Commit Graph

169 Commits

Author SHA1 Message Date
kasperl@chromium.org
90b3370374 Update V8 to version 3.0 (re-land r5920).
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:31:57 +00:00
kasperl@chromium.org
51b494d096 Revert r5920. Will re-land shortly.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:01:02 +00:00
kasperl@chromium.org
e5860bd6a8 Update V8 to version 3.0.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 09:11:56 +00:00
lrn@chromium.org
7be18f702b make DateParser::TimeComposer handle 1-2 digits millisecond values
see http://code.google.com/p/v8/issues/detail?id=944
This patch makes DateParser::TimeComposer process times that have
millisecond values with only 1 or 2 digits.

Without this patch, Date.parse("2010-11-25T22:02:30.5") returns
1290690150005 and
Date.parse("2010-11-25T22:02:30.5") == Date.parse("2010-11-25T22:02:30.005")
evaluates to true.

With this patch, Date.parse("2010-11-25T22:02:30.5") returns
1290690150500 instead, and
Date.parse("2010-11-25T22:02:30.5") == Date.parse("2010-11-25T22:02:30.005")
evaluates to false.

Review URL: http://codereview.chromium.org/5336005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-26 11:48:35 +00:00
sgjesse@chromium.org
010f35f478 Change the order of evaluation of sub-expressions for keyed call
The expression of the key is now evaluated before the arguments, so all expressions in a keyed call are evaluared from left to right.

BUG=http://code.google.com/p/v8/issues/detail?id=931
TEST=test/mjsunit/regress/regress-931.js
Review URL: http://codereview.chromium.org/5161002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-17 13:59:07 +00:00
lrn@chromium.org
0464b33625 Fix bug in parser that allows "(foo):42" as a labeled statement.
Fixes issue 918.

Review URL: http://codereview.chromium.org/5044003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-16 12:10:48 +00:00
vegorov@chromium.org
20d3aad5ae Add check for overflow after MUL operations in side-effect free int32 expressions.
BUG=http://code.google.com/p/v8/issues/detail?id=927
TEST=test/mjsunit/regress/regress-927.js

Review URL: http://codereview.chromium.org/4746001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-09 19:32:49 +00:00
vegorov@chromium.org
746d72420c Improve positions recording for calls.
Review URL: http://codereview.chromium.org/4469002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-04 15:12:03 +00:00
erik.corry@gmail.com
759a87b520 Fix new-space-too-small test crash on 64 bit VM.
Review URL: http://codereview.chromium.org/3778009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-15 10:45:18 +00:00
erik.corry@gmail.com
d22965c49d Fix creation of an exception to avoid rare GC corner case.
Review URL: http://codereview.chromium.org/3782009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-15 07:54:20 +00:00
lrn@chromium.org
6c0cde67bc Fix bug in cache handling of lastIndex on global regexps.
Review URL: http://codereview.chromium.org/3745005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-14 08:51:20 +00:00
vegorov@chromium.org
622351fedd Fix getOwnPropertyDescriptor() support for index properties.
Add support for index properties with getters, setters or indexed interceptors.

For indexed interceptor case only fix crashes, do not guarantee any semantic soundness. Separate issue opened for this http://code.google.com/p/v8/issues/detail?id=877

BUG=http://code.google.com/p/v8/issues/detail?id=874

Review URL: http://codereview.chromium.org/3462005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-23 11:25:01 +00:00
lrn@chromium.org
0dece535d9 RegExp: Fix caching to correctly set lastIndex.
BUG: 52801

Review URL: http://codereview.chromium.org/3389022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-22 11:22:57 +00:00
fschneider@chromium.org
e91a352d02 Fix a regression in character-at stub when doing a keyed load on a string.
Loading from out-of-range has to go to the runtime system to check if there
exists a property with that index in the prototype.

Review URL: http://codereview.chromium.org/3410011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-16 09:18:08 +00:00
lrn@chromium.org
ac2ae05f85 make Date.parse properly handle TZ offsets
This makes, e.g., Date.parse("2010-08-31T22:35:36-09:00") work as
expected. Without this change, the "-9:00" timezone-offset portion
causes V8 to fail to properly parse that string into a date.
BUG=http://code.google.com/p/v8/issues/detail?id=857
TEST=Try Date.parse("2010-08-31T22:35:36-09:00") and make sure
that it gets parsed without errors and does not return NaN.

