AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
22,329 Commits 1 Branch 0 Tags 839 MiB
68a7773e0f
Commit Graph

1298 Commits

Author SHA1 Message Date
mstarzinger
22dd6dc2a6 Fix representation for CompareIC in JSGenericLowering. 
R=jarin@chromium.org
TEST=mjsunit/regress/regress-3884
BUG=v8:3884
LOG=N

Review URL: https://codereview.chromium.org/933913002

Cr-Commit-Position: refs/heads/master@{#26702}
 2015-02-17 16:37:36 +00:00
jarin
0a4047a69b During arguments materialization, do not store materialized objects without lazy deopt. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/919173003

Cr-Commit-Position: refs/heads/master@{#26695}
 2015-02-17 15:24:34 +00:00
titzer
c5f7d2bb82 [turbofan] Fix control reducer with re-reducing branches. 
R=jarin@chromium.org
LOG=Y
BUG=chromium:458876

Review URL: https://codereview.chromium.org/917383004

Cr-Commit-Position: refs/heads/master@{#26666}
 2015-02-16 14:56:49 +00:00
jarin
d0758949e1 [turbofan] Clear pending exception from unsuccessful compilation. 
BUG=chromium:458987
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/932603002

Cr-Commit-Position: refs/heads/master@{#26665}
 2015-02-16 14:25:23 +00:00
hpayer
c889fb4c1d Use just one to-space page for the promotion queue. 
BUG=454725
LOG=n

Review URL: https://codereview.chromium.org/919473008

Cr-Commit-Position: refs/heads/master@{#26577}
 2015-02-11 13:39:40 +00:00
titzer
1db760de7d Reduce the number of iterations in some OSR tests by using an explicit %OptimizeOsr(). 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/913463002

Cr-Commit-Position: refs/heads/master@{#26540}
 2015-02-10 09:53:22 +00:00
titzer
9030a2674b Remove some busy-OSR loops from tests using %OptimizeOsr(). 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/908863002

Cr-Commit-Position: refs/heads/master@{#26527}
 2015-02-09 14:11:23 +00:00
titzer
4c302ca290 Make it easier to test OSR with %OptimizeOsr() runtime call. 
This call triggers OSR for the current function. And also allows explicitly testing OSR on the top-level code.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/906243002

Cr-Commit-Position: refs/heads/master@{#26523}
 2015-02-09 12:47:43 +00:00
mstarzinger
df986d08b7 Fix try-finally for dead AST-branches in TurboFan. 
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-455644
BUG=chromium:455644
LOG=N

Review URL: https://codereview.chromium.org/880443004

Cr-Commit-Position: refs/heads/master@{#26458}
 2015-02-05 12:29:33 +00:00
jkummerow
bfe7f4af14 Fix HConstant(double, ...) constructor 
It must always populate int32_value_, even if that's lossy, because other code (specifically, constant folding for truncating operations) relies on it.

BUG=v8:3865
LOG=y

Review URL: https://codereview.chromium.org/897263002

Cr-Commit-Position: refs/heads/master@{#26453}
 2015-02-05 10:28:13 +00:00
caitpotter88
49ef549807 templates: Don't check IsLineTerminator() if character is negative 
BUG=455212
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/902703002

Cr-Commit-Position: refs/heads/master@{#26442}
 2015-02-04 21:05:48 +00:00
jarin
4f786befb7 Infer HConstant::NotInNewSpace only if the supplied handle is null. 
BUG=chromium:449291
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/898753003

Cr-Commit-Position: refs/heads/master@{#26413}
 2015-02-03 17:48:35 +00:00
bmeurer
f6e02e195c Compute the same hash for all NaN values. 
Both SameValue and SameValueZero consider different NaNs equal, so we
better assign the same hash value to all NaNs.

