AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
21,567 Commits 1 Branch 0 Tags 839 MiB
4a709dd658
Commit Graph

3716 Commits

Author SHA1 Message Date
bmeurer
b5e8dd0e12 [turbofan] Raise max virtual registers and call parameter limit. 
Change InstructionOperand to use a 64-bit field for encoding the operand
information instead of the 32-bit field that was used before. Ideally we
wouldn't use the Zone-allocated bit field at all, and use an integer
instead of the pointer; but that requires fixing the register allocator
first, which will take some time.

TEST=mjsunit/compiler/regress-3786
BUG=v8:3786
LOG=y

Review URL: https://codereview.chromium.org/826673002

Cr-Commit-Position: refs/heads/master@{#25941}
 2014-12-25 18:18:04 +00:00
Benedikt Meurer
3f00ce2d59 [turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer. 
TEST=mjsunit/compiler/regress-444695
BUG=chromium:444695
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/824843002

Cr-Commit-Position: refs/heads/master@{#25932}
 2014-12-23 06:54:00 +00:00
jochen
d98d97ee17 Mark mjsunit/setters-on-elements as flaky 
TBR=machenbach@chromium.org
LOG=n
BUG=v8:3784
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/817293002

Cr-Commit-Position: refs/heads/master@{#25929}
 2014-12-22 15:30:46 +00:00
Benedikt Meurer
65e69497ab [turbofan] Correctify lowering of Uint8ClampedArray buffer access. 
TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}
 2014-12-22 08:27:59 +00:00
adamk
1f1329d960 Use SetOwnElement when creating splice records in array length setter 
This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Review URL: https://codereview.chromium.org/820503005

Cr-Commit-Position: refs/heads/master@{#25908}
 2014-12-19 19:39:35 +00:00
Benedikt Meurer
f7e4689061 [turbofan] Fix unsafe out-of-bounds check for checked loads/stores. 
BUG=chromium:443744
LOG=y
TEST=mjsunit/compiler/regress-443744
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/804993004

Cr-Commit-Position: refs/heads/master@{#25901}
 2014-12-19 12:53:29 +00:00
caitpotter88
233f2d2bf1 Simplify scanner and generate better error message for legacy octals in templates 
LOG=N
BUG=
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/812163003

Cr-Commit-Position: refs/heads/master@{#25895}
 2014-12-18 22:01:41 +00:00
arv
c05a4036b0 ES6 template literals should not use legacy octal strings 
Correctly handle SyntaxErrors in escape sequences.

BUG=v8:3736
LOG=Y
R=dslomov@chromium.org, caitpotter88@gmail.com

Review URL: https://codereview.chromium.org/811113002

Cr-Commit-Position: refs/heads/master@{#25891}
 2014-12-18 19:41:58 +00:00
ulan
83e6c7fe26 Temporarily disable mjsunit/debug-stepframe for GC stress until 
crash is fixed.

BUG=v8:3776
LOG=N
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/812283004

Cr-Commit-Position: refs/heads/master@{#25883}
 2014-12-18 14:05:04 +00:00
machenbach
7d48fd9dc2 Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/792233008/) 
Reason for revert:
[sheriff] Still crashes on win32 (XP):
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1380

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f4.
>
> This changes to do an early bailout in
> HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
> loop.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org,arv@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/811593004

Cr-Commit-Position: refs/heads/master@{#25872}
 2014-12-17 19:47:12 +00:00
arv
cc568d1b7a ES6 computed property names 
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f4.

This changes to do an early bailout in
HOptimizedGraphBuilder::VisitObjectLiteral instead of doing that in the later
loop.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/792233008

Cr-Commit-Position: refs/heads/master@{#25868}
 2014-12-17 18:38:55 +00:00
caitpotter88
525385ab50 Fix ArrayConcat for JSValues/JSFunctions/JSRegExps with @@isConcatSpreadable 
LOG=N
BUG=v8:3764, v8:3765
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/799803003

Cr-Commit-Position: refs/heads/master@{#25855}
 2014-12-16 21:08:27 +00:00
arv
2639bfe993 ES6: Update unscopables to match spec 
The spec ended up using Get(unscopables, propertyName) and
comparing the result to undefined instead of using Has.

BUG=v8:3632
LOG=Y
R=adamk, dslomov@chromium.org

Review URL: https://codereview.chromium.org/807893002

Cr-Commit-Position: refs/heads/master@{#25854}
 2014-12-16 20:07:41 +00:00
arv
5f22fdd5ae Revert of ES6 computed property names (patchset #1 id:1 of https://codereview.chromium.org/807173002/) 
Reason for revert:
Crashes Win32. It was not flake.

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> This is a revert of the revert, a76419f0f4 with
> no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
> try again.
>
> BUG=v8:3754
> LOG=Y
> TBR=dslomov@chromium.org

TBR=dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/807033003

Cr-Commit-Position: refs/heads/master@{#25853}
 2014-12-16 19:38:59 +00:00
arv
a235b1076a ES6 computed property names 
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

This is a revert of the revert, a76419f0f4 with
no changes. I cannot reproduce the issue on Win8.1 or WinXP. Letting the bots
try again.

BUG=v8:3754
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/807173002

Cr-Commit-Position: refs/heads/master@{#25851}
 2014-12-16 17:30:05 +00:00
svenpanne
cbf3b0bcc7 More -fsanitize=vptr fixes. 
This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
 2014-12-16 14:20:28 +00:00
marja
978f41a1da RegExpParser: Fix Reset()ting to the end. 
The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}
 2014-12-16 12:14:19 +00:00
caitpotter88
aed5d734e6 Use proper ToLength() operation in %ArrayConcat() 
LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/799853003

Cr-Commit-Position: refs/heads/master@{#25828}
 2014-12-15 19:08:41 +00:00
arv
a76419f0f4 Revert of ES6 computed property names (patchset #9 id:160001 of https://codereview.chromium.org/795573005/) 
Reason for revert:
Crashes on Win32

http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%201/builds/1357

Test: mjsunit/harmony/computed-property-names
Flags: --stress-opt --always-opt
Command: build\Release\d8.exe --test --random-seed=-233815021 --stress-opt --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --harmony-computed-property-names test\mjsunit\mjsunit.js test\mjsunit\harmony\computed-property-names.js

Run #1
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #2
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Run #3
Exit code: -1073741819
Result: CRASH
Expected outcomes: PASS

Original issue's description:
> ES6 computed property names
>
> This adds support for computed property names, under the flag
> --harmony-computed-property-names, for both object literals and
> classes.
>
> BUG=v8:3754
> LOG=Y

TBR=dslomov@chromium.org,wingo@igalia.com
NOTREECHECKS=true
NOTRY=true
BUG=v8:3754

Review URL: https://codereview.chromium.org/809433002

Cr-Commit-Position: refs/heads/master@{#25825}
 2014-12-15 16:38:42 +00:00
jkummerow
c060f4e26c Internalize strings being stored into uninitialized property cells 
Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}
 2014-12-15 15:46:11 +00:00
arv
6e38caf8d3 ES6 computed property names 
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.

BUG=v8:3754
LOG=Y

Review URL: https://codereview.chromium.org/795573005

Cr-Commit-Position: refs/heads/master@{#25821}
 2014-12-15 15:27:19 +00:00
fedor.indutny
f6e68d2c2c Hydrogen: fix keyed loads with string keys 
Keyed loads should not unconditionally be compiled to element loads. Update KeyedLoadICs to keep track of the key type, so that Hydrogen can emit ICs for string-keyed loads it doesn't have inline support for.

BUG=v8:3167
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/755513003

Cr-Commit-Position: refs/heads/master@{#25817}
 2014-12-15 13:36:23 +00:00
mathiasb
b24f04d4c3 Make RegExp.prototype.flags getter configurable 
TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/788053003

Cr-Commit-Position: refs/heads/master@{#25809}
 2014-12-13 22:36:29 +00:00
caitpotter88
48054170e9 Implement ES6 @@isConcatSpreadable / Array.prototype.concat 
Add support for Symbol.isConcatSpreadable in Array.prototype.concat. This enables spreading non-Array objects with the symbol.

LOG=N
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/771483002

Cr-Commit-Position: refs/heads/master@{#25808}
 2014-12-12 18:38:48 +00:00
Benedikt Meurer
14409abc22 [turbofan] Quickfix for invalid number truncation of typed array loads. 
TEST=mjsunit/compiler/regress-int32array-outofbounds-nan
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/803483002

Cr-Commit-Position: refs/heads/master@{#25793}
 2014-12-12 10:45:38 +00:00
caitpotter88
17ba366bb8 Implement Array.from() 
A helpful utility which converts iterables and array-like objects into Arrays

https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.from

LOG=Y
BUG=v8:3336
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/363833006

Cr-Commit-Position: refs/heads/master@{#25785}
 2014-12-11 17:16:27 +00:00
dslomov
e6198a0fed Update tests in preparation for shipping classes. 
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}
 2014-12-11 15:54:09 +00:00
yangguo
dae6dfe08b Implement Math.log2 via ported extract from fdlibm. 
Adapted from Raymond Toy's (rtoy@chromium.org) port, extracted from fdlibm's pow implementation.

R=rtoy@chromium.org
BUG=v8:3579
LOG=N

Review URL: https://codereview.chromium.org/786823003

Cr-Commit-Position: refs/heads/master@{#25768}
 2014-12-11 11:23:37 +00:00
kozyatinskiy
affe4c03b6 [V8] Report v8::AfterCompile and v8::CompileError to listener on pause 
V8 didn't report compile events on pause before this patch. These events can be important for listener. For example, DevTools allows user to execute some JS code on pause and needs to show correct stack trace in message from it.

