jkummerow@chromium.org
63263a9aa9
Fix unsigned-Smi check in MappedArgumentsLookup
...
BUG=126414
TEST=mjsunit/regress/regress-crbug-126414
Review URL: https://chromiumcodereview.appspot.com/10375033
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-05-07 10:05:39 +00:00
yangguo@chromium.org
b42ab19d2e
Modify two regression tests to actually fail when failing.
...
BUG=
TEST=regress-1639, regress-1639-2
Review URL: https://chromiumcodereview.appspot.com/10315009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-05-03 11:52:56 +00:00
danno@chromium.org
908e77a53a
Ensure reload of elements pointer in StoreFastDoubleElement stub.
...
R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-125515.js
BUG=chromium:125515
Review URL: https://chromiumcodereview.appspot.com/10260014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-05-02 09:58:42 +00:00
jkummerow@chromium.org
f6dacfe83a
Fixed corner cases in truncation behavior when storing to TypedArrays.
...
Also simplified ia32 KeyedStoreStubCompiler::GenerateStoreExternalArray a bit.
BUG=v8:2110
TEST=mjsunit/regress/regress-2110
Review URL: https://chromiumcodereview.appspot.com/10260011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-30 15:17:59 +00:00
mstarzinger@chromium.org
b54ca31fb2
Fix LFastLiteral to check boilerplate elements kind.
...
Adds a missing check that the elements kind of the boilerplate object
still has the expected elements kind, unoptimized code can transition
the boilerplate. Corner cases might cause the optimized code to be
reentered again.
R=danno@chromium.org
TEST=mjsunit/regress/regress-fast-literal-transition
Review URL: https://chromiumcodereview.appspot.com/10254006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-30 14:59:13 +00:00
mstarzinger@chromium.org
21fc0fef6a
Fix deopted construct stub frame to contain code object.
...
R=danno@chromium.org
BUG=chromium:124594
TEST=mjsunit/regress/regress-124594
Review URL: https://chromiumcodereview.appspot.com/10155024
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-25 13:22:04 +00:00
mstarzinger@chromium.org
e3be59512a
Fix source property of empty RegExp objects.
...
R=rossberg@chromium.org
BUG=v8:1982
TEST=test262/15.10.4.1-5
Review URL: https://chromiumcodereview.appspot.com/10134010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-23 13:59:43 +00:00
rossberg@chromium.org
c8aea7a184
Put new global var semantics behind a flag until WebKit tests are cleaned up.
...
R=mstarzinger@chromium.org
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10163003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-20 13:35:09 +00:00
mstarzinger@chromium.org
57739100f3
Fix missing GVN flag for new-space promotion.
...
R=vegorov@chromium.org
BUG=chromium:123919
TEST=mjsunit/regress/regress-123919
Review URL: https://chromiumcodereview.appspot.com/10119016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-19 07:49:11 +00:00
mstarzinger@chromium.org
47d07b8a7b
Fix fast array literals to ignore prototype chain.
...
This makes sure that boilerplate objects for array literals with
non-constant elements (which will contain the hole at non-constant
positions) will not cause prototype chain lookups when generating
optimized code.
R=erik.corry@gmail.com
BUG=chromium:123512
TEST=mjsunit/regress/regress-123512
Review URL: https://chromiumcodereview.appspot.com/10105025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-17 11:12:37 +00:00
rossberg@chromium.org
62945585fd
Implement ES5 erratum: global declarations shadow inherited properties.
...
I also discovered that our treatment of const declarations is inconsistent
when inside a global eval under 'with' (i.e., when created by
DeclareContextSlots). That is,
var x;
eval("const x = 9")
and
var x;
eval("with({}) const x = 9")
differ (the former assigns 9, the latter throws). This appears to be an
oversight from earlier changes to our const semantics (the latter shouldn't
throw either). Fixing this is a separate issue, though (and one that doesn't
seem quite worthwhile).