BUG=v8:3859
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/897593002

Cr-Commit-Position: refs/heads/master@{#26391}
 2015-02-03 06:29:18 +00:00
verwaest
9cce4ff285 Clear pending exception on stack overflow in the parser 
BUG=450960
LOG=n

Review URL: https://codereview.chromium.org/858213003

Cr-Commit-Position: refs/heads/master@{#26390}
 2015-02-03 06:22:36 +00:00
verwaest
1de7dff2ef Check global object behind global proxy for extensibility 
BUG=454091
LOG=Y

Review URL: https://codereview.chromium.org/895573002

Cr-Commit-Position: refs/heads/master@{#26380}
 2015-02-02 12:49:12 +00:00
mvstanton
3df0a9ae77 CallIC used an invalid mechanism to detect if it was in optimized code. 
BUG=453481
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/885333002

Cr-Commit-Position: refs/heads/master@{#26361}
 2015-01-30 15:07:14 +00:00
jarin
da90aabc07 Always emit bailout id for inlining property access (even for keyed access). 
R=ulan@chromium.org
BUG=chromium:453805
LOG=n

Review URL: https://codereview.chromium.org/887023003

Cr-Commit-Position: refs/heads/master@{#26359}
 2015-01-30 14:35:43 +00:00
ishell
32fe247d91 Layout descriptor sharing issue fixed. 
BUG=chromium:437713, v8:3832
LOG=Y

Review URL: https://codereview.chromium.org/885003002

Cr-Commit-Position: refs/heads/master@{#26354}
 2015-01-30 12:55:25 +00:00
aperez
91b87e7a28 Do not create unresolved variables when parsing arrow functions lazily 
Arrow function parameter lists are parsed as expressions. When an identifier
is found a VariableProxy is created and added to the list of unresolved
variables for the scope. When parsing a function lazily, the scope has been
already resolved, so with this patch only the VariableProxy is created,
without adding it as an unresolved variable in the scope.

BUG=v8:3501
LOG=Y

Review URL: https://codereview.chromium.org/880253004

Cr-Commit-Position: refs/heads/master@{#26328}
 2015-01-29 15:53:15 +00:00
mstarzinger
c5833e8596 Add missing FrameState to JSToName nodes. 
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451770
BUG=chromium:451770
LOG=N

Review URL: https://codereview.chromium.org/880963002

Cr-Commit-Position: refs/heads/master@{#26305}
 2015-01-28 11:40:02 +00:00
yangguo
1e905469be Land test case for RegExp.source. 
BUG=chromium:447561
LOG=N
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/878033003

Cr-Commit-Position: refs/heads/master@{#26297}
 2015-01-27 15:17:37 +00:00
ishell
7f9b2fa699 Do not generalize field representations when making elements kind or observed transition. 
BUG=chromium:448711
LOG=y

Review URL: https://codereview.chromium.org/861173004

Cr-Commit-Position: refs/heads/master@{#26289}
 2015-01-27 11:19:06 +00:00
titzer
7c81161b97 [turbofan] Simplify reduction if IfTrue and IfFalse and fix bugs. 
R=mstarzinger@chromium.org
BUG=chromium:451958
LOG=Y

Review URL: https://codereview.chromium.org/880533002

Cr-Commit-Position: refs/heads/master@{#26276}
 2015-01-26 16:11:24 +00:00
mstarzinger
00f3f99221 Add missing FrameState for Runtime_CreateArrayLiteral. 
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451013
BUG=chromium:451013
LOG=N

Review URL: https://codereview.chromium.org/873973003

Cr-Commit-Position: refs/heads/master@{#26268}
 2015-01-26 12:45:34 +00:00
svenpanne
a7d67a64f1 Fixed Hydrogen environment handling for mul-i on ARM and ARM64. 
The whole logic in DoMul makes me cry, so I made only the minimal
change to fix the issue...