BUG=396013
R=yurys@chromium.org

Review URL: https://codereview.chromium.org/781623004

Cr-Commit-Position: refs/heads/master@{#25767}
 2014-12-11 10:59:00 +00:00
mathiasb
33f0cf5acd Implement the RegExp.prototype.flags getter 
TEST=mjsunit/harmony
BUG=v8:3751
LOG=N

Review URL: https://codereview.chromium.org/770333005

Cr-Commit-Position: refs/heads/master@{#25762}
 2014-12-10 20:41:10 +00:00
adamk
4fa7ae1c07 Optimize Object.seal and Object.preventExtensions 
They both now run fast (due to utilizing transitions instead of always
creating new maps) and sealed or non-extensible objects can stay in
fast mode after transitioning.

This almost entirely reuses the code for transitioning objects
frozen by Object.freeze(), with the added benefit of freeing
up a bit on the map (we no longer keep track of frozen-ness,
as that bit wasn't used for anything interesting).

BUG=v8:3662,chromium:115960
LOG=y

Review URL: https://codereview.chromium.org/776143005

Cr-Commit-Position: refs/heads/master@{#25759}
 2014-12-10 20:02:59 +00:00
Adam Klein
986e7cefe1 Ensure class prototype objects have the right Map::constructor field 
The null constructor they had previously could be observed as crashes in
the V8 API's Object::CreationContext() method and in Object.observe.

BUG=v8:3750
LOG=n
R=arv@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/787763005

Cr-Commit-Position: refs/heads/master@{#25757}
 2014-12-10 18:25:55 +00:00
ishell
7d13ca278a Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}
 2014-12-10 15:18:52 +00:00
titzer
9a823cf612 Reland "[turbofan] Fix control reducer bug with NTLs." 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/789083004

Cr-Commit-Position: refs/heads/master@{#25740}
 2014-12-10 11:45:35 +00:00
d
4161b54d58 Add Array.prototype.includes 
Requires adding a SameValueZero implementation.

LOG=Y
BUG=v8:3575
R=dslomov@chromium.org, arv@chromium.org
TEST=added to test262

Review URL: https://codereview.chromium.org/771863002

Cr-Commit-Position: refs/heads/master@{#25735}
 2014-12-10 08:58:15 +00:00
dslomov
008405f0b9 Pass --noharmony-scoping to tests validating that we throw on 'const' in strict mode. 
R=marja@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/784323002

Cr-Commit-Position: refs/heads/master@{#25733}
 2014-12-10 08:55:53 +00:00
Benedikt Meurer
19418d76df [x64] Fix optimization for certain checked load/stores. 
BUG=chromium:439743
LOG=y
TEST=mjsunit
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/733893008

Cr-Commit-Position: refs/heads/master@{#25731}
 2014-12-10 07:49:12 +00:00
Ben L. Titzer
a068503b45 Revert "[turbofan] Fix control reducer bug with NTLs." 
This reverts commit aeda76c5cf.

Reason: exposed other TurboFan bugs.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/785233003

Cr-Commit-Position: refs/heads/master@{#25730}
 2014-12-09 16:28:20 +00:00
titzer
aeda76c5cf [turbofan] Fix control reducer bug with NTLs. 
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/789773002

Cr-Commit-Position: refs/heads/master@{#25725}
 2014-12-09 15:09:59 +00:00
Benedikt Meurer
48a6766e78 [x86] Disable invalid checked load/store optimization. 
TEST=mjsunit/compiler/regress-lena
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/784153006

Cr-Commit-Position: refs/heads/master@{#25722}
 2014-12-09 14:16:34 +00:00
dslomov
1954ad8bc1 Do not reflect uninitialized 'let' and 'const' in scope mirrors. 
R=yangguo@chromium.org,aandrey@chromium.org
BUG=v8:3743
LOG=N

Review URL: https://codereview.chromium.org/758603004

Cr-Commit-Position: refs/heads/master@{#25712}
 2014-12-08 14:59:28 +00:00
jochen
97c1f4b15c Turn on DCHECKs and other debugging code if dcheck_always_on is 1 
When compiling with the macro DCHECK_ALWAYS_ON defined, DCHECKs and
supporting code gets compiled and enabled.

This increases test coverage for chromium release buildbots

BUG=v8:3731
R=jkummerow@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/760213005

Cr-Commit-Position: refs/heads/master@{#25701}
 2014-12-08 09:26:16 +00:00
dslomov
293f898a6f Make sure that individual shipping features can be disabled. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/779203005

Cr-Commit-Position: refs/heads/master@{#25690}
 2014-12-05 15:35:37 +00:00
dslomov
bd04e6cdad Fix the order of context binding/simulate insertion for BlockContexts. 
R=jarin@chromium.org
BUG=v8:3741
LOG=N

Review URL: https://codereview.chromium.org/762393008

Cr-Commit-Position: refs/heads/master@{#25684}
 2014-12-05 13:06:50 +00:00
arv
edf3dab466 ES6 template literals: Fix issue with template after rbrace 
If we hade }` the right brace was always treated as part of the
template literal. We should only treat the right brace as part of
the literal when we continue to parse the template literal after a
placeholder.

BUG=v8:3734
LOG=Y

Review URL: https://codereview.chromium.org/778813003

Cr-Commit-Position: refs/heads/master@{#25661}
 2014-12-04 14:50:17 +00:00
arv
d67e573dbe Simplify template literal raw string creation 
BUG=v8:3710
LOG=Y
R=dslomov@chromium.org, marja@chromium.org

Review URL: https://codereview.chromium.org/768203002

Cr-Commit-Position: refs/heads/master@{#25640}
 2014-12-03 14:17:23 +00:00
ulan
2ac522ab15 Reland parts of 'Use weak cells in map checks in polymorphic ICs' 
This relands macroassembler instructions and weak cell caching and
does not include parts that caused "Linux ASan LSan" test failures.

BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/764003003

Cr-Commit-Position: refs/heads/master@{#25615}
 2014-12-02 14:25:26 +00:00
svenpanne
c16b8f6cbb Fixed environment handling for LFlooringDivI on ARM. 
Beautiful code... :-}

BUG=chromium:437765
LOG=y

Review URL: https://codereview.chromium.org/775613002

Cr-Commit-Position: refs/heads/master@{#25613}
 2014-12-02 13:47:19 +00:00
marja
0a0e6c8c81 ES6 unicode extensions, part 1. 
Allows \u{xxxxx} in variable names and string literals (not yet in regexps).

Everything's behind the --harmony-unicode flag.

BUG=

Review URL: https://codereview.chromium.org/716423002

Cr-Commit-Position: refs/heads/master@{#25603}
 2014-12-02 10:58:19 +00:00
machenbach
d9c83f6bd0 Revert of Use weak cells in map checks in polymorphic ICs. (patchset #8 id:140001 of https://codereview.chromium.org/753993003/) 
Reason for revert:
[Sheriff] Speculative revert for breaking chromium asan (roll blocker):
http://build.chromium.org/p/client.v8/builders/Linux%20ASan%20LSan%20Tests%20%281%29/builds/1683

Original issue's description:
> Use weak cells in map checks in polymorphic ICs.
>
> BUG=v8:3663
> LOG=N

TBR=mvstanton@chromium.org,akos.palfi@imgtec.com,weiliang.lin@intel.com,ulan@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=v8:3663

Review URL: https://codereview.chromium.org/771033003

Cr-Commit-Position: refs/heads/master@{#25597}
 2014-12-02 08:17:05 +00:00
dslomov
573401a422 harmony-classes: Fix some issues with syntactic restriction on super(...). 
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/770843002

Cr-Commit-Position: refs/heads/master@{#25589}
 2014-12-01 20:13:54 +00:00
ulan
45a36948e1 Use weak cells in map checks in polymorphic ICs. 
BUG=v8:3663
LOG=N

Review URL: https://codereview.chromium.org/753993003

Cr-Commit-Position: refs/heads/master@{#25581}
 2014-12-01 10:41:14 +00:00
dslomov
9e02e98771 Introduce a kill-switch for shipping features. 
R=rossberg@chromium.org
TBR=hpayer@chromium.org

Committed: d628562086

Review URL: https://codereview.chromium.org/763273002

Cr-Commit-Position: refs/heads/master@{#25577}
 2014-11-28 20:07:18 +00:00
dslomov
557bf53b79 Revert of Introduce a kill-switch for shipping features. (patchset #2 id:20001 of https://codereview.chromium.org/763273002/) 
Reason for revert:
Reverted for breaking nosnap: http://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20nosnap/builds/1003/steps/Check/logs/Threading3

Original issue's description:
> Introduce a kill-switch for shipping features.
>
> R=rossberg@chromium.org
>
> Committed: d628562086

TBR=rossberg@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/763353002

Cr-Commit-Position: refs/heads/master@{#25574}
 2014-11-28 18:27:55 +00:00
aandrey
cec0acad38 Expose generator object internal properties via mirrors. 
BUG=v8:3292
R=yangguo@chromium.org, wingo@igalia.com
LOG=N

Review URL: https://codereview.chromium.org/760303002

Cr-Commit-Position: refs/heads/master@{#25571}
 2014-11-28 14:49:08 +00:00
Dmitry Lomov
d628562086 Introduce a kill-switch for shipping features. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/763273002