Review URL: http://codereview.chromium.org/3318017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-10 07:00:28 +00:00
kaznacheev@chromium.org
73c02394bf Avoid pushing arguments twice in GenericBinaryOpStub.
Under some conditions (ADD, non-number arguments passed in registers)
GenerateRegisterArgumentsPush was called twice and the stack broke.

Review URL: http://codereview.chromium.org/3290012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-07 13:33:40 +00:00
vegorov@chromium.org
3d60cc34af Fix regress-851.js to use assertNull instead of assertFalse.
Review URL: http://codereview.chromium.org/3232002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-27 13:23:14 +00:00
vegorov@chromium.org
f059093562 Check result of JSObject::NormalizeElements() in JSObject::PreventExtensions().
Normalization requires allocation so Failure object can be returned.

BUG=http://code.google.com/p/v8/issues/detail?id=851
TEST=test/mjsunit/regress/regress-851.js

Review URL: http://codereview.chromium.org/3262001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-27 13:06:50 +00:00
ricow@chromium.org
7672338bc9 Fixes bug in Object.freeze and Object.seal causing them to misbehave when Array.prototype has changed.
Object.freeze and Object.seal uses GetOwnPropertyNames which
returns an array with local property names. This array will also have
the additional properties defined on Array.prototype or
Object.prototype.

Note that, the implementation of GetOwnPropertyNames (when used as
Object.getOwnPropertyNames) is correct, since the spec says to create
a new Array (which would also have these properties).

Review URL: http://codereview.chromium.org/3137041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-26 08:35:49 +00:00
erik.corry@gmail.com
e18d07b604 ARM: Ensure that we are not in a spilled scope when calling
Load() or constructing a reference.
Review URL: http://codereview.chromium.org/3125011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-16 11:43:30 +00:00
sgjesse@chromium.org
56e0221754 Handle accessors when generating Error.stack
BUG=http://code.google.com/p/v8/issues/detail?id=798
TEST=test/mjsunit/regress/regress-798.js
Review URL: http://codereview.chromium.org/3082012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-13 08:31:52 +00:00
sgjesse@chromium.org
8e0cd6db8a Handle overwriting valueOf on String objects correctly when adding
This adds a check to the fast case string add to ensure that the String object still have the default valueOf function. The default valueOf is sitting on a hidden prototype of String.prototype.

Before using the fast case valueOf the object is checked for a local valueOf property. For slow case objects this check always reports true (the dictionary is not probed, so valueOf might be there) and for fast case objects the descriptor array is checked for the valueOf symbol (just liniar scan). After that the prototype is checked for beeing the initial value of String.prototype. If this all pass (that is the default valueOf is still in place) this result is cached on the map making the check fast the next time.

This is only implemented in the optimizing compiler, as the two usages of %_IsStringWrapperSafeForDefaultValueOf is never hit by the full compiler.

I will port to x64 and ARM when this has been reviewed for ia32.

I will remove the performance counters prior to final commit.

BUG=http://code.google.com/p/v8/issues/detail?id=760
TEST=test/mjsunit/regress/regress-760-1.js
TEST=test/mjsunit/regress/regress-760-2.js

Review URL: http://codereview.chromium.org/3117006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-12 13:43:08 +00:00
erik.corry@gmail.com
bdfdf8bee9 Fix fuzzer-found error where left and right were the same register in bitops.
Review URL: http://codereview.chromium.org/3115004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-10 12:30:14 +00:00
ricow@chromium.org
44425bcc03 Change dos line endings to unix line endings in a number of mjsunit test files.
Review URL: http://codereview.chromium.org/3072031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5212 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-09 12:21:50 +00:00
vegorov@chromium.org
4a2f05ce35 Fix issue 806.
Ensure that we are not using r12 as a receiver in inlined NamedStore code.