R=mstarzinger@chromium.org
BUG=v8:1991,80591
TEST=
Review URL: https://chromiumcodereview.appspot.com/10067010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-16 13:20:50 +00:00
vegorov@chromium.org
69952d78af
Untabify test/mjsunit/regress/regress-119609.js.
...
TBR=kmillikin@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10067017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-12 20:29:48 +00:00
vegorov@chromium.org
ec4c772746
Return LOOKUP variable instead of CONTEXT for non-context allocated outer scope parameters.
...
R=kmillikin@chromium.org
BUG=chromium:119609
TEST=test/mjsunit/regress/regress-119609.js
Review URL: https://chromiumcodereview.appspot.com/10010046
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-12 19:32:29 +00:00
jkummerow@chromium.org
14e181709b
Fix regular and ElementsKind transitions interfering with each other
...
R=danno@chromium.org
BUG=122271
TEST=mjsunit/regress/regress-crbug-122271
Review URL: https://chromiumcodereview.appspot.com/10038010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-12 12:30:32 +00:00
erikcorry
f90e665e9a
Ensure that a call to String.prototype.match with a
...
global regexp after a call to String.prototype.replace
with a function argument sets the last match info
correctly. Bug=2058
Review URL: http://codereview.chromium.org/10029009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-10 10:42:25 +00:00
danno@chromium.org
ed5d288ac1
Adjust stack limit again to avoid overflow on 64 bit windows
...
Also add additional stack check.
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10006010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11238 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 14:01:39 +00:00
ulan@chromium.org
3861063018
Check for NaN in inlined versions of Math.min, Math.max.
...
R=danno@chromium.org
BUG=V8:2056
TEST=mjsunit/regress/regress-2056.js
Review URL: https://chromiumcodereview.appspot.com/10006008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 13:24:52 +00:00
danno@chromium.org
3c6f5774d2
Fix stack overflows on Windows x64.
...
R=mstarzinger@chromium.org
TEST=win 64 not red anymore
Review URL: https://chromiumcodereview.appspot.com/10008005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 12:32:35 +00:00
danno@chromium.org
7bd1274baa
Rollback 11231: Add regression test case for issue 2025.
...
TBR=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/10006006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 08:35:32 +00:00
danno@chromium.org
db34072379
Add regression test case for issue 2025.
...
R=ulan@chromium.org
BUG=v8:2056
TEST=test/mjsunit/regress/regress-2056.js
Review URL: https://chromiumcodereview.appspot.com/10006004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 08:08:05 +00:00
mstarzinger@chromium.org
47aa3254c2
Fix rewriter to not treat throw as an expression.
...
Now we can correctly optimize top level code that contains a throw (or
return) as it's last statement.
R=ulan@chromium.org
BUG=v8:2054
TEST=mjsunit/regress/regress-2054
Review URL: https://chromiumcodereview.appspot.com/9969146
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-04 13:41:05 +00:00
mstarzinger@chromium.org
7b59b1d5ac
Fix array boilerplate object transitioning.
...
Array literal boilerplate objects can be transitioned while existing
un-transitioned clones are still being populated. This adds a check that
prevents us from performing the same transition twice.
R=danno@chromium.org
BUG=v8:2055
TEST=mjsunit/regress/regress-2055
Review URL: https://chromiumcodereview.appspot.com/9950095
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 16:54:28 +00:00
danno@chromium.org
8dc9bc962f
Don't crash on stack overflow entering the debugger.
...
R=ager@chromium.org , sgjesse@chromium.org
BUG=chromium:119429
TEST= test/mjsunit/regress/regress-119429.js
Review URL: https://chromiumcodereview.appspot.com/9965101
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 13:45:56 +00:00
danno@chromium.org
d9437722da
Properly support shrinking arrays in CopyDictionaryToObjectElements.
...
R=mstarzinger@chromium.org
BUG=chromium:121407
TEST=test/mjsunit/regress/regress-121407.js
Review URL: https://chromiumcodereview.appspot.com/9968056
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-03 08:13:59 +00:00
mstarzinger@chromium.org
5798bc27aa
Fix hidden properties to ignore [[Extensible]].
...