Cr-Commit-Position: refs/heads/master@{#25570}
 2014-11-28 14:32:17 +00:00
dslomov
65aa17b9c3 harmony-classes: Implement 'super(...)' call syntactic restriction. 
R=rossberg@chromium.org,arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/766663003

Cr-Commit-Position: refs/heads/master@{#25555}
 2014-11-28 04:08:58 +00:00
dslomov
34702e9d59 Set @@toStringTag on GeneratorFunction prototype. 
R=caitpotter88@gmail.com
BUG=v8:3502
LOG=N

Review URL: https://codereview.chromium.org/764823002

Cr-Commit-Position: refs/heads/master@{#25550}
 2014-11-27 16:09:43 +00:00
ishell
1a2e4b265a Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map. 
BUG=chromium:436820
LOG=N

Review URL: https://codereview.chromium.org/759823004

Cr-Commit-Position: refs/heads/master@{#25530}
 2014-11-26 17:37:05 +00:00
caitpotter88
0ea30611f3 Fix raw TemplateLiteral spans with non-ascii characters 
BUG=v8:3710

Review URL: https://codereview.chromium.org/745233002

Cr-Commit-Position: refs/heads/master@{#25529}
 2014-11-26 17:15:54 +00:00
titzer
9da4998204 Abort optimization in corner case. 
The %OptimizeFunctionOnNextCall sledgehammer can cause a function to be
marked for optimization before it's ever been compiled by fullcode.
This can lead to the situation where a function doesn't have optimization
disabled until we try to compile it optimized.

Basically, the assert should just handle this case more gracefully.

R=yangguo@chromium.org
BUG=436893
LOG=Y

Review URL: https://codereview.chromium.org/760063002

Cr-Commit-Position: refs/heads/master@{#25528}
 2014-11-26 16:57:52 +00:00
jarin
97cab985b8 Do not try to inline if the function has an illegal redeclaration. 
R=mvstanton@chromium.org
BUG=chromium:436896
LOG=n

Review URL: https://codereview.chromium.org/755333003

Cr-Commit-Position: refs/heads/master@{#25527}
 2014-11-26 16:32:46 +00:00
dslomov
626f110f0b Introduce legacy const slots in correct context. 
R=rossberg@chromium.org
BUG=chromium:410030
LOG=Y

Review URL: https://codereview.chromium.org/756293004

Cr-Commit-Position: refs/heads/master@{#25519}
 2014-11-26 12:16:30 +00:00
rodolph.perfetta
55614cfe69 [turbofan] Recognize rotate right. 
Extended the rotate left detection code.

BUG=

Review URL: https://codereview.chromium.org/760523004

Cr-Commit-Position: refs/heads/master@{#25517}
 2014-11-26 11:49:43 +00:00
dslomov
6ac4de87a8 harmony-scoping: make assignment to 'const' a late error. 
Per TC39 Nov 2014 decision.

This patch also changes behavior for "legacy const": assignments to sloppy const in strict mode is now also a type error. This fixes v8:2243 and also brings us in compliance with other engines re assignment to function names (see updated webkit test), but might have bigger implications.
That change can easily be reverted by changing Variable::IsSignallingAssignmentToConst.

BUG=v8:3713,v8:2243
LOG=N

Review URL: https://codereview.chromium.org/749633002

Cr-Commit-Position: refs/heads/master@{#25516}
 2014-11-26 11:21:23 +00:00
Benedikt Meurer
560b0c4534 [arm] Fix recognition of VNEG. 
TEST=mjsunit,unittests
R=svenpanne@chromium.org

Committed: 2aed882fe7

Review URL: https://codereview.chromium.org/762493006

Cr-Commit-Position: refs/heads/master@{#25515}
 2014-11-26 11:18:58 +00:00
machenbach
86f6123ade Revert of [arm] Fix recognition of VNEG. (patchset #3 id:40001 of https://codereview.chromium.org/762493006/) 
Reason for revert:
Breaks arm compilation.

Original issue's description:
> [arm] Fix recognition of VNEG.
>
> TEST=mjsunit,unittests
> R=svenpanne@chromium.org
>
> Committed: 2aed882fe7

TBR=svenpanne@chromium.org,bmeurer@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/751653004

Cr-Commit-Position: refs/heads/master@{#25514}
 2014-11-26 11:07:23 +00:00
Benedikt Meurer
2aed882fe7 [arm] Fix recognition of VNEG. 
TEST=mjsunit,unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/762493006

Cr-Commit-Position: refs/heads/master@{#25513}
 2014-11-26 10:46:37 +00:00
machenbach
38a111c4b2 Mark slow tests as slow. 
TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/755283004

Cr-Commit-Position: refs/heads/master@{#25511}
 2014-11-26 08:51:48 +00:00
dslomov
f1d8668e38 harmony-scoping: Catch variable should be VAR, not LET 
R=rossberg@chromium.org
BUG=v8:2858
LOG=N

Review URL: https://codereview.chromium.org/748113003

Cr-Commit-Position: refs/heads/master@{#25503}
 2014-11-25 14:48:39 +00:00
jarin
322bb23e82 [turbofan] Insert appropriate conversions for typed array stores. 
BUG=

Review URL: https://codereview.chromium.org/758643003

Cr-Commit-Position: refs/heads/master@{#25496}
 2014-11-25 08:40:29 +00:00
jarin
d9cabb9b22 [turbofan] Fix matching of the lea instruction. 
Resets the scaled exponent to 0 when the scaling match fails.

BUG=

Review URL: https://codereview.chromium.org/756643002

Cr-Commit-Position: refs/heads/master@{#25491}
 2014-11-24 17:45:33 +00:00
Yang Guo
fc22bf2e8d Disable regress-3717 for gc-stress. 
TBR=ulan@chromium.org
BUG=v8:3723
LOG=N

Review URL: https://codereview.chromium.org/749283002

Cr-Commit-Position: refs/heads/master@{#25489}
 2014-11-24 16:29:23 +00:00
yangguo
270dccf6db Correctly find shared function info for debugging when compiling eagerly. 
R=ulan@chromium.org
BUG=v8:3717
LOG=N

Review URL: https://codereview.chromium.org/758523004

Cr-Commit-Position: refs/heads/master@{#25486}
 2014-11-24 15:43:35 +00:00
yangguo
14a3b9188d Fix RegExp.source for uncompiled regexp. 
R=jkummerow@chromium.org
BUG=435825
LOG=N

Review URL: https://codereview.chromium.org/753983002

Cr-Commit-Position: refs/heads/master@{#25476}
 2014-11-24 11:21:52 +00:00
svenpanne
be0fcaa2bc Added test cases for truncating stores. 
Review URL: https://codereview.chromium.org/741643003

Cr-Commit-Position: refs/heads/master@{#25474}
 2014-11-24 10:42:26 +00:00
yangguo
5414c39974 Slightly improve tests that rely on lazy compilation. 
R=rossberg@chromium.org
BUG=v8:3712
LOG=N

Review URL: https://codereview.chromium.org/743843003

Cr-Commit-Position: refs/heads/master@{#25463}
 2014-11-21 12:41:06 +00:00
yangguo
61bee5c898 Correctly escape RegExp source. 
R=ulan@chromium.org
BUG=v8:3229
LOG=N

Review URL: https://codereview.chromium.org/736003002

Cr-Commit-Position: refs/heads/master@{#25457}
 2014-11-21 10:50:24 +00:00
Michael Stanton
cf572694fe Assert to protect against polymorphic string loads fires on valid stores. 
BUG=435477
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/751513002

Cr-Commit-Position: refs/heads/master@{#25456}
 2014-11-21 10:29:08 +00:00
Michael Stanton
3d58b82add Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed. 
The bug was an error when copying arrays in crankshaft. If it's a holey smi
array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation
changes from being inserted that deopt on encountering the hole.

Also, prevent inlining array pop() and shift() if the length is read-only.

BUG=435073
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/737383002

Cr-Commit-Position: refs/heads/master@{#25455}
 2014-11-21 10:14:19 +00:00
caitpotter88
ad86a1a27a Cache template literal callSiteObj 
BUG=v8:3230
LOG=y

Review URL: https://codereview.chromium.org/742643003

Cr-Commit-Position: refs/heads/master@{#25450}
 2014-11-20 22:37:55 +00:00
dslomov
5aed61cc38 Rename String.prototype.contains to 'includes'. 
Per TC39 Nov 2014 decison.

R=arv@chromium.org,yangguo@chromium.org
LOG=Y

Committed: b5379216e2

Review URL: https://codereview.chromium.org/742963002

Cr-Commit-Position: refs/heads/master@{#25448}
 2014-11-20 19:21:36 +00:00
ulan
dc88962350 Do not bailout from optimizing functions that use f(x, arguments) 
if there is not enough type-feedback to detect that f is Function.prototype.apply.