Review URL: http://codereview.chromium.org/3081007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5162 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-02 09:14:44 +00:00
whesse@chromium.org
3607a9e78e Fix error in optimized x.apply(y, arguments) code generation on ARM. Fixes issue 784. Adds regression test.
Review URL: http://codereview.chromium.org/3048035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-28 12:50:27 +00:00
whesse@chromium.org
cb1eedd269 Fix error in x64 fast smi loops, change 4998.
Review URL: http://codereview.chromium.org/2925012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-14 13:22:47 +00:00
ricow@chromium.org
eff34b9952 Update JSON.stringify to floor the space parameter (fixes issue 753).
Review URL: http://codereview.chromium.org/2877004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-29 07:22:40 +00:00
ricow@chromium.org
faaf524445 Fixes bug in Array.prototype.lastIndexOf when called with null or undefined as fromIndex argument. (fixes issue 754).
Review URL: http://codereview.chromium.org/2840021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4950 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 09:28:38 +00:00
ager@chromium.org
b71fe5b61e Fix bug in JSON.stringify where Boolean objects are incorrectly
unwrapped.

This fixes issue 752.
Review URL: http://codereview.chromium.org/2845023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 07:45:52 +00:00
lrn@chromium.org
7b46a1f49d Fix bug in regexp exec with global regexps.
Review URL: http://codereview.chromium.org/2826020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 07:00:29 +00:00
ricow@chromium.org
be531accc0 Add regression test for the code flushing in issue 474 (which was
fixed in revision 4921).

This also enables codeflushing by default.

Review URL: http://codereview.chromium.org/2829020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-23 08:02:06 +00:00
ricow@chromium.org
de512af068 Add support for elements and array indices in Object.defineProperty
(fixes bug 619).

This also fixes a bug in GetOwnProperty in runtime.cc discovered by
the new test cases. That part of the code was not testable before
since we had no way of correctly defining properties on elements.

Review URL: http://codereview.chromium.org/2832001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-14 13:55:38 +00:00
vegorov@chromium.org
1d932dcc6e Add regression tests for issues 728, 732
TBR=lrn@chromium.org

Review URL: http://codereview.chromium.org/2698004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-07 10:54:42 +00:00
ricow@chromium.org
95939ada29 Fix issue 720 making Object.defineProperty handle existing writable flags correctly.
The existing version will overwrite the existing writable flag with
false even in the case where no new value is given and the existing
writable flag is true.

The reason for the issue is that there is no check to see if the
provided descriptor actually has a writable attribute. This causes us
to use the default value (false) even in the case where nothing was
provided. In addition, the existing tests makes wrong assumptions (that writable is always set to false if not provided) and has been changed to follow the specification.

Review URL: http://codereview.chromium.org/2271001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-26 08:31:57 +00:00
ricow@chromium.org
fb58bc06c6 Fixes issue 712 causing non-configurable accessors to be overwritable by using
Object.defineProperty with empty property descriptor.

The issue is fixed by implementing step 5 and 6 from DefineOwnProperty in the
specification (ES5 8.12.9).

This also fixes a bug in SameValue when used on boolean values (it
would priorly return a number - not a boolean).

Review URL: http://codereview.chromium.org/2131019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-25 06:25:27 +00:00
ricow@chromium.org
8d51195778 Fixed issue 619 allowing Object.create to be called with a function.
This change allows Object.create to take a function as input in the
proto argument. The spec says that Type(O) for the proto argument
should be true but our IS_OBJECT does not check for this. I will make a
IS_SPEC_OBJECT in macros.py and refactor v8natives in another CL.

Review URL: http://codereview.chromium.org/2051001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-09 08:43:59 +00:00
ricow@chromium.org
fb3e01a306 Correct issue 696 with Date.parse returning a value when called on a non date string.
The error was introduced in revision 4557 where support was added for
ES5 date time format strings. Because there was no check for a valid
year a random string starting with a non-digit character would be
parsed.

This change disallows ES5 formatted dates where there is no date
fraction (i.e., with only a timestamp). Since none of the other
browsers support Date.parse on only timestamps I have disabled this
totally instead of just correcting the parser.


Review URL: http://codereview.chromium.org/2017005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-07 11:53:20 +00:00
ricow@chromium.org
f066a9af40 Added regression test for crbug 40931 http://crbug.com/40931
Review URL: http://codereview.chromium.org/1756013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-26 13:26:11 +00:00
ager@chromium.org
c0f1f18f80 Fix bug in KeyedLoadIC generic stub where signed instead of unsigned
comparison was used.

