AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
9,650 Commits 1 Branch 0 Tags 839 MiB
55e924c595
Commit Graph

553 Commits

Author SHA1 Message Date
verwaest@chromium.org
55e924c595 Fix CNLT regression. 
This happens when a map A with no descriptors in fast_holey_elements
mode first gets some properties, making it share descriptor arrays with
a map B to which it transitions. Then map A transitions elements kind to
dictionary_elements in map C. C stores the empty_descriptor_array in its
own transition array. When adding a property to C, C transitions to D
and shares the descriptors. If D dies, a CNLT clears the transition
array of C, making the descriptor array of A (and thus also of B) shine
through. If a property is now added to an object in state C, it'll inherit
all the properties of A (and B). If those properties had high field indices,
we do not have a large enough backing store for the single newly added
property, and we'll write out of bounds.

BUG=chromium:151749

Review URL: https://chromiumcodereview.appspot.com/11017054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 12:29:44 +00:00
svenpanne@chromium.org
5d11c5ee69 Fixed Accessors::FunctionGetPrototype's proto chain traversal. 
Actually it didn't traverse that far... ;-) Did some cleanup on the way.

R=rossberg@chromium.org
BUG=chrome:143967
TEST=regress/regress-143967.js

Review URL: https://codereview.chromium.org/11087004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-08 12:58:46 +00:00
rossberg@chromium.org
329cf12363 Make sure that names of temporaries do not clash with real variables. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11035054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 12:47:34 +00:00
rossberg@chromium.org
3f7b5c338a Reject uses of lexical for-loop variable on the RHS. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11031045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 09:07:53 +00:00
mmassi@chromium.org
8fbfad63cd Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339). 
BUG=v8:2339

Review URL: https://chromiumcodereview.appspot.com/10963032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-26 09:57:30 +00:00
erik.corry@gmail.com
72e9f1bea1 x64 and ARM: Fix issue 2346 (order of operations in keyed store 
on arrays) and turn get-own-property-descriptor.js test into
a regression test.
Review URL: https://chromiumcodereview.appspot.com/10985017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12604 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-25 13:35:42 +00:00
jkummerow@chromium.org
8a3ec89824 Delete test/mjsunit/regress-1969. 
It was flaky, and its usefulness was doubtful.

Review URL: https://codereview.chromium.org/10961075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:48:14 +00:00
jkummerow@chromium.org
cc6fe90b2b Remove trailing whitespace 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/10969064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:44:04 +00:00
jkummerow@chromium.org
cf0cae7eb1 Speed up test/mjsunit/regress/regress-crbug-119926 
Review URL: https://codereview.chromium.org/10958063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:56:11 +00:00
verwaest@chromium.org
083ee63a83 Fix CNLT for enum indices. 
Review URL: https://chromiumcodereview.appspot.com/10958015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 15:18:00 +00:00
verwaest@chromium.org
ea31f868e8 Deopt on storing undefined into double elements. 
Review URL: https://chromiumcodereview.appspot.com/10963010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12568 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 13:41:00 +00:00
jkummerow@chromium.org
a8e502fe60 Fix LBoundsCheck on x64 to handle (stack slot + constant) correctly 
BUG=150729

Review URL: https://codereview.chromium.org/10959009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:56:24 +00:00
jkummerow@chromium.org
83da019a46 Move regress-2286.js where it belongs 
Review URL: https://codereview.chromium.org/10957013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:55:19 +00:00
mstarzinger@chromium.org
c012afb6d4 Fix setting array length to zero for slow elements. 
R=verwaest@chromium.org
BUG=chromium:146910
TEST=mjsunit/regress/regress-crbug-146910

Review URL: https://codereview.chromium.org/10937026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 11:52:33 +00:00
mstarzinger@chromium.org
f0dcaf9a19 Fix lost arguments dropping in HLeaveInlined. 
This fixes HleaveInlined to correctly drop pushed arguments on all code
paths and addresses a corner case where the arguments stack height
mismatched at an OSR entry point.

R=jkummerow@chromium.org
BUG=chromium:150545
TEST=mjsunit/regress/regress-crbug-150545

Review URL: https://codereview.chromium.org/10938016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 08:13:46 +00:00
yangguo@chromium.org
73462594ea Change regress-2318 to trigger more quickly and reliably. 
BUG=v8:2336

Review URL: https://chromiumcodereview.appspot.com/10913294

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 13:21:59 +00:00
erik.corry@gmail.com
bafcfe5427 Fix misplaced assert in heap.cc. 
Bug=2336
Review URL: https://chromiumcodereview.appspot.com/10911334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 11:38:24 +00:00
yangguo@chromium.org
cb72bf5735 Fix debugger's eval when close to stack overflow. 
R=verwaest@chromium.org
BUG=v8:2318

Review URL: https://chromiumcodereview.appspot.com/10914290

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:40:32 +00:00
verwaest@chromium.org
ad4746c8a3 CNLT with descriptors but no valid enum fields has to clear the EnumCache. 
Review URL: https://chromiumcodereview.appspot.com/10928204

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:15:43 +00:00
mstarzinger@chromium.org
77a7d9f539 Fix caching of optimized code for OSR. 
This makes sure we do not share optimized code across closures that were
optimized using OSR (for a particular OSR entry AST id) even if caching
of optimized code kicks in.

