The underlying problem is that for compound/count operations we use the *load*
type feedback for storing, too. For normal properties this doesn't matter, but
for accessor properties we should better use the *store* type feedback, which
would be available, too. This consistent feedback usage could be guaranteed if
we removed the heavy copy-n-paste in the crankshaft code generation for
compound/count operations and assignments/property loads.
To be on the safe side, we postpone this refactoring and do a quick and easily
mergeable fix.
BUG=140083
TEST=mjsunit/regress/regress-crbug-140083.js
Review URL: https://chromiumcodereview.appspot.com/10828146
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is a forward-compatible change to avoid type/naming
conflicts when the Android platform/NDK will update its
<signal.h> header to properly define 'struct sigcontext',
'mcontext_t' and 'ucontext_t'.
In particular:
- Do not define 'struct sigcontext.h' to avoid
conflicts with the C library definition (which
is different, see below).
- Only provide custom ucontext_t declarations if
the Android <signal.h> doesn't provide it. This can
be tested with a macro check (__BIONIC_HAVE_UCONTEXT_T)
+ Use 'gettid()' on Android since it is available (at all
API levels).
See http://code.google.com/p/android/issues/detail?id=34784
Review URL: https://chromiumcodereview.appspot.com/10829122
Patch from David Turner <digit@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
mksnapshot or a VM that is booted from a snapshot. --debug-code
can still have an effect on stub and optimized code and it still
works on the full code generator when running without snapshots.
The deoptimizer generates full-code-generator code and relies on it having
the same layout as last time. This means that the code the full code
generator makes for the snapshot should be the same as the code it makes
later. This change makes the full code generator create more consistent
code between mksnapshot time and run time.
This is a bug fix and a step towards making the snapshot code more robust.
Review URL: https://chromiumcodereview.appspot.com/10834085
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The deoptimizer generates full-code-generator code and relies on it having
the same layout as last time. This means that the code the full code
generator makes for the snapshot should be the same as the code it makes
later. This change makes the full code generator create more consistent
code between mksnapshot time and run time.
This is a bug fix and a step towards making the snapshot code more robust.
Review URL: https://chromiumcodereview.appspot.com/10824084
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12233 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
x64 BinaryOpStub::GenerateSmiCode use wrong registers in one code path.
e.g. d8 --trace_ic
var dd = new Float64Array(2);
dd[1] = 1;
(function fn() {
for (var i = 0; i < 1000; i++)
dd[0] = 2 / dd[1];
})();
It keeps falling into runtime call and patching.
No regression test, because I don't how to test it.
Review URL: https://chromiumcodereview.appspot.com/10834064
Patch from Zheng Liu <shdwthr@gmail.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12226 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This adds the --verify-global-context-separation flag which can be used
to verify that no code object embeds pointers to more than one global
context after a full GC. It uses an object visitor that just performs
shallow traversal of the object graph spanned by one code object, and
breaks at points where application objects are encountered. So it will
not trip on cross-context leaks introduced by the application itself.
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10830049
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Currently only simple getter calls are handled (i.e. no calls in count
operations or compound assignments), and deoptimization in the getter is not
handled at all. Because of the latter, we temporarily hide this feature behind a
new flag --inline-accessors, which is false by default.
Review URL: https://chromiumcodereview.appspot.com/10828066
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is a refactoring-only CL and the third one in a series for enabling
inlining of accessors. The goal of this CL is to move the builders for accessors
to the places where we might be able to inline them later, i.e. the VisitFoo and
HandleBar member functions of HGraphBuilder.
Extracted duplicate code into LookupAccessorPair.
Review URL: https://chromiumcodereview.appspot.com/10831047
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is a refactoring-only CL and the first one in a series for enabling
inlining of accessors. The naming and argument order has been unified a bit, and
some tests have been pushed to the caller in order to get a simpler
signature. Note that the latter temporarily introduces some code redundancy, but
this will be cleaned up in one of the next CLs.
Review URL: https://chromiumcodereview.appspot.com/10826028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12198 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
