00:00
sgjesse@chromium.org
eff2946b9b Handle changes to the Object prototype in fast handling of arrays 
R=ager@chromium.org

BUG=v8:1403
TEST=test/mjsunit/regress/regress-1403.js

Review URL: http://codereview.chromium.org//7067019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-24 12:28:10 +00:00
ricow@chromium.org
ab67432ed0 Change strict mode poison pill to be the samme type error function (fixes issue 1387). 
We are now following the spec, and with regards to the error message we are following firefox (webkit still has different type errors in their nightly)
Review URL: http://codereview.chromium.org/7067017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-24 11:07:06 +00:00
sgjesse@chromium.org
fbd106d9cd MIPS: arch-independent changes to support mips. 
This change supports all non-crankshaft features except serialization.

This must be built after the changes in http://codereview.chromium.org/6966031
are landed.

BUG=
TEST=

Review URL: http://codereview.chromium.org//7039058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-24 07:56:20 +00:00
danno@chromium.org
780df33019 SMI checks for receiver in KeyedLoad/Store (done right this time) 
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7059013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-23 13:42:33 +00:00
sgjesse@chromium.org
825a433900 Add regression test for issue 1401 
R=ager@chromium.org

BUG=v8:1401
TEST=test/regress/regress-1401.js

Review URL: http://codereview.chromium.org//7062002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-23 13:03:45 +00:00
ager@chromium.org
98778dc802 Remove execScript from V8. No longer present i neither Firefox nor Safari. 
R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7046002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7948 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-19 08:10:27 +00:00
vegorov@chromium.org
7fba506f23 Add regression test for http://crbug.com/82769 
Review URL: http://codereview.chromium.org/7034025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-18 12:46:21 +00:00
fschneider@chromium.org
66911961cf Fix bug in optimized compiler's switch-statement. 
In the case where the default-clause occurs as the first clause,
the case-blocks were not wired up correctly.

BUG=v8:1394
TEST=mjsunit/compiler/regress-1394.js
Review URL: http://codereview.chromium.org/7037023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-18 11:06:07 +00:00
whesse@chromium.org
0eca2b4fc1 Fix error in postfix ++ in Crankshaft. 
Add HForceRepresentation, to represent the implicit ToNumber applied to the input of a count operation.

BUG=v8:1389

TEST=

Review URL: http://codereview.chromium.org/7033008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7913 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-17 11:41:59 +00:00
danno@chromium.org
daa1be1226 Support conversion of clamped double values for pixel arrays in Crankshaft. 
BUG=1313
TEST=test/mjsunit/external-array.js

Review URL: http://codereview.chromium.org/7014033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-16 14:10:56 +00:00
sgjesse@chromium.org
230a56abda Limit the number of local variables in a function 
Review URL: http://codereview.chromium.org//7003030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7892 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-16 08:27:52 +00:00
ricow@chromium.org
964dbff40d Only send null or undefined as receiver for es5 natives, not generally 
for builtin functions.
Review URL: http://codereview.chromium.org/7012012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7879 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-13 07:26:44 +00:00
ager@chromium.org
8a0b1f5bc9 Allow closures to be optimized if outer contexts that call eval are all in strict mode. 
R=kmillikin@chromium.org
BUG=
TEST=mjsunit/compiler/eval-introduced-closure.js

Review URL: http://codereview.chromium.org/6993008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-11 11:26:11 +00:00
ricow@chromium.org
7f8a918f08 Allow strict mode flag as extraicstate for keyed external array store ic 
We currently hit an assertion in computeflags, but the extra_ic_state is used to pass the strict mode flag in.

BUG: 1383
Review URL: http://codereview.chromium.org/7003022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-11 08:53:46 +00:00
jkummerow@chromium.org
944a388412 Avoid using a register for constant external array indices. 
This CL is based on and obsoletes CL 6879037.

TEST=mjsunit/external-array.js

Review URL: http://codereview.chromium.org/6902112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-10 15:25:17 +00:00
jkummerow@chromium.org
1eedd8056d Fix timeout of test regress-1118.js 
TEST=mjsunit/regress/regress-1118.js no longer times out when run in the ARM simulator.