R=danno@chromium.org
BUG=v8:2326
TEST=mjsunit/regress/regress-2326

Review URL: https://codereview.chromium.org/10933088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 10:41:31 +00:00
verwaest@chromium.org
1d1adaf9d3 Ensure correct enumeration indices in the dict 
BUG=chromium:148376

Review URL: https://chromiumcodereview.appspot.com/10908216

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-13 08:52:55 +00:00
yangguo@chromium.org
67d0506622 Correctly initialize regexp global cache. 
R=ulan@chromium.org
BUG=148378

Review URL: https://chromiumcodereview.appspot.com/10905239

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 15:26:43 +00:00
mstarzinger@chromium.org
f37f504de5 Fix arguments object materialization during deopt. 
This fixes materialization of arguments objects for strict mode functions during
deoptimization. We materialize arguments from the stack area where optimized
code pushes the arguments when entering the inlined environment. For adapted
invocations we use the arguments adaptor frame for materialization.

R=svenpanne@chromium.org
BUG=v8:2261
TEST=mjsunit/regress/regress-2261,mjsunit/compiler/inline-arguments

Review URL: https://chromiumcodereview.appspot.com/10908194

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 12:28:42 +00:00
mstarzinger@chromium.org
f6cd2403e3 Fix deoptimizer for shared optimized code. 
The deoptimizer searched the stack for activations of the same function to
determine whether to trigger lazy deopting. Since we share optimized code we
actually need to search for activations of the same code (but potentially
different functions).

R=jkummerow@chromium.org
BUG=chromium:147475
TEST=mjsunit/regress/regress-crbug-147475

Review URL: https://chromiumcodereview.appspot.com/10917162

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 11:05:17 +00:00
svenpanne@chromium.org
7af6883098 Fixed deoptimization of inlined getters. 
It is necessary to explicitly handle the internal frame lying between the caller
of the getter and the getter itself in the deoptimizer: When the getter is
inlined, leaving the internal frame restores the correct context.

BUG=http://crbug/134609
TEST=mjsunit/regress/regress-crbug-134609

Review URL: https://chromiumcodereview.appspot.com/10910110

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-07 09:01:54 +00:00
erik.corry@gmail.com
e5df02834b Fix some corner cases in skipping native methods using caller. 
Review URL: https://chromiumcodereview.appspot.com/10911063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-05 08:19:49 +00:00
verwaest@chromium.org
0c24942be7 Fixed test expectation. 
Review URL: https://chromiumcodereview.appspot.com/10913062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12435 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:54:36 +00:00
verwaest@chromium.org
a8638c1570 Support register as right operand in min/max support. 
R=jkummerow@chromium.org
BUG=chromium:145961
TEST=mjsunit/regress/regress-crbug-145961.js

Review URL: https://chromiumcodereview.appspot.com/10914072

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:35:43 +00:00
verwaest@chromium.org
90db487390 Elements load depends on the type of the receiver. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10918005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12413 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-30 17:31:32 +00:00
danno@chromium.org
3544e2e875 Disable speculative LICM when it may lead to unnecessary deopts 
BUG=v8:2250
R=vegorov@chromium.org
TEST=tests/mjsunit/regress/regress-2250.js

Review URL: https://chromiumcodereview.appspot.com/10867033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 21:08:58 +00:00
ulan@chromium.org
efc26f9b2b Fix rounding in Uint8ClampedArray setter. 
According to Web IDL spec, we should round to
the nearest integer, choosing the even integer
if it lies halfway between two.

R=yangguo@chromium.org,kbr@chromium.org
BUG=v8:2294

Review URL: https://chromiumcodereview.appspot.com/10831409

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-22 14:27:11 +00:00
verwaest@chromium.org
5df5eea066 Check that index and length are Smi in bounds check. 
BUG=chromium:142218
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10829456

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-21 16:46:25 +00:00
yangguo@chromium.org
3a1c290b2c Add input check to %DebugSetScriptSource. 
R=verwaest@chromium.org
BUG=v8:2296

Review URL: https://chromiumcodereview.appspot.com/10837308

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 15:21:15 +00:00
erik.corry@gmail.com
ee3a66b273 Fix bug in compare IC. BUG=2291 
Review URL: https://chromiumcodereview.appspot.com/10830334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-15 15:08:42 +00:00
yangguo@chromium.org
28c892938e Ensure capacity when adding parts in String.replace. 
R=ulan@chromium.org
BUG=v8:2289
TEST=regress-2289.js

Review URL: https://chromiumcodereview.appspot.com/10830304

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-14 11:33:12 +00:00
yangguo@chromium.org
3605fcbe63 Fix indexing bug in regexp, part 2. 
The previous fix initialized the start index incorrectly.