BUG=v8:3709
LOG=N
TEST=mjsunit/regress/regress-3709

Review URL: https://codereview.chromium.org/736043002

Cr-Commit-Position: refs/heads/master@{#25447}
 2014-11-20 17:07:44 +00:00
yangguo
c64b47f552 When optimizing deserialized code, make sure IC state is preserved. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/737373003

Cr-Commit-Position: refs/heads/master@{#25444}
 2014-11-20 16:20:56 +00:00
Rodolph Perfetta
481772acdd [turbofan] remove redundant '& 0x1F' for shifts. 
JavaScript shifts perform an implicit '& 0x1F' on their right operand, this
patch removes it when the underlying architecture already does it.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/732103002

Cr-Commit-Position: refs/heads/master@{#25438}
 2014-11-20 13:09:26 +00:00
Andreas Rossberg
4f63564700 Fix lower bound violation 
R=jarin@chromium.org
BUG=433332
LOG=N

Review URL: https://codereview.chromium.org/739563002

Cr-Commit-Position: refs/heads/master@{#25436}
 2014-11-20 11:22:49 +00:00
Andreas Rossberg
1808badc2d Disable classes in sloppy mode unless --harmony-sloppy is set 
Also clean up flag names a little.

Baseline: https://codereview.chromium.org/713413003/

R=arv@chromium.org, dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/722203006

Cr-Commit-Position: refs/heads/master@{#25435}
 2014-11-20 10:52:03 +00:00
yangguo
529ff0cfbf Implement log10 via fdlibm port. 
R=rtoy@chromium.org
BUG=v8:3579
LOG=N

Review URL: https://codereview.chromium.org/739913003

Cr-Commit-Position: refs/heads/master@{#25433}
 2014-11-20 09:37:27 +00:00
machenbach
b3acdf5347 Revert of Rename String.prototype.contains to 'includes'. (patchset #1 id:1 of https://codereview.chromium.org/742963002/) 
Reason for revert:
Breaks test262-es6:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/1289

Original issue's description:
> Rename String.prototype.contains to 'includes'.
>
> Per TC39 Nov 2014 decison.
>
> R=arv@chromium.org,yangguo@chromium.org
> LOG=Y
>
> Committed: b5379216e2

TBR=arv@chromium.org,yangguo@chromium.org,dslomov@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/745543002

Cr-Commit-Position: refs/heads/master@{#25432}
 2014-11-20 09:03:54 +00:00
dslomov
2dae17fb87 Rename String.prototype.contains to 'includes'. 
Per TC39 Nov 2014 decison.

R=arv@chromium.org,yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/742963002

Cr-Commit-Position: refs/heads/master@{#25430}
 2014-11-20 00:32:13 +00:00
dslomov
69990745f7 Remove Weak{Map,Set}.prototype.clear. 
Per Nov 2014 TC39 decision.

R=adamk@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/739303002

Cr-Commit-Position: refs/heads/master@{#25429}
 2014-11-19 21:53:01 +00:00
aandrey
f07b0f214b Allow stepping into Object.observe handlers. 
BUG=chromium:432468
R=yangguo@chromium.org, adamk@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/739523002

Cr-Commit-Position: refs/heads/master@{#25423}
 2014-11-19 15:16:40 +00:00
Michael Stanton
cfa1f94781 Revert "Re-land r25392 Use a stub in crankshaft for grow store arrays." 
Due to performance issue.
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735323002

Cr-Commit-Position: refs/heads/master@{#25421}
 2014-11-19 14:08:43 +00:00
ishell
f3d1888fdb PropertyDetails cleanup: NORMAL property type merged with FIELD. 
First step towards replacing PropertyType with two enums: {DATA,ACCESSOR} x {CONST,WRITABLE}.

Review URL: https://codereview.chromium.org/733253004

Cr-Commit-Position: refs/heads/master@{#25417}
 2014-11-19 11:45:34 +00:00
caitpotter88
99a9d68d94 Implement ES6 String.raw behind --harmony-templates 
BUG=

Review URL: https://codereview.chromium.org/731573004

Cr-Commit-Position: refs/heads/master@{#25410}
 2014-11-19 04:44:44 +00:00
arv
d5d15253b8 Classes: Expand test to cover strict runtime behavior 
This tests that the extends expression is treated as strict at
runtime and not just at parse time.

BUG=v8:3330
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/729323003

Cr-Commit-Position: refs/heads/master@{#25407}
 2014-11-18 19:00:15 +00:00
dslomov
ca8eaef638 harmony-scoping: better error messages for let declarations in sloppy mode. 
R=rossberg@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/713413003

Cr-Commit-Position: refs/heads/master@{#25406}
 2014-11-18 18:51:26 +00:00
yangguo
5bea77f786 Fix disabling all break points from within the debug event callback. 
BUG=chromium:432493
LOG=Y

Review URL: https://codereview.chromium.org/728103008

Cr-Commit-Position: refs/heads/master@{#25400}
 2014-11-18 14:57:48 +00:00
Michael Stanton
47f55baeaf Re-land r25392 Use a stub in crankshaft for grow store arrays. 
Code was vulnerable to different evaluation order in Clang.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/726693004

Cr-Commit-Position: refs/heads/master@{#25397}
 2014-11-18 14:31:00 +00:00
Michael Stanton
77ee440af1 Revert "Use a stub in crankshaft for grow store arrays." 
This reverts commit d40204f84c.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735653003

Cr-Commit-Position: refs/heads/master@{#25393}
 2014-11-18 13:08:07 +00:00
Michael Stanton
d40204f84c Use a stub in crankshaft for grow store arrays. 
We were deopting without learning anything.

BUG=v8:3417
LOG=N
R=danno@chromium.org

Review URL: https://codereview.chromium.org/368263003

Cr-Commit-Position: refs/heads/master@{#25392}
 2014-11-18 12:32:24 +00:00
Benedikt Meurer
1d4dfd9ac4 [turbofan] Push JSToNumber conversions into Phis. 
This essentially performs the following transformation

  JSToNumber(phi(x1,...,xn,control):primitive)
    => phi(JSToNumber(x1),...,JSToNumber(xn),control):number

which is similar to what we already do for JSToBoolean.

TEST=mjsunit/asm
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/732463003

Cr-Commit-Position: refs/heads/master@{#25390}
 2014-11-18 11:34:21 +00:00
aandrey
407d1dfb87 Allow stepping into Promise handlers. 
BUG=chromium:432468
R=yangguo@chromium.org, adamk@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/734163002

Cr-Commit-Position: refs/heads/master@{#25389}
 2014-11-18 09:50:32 +00:00
dslomov
d7e3697ddc harmony-scoping: Implement debugger support for script scope. 
We add a new ScopeType, ScopeType.Script. The scope with
ScopeType.Script is always present in the scope chain (ScopeIterator
fakes it if neededi - i.e. if ScriptContext for a script has not been
allocated since that script has no lexical declarations).
ScriptScope reflects ScriptContextTable.

R=yurys@chromium.org,yangguo@chromium.org
BUG=v8:3690
LOG=N

Review URL: https://codereview.chromium.org/726643002

Cr-Commit-Position: refs/heads/master@{#25383}
 2014-11-17 17:58:12 +00:00
Andrey Adaikin
685bc04a01 Expose internal properties of map/set iterators via mirrors. 
R=yangguo@chromium.org, vsevik
LOG=Y

Committed: https://code.google.com/p/v8/source/detail?r=d5f5d38f73f43eba9658d91ffbe511af8c340d78

Review URL: https://codereview.chromium.org/710273002

Cr-Commit-Position: refs/heads/master@{#25380}
 2014-11-17 12:48:29 +00:00
Michael Starzinger
e9a3d153ed Remove left-over generated runtime test from mjsunit. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/734633002

Cr-Commit-Position: refs/heads/master@{#25372}
 2014-11-17 10:50:57 +00:00
Jakob Kummerow
bf22724e0d Fix one more missing c0_ < 0 check in scanner 
BUG=chromium:433766
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/731953003

Cr-Commit-Position: refs/heads/master@{#25371}
 2014-11-17 09:43:31 +00:00
Jaroslav Sevcik
c3af691e72 [turbofan] Remove int32 narrowing during typed lowering. 
With Int32Add we lose the int/uint distinction, so later, in simplified lowering we can make a wrong decision. E.g., see the attached test case, where we lower NumberAdd -> Int32Add because inputs are Uint32, but during simplified lowering we change the inputs to Int32, so we get a wrong result.

Simplified lowering will lower the NumberAdd operations anyway, so we should lose performance.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/721723004

Cr-Commit-Position: refs/heads/master@{#25368}
 2014-11-17 09:04:52 +00:00
arv
ef41de10db Classes: Add support for stepping through default constructors 
If a class extends another class and it doesn't provide a constructor,
one is created for them. We therefore need to ensure that stepping into
the constructor steps into the super class constructor.

BUG=v8:3674
LOG=Y
R=dslomov@chromium.org, aandrey , yurys

Review URL: https://codereview.chromium.org/725983002

Cr-Commit-Position: refs/heads/master@{#25366}
 2014-11-15 19:48:39 +00:00
adamk
4a4158f363 Throw as per spec when modifying an Array with builtin methods 
BUG=v8:3684
LOG=n

Review URL: https://codereview.chromium.org/726773002

Cr-Commit-Position: refs/heads/master@{#25364}
 2014-11-14 19:42:15 +00:00
adamk
b17eaaa575 Fix desugaring of let bindings in for loops to handle continue properly 
This requires putting the original loop's body inside an inner for loop (with
the same labels as the original loop) and re-binding the temp variables in its
"next" expression. A second flag is added to the desugared code to ensure the
loop body executes at most once per loop.

BUG=v8:3683
LOG=y

Review URL: https://codereview.chromium.org/720863002

Cr-Commit-Position: refs/heads/master@{#25363}
 2014-11-14 19:33:23 +00:00
caitpotter88
353b696467 Implement ES6 Template Literals 
BUG=v8:3230

Review URL: https://codereview.chromium.org/663683006

Cr-Commit-Position: refs/heads/master@{#25362}
 2014-11-14 18:53:52 +00:00
arv
f3d5b13e04 Classes: Implement correct name binding 
Named class declarations and class expression have a const binding for
the name that is in TDZ for the extends expression.