The [[Extensible]] property prevented the very first hidden property
from being added. If any hidden property was added to the object before
preventing extension, adding subsequent hidden properties would have
succeed however.
R=svenpanne@chromium.org
BUG=v8:2034
TEST=mjsunit/regress/regress-2034
Review URL: https://chromiumcodereview.appspot.com/9844025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-02 08:26:30 +00:00
vegorov@chromium.org
8360ec877e
Ensure that arguments object is materialized when deoptimizing from inlined function.
...
Lithium translation rebuilds hydrogen environments from scratch so we have to ensure that arguments object is correctly bound on function entry otherwise deoptimization will not materialize it.
This fix was implemented as part of r11109 and then reverted.
R=danno@chromium.org
BUG=v8:2045
TEST=test/mjsunit/regress/regress-2045.js
Review URL: https://chromiumcodereview.appspot.com/9963008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-30 13:22:39 +00:00
mstarzinger@chromium.org
552393c383
Add missing regression test for r11173.
...
R=svenpanne@chromium.org
BUG=chromium:12009
TEST=mjsunit/regress/regress-120099
Review URL: https://chromiumcodereview.appspot.com/9873027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-28 15:17:14 +00:00
mstarzinger@chromium.org
057371da13
Fix polymorphic load on named fields.
...
This fixes polymorphic loads to correctly compare in-object offsets
instead of indices, because indices might coincide even though the
actual slot is different because of different instance sizes.
R=danno@chromium.org
BUG=v8:2030
TEST=mjsunit/regress/regress-2030,mjsunit/mirror-array
Review URL: https://chromiumcodereview.appspot.com/9864028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 10:42:38 +00:00
erik.corry@gmail.com
6cb333cadf
Fix broken test.
...
Review URL: https://chromiumcodereview.appspot.com/9865019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 09:10:58 +00:00
erik.corry@gmail.com
bfb1e9e702
Fix edge case for case independent regexp character classes.
...
http://code.google.com/p/v8/issues/detail?id=2032
Review URL: https://chromiumcodereview.appspot.com/9860029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 08:42:37 +00:00
ulan@chromium.org
a47d1c0714
Fix the return type of the date set methods.
...
Date set methods (setMinutes, setHours, etc.) should return the time value as a number instead of JSDate.
R=jkummerow@chromium.org
TEST=test/mjsunit/regress/regress-2027.js
Review URL: https://chromiumcodereview.appspot.com/9809010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-26 10:13:03 +00:00
jkummerow@chromium.org
4e405b6945
Fix missing write barrier in CopyObjectToObjectElements.
...
Passing the write barrier mode as a parameter does not make sense, as the elements kind specific copiers know best whether a write barrier is needed or not.
BUG=119926
TEST=mjsunit/regress/regress-crbug-119926
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9808111
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11134 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-25 15:16:06 +00:00
danno@chromium.org
8833c99552
Check double array bounds in HasElementImpl.
...
R=jkummerow@chromium.org
BUG=chromium:119925
TEST=test/mjsunit/regress/regress-119925.js
Review URL: https://chromiumcodereview.appspot.com/9808110
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-25 14:21:51 +00:00
mstarzinger@chromium.org
79a98de9f7
Fix declarations escaping global strict eval.
...
According to ES5 10.4.2(3), eval calls of strict code always require
their own lexical and variable environment. For now we just add a new
scope when we parse the strict mode directive. The clean solution would
be to always have this sope present (even for global eval calls) and
adapt variable binding to cope with that.
R=rossberg@chromium.org
BUG=v8:1624
TEST=mjsunit/regress/regress-1624,test262/S10.4.2.1_A1
Review URL: https://chromiumcodereview.appspot.com/9703021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-15 13:02:21 +00:00
mstarzinger@chromium.org
2c7f0edd48
Fix wrapping of receiver for non-strict callbacks.
...
R=rossberg@chromium.org
BUG=v8:1973
TEST=mjsunit/regress/regress-1973
Review URL: https://chromiumcodereview.appspot.com/9705020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 17:42:19 +00:00
rossberg@chromium.org
46001aa54c
Function declarations shall not overwrite read-only global properties.