BUG=

Review URL: https://chromiumcodereview.appspot.com/10834291

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:53:40 +00:00
mstarzinger@chromium.org
e77f24f44e Remove prototype of global builtins object. 
R=yangguo@chromium.org
BUG=v8:2284
TEST=mjsunit/regress/regress-2284

Review URL: https://chromiumcodereview.appspot.com/10854116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:34:49 +00:00
yangguo@chromium.org
960b1af12f Fix wrong indexing in global regexp. 
R=ulan@chromium.org
BUG=142087

Review URL: https://chromiumcodereview.appspot.com/10824278

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:26:46 +00:00
yangguo@chromium.org
f30099dacf Check for function in %_CallFunction. 
R=mstarzinger@chromium.org
BUG=v8:2285

Review URL: https://chromiumcodereview.appspot.com/10854115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 12:11:26 +00:00
yangguo@chromium.org
cd5ee62692 Allow multiple lines of custom flags in javascript tests. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10855099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-10 12:26:33 +00:00
svenpanne@chromium.org
83fc4205f6 Fixed compound/count operations with getter-only accessor properties. 
The underlying problem is that for compound/count operations we use the *load*
type feedback for storing, too. For normal properties this doesn't matter, but
for accessor properties we should better use the *store* type feedback, which
would be available, too. This consistent feedback usage could be guaranteed if
we removed the heavy copy-n-paste in the crankshaft code generation for
compound/count operations and assignments/property loads.

To be on the safe side, we postpone this refactoring and do a quick and easily
mergeable fix.

BUG=140083
TEST=mjsunit/regress/regress-crbug-140083.js

Review URL: https://chromiumcodereview.appspot.com/10828146

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-03 09:45:08 +00:00
erik.corry@gmail.com
b3e2440580 Speed up quicksort test to avoid timeouts on simulators. 
Review URL: https://chromiumcodereview.appspot.com/10830093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-31 13:36:24 +00:00
jkummerow@chromium.org
80c35c6522 Always set the callee's context when calling a function from optimized code. 
This is necessary even for recursive calls because we're sharing optimized code among closures, which could call each other and have distinct contexts.

BUG=138887
TEST=mjsunit/regress/regress-crbug-138887

Review URL: https://chromiumcodereview.appspot.com/10834031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12201 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-26 12:49:08 +00:00
mstarzinger@chromium.org
806fb8be96 Fix bootstrapping without snapshot and low GC interval. 
R=yangguo@chromium.org
BUG=v8:2249
TEST=mjsunit/regress/regress-2249 (snapshot=off)

Review URL: https://chromiumcodereview.appspot.com/10818005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 16:18:25 +00:00
danno@chromium.org
3667f92cbb Add dependency to HLoadKeyed* instructions to prevent invalid hoisting 
BUG=chromium:137768
TEST=test/mjsunit/regress/regress-137768.js

Review URL: https://chromiumcodereview.appspot.com/10802038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 13:59:24 +00:00
sanjoy@chromium.org
693c7643d2 Optimize functions on a second thread. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10807024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12148 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-19 18:58:23 +00:00
verwaest@chromium.org
90c7cb1397 When following an accessor transition for an already existing accessor, don't load the last added descriptor but the same descriptor as we already found previously. 
BUG=137689
TEST=test/mjsunit/regress/regress-crbug-137689.js

Review URL: https://chromiumcodereview.appspot.com/10808005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12115 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-18 09:20:57 +00:00
yangguo@chromium.org
022ba0588a Fix transcendental cache on ARM in optimized code. 
R=jkummerow@chromium.org
BUG=v8:2234
TEST=regress-2234.js

Review URL: https://chromiumcodereview.appspot.com/10695205

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-16 09:44:59 +00:00
svenpanne@chromium.org
43e87a65e1 Added Crankshaft support for setters. 
Refactored ComputeLoadStoreField a bit on the way to clarify a bit what it
actually does.

Review URL: https://chromiumcodereview.appspot.com/10692187

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-13 07:14:28 +00:00
svenpanne@chromium.org
b8a7abd1fc Perform HasFastProperties check on prototypes when computing call targets in Crankshaft, part 2. 
The previous fix was for "real" calls, this one is for getters. It is a bit
unfortunate that this has to be fixed twice: We should really break up
Call::ComputeTarget into a predicate and 1 or 2 getters, so code can be reused.

The regression test has been modified a bit to make things more uniform.

Review URL: https://chromiumcodereview.appspot.com/10702164

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-12 09:32:26 +00:00