BUG=v8:3330
LOG=Y
R=dslomov@chromium.org, adamk

Review URL: https://codereview.chromium.org/722793005

Cr-Commit-Position: refs/heads/master@{#25360}
 2014-11-14 15:05:20 +00:00
Dmitry Lomov
7e69b2f996 Implement 'setVariableValue' for debugger block scopes. 
R=aandrey@chromium.org, rossberg@chromium.org, yurys@chromium.org
BUG=v8:3690
LOG=N

Review URL: https://codereview.chromium.org/732543002

Cr-Commit-Position: refs/heads/master@{#25358}
 2014-11-14 13:39:20 +00:00
Ben L. Titzer
cf85209035 Do not do field type tracking with GC stress. 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/718393004

Cr-Commit-Position: refs/heads/master@{#25355}
 2014-11-14 11:36:44 +00:00
Ben L. Titzer
3bcea483a7 Remove arguments arity check in mjsunit because it vastly slows down the tests. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/724133004

Cr-Commit-Position: refs/heads/master@{#25353}
 2014-11-14 10:30:25 +00:00
Benedikt Meurer
45ff9d53c5 [turbofan] Optimize remainder of integer division by unknown power of two. 
Drive-by-Fix: minint % 0 was broken on ARM, but we didn't notice because
there was no test covering that case...

TEST=msjunit
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/727673002

Cr-Commit-Position: refs/heads/master@{#25347}
 2014-11-14 08:21:18 +00:00
ishell@chromium.org
2e38f33911 Revert "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Revert "Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136."

This revert is made in order to revert r25099 which potentially causes renderer hangs.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/722873004

Cr-Commit-Position: refs/heads/master@{#25332}
 2014-11-13 15:31:04 +00:00
Adrian Perez
ddcd08b1d1 Implement .of() on typed arrays 
BUG=v8:3578
LOG=Y
R=dslomov@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/660863003

Patch from Adrian Perez <aperez@igalia.com>.

Cr-Commit-Position: refs/heads/master@{#25325}
 2014-11-13 11:20:13 +00:00
ishell@chromium.org
bc8c41c08d Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions. 
It started showing after r25253.

BUG=v8:3687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/715313003

Cr-Commit-Position: refs/heads/master@{#25324}
 2014-11-13 10:56:31 +00:00
Michael Starzinger
2f09dcbd20 Enable harmony tests for TurboFan that now pass. 
R=jarin@chromium.org
TEST=mjsunit/harmony

Review URL: https://codereview.chromium.org/723983002

Cr-Commit-Position: refs/heads/master@{#25320}
 2014-11-13 09:44:00 +00:00
Jaroslav Sevcik
2d075e2298 Reland "[turbofan] Weakening of types must weaken ranges inside unions." 
This relands commit 4c1f4b796d.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/723023002

Cr-Commit-Position: refs/heads/master@{#25317}
 2014-11-13 09:02:14 +00:00
Yang Guo
b96309b776 Move public symbols to the root set. 
This allows serializing public symbols that are embedded in code.

BUG=v8:3689
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722723002

Cr-Commit-Position: refs/heads/master@{#25315}
 2014-11-13 08:48:08 +00:00
Jaroslav Sevcik
c513297f9f Revert "[turbofan] Weakening of types must weaken ranges inside unions." 
This reverts commit 4c1f4b796d.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722943003

Cr-Commit-Position: refs/heads/master@{#25312}
 2014-11-13 06:10:42 +00:00
Jaroslav Sevcik
4c1f4b796d [turbofan] Weakening of types must weaken ranges inside unions. 
BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/712623002

Cr-Commit-Position: refs/heads/master@{#25311}
 2014-11-13 05:31:47 +00:00
jkummerow@chromium.org
fd9a4df561 Skip regress-crbug-137689.js when running with GC stress 
It depends on maps not disappearing prematurely.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/720853002

Cr-Commit-Position: refs/heads/master@{#25302}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 16:06:24 +00:00
wingo@igalia.com
757f400246 Leaving a generator via an exception causes it to close 
R=rossberg@chromium.org
BUG=v8:3096
LOG=Y

Review URL: https://codereview.chromium.org/717123002

Cr-Commit-Position: refs/heads/master@{#25297}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 14:29:22 +00:00
yangguo@chromium.org
e201eb9a9e Temporarily disable test due to not being compatible with the serializer. 
TBR=dslomov@chromium.org
BUG=v8:3689
LOG=N

Review URL: https://codereview.chromium.org/697893004

Cr-Commit-Position: refs/heads/master@{#25296}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 14:27:08 +00:00
bmeurer@chromium.org
24d288cb8a Fix copyright headers. 
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/720793002

Cr-Commit-Position: refs/heads/master@{#25295}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 13:29:57 +00:00
dslomov@chromium.org
0e2f7e3c35 Re-enable serialization under harmony-scoping. 
R=yangguo@chromium.org
BUG=v8:3689
LOG=N

Review URL: https://codereview.chromium.org/717153002

Cr-Commit-Position: refs/heads/master@{#25294}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 13:12:50 +00:00
yangguo@chromium.org
1dbd6369b1 Correctly compute line numbers in functions from the function constructor. 
R=aandrey@chromium.org
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/701093003

Cr-Commit-Position: refs/heads/master@{#25289}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 10:06:47 +00:00
yangguo@chromium.org
4fd9ba9042 Reland "Fix stepping in for-loops." 
BUG=v8:3634
LOG=N
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/688243005

Cr-Commit-Position: refs/heads/master@{#25279}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 08:26:42 +00:00
arv@chromium.org
aa6815c79a Classes: Add support for arguments in default constructor 
This is currently done by generating a default constructor that looks
like this:

  constructor() {
    %DefaultConstructorSuperCall();
  }

The a runtime function implements the logic which is pretty similar to
Runtime_Apply except that it uses the [[Prototype]] of the current
function.

This is the second try. The first failed because the test was using a
array that was too large for Function.prototype.apply.

Revert "Revert "Classes: Add support for arguments in default constructor""

This reverts commit 43aa7e541df56a132608b8b4217e9da84575e4f8.

BUG=v8:3672
LOG=Y
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/716853003

Cr-Commit-Position: refs/heads/master@{#25272}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 21:36:16 +00:00
arv@chromium.org
84741e76a3 ES6: Add support for super in object literals 
This only available under --harmony-classes

BUG=v8:3571
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/718473002

Cr-Commit-Position: refs/heads/master@{#25271}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 19:54:56 +00:00
adamk@chromium.org
1386257c55 Correctly handle Array unshift/splices that move elements past the max length of an Array 
BUG=v8:2615
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/679113003

Cr-Commit-Position: refs/heads/master@{#25270}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 19:08:14 +00:00
arv@chromium.org
6a5cd94676 Revert "Classes: Add support for arguments in default constructor" 
This reverts commit 3f4ea6c91a962a04407c79f08e5c86ce9ff2911a.

Broke tests on Mac64

http://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/923/steps/Check/logs/classes

BUG=v8:3672
TBR=dslomov@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/712333003

Cr-Commit-Position: refs/heads/master@{#25269}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 16:22:47 +00:00
arv@chromium.org
3a91adaec8 Classes: Add support for arguments in default constructor 
This is currently done by generating a default constructor that looks
like this:

  constructor() {
    %DefaultConstructorSuperCall();
  }

The a runtime function implements the logic which is pretty similar to
Runtime_Apply except that it uses the [[Prototype]] of the current
function.

BUG=v8:3672
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/692333011

Cr-Commit-Position: refs/heads/master@{#25268}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 15:55:30 +00:00
jkummerow@chromium.org
3b3929fdc7 Reland "Avoid some unnecessary fast-properties map creations." 
This relands commit ea74f0f85a.

The revert was due to failures in cctest/test-heap/ReleaseOverReservedPages,
caused by apparent changes to memory layout and fragmentation of the
first page. Eliminating a situation in messages.js where this CL has had
an effect on map transitions seems to solve the issue.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/714883003

Cr-Commit-Position: refs/heads/master@{#25266}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 15:41:30 +00:00
aandrey@chromium.org
4984224af2 Add optional max elements limit for Map/Set mirror iterator preview. 
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/712083002

Cr-Commit-Position: refs/heads/master@{#25257}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 09:47:19 +00:00
jkummerow@chromium.org
d3b68cf370 Fix has_constant_parameter_count() confusion in LReturn 
BUG=chromium:431602
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/714663002

Cr-Commit-Position: refs/heads/master@{#25249}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 15:25:50 +00:00
titzer@chromium.org
b9886ae9ff Fix bugs in simplified lowering relating to int32/uint32 signs. 
Lowering of NumberToUint32 and NumberToInt32 was not correctly accounting for the sign of the input and the sign of the output, emitting the wrong representation changes.

Along the way, I've found cases where MachineOperatorBuilder would break if fed a machine type for loads or stores that was not cached, requiring MachineOperatorBuilder to take zone to allocate operators for these cases.