BUG=v8:451322
LOG=y

Review URL: https://codereview.chromium.org/873703002

Cr-Commit-Position: refs/heads/master@{#26261}
 2015-01-26 08:35:58 +00:00
mstarzinger
d2e424afb8 Avoid unintentional optimization of hot builtins by TurboFan. 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-crbug-451016
BUG=chromium:451016
LOG=N

Review URL: https://codereview.chromium.org/817293005

Cr-Commit-Position: refs/heads/master@{#26229}
 2015-01-22 18:52:15 +00:00
ishell
8ccc696bf6 Support concatenating with zero-size arrays with DICTIONARY_ELEMENTS in Runtime_ArrayConcat. 
BUG=chromium:450895
LOG=y

Review URL: https://codereview.chromium.org/849693003

Cr-Commit-Position: refs/heads/master@{#26219}
 2015-01-22 11:15:30 +00:00
mstarzinger
558efe21f0 Add missing BailoutId and FrameState to with statements. 
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-450642
BUG=chromium:450642
LOG=N

Review URL: https://codereview.chromium.org/865833002

Cr-Commit-Position: refs/heads/master@{#26218}
 2015-01-22 10:57:42 +00:00
bmeurer
0381acf7b3 Double field values need sNaN -> qNaN canonicalization. 
Also fix mjsunit/regress/regress-undefined-nan to ensure that we are
testing transfer via xmm registers by forcing the transfer to be in an
optimized function.

BUG=v8:3839
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863153002

Cr-Commit-Position: refs/heads/master@{#26213}
 2015-01-22 08:36:12 +00:00
Benedikt Meurer
ee86227600 [arm] Fix sNaN quietening in the ARM simulator on IA-32. 
TEST=msjunit/regress/regress-undefined-nan2
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/802243004

Cr-Commit-Position: refs/heads/master@{#26185}
 2015-01-21 13:01:23 +00:00
Benedikt Meurer
9eace97bba Use signaling NaN for holes in fixed double arrays. 
TEST=mjsunit,cctest,unittests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863633002

Cr-Commit-Position: refs/heads/master@{#26180}
 2015-01-21 08:52:25 +00:00
ishell
33994b4a22 Massive renaming of PropertyType values and other implied stuff. 
PropertyKind:
  DATA -> kData
  ACCESSOR -> kAccessor

PropertyType:
  FIELD -> DATA
  CONSTANT -> DATA_CONSTANT
  ACCESSOR_FIELD -> ACCESSOR
  CALLBACKS -> ACCESSOR_CONSTANT

PropertyLocation:
  IN_OBJECT -> kField
  IN_DESCRIPTOR -> kDescriptor

StoreMode:
  FORCE_IN_OBJECT -> FORCE_FIELD

FieldDescriptor -> DataDescriptor
ConstantDescriptor -> DataConstantDescriptor
CallbacksDescriptor -> AccessorConstantDescriptor

Review URL: https://codereview.chromium.org/856503002

Cr-Commit-Position: refs/heads/master@{#26146}
 2015-01-19 17:49:22 +00:00
mvstanton
173b69f041 ClusterFuzz fix: %NormalizeElements shouldn't process the global proxy. 
BUG=449070
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/859713002

Cr-Commit-Position: refs/heads/master@{#26126}
 2015-01-19 09:31:19 +00:00
Sven Panne
e5184734b3 Another attempt to fix regress-crbug-178790. 
This time we simply undo the change introduced by the PPC port for
this test. No idea why it should be necessary, and Windows XP
obviously doesn't give us that much stack, anyway.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/826833003

Cr-Commit-Position: refs/heads/master@{#26093}
 2015-01-16 10:12:15 +00:00
Sven Panne
54570cfa74 PPC aftermath: Fix regress-crbug-178790. 
The test fails on XP only, so let's tentatively raise the stack limit more. We probably need to investigate what a tighter limit might be and (more importantly) what the underlying reason for the failure is.

Hopefully 1800kB is enough, we can't test this via try jobs, because we don't have XP try bots. :-/

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/791693005

Cr-Commit-Position: refs/heads/master@{#26092}
 2015-01-16 09:45:31 +00:00
Sven Panne
e4c5b84652 Contribution of PowerPC port (continuation of 422063005) 
Contribution of PowerPC port (continuation of 422063005). The inital patch
covers the core changes to the common files.  Subsequent patches will cover
changes to common files to support AIX and to update the ppc directories so
they are current with the changes in the rest of the project.