Review URL: http://codereview.chromium.org/6994010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-10 15:07:30 +00:00
jkummerow@chromium.org
89c64653bf Expose optimization info via runtime functions 
TEST=mjsunit/assert-opt-and-deopt.js

Review URL: http://codereview.chromium.org/6879108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-09 08:58:57 +00:00
ager@chromium.org
0961b1a936 Check that receiver is JSObject on API calls. 
R=sgjesse@chromium.org
BUG=v8:1369
TEST=mjsunit/regress/regress-1369.js

Review URL: http://codereview.chromium.org/6931056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-06 14:14:16 +00:00
karlklose@chromium.org
d43066050a Replace loops by OptimizeFunctionOnNextCall in regress-1085 and regress-1210. 
Review URL: http://codereview.chromium.org/6938001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-06 09:10:28 +00:00
ricow@chromium.org
e0eb110130 Reapply 7763, including arm and x64 variants. 
The only difference to revision 7763 is the implementation in the
builtins file for arm and x64, plus a move of Array.prototype.toString
and Array.prototype.toLocaleString from should throw on null or
undefined to the non generic test cases in the function-call test (due
to us not currently supporting generic cases with these to functions)
Review URL: http://codereview.chromium.org/6928007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-05 05:21:30 +00:00
ricow@chromium.org
797cbc68b7 Delete empty test/mjsunit/function-call.js file 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 14:20:19 +00:00
karlklose@chromium.org
8b917d4d96 Replace long running loops by OptimizeFunctionOnNextCall in some tests that are often timing out on ARM. 
Review URL: http://codereview.chromium.org/6910022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 13:53:08 +00:00
ricow@chromium.org
4d890da191 Revert 7763, missing implementation on x64 and arm for call and apply with null or undefined. 
Review URL: http://codereview.chromium.org/6913024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 13:45:19 +00:00
ricow@chromium.org
2b730c2bf6 Don't exchange null and undefined with the global object in function.prototype.{call, apply} for natives. 
This makes us compatible with firefox in throwing an exception when
call is invoked on a builtin with null as the this argument.
Review URL: http://codereview.chromium.org/6902104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 13:19:04 +00:00
lrn@chromium.org
569574b7bf Fix implementation of == to correctly convert Date objects to primitives. 
Fix issue 1356

BUG=v8:1356
TEST=mjsunit/double-equals

Review URL: http://codereview.chromium.org/6912021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 12:15:14 +00:00
lrn@chromium.org
d1411602a7 Don't allow whitespace after sign characters in parseInt. 
BUG=v8:955
TEST=mjsunit/regress/regress-955

Review URL: http://codereview.chromium.org/6903171

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 07:11:17 +00:00
ager@chromium.org
ccafbca61d Use JSON.parse instead of eval for the debugger JSON protocol. 
R=sgjesse@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/6903172

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-02 14:20:34 +00:00
kmillikin@chromium.org
1af840ad4c Be more discriminating about uses of the arguments object in optimized code. 
Because we track the value of the arguments object, we need to check
values whenever plugged into a forbidden value context.  It is not
enough to check at only variable references as we did previously.

R=fschneider@chromium.org
BUG=1351
TEST=regress-1351.js

Review URL: http://codereview.chromium.org/6902202

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-02 11:35:51 +00:00
mmaly@chromium.org
796ac25a4f Strict mode eval declares its locals in its own environment. 
BUG=
TEST=strict-mode.js

Review URL: http://codereview.chromium.org/6883200

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-29 15:31:39 +00:00
lrn@chromium.org
f470cf2777 Handle join of sparse arrays with non-empty separator more efficiently. 
BUG=v8:1028

Review URL: http://codereview.chromium.org/6902144

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-29 08:53:36 +00:00
vegorov@chromium.org
1c950e04cc Fix missing writebarrier in ArraySplice builtin. 
Review URL: http://codereview.chromium.org/6883227

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-28 16:03:40 +00:00
kmillikin@chromium.org
dc28280a82 Fix a bug in a corner case of direct eval detection. 
The corner case is calling a function named 'eval' that is looked up at
runtime and found in a non-global context (but not an extension object).
The bug is that we used the function itself as the receiver rather than
using the global object.