R=bmeurer@chromium.org, jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/714613002

Cr-Commit-Position: refs/heads/master@{#25247}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25247 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 14:28:42 +00:00
yangguo@chromium.org
4a6d092fdf Revert "Fix stepping in for-loops." 
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/713813002

Cr-Commit-Position: refs/heads/master@{#25233}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25233 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 09:36:16 +00:00
yangguo@chromium.org
3bed0a171a Fix stepping in for-loops. 
R=ulan@chromium.org
BUG=v8:3634
LOG=N

Review URL: https://codereview.chromium.org/682413004

Cr-Commit-Position: refs/heads/master@{#25231}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 09:08:11 +00:00
bmeurer@chromium.org
8977e3d5e4 [arm] Recognize SXTB, SXTH, UXTB and UXTH. 
TEST=cctest,msjunit/asm,unittests
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/709123005

Cr-Commit-Position: refs/heads/master@{#25228}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 05:49:17 +00:00
arv@chromium.org
c24ebcd387 Revert "Avoid some unnecessary fast-properties map creations." 
This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2.

Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa..

BUG=None
LOG=N
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/709123002

Cr-Commit-Position: refs/heads/master@{#25224}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 18:49:45 +00:00
danno@chromium.org
9a58807030 [turbofan] Optimize add operations to use 'leal' instruction on x64 
Add MemoryOperandMatcher that recognizes node clusters in the form
[%r1 + %r2*SCALE + OFFSET] and explicit support in the x64 Int32Add
selector to use it to translate complex adds to 'leal' instructions.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/704713003

Cr-Commit-Position: refs/heads/master@{#25223}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 16:47:45 +00:00
arv@chromium.org
b86c30a2b3 Classes: Partial fix for constructor not calling super 
Introduce two new function kind, one for default constructor and one
for default constructor call super. Then when we are about to pares
these we just generate the correct AST in source.

BUG=v8:3661, v8:3672
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/700523003

Cr-Commit-Position: refs/heads/master@{#25222}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 16:39:27 +00:00
jkummerow@chromium.org
ea74f0f85a Avoid some unnecessary fast-properties map creations. 
(1) When we have just normalized and re-fastified a map, we don't need to copy it again to set the is_prototype bit.
(2) When defining accessors causes a non-prototype object to go slow, don't force re-fastification.

BUG=v8:3267
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/706243002

Cr-Commit-Position: refs/heads/master@{#25221}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 16:33:47 +00:00
marja@chromium.org
2b026851ac Scanner: disallow unicode escapes in regexp flags. 
The spec explicitly forbids them. V8 never handled them properly either, just
the Scanner accepted them (it had code to add them literally to the
LiteralBuffer) and later on, Regexp constructor disallowed them.

According to the spec, unicode escapes in regexp flags should be an early error
("It is a Syntax Error if IdentifierPart contains a Unicode escape sequence.").

Note that Scanner is still more relaxed about regexp flags than the
spec. Especially, it accepts any identifier parts (not just a small set of
letters) and doesn't check for duplicates.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/700373003

Cr-Commit-Position: refs/heads/master@{#25215}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 14:32:19 +00:00
jarin@chromium.org
364cec0034 [turbofan] Fix deoptimization of uint8, uint16 inputs. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/707443003

Cr-Commit-Position: refs/heads/master@{#25214}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 14:07:45 +00:00
dcarney@chromium.org
a350f0d608 [turbofan] phis cannot take registers as inputs 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/704153002

Cr-Commit-Position: refs/heads/master@{#25191}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 12:56:44 +00:00
verwaest@chromium.org
f26d93e6f0 Allow JSArray fast moving elements even if the array's proto isn't Array.prototype in original state 
Otherwise array builtins don't work on internal arrays.

BUG=v8:3681
LOG=n
R=machenbach@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/706703005

Cr-Commit-Position: refs/heads/master@{#25190}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 12:56:12 +00:00
machenbach@chromium.org
d04038bde5 Skip json2 on 64 bits debug. 
BUG=3681
LOG=n
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/701353003

Cr-Commit-Position: refs/heads/master@{#25186}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25186 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 11:53:13 +00:00
ishell@chromium.org
e1f93a82f2 Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136. 
BUG=chromium:430846
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/704183002

Cr-Commit-Position: refs/heads/master@{#25185}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 11:50:33 +00:00
ishell@chromium.org
89617f06d1 Skip tests that timeout on arm64 
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/709443002

Cr-Commit-Position: refs/heads/master@{#25183}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 10:24:49 +00:00
bmeurer@chromium.org
a7277a9b8c MIPS: Skip embenchen tests on big-endian. 
Emscripten requires little-endian arch. It has assertion for endianness:

assert(HEAPU8[0] === 255 && HEAPU8[3] === 0,
    'Typed arrays 2 must be run on a little-endian system');

TEST=mjsunit/asm/embenchen/*
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/708663003

Patch from Paul Lind <paul.lind@imgtec.com>.

Cr-Commit-Position: refs/heads/master@{#25177}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 06:18:42 +00:00
bmeurer@chromium.org
881cece8de [turbofan] Transform x * -1.0 to -0.0 - x. 
TEST=msjunit/asm,unittests
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/683753004

Cr-Commit-Position: refs/heads/master@{#25176}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 06:13:46 +00:00
ishell@chromium.org
023c5e2f82 Skip tests that timout on arm64 
TBR=machenbach@chromium.org, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/702163002

Cr-Commit-Position: refs/heads/master@{#25166}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 17:03:01 +00:00
machenbach@chromium.org
8db1bc7b06 Skip test in release mode for arm64 
TBR=bmeurer@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/701013006

Cr-Commit-Position: refs/heads/master@{#25161}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 14:39:43 +00:00
machenbach@chromium.org
fbb3898f96 Make slow tests on arm64 
TBR=bmeurer@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/701023003

Cr-Commit-Position: refs/heads/master@{#25160}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 14:32:46 +00:00
machenbach@chromium.org
90bfcce84b Skip box2d for gc stress. 
TBR=bmeurer@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/696213003

Cr-Commit-Position: refs/heads/master@{#25152}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25152 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 13:12:46 +00:00
jarin@chromium.org
91eeae5849 [turbofan] Fix deopt for assignments in non-effect context. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/701853002

Cr-Commit-Position: refs/heads/master@{#25151}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 13:09:14 +00:00
machenbach@chromium.org
e0801075cd Add fast-variants feature to test driver. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/704723002

Cr-Commit-Position: refs/heads/master@{#25139}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 10:39:15 +00:00
ishell@chromium.org
33dde8d92c TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/661133002

Cr-Commit-Position: refs/heads/master@{#25136}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 09:26:48 +00:00
bmeurer@chromium.org
3abe032b4c Add test cases based on the programs from the Embenchen benchmark suite. 
TEST=mjsunit/asm/embenchen
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/704653004

Cr-Commit-Position: refs/heads/master@{#25135}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 09:11:20 +00:00
yangguo@chromium.org
630d6b8b71 Introduce new stepping mode to step into another frame. 
R=aandrey@chromium.org
BUG=chromium:267592
LOG=Y

Review URL: https://codereview.chromium.org/690263004

Cr-Commit-Position: refs/heads/master@{#25130}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25130 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 08:44:54 +00:00
bmeurer@chromium.org
50ecc64539 [turbofan] Fix missing machine type for float32/float64 array accesses. 
TEST=mjsunit/asm
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/703883002

Cr-Commit-Position: refs/heads/master@{#25128}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 08:15:47 +00:00
rossberg@chromium.org
357882a8e5 1..isPrototypeOf.call(null) should return false, not throw TypeError. 
BUG=v8:3483
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/433413002

Cr-Commit-Position: refs/heads/master@{#25116}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 16:14:18 +00:00
rossberg@chromium.org
0b9a70ade3 Remove --harmony implications for incomplete features 
This is in preparation for making --harmony and --es-staging synonyms.
The only remaining difference currently is block-scoping, which is still
implied by --harmony, to avoid regressing on a long-available feature.

Also removes the special-casing of --harmony-proxies.

R=adamk@chromium.org
BUG=

Review URL: https://codereview.chromium.org/693153004

Cr-Commit-Position: refs/heads/master@{#25115}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25115 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 16:05:44 +00:00
titzer@chromium.org
3386da98fb Reduce size of array in polymorph-arrays.js. 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/686273003

Cr-Commit-Position: refs/heads/master@{#25114}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25114 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 15:54:48 +00:00
ulan@chromium.org
6ff255eabc Disable long running gc-stress tests on arm64 for TF. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/701723004

Cr-Commit-Position: refs/heads/master@{#25105}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25105 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 11:58:49 +00:00
bmeurer@chromium.org
e6cfe350f8 [turbofan] Fix recognition of Uint32Div in simplified lowering. 
TEST=mjsunit/asm
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/701813003

Cr-Commit-Position: refs/heads/master@{#25103}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25103 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 11:37:47 +00:00
aandrey@chromium.org
35eaced208 Add debug mirror support for ES6 Map/Set iterators. 
This is to show values preview of an iterator in DevTools console.