This is based off of the GitHub repository
https://github.com/andrewlow/v8ppc

BUG=
R=svenpanne@chromium.org, danno@chromium.org, sevnpanne@chromium.org

Review URL: https://codereview.chromium.org/817143002

Cr-Commit-Position: refs/heads/master@{#26091}
 2015-01-16 07:42:15 +00:00
bmeurer
e1d878d16f Add proper support for proxies to HType. 
TEST=mjsunit/regress/regress-crbug-448730
BUG=chromium:448730
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/847373002

Cr-Commit-Position: refs/heads/master@{#26056}
 2015-01-14 13:57:09 +00:00
dslomov
a4124b3bfc Map -0 to integer 0 for typed array constructors. 
R=bmeurer@chromium.org
BUG=chromium:447756
LOG=Y

Review URL: https://codereview.chromium.org/790813005

Cr-Commit-Position: refs/heads/master@{#26021}
 2015-01-12 11:42:57 +00:00
titzer
7e98658e31 [turbofan] Fix control reducer for degenerate cases of self-loop branches. 
R=jarin@chromium.org
BUG=chromium:447526

Review URL: https://codereview.chromium.org/828823006

Cr-Commit-Position: refs/heads/master@{#26009}
 2015-01-09 12:28:14 +00:00
Yang Guo
2050994d80 Correctly parse line ends for debugging. 
Instead of using only \n as line terminator, we now use the definition
in http://www.ecma-international.org/ecma-262/5.1/#sec-7.3

R=marja@chromium.org
BUG=v8:2825
LOG=Y

Review URL: https://codereview.chromium.org/821383009

Cr-Commit-Position: refs/heads/master@{#25989}
 2015-01-08 10:46:13 +00:00
ishell
0d6785805c Correct handling of exceptions occured during getting of exception stack trace. 
BUG=chromium:444805
LOG=Y

Review URL: https://codereview.chromium.org/793333003

Cr-Commit-Position: refs/heads/master@{#25978}
 2015-01-07 14:50:16 +00:00
titzer
d77d3ba9a3 Fix bug in Runtime_CompileOptimized resulting from stack overflow. 
R=jarin@chromium.org
BUG=chromium:446389
LOG=Y

Review URL: https://codereview.chromium.org/844503002

Cr-Commit-Position: refs/heads/master@{#25974}
 2015-01-07 13:43:44 +00:00
svenpanne
cbf3b0bcc7 More -fsanitize=vptr fixes. 
This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
 2014-12-16 14:20:28 +00:00
marja
978f41a1da RegExpParser: Fix Reset()ting to the end. 
The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}
 2014-12-16 12:14:19 +00:00
jkummerow
c060f4e26c Internalize strings being stored into uninitialized property cells 
Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}
 2014-12-15 15:46:11 +00:00
dslomov
e6198a0fed Update tests in preparation for shipping classes. 
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}
 2014-12-11 15:54:09 +00:00
ishell
7d13ca278a Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}
 2014-12-10 15:18:52 +00:00
svenpanne
c16b8f6cbb Fixed environment handling for LFlooringDivI on ARM. 
Beautiful code... :-}

BUG=chromium:437765
LOG=y

Review URL: https://codereview.chromium.org/775613002

Cr-Commit-Position: refs/heads/master@{#25613}
 2014-12-02 13:47:19 +00:00
ishell
1a2e4b265a Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map. 
BUG=chromium:436820
LOG=N

Review URL: https://codereview.chromium.org/759823004

Cr-Commit-Position: refs/heads/master@{#25530}
 2014-11-26 17:37:05 +00:00
titzer
9da4998204 Abort optimization in corner case. 
The %OptimizeFunctionOnNextCall sledgehammer can cause a function to be
marked for optimization before it's ever been compiled by fullcode.
This can lead to the situation where a function doesn't have optimization
disabled until we try to compile it optimized.

Basically, the assert should just handle this case more gracefully.