R=ager@chromium.org
TEST=has been added to the eval mjsunit test

Review URL: http://codereview.chromium.org/6893057

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-28 05:04:48 +00:00
jkummerow@chromium.org
bc8f6943bb Support Float64Arrays 
BUG=None
TEST=mjsunit/external-arrays.js; updated cctest; existing unit tests

Review URL: http://codereview.chromium.org/6879009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-21 07:15:43 +00:00
karlklose@chromium.org
3b6fe22c4d Make throw inlineable only if the exception is inlineable. 
BUG=1337
TEST=regress-1337

Review URL: http://codereview.chromium.org/6881079

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-20 09:15:52 +00:00
yurys@chromium.org
5d70a291fe Fix debuger evaluation on a breakpoint inside eval 
Corresponding Chromium issue: http://code.google.com/p/chromium/issues/detail?id=74412
Review URL: http://codereview.chromium.org/6875005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7633 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-15 14:09:45 +00:00
lrn@chromium.org
7aec228dbb Cleanup of mjsunit.js code and make assertEquals more strict. 
Encapsulate the helper functions in mjsunit.js.
Now only exposes the exception class and the assertXXX functions.

Make assertEquals use === instead of ==.
This prevents a lot of possiblefalse positives in tests, and avoids
having to do assertTrue(expected === actual) when you need it.

Fixed some tests that were either buggy or assuming == test.

Review URL: http://codereview.chromium.org/6869007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-15 11:35:36 +00:00
karlklose@chromium.org
dab8f48ebc ARM: Implement correct rounding in the lithium codegenerator. 
This patch provides testing for values that have a fraction part of 0.5 and uses a different rounding method for them. The original method of VFPTruncating the value with round-to-nearest is not correct because it does not round to the larger number in case of a tie.

BUG=http://code.google.com/p/v8/issues/detail?id=958

Review URL: http://codereview.chromium.org/6840051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-15 11:29:01 +00:00
ricow@chromium.org
cfb5a7ee78 Reapply 7581, Fix tools/test.py to allow CTRL+C to work correctly again. 
Buildbot now has python 2.6

Also, remove some semicolons.
Review URL: http://codereview.chromium.org/6871007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-15 09:41:09 +00:00
lrn@chromium.org
3bbcab1ca9 X64: Use roundsd for DoMathFloor. 
TEST=mjsunit/math-floor

Review URL: http://codereview.chromium.org/6835021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-14 09:05:43 +00:00
whesse@chromium.org
98c17a2bf3 Adjust mjsunit.status to account for math-round test passing on ARM when crankshaft is disabled. 
Review URL: http://codereview.chromium.org/6840013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7606 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-13 14:03:24 +00:00
fschneider@chromium.org
9783526239 Enable inlining functions containing throw. 
After Kevin's change to the graph builder to allow aborting graph construction
inside arbitrary expressions this just works.

BUG=v8:1143
Review URL: http://codereview.chromium.org/6839017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7605 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-13 13:09:58 +00:00
lrn@chromium.org
caee8a3ccf Fix Math.round in runtime.cc and x64 optimized code. 
Make math-round.js test check both normal and optimized version.
Add some cases to the tests.

BUG=v8:958
TEST=mjsunit/math-round

Review URL: http://codereview.chromium.org/6837018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-13 09:35:56 +00:00
jkummerow@chromium.org
1d774ac5ca Fix load/store of external float arrays on ARM 
BUG=1323
TEST=mjsunit/regress/regress-1323.js, run with simulator=arm

Review URL: http://codereview.chromium.org/6822054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-12 15:20:26 +00:00
ricow@chromium.org
6baa8a2bde Revert 7581, you can't have try except finally toghetter until python 2.5 
We have some 2.4 versions on the windows buildbots, I will try to have these updated and reapply.
Review URL: http://codereview.chromium.org/6821069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-12 07:46:17 +00:00
ricow@chromium.org
7c0b1af4d7 Fix tools/test.py to allow CTRL+C to work correctly again. 
This also changes the AfterRun functions to allow None as the passed in parameter.
Review URL: http://codereview.chromium.org/6824040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-12 06:26:38 +00:00
jkummerow@chromium.org
ed968b1042 Introduce runtime function %OptimizeFunctionOnNextCall to manually trigger optimization. 
TEST=existing unit tests still pass

Review URL: http://codereview.chromium.org/6821009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7572 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-11 13:24:50 +00:00
mmaly@chromium.org
164e3a4173 Strict mode fixes. 
- mutual inlining strict and non-strict functions in crankshaft.
- assignment to undefined variable with eval in scope.
- propagation of strict mode through lazy compilation.