API=v8::Value::IsMapIterator, v8::Value::IsSetIterator
BUG=chromium:427868
R=arv@chromium.org, yangguo@chromium.org, adamk@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/693813002

Cr-Commit-Position: refs/heads/master@{#25100}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25100 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 10:02:43 +00:00
verwaest@chromium.org
3ea82aa917 Don't double-check elements in the prototype chain in array builtins 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/701513002

Cr-Commit-Position: refs/heads/master@{#25076}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-03 14:06:15 +00:00
bmeurer@chromium.org
498920f91c [turbofan] Also optimize unsigned division by constant. 
TEST=cctest,mjsunit,unittests
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/697663003

Cr-Commit-Position: refs/heads/master@{#25061}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-03 10:05:46 +00:00
yangguo@chromium.org
e634bdb290 Fix constant in Math.tan implementation. 
R=jkummerow@chromium.org, rtoy@chromium.org
BUG=chromium:427468
LOG=Y

Review URL: https://codereview.chromium.org/695263002

Cr-Commit-Position: refs/heads/master@{#25060}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-03 09:40:44 +00:00
bmeurer@chromium.org
017c518321 [x86] Fix register constraints for multiply high and modulus. 
R=jarin@chromium.org
TEST=mjsunit/compiler/regress-register-allocator2

Review URL: https://codereview.chromium.org/697053002

Cr-Commit-Position: refs/heads/master@{#25054}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-03 06:28:12 +00:00
mstarzinger@chromium.org
cd3273b562 Properly handle stack overflows in the AST graph builder. 
R=jarin@chromium.org
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159
LOG=N

Review URL: https://codereview.chromium.org/697473006

Cr-Commit-Position: refs/heads/master@{#25037}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-31 14:02:46 +00:00
machenbach@chromium.org
6bd521a549 Skip tests for mips. 
TBR=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/698513003

Cr-Commit-Position: refs/heads/master@{#25035}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-31 13:36:49 +00:00
titzer@chromium.org
bd5c9834b6 Fix bug in optimization of Uint32LessThan. 
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/689883003

Cr-Commit-Position: refs/heads/master@{#25023}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 15:52:47 +00:00
yangguo@chromium.org
0e830ad0bb Do not embed array objects in unoptimized code. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/685393002

Cr-Commit-Position: refs/heads/master@{#25019}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25019 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 14:21:43 +00:00
sigurds@chromium.org
75ac43928b Add floor, ceil, round (truncate) instructions for ia32, x64 (if SSE4.1) and 
add floor, ceil, round (truncate and away from zero) for arm64.

R=bmeurer@chromium.org, dcarney@chromium.org, mstarzinger@chromium.org, rodolph.perfetta@arm.com
TEST=test/mjsunit/asm/math-floor.js,test/mjsunit/asm/math-ceil.js,test/unittest/compiler/js-builtin-reducer-unittest.cc

Review URL: https://codereview.chromium.org/677433002

Cr-Commit-Position: refs/heads/master@{#25018}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25018 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 14:16:15 +00:00
yangguo@chromium.org
e847cd21fd Add test case for replacing turbofan code for debugging. 
R=jarin@chromium.org
BUG=v8:3660
LOG=N

Review URL: https://codereview.chromium.org/665833003

Cr-Commit-Position: refs/heads/master@{#25002}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 07:33:58 +00:00
yangguo@chromium.org
76292d2daf Fix assertion scope in Runtime_GetScript. 
The HeapIterator implies DisallowHeapAllocation, but Script::GetWrapper
may allocate.

LOG=N
R=jkummerow@chromium.org
BUG=chromium:410033

Review URL: https://codereview.chromium.org/680283002

Cr-Commit-Position: refs/heads/master@{#25001}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 07:25:43 +00:00
baptiste.afsa@arm.com
df312d90f0 [turbofan] Bug fix in arm64 ubfx selection. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/687193002

Cr-Commit-Position: refs/heads/master@{#24989}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24989 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 16:47:45 +00:00
machenbach@chromium.org
f02d4acbf9 Skip some tests with TF on gc stress. 
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/652193007

Cr-Commit-Position: refs/heads/master@{#24985}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24985 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 15:18:47 +00:00
bmeurer@chromium.org
de088f207c [turbofan] Introduce new Select operator to improve bounds checking. 
TEST=mjsunit,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/691513002

Cr-Commit-Position: refs/heads/master@{#24980}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 14:17:14 +00:00
arv@chromium.org
5b3f9ec76d Classes: Add super support in methods and accessors 
This is done by installing the [[HomeObject]] on the method and the
accessor functions.

BUG=v8:3330
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/683893002

Cr-Commit-Position: refs/heads/master@{#24976}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 11:46:18 +00:00
yangguo@chromium.org
64cef0b2e9 Reland "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
BUG=chromium:424142
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/692453002

Cr-Commit-Position: refs/heads/master@{#24970}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24970 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 10:19:44 +00:00
yangguo@chromium.org
67b76ebaea Revert "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
This reverts commit r24964.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/687163002

Cr-Commit-Position: refs/heads/master@{#24966}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 09:23:10 +00:00
yangguo@chromium.org
7668c4c29a In PrepareForBreakPoints, also purge shared function info not referenced by functions. 
R=ulan@chromium.org
BUG=chromium:424142
LOG=N

Review URL: https://codereview.chromium.org/685753002

Cr-Commit-Position: refs/heads/master@{#24964}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 08:11:41 +00:00
machenbach@chromium.org
a5ffbf3c46 [Sheriff] Skip tests that fail with TF on arm64. 
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/687653002

Cr-Commit-Position: refs/heads/master@{#24944}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24944 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 14:47:45 +00:00
arv@chromium.org
013a29a2bc Classes: Add more tests for prototype edge cases 
BUG=3655
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/687453004

Cr-Commit-Position: refs/heads/master@{#24943}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24943 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 14:12:44 +00:00
arv@chromium.org
5c2dffc380 Classes: Add test for method prototype 
Methods should not have a prototype property

BUG=v8:3330
LOG=y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/678103004

Cr-Commit-Position: refs/heads/master@{#24939}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 13:40:14 +00:00
arv@chromium.org
1881cee691 Classes: Add basic support for properties 
This adds the properties to the prototype and the constructor.

BUG=v8:3330
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/680993003

Cr-Commit-Position: refs/heads/master@{#24934}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 12:43:49 +00:00
yangguo@chromium.org
0dfbf83468 Use shared function info for eval cache key. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/678843004

Cr-Commit-Position: refs/heads/master@{#24927}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 10:01:44 +00:00
yangguo@chromium.org
efc01f4736 Prevent recursion in the debug event listener. 
R=ulan@chromium.org
BUG=chromium:409614
LOG=N

Review URL: https://codereview.chromium.org/684573005

Cr-Commit-Position: refs/heads/master@{#24924}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 09:44:43 +00:00
bmeurer@chromium.org
95095af57f [turbofan] Improve typed lowering for JSToBoolean. 
- JSToBoolean(x:string) => BooleanNot(NumberEqual(x.length, #0))
- JSToBoolean(phi(x1,...,xn):primitive) => phi(JSToBoolean(x1),...,JSToBoolean(xn))

TEST=cctest,mjsunit/asm/do-while,mjsunit/boolean,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/681223002

Cr-Commit-Position: refs/heads/master@{#24919}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 08:34:15 +00:00
jarin@chromium.org
abefd29161 Revert "Enable turbofan deoptimization by default." 
This reverts commit 866032692f for breaking
tests.

TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/681713004

Cr-Commit-Position: refs/heads/master@{#24908}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-27 14:37:10 +00:00
adamk@chromium.org
f1954232b0 SimpleMove now calls [[Has]] before [[Get]] when moving elements 
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/678753002

Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-27 13:05:13 +00:00
jarin@chromium.org
866032692f Enable turbofan deoptimization by default. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/638833004

Cr-Commit-Position: refs/heads/master@{#24905}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-27 12:47:16 +00:00
jarin@chromium.org
23df66ee24 Add more missing deopts 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/639883002

Cr-Commit-Position: refs/heads/master@{#24886}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-26 10:25:48 +00:00
dslomov@chromium.org
08ee4d3a5c Add remaining @@toStringTag symbols to builtins 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/664333003

Patch from Caitlin Potter <caitpotter88@gmail.com>.

Cr-Commit-Position: refs/heads/master@{#24885}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 19:29:10 +00:00
adamk@chromium.org
c9ea8d6512 SimpleSlice now calls [[Get]] before [[Has]] when generating copy 
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.

BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/674003002

Cr-Commit-Position: refs/heads/master@{#24884}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:08:13 +00:00
adamk@chromium.org
02d37b8f10 Widen definition of %HasComplexElements() to include non-enumerability 
This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:04:13 +00:00
bmeurer@chromium.org
548fb46331 [x86] Fix register constraints for multiply-high. 
TEST=mjsunit/compiler,unittests
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/671393002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 09:36:40 +00:00
adamk@chromium.org
0ef073d556 Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/673893002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 21:13:29 +00:00
adamk@chromium.org
5f1ae66d56 Narrow cases where Sparse/Smart versions of Array methods are used 
Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/656423004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 18:21:50 +00:00
adamk@chromium.org
f3c3697521 Change SmartMove no-op behavior to match SimpleMove (and ES6 spec) 
The previous behavior, which caused Array.prototype.unshift() (with no args)
to have side-effects, no longer matches the spec (ES6 changed the no-arg behavior
in April 2014). The new SmartMove behavior is also compatible with current
versions of Firefox.

This is a baby step towards getting rid of SmartMove; it isolates the test
change in this patch, instead of lumping it in confusingly with all the
other test updates necessary for moving away from SmartMove.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/666883009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 17:46:34 +00:00
ishell@chromium.org
5509cc2c07 Fixed mutable heap numbers leak in JSON parser. 
BUG=chromium:423687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/669403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 14:41:39 +00:00
dslomov@chromium.org
96105a90fc harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=24834

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 12:30:20 +00:00
dslomov@chromium.org
707ed29a51 Revert "harmony-scoping: Allow 'const' iteration variables in strict mode." 
This reverts commit r24834 for breaking debug tests.