Review URL: http://codereview.chromium.org/1769005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-23 12:57:41 +00:00
ager@chromium.org
c678e44805 Add missing smi check in IC for nonexistent properties.
Add regression test.

BUG=v8:681
Review URL: http://codereview.chromium.org/1673005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4446 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-20 10:20:39 +00:00
ager@chromium.org
afc15bb48f Reapply load ICs for nonexistent properties.
We need to be careful to check global property cells for the property
encountered during lookup.  Therefore, the ICs have to be specific to
the name of the property if global objects are involved.  In
principle, this means that we could get a large number of monomorphic
ICs for the same map if there is a global object in the prototype
chain.  However, since this is only done for normal load ICs and not
for keyed load ICs I do not expect this to be a problem.  I will
experiment with it once this goes in.

BUG=675
Review URL: http://codereview.chromium.org/1559033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-15 11:25:41 +00:00
sgjesse@chromium.org
6a63910650 Re-apply "Inline floating point compare"
This re-applies r4220 and r4233, which was reverted in r4254 due to a bug. This bug has now been fixed, with the only change being line 2884 changed from

  __ SmiTag(left_side->reg());

to

  __ SmiTag(operand->reg());

Added a regression test.

BUG=http://crbug.com/39160
TEST=test/mjsunit/regress/regress-crbug-39160.js

Review URL: http://codereview.chromium.org/1251009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-25 12:04:34 +00:00
sgjesse@chromium.org
1963ffba99 Don't generate inline constructors if this.__proto__ is assigned.
BUG=http://code.google.com/p/v8/issues/detail?id=646
TEST=test/mjsunit/regress/regress-646.js
Review URL: http://codereview.chromium.org/1023008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-17 13:23:53 +00:00
fschneider@chromium.org
d0908674fa Fix bug in assigned variables analysis.
Property stores were not visited correctly by the visitor.
I fixed this issue by visiting property stores by visiting 
receiver and key directly (and not calling visit on the lhs property
 ast node)

Review URL: http://codereview.chromium.org/903003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-12 13:12:08 +00:00
fschneider@chromium.org
d896e4f6f2 Fix treatment of const variables in assigned variable analysis.
Const variables are not considered as trivial sub-expressions since
we have the check for the hole value as a side-effect.

Review URL: http://codereview.chromium.org/849003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4112 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-12 10:20:31 +00:00
sgjesse@chromium.org
b0c9738f77 Fix code cache lookup for keyed IC's
For keyed IC's the name is not necessarily a string.

BUG=http://crbug.com/37853
TEST=test/mjsunit/regress/regress-crbug-37853.js
Review URL: http://codereview.chromium.org/872001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-11 08:52:31 +00:00
sgjesse@chromium.org
800b6df2a6 Correct handling of adding a string and a smal integer
The fast case of looking up the string convertion of the smi did not handle the case where left/reghe operands could be in eax/edx instead of edx/eax which is the default.

Also got rid of creating an internal frame for calling string and instead patched the argument on the stack and performed a tail call.

BUG=http://code.google.com/p/v8/issues/detail?id=636
TEST=test/mjsunit/regress/regress-636.js
Review URL: http://codereview.chromium.org/720001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-09 09:40:35 +00:00
sgjesse@chromium.org
df4471c8f3 Fix stack tweaking in array allocation
When Array(0) or new Array(0) is handled by the generated code it is handled
by the same code as Array() and new Array(). For this to work the stack is
tweaked to remove the argument of value 0. However the argc was still passed
as 1 if a call to the runtime system was made.

When the stack is tweaked argc is also changed to 0.

BUG=634
TEST=test/mjsunittest/mjsunit/regress/regress-634.js
Review URL: http://codereview.chromium.org/668155

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-05 13:43:53 +00:00
kmillikin@chromium.org
3c0d77f32e Fix stack corruption when calling non-function.
Fix for issue 603.

Revision r3484 removed the property name from the call stack for
call ICs.  When a non-function was called via a call IC and
Function.prototype.call, an extra value was left on the stack that the
caller could not know to clean up.

Fix is to change the JS builtin used for calling non-functions.  It
now gets the callee as receiver, rather than iterating stack frames
and finding it on the expression stack of its JS caller.

Review URL: http://codereview.chromium.org/604064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-17 08:26:50 +00:00