...
R=mstarzinger@chromium.org
BUG=115452
TEST=mjsunit/regress/regress-115452
Review URL: https://chromiumcodereview.appspot.com/9696035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 13:51:00 +00:00
kmillikin@chromium.org
7d6fd56fd5
Ensure there is a smi check of the receiver for global load and call ICs.
...
There was a comment that, for such ICs specialized to the global object,
they were always contextual loads. This is very brittle. It is a
micro-optimization that relies too much on the way that things happen to
work today.
Instead, never omit the smi check because it's safer.
R=vegorov@chromium.org
BUG=117794
TEST=regress-117794.js
Review URL: https://chromiumcodereview.appspot.com/9691038
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-13 11:39:30 +00:00
yangguo@chromium.org
7659beafb1
Ensure consistency of Math.sqrt on Intel platforms.
...
BUG=
TEST=regress-sqrt.js
Review URL: https://chromiumcodereview.appspot.com/9690010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-12 14:56:04 +00:00
yangguo@chromium.org
13689a4f13
Set debug break slot at init of loop variable in a for loop.
...
BUG=102153
TEST=regress-102153.js
Review URL: https://chromiumcodereview.appspot.com/9625011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-08 10:21:43 +00:00
yangguo@chromium.org
67540abe08
Fix compile with debuggersupport=off.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9546051
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-07 10:57:36 +00:00
mstarzinger@chromium.org
8c2708de6d
Fix Error.prototype.toString to throw TypeError.
...
R=rossberg@chromium.org
BUG=v8:1980
TEST=mjsunit/function-call,mjsunit/regress/regress-1980
Review URL: https://chromiumcodereview.appspot.com/9568005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-05 13:57:48 +00:00
yangguo@chromium.org
f2699b66cf
Revert r10908 due to flakiness and crashes.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9580007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 15:00:52 +00:00
yangguo@chromium.org
12f2099993
Ensure consistent result of transcendental functions.
...
BUG=
TEST=regress-transcendental.js
Review URL: https://chromiumcodereview.appspot.com/9572009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 14:33:15 +00:00
mstarzinger@chromium.org
fb8eb04bfd
Implement inlining of constructor calls.
...
R=vegorov@chromium.org ,kmillikin@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9304001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-28 09:05:55 +00:00
yangguo@chromium.org
32e2b0319e
Update break points set with partial file name after compile.
...
BUG=v8:1853
Review URL: https://chromiumcodereview.appspot.com/9460059
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-27 11:52:08 +00:00
yangguo@chromium.org
baabb87dae
Fix HConstant's hash function for smis on x64.
...
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9466003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-24 10:59:12 +00:00
yangguo@chromium.org
671084074d
Lazy removal of dead HValues in GVN from use lists.
...
BUG=v8:1969
TEST=regress/regress-1969
Review URL: https://chromiumcodereview.appspot.com/9455011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-23 13:59:35 +00:00
vegorov@chromium.org
f5c8ac9839
On ia32 LFunctionLiteral instruction should get context from esi register instead of stack slot.
...
This makes LFunctionLiteral safe even when it is used from inside inlined function.
All other architectures were implementing LFunctionLiteral correctly.
R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-inlining-function-literal-context.js
Review URL: https://chromiumcodereview.appspot.com/9425061
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-21 12:10:04 +00:00
mstarzinger@chromium.org
e423637898
Fix sequence of element access in array builtins.
...
R=rossberg@chromium.org
BUG=v8:1790
TEST=mjsunit/regress/regress-1790,test262/15.4.4.22-9-9
Review URL: https://chromiumcodereview.appspot.com/9419044
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-17 10:06:26 +00:00
yangguo@chromium.org
cc2780403a
Ensure using byte registers for byte instructions on ia32 and x64.
...
BUG=v8:1945
TEST=regress-1945.js
Review URL: https://chromiumcodereview.appspot.com/9418005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-16 12:48:02 +00:00