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/672193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:55:19 +00:00
dslomov@chromium.org
b54f7d3c46 harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:18:50 +00:00
dslomov@chromium.org
98c208447d Classes: implement 'new super'. 
R=ishell@chromium.org, arv@chromium.org
BUG=v8:3330
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=24822

Review URL: https://codereview.chromium.org/665773003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24825 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 08:32:23 +00:00
dslomov@chromium.org
6442348d6e Revert "Classes: implement 'new super'." 
This reverts commit r24822 for breaking debug compilation.

TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/662253003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 08:21:30 +00:00
dslomov@chromium.org
99cafa0d5a Classes: implement 'new super'. 
R=ishell@chromium.org, arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/665773003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24822 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 08:11:51 +00:00
rodolph.perfetta@arm.com
ecbfc43f37 ARM64: Fix stack manipulation. 
Builtins::Generate_StringConstructCode was claiming stack space instead of
giving it back.

BUG=chromium:425585
LOG=Y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/672623003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 18:24:20 +00:00
adamk@chromium.org
98e0eac76f Speed up creation of Objects whose prototype has dictionary elements 
This speeds up both the case from the bug (using Object.create) but also
takes care ofthe "{ __proto__: obj  }" syntax, which was previously (and
erroneously) being treated the same as setting the prototype dynamically
from script using the __proto__ setter or Object.setPrototypeOf.

BUG=chromium:422754
LOG=y
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/667253002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 18:16:35 +00:00
adamk@chromium.org
04db7c8793 Fix {get,set}ter-on-elements tests to run through all creation functions 
setter-on-elements had the wrong length hardcoded in a for loop over the
creation functions (getter-on-elements had the right length, but seemed
worth future-proofing).

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/643143005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 17:21:53 +00:00
wingo@igalia.com
6c9bab5c74 Array.prototype.{reduce, reduceRight}: Wrong order of operations when determining initial value. 
BUG=v8:3534
LOG=
R=svenpanne@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/614733002

Patch from Diego Pino <dpino@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 13:13:19 +00:00
dslomov@chromium.org
b664c12235 Flatten the string in StringToDouble function. 
R=yangguo@chromium.org
BUG=chromium:425551
LOG=N

Review URL: https://codereview.chromium.org/654763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 08:19:05 +00:00
adamk@chromium.org
b6d0113abc Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/649063003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 17:46:42 +00:00
dslomov@chromium.org
37bd114925 Update ObjectToString to Harmony-draft algorithm 
Updates Object.prototype.toString() to use algorithm described in harmony drafts.

Currently, the behaviour is essentially the same as ES262's version, however this changes when internal structures
such as Promise make use of symbolToStringTag (as they are supposed to, see v8:3241), and changes further once
Symbol.toStringTag is exposed publicly.

BUG=v8:3241, v8:3502
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/546803003

Patch from Caitlin Potter <caitpotter88@gmail.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 17:21:32 +00:00
titzer@chromium.org
12a82ef32c Fix AstGraphBuilder for loops like for(;;). 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/640203004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 14:17:08 +00:00
mvstanton@chromium.org
8330178b4c The issue is that by handling strings with map/handler pairs instead of a special 
version of the keyed load stub (https://code.google.com/p/v8/source/detail?r=24661),
I allowed polymorphism between string and non-string types in the IC. Before, the
IC would go generic.

Then, at crankshaft time, we special case when we only saw strings. The error
here is that crankshaft can't emit code that handles polymorphism between string
and non-string types. The choice is either to get that to happen (I don't deem
this necessary from a performance point of view, an IC with such type feedback
before would have gone generic), or simply check for the case of "polymorphic
with some string maps" and require crankshaft to go generic. I'll do the latter.

BUG=425519
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/667923004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 13:04:51 +00:00
dslomov@chromium.org
b830c2741c Handle property name "-0" correctly for typed arrays. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/670623003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 11:54:10 +00:00
dslomov@chromium.org
6ae42d9171 Simplify language feature management. 
R=rossberg@chromium.org
BUG=v8:3640
LOG=N

Review URL: https://codereview.chromium.org/642233003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-20 13:33:34 +00:00
bmeurer@chromium.org
7cfd0ed4d6 [arm64] Skip TF tests that time out in simulator debug runs. 
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/642293005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24724 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-20 09:01:14 +00:00
yangguo@chromium.org
8cc5d418ee Special handling for inline caches in code serializer. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/656533003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-20 08:46:11 +00:00
bmeurer@chromium.org
d029d76120 [turbofan] Skip bounds checks for positive indices only. 
TEST=unittests,mjsunit/asm/int32array-constant-key
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/647773004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-20 06:25:41 +00:00
adamk@chromium.org
730c3fa3e0 Don't expose Array.prototype.values as it breaks webcompat 
Some versions of Outlook Web Access test for the existence of a 'values'
property on Array instances, so adding the 'values' iterator to the prototype
(even with @@unscopeables) causes breakage.

This matches Gecko: they ship Array.prototype.{keys,entries} but not 'values'.

BUG=409858
LOG=Y
R=arv@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/647703003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 20:11:47 +00:00
dslomov@chromium.org
e3ad693020 Correct semantics for numerically indexed stores to typed arrays. 
R=verwaest@chromium.org, ishell@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24691

Review URL: https://codereview.chromium.org/652303002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 16:33:38 +00:00
jkummerow@chromium.org
c186399e5f Tick processor: Print C++ entry points 
R=loislo@chromium.org, yangguo@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/638633002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 15:44:02 +00:00
dcarney@chromium.org
1d31e89c6b skip some gc stress tests for tf 
TBR=mstarzinger@chromium.org

BUG=

Review URL: https://codereview.chromium.org/659333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 14:28:00 +00:00
yangguo@chromium.org
83ddaa0df7 Fix break location calculation. 
R=ulan@chromium.org
BUG=chromium:419663
LOG=Y

Review URL: https://codereview.chromium.org/658723005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 14:11:01 +00:00
dslomov@chromium.org
e149f81eba Keyed stores to super with numeric keys. 
R=verwaest@chromium.org, arv@chromium.org, ishell@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/649603003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 13:19:45 +00:00
dslomov@chromium.org
8854589c79 Revert "Correct semantics for numerically indexed stores to typed arrays." 
This reverts commit r24691 because win64 release build breaks.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/659313002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 13:01:54 +00:00
titzer@chromium.org
e4c6f9488e Implement graph trimming in ControlReducer. 
Trimming the graph consists of breaking links from nodes that are not reachable from end to nodes that are reachable from end. Such dead nodes show up in the use lists of the live nodes and though mostly harmless, just clutter up the graph. They also can limit instruction selection opportunities, so it is good to get rid of them.

This CL is one half of the ControlReducer functionality, the other half
being branch folding.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/661923002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 11:51:57 +00:00
dslomov@chromium.org
3154c4a5f2 Correct semantics for numerically indexed stores to typed arrays. 
R=verwaest@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/652303002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 11:40:40 +00:00
titzer@chromium.org
8c5f9b6bb0 Fix InstructionSelector to handle calls with no (used) output values. 
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/664693002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 11:26:26 +00:00
yangguo@chromium.org
d913faaf6d Improve String.repeat. 
Adapted from patch contributed by Isiah Meadows <impinball@gmail.com>.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/657863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 10:01:38 +00:00
bmeurer@chromium.org
a779150260 [turbofan] Eliminate typed array bounds checks if both key and length are constant. 
TEST=mjsunit,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/638853004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 09:35:45 +00:00
dslomov@chromium.org
d4cbcfce6e Implement the new semantics for 'super(...)' 
Per the latest ES6 draft, super(...) translates into a call
to function's prototype.

R=arv@chromium.org, ishell@chromium.org, verwaest@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/661433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 09:16:03 +00:00
bmeurer@chromium.org
fe6656fbfe [arm] Prefer BIC over BFC. 
BFC requires same register for input and output and causes introduction
of some unneccesary gap moves.

TEST=unittests,mjsunit
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/658283003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 07:07:54 +00:00
bmeurer@chromium.org
e918a842c9 Blacklist tests that are too slow with TurboFan in debug mode. 
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/660653008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 06:59:02 +00:00
wingo@igalia.com
04c17602a4 Object.is should use SameValue 
BUG=v8:3576
LOG=
R=arv@chromium.org, svenpanne@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/626323002

Patch from Diego Pino <dpino@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-16 11:24:45 +00:00
wingo@igalia.com
ee64a14b24 Implement .forEach() on typed arrays 
BUG=v8:3578
LOG=Y
R=dslomov@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/583723002

Patch from Adrian Perez de Castro <aperez@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-16 10:55:26 +00:00
adamk@chromium.org
ae7161e4cb Revert "Remove SmartMove, bringing Array methods further into spec compliance" 
This reverts https://code.google.com/p/v8/source/detail?r=24647

It caused test failures in Array methods in Linux64 OptimizeForSize.

BUG=v8:2615
TBR=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/656683003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:53:02 +00:00
adamk@chromium.org
bb885a79db Remove SmartMove, bringing Array methods further into spec compliance 
This is one step towards a single codepath for each method in array.js.

This patch is based on rafaelw's https://codereview.chromium.org/349073002

BUG=v8:2615
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/455933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:36:58 +00:00
adamk@chromium.org
a6ff3f7f4a Handle exceptions thrown by Array.observe machinery 
BUG=chromium:417709
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/651323003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 18:22:20 +00:00