BUG=
TEST=test/mjsunit/strict-mode.js test/mjsunit/strict-mode-opt.js

Review URL: http://codereview.chromium.org/6814012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-08 14:30:10 +00:00
vegorov@chromium.org
8a8d3bbbee In LCodeGen::DoDeferredLInstanceOfKnownGlobal emit safepoint with registers for the call to stub. 
Review URL: http://codereview.chromium.org/6793017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-07 13:32:45 +00:00
jkummerow@chromium.org
adf509f159 Make "length" and "BYTES_PER_ELEMENT" properties of typed arrays accessible. 
Review URL: http://codereview.chromium.org/6805010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-07 08:24:56 +00:00
yurys@chromium.org
c2e7beb952 Debugger: show local scope before with for functions created inside with block 
Review URL: http://codereview.chromium.org/6804015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-06 17:54:39 +00:00
peterhal@chromium.org
e3d788329a 1309 fix 
BUG=
TEST=

Review URL: http://codereview.chromium.org/6800018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-06 16:22:06 +00:00
jkummerow@chromium.org
348a4e44f5 Add regression test for overlapping key and value registers. 
Review URL: http://codereview.chromium.org/6804007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7510 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-06 11:01:07 +00:00
sgjesse@chromium.org
1244225ba8 Extend crankshaft support for global stores 
All global stores are now supported in crankshaft by using the normal store IC when other optimizations are not possible due to the state of the global object.

R=fschneider@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//6693066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-04 15:03:34 +00:00
sgjesse@chromium.org
1e8079fcc9 Increase coverage of global loads in optimized code 
In the cases where a global property cell cannot be used in the optimized code
use standard load ic to get the property instead of bailing out.

This is re-committing r7212 and r7215 which where reverted in r7239 with the addition of recoring the source position in the hydrogen code for the LoadGlobalCell instruction. To record that position an optional position field has been added to the variable proxy AST node.
Review URL: http://codereview.chromium.org/6758007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-01 11:54:04 +00:00
vegorov@chromium.org
ae65366f0b Fix SlotRef::SlotAddress for parameters indices. 
Fix %NewObjectFromBound to correctly handle optimized frames (including those with inlined functions).

Fix %_IsConstructCall handling in hydrogen: when called from inlined function return false constant directly instead of emiting HIsConstructCall.

Fix success case in TraceInline.

BUG=v8:1229
TEST=test/mjsunit/regress/regress-1229.js

Review URL: http://codereview.chromium.org/6740023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-01 11:41:36 +00:00
ricow@chromium.org
b4bae54ef2 Decrease number of runs in mjsunit/compiler/pic.js (Test still gets optimized, even without --stress-opt) 
Review URL: http://codereview.chromium.org/6731049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7414 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-29 13:20:05 +00:00
sgjesse@chromium.org
1eb224c2a2 ARM: Check for minus zero when converting binary operation result to smi 
The result of an Int32 binary operation will be converted to a smi if it fits. However a minus zero check was missing.

BUG=v8:1278
TEST=test/mjsunit/regress/regress-1278.js

R=ager@chromium.org
Review URL: http://codereview.chromium.org/6755009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-29 07:43:27 +00:00
ricow@chromium.org
e0c7d3cf08 Run array-length less times to make the builder green. 
We still get this method optimized even without --always-opt flag.
Review URL: http://codereview.chromium.org/6719029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-28 08:51:08 +00:00
ricow@chromium.org
fb6d7e17df Follow jsc on not throwing when trying to add a property to a non-extensible object. 
This change makes us compatible with Safari on not throwing when trying to add a property to a non-extensible object. 
Review URL: http://codereview.chromium.org/6712059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-28 06:11:08 +00:00