R=yangguo@chromium.org
BUG=436893
LOG=Y

Review URL: https://codereview.chromium.org/760063002

Cr-Commit-Position: refs/heads/master@{#25528}
 2014-11-26 16:57:52 +00:00
jarin
97cab985b8 Do not try to inline if the function has an illegal redeclaration. 
R=mvstanton@chromium.org
BUG=chromium:436896
LOG=n

Review URL: https://codereview.chromium.org/755333003

Cr-Commit-Position: refs/heads/master@{#25527}
 2014-11-26 16:32:46 +00:00
dslomov
626f110f0b Introduce legacy const slots in correct context. 
R=rossberg@chromium.org
BUG=chromium:410030
LOG=Y

Review URL: https://codereview.chromium.org/756293004

Cr-Commit-Position: refs/heads/master@{#25519}
 2014-11-26 12:16:30 +00:00
dslomov
6ac4de87a8 harmony-scoping: make assignment to 'const' a late error. 
Per TC39 Nov 2014 decision.

This patch also changes behavior for "legacy const": assignments to sloppy const in strict mode is now also a type error. This fixes v8:2243 and also brings us in compliance with other engines re assignment to function names (see updated webkit test), but might have bigger implications.
That change can easily be reverted by changing Variable::IsSignallingAssignmentToConst.

BUG=v8:3713,v8:2243
LOG=N

Review URL: https://codereview.chromium.org/749633002

Cr-Commit-Position: refs/heads/master@{#25516}
 2014-11-26 11:21:23 +00:00
jarin
d9cabb9b22 [turbofan] Fix matching of the lea instruction. 
Resets the scaled exponent to 0 when the scaling match fails.

BUG=

Review URL: https://codereview.chromium.org/756643002

Cr-Commit-Position: refs/heads/master@{#25491}
 2014-11-24 17:45:33 +00:00
yangguo
270dccf6db Correctly find shared function info for debugging when compiling eagerly. 
R=ulan@chromium.org
BUG=v8:3717
LOG=N

Review URL: https://codereview.chromium.org/758523004

Cr-Commit-Position: refs/heads/master@{#25486}
 2014-11-24 15:43:35 +00:00
yangguo
14a3b9188d Fix RegExp.source for uncompiled regexp. 
R=jkummerow@chromium.org
BUG=435825
LOG=N

Review URL: https://codereview.chromium.org/753983002

Cr-Commit-Position: refs/heads/master@{#25476}
 2014-11-24 11:21:52 +00:00
yangguo
5414c39974 Slightly improve tests that rely on lazy compilation. 
R=rossberg@chromium.org
BUG=v8:3712
LOG=N

Review URL: https://codereview.chromium.org/743843003

Cr-Commit-Position: refs/heads/master@{#25463}
 2014-11-21 12:41:06 +00:00
yangguo
61bee5c898 Correctly escape RegExp source. 
R=ulan@chromium.org
BUG=v8:3229
LOG=N

Review URL: https://codereview.chromium.org/736003002

Cr-Commit-Position: refs/heads/master@{#25457}
 2014-11-21 10:50:24 +00:00
Michael Stanton
cf572694fe Assert to protect against polymorphic string loads fires on valid stores. 
BUG=435477
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/751513002

Cr-Commit-Position: refs/heads/master@{#25456}
 2014-11-21 10:29:08 +00:00
Michael Stanton
3d58b82add Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed. 
The bug was an error when copying arrays in crankshaft. If it's a holey smi
array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation
changes from being inserted that deopt on encountering the hole.

Also, prevent inlining array pop() and shift() if the length is read-only.

BUG=435073
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/737383002

Cr-Commit-Position: refs/heads/master@{#25455}
 2014-11-21 10:14:19 +00:00
ulan
dc88962350 Do not bailout from optimizing functions that use f(x, arguments) 
if there is not enough type-feedback to detect that f is Function.prototype.apply.

BUG=v8:3709
LOG=N
TEST=mjsunit/regress/regress-3709

Review URL: https://codereview.chromium.org/736043002

Cr-Commit-Position: refs/heads/master@{#25447}
 2014-11-20 17:07:44 +00:00
Andreas Rossberg
4f63564700 Fix lower bound violation 
R=jarin@chromium.org
BUG=433332
LOG=N

Review URL: https://codereview.chromium.org/739563002

Cr-Commit-Position: refs/heads/master@{#25436}
 2014-11-20 11:22:49 +00:00
yangguo
5bea77f786 Fix disabling all break points from within the debug event callback. 
BUG=chromium:432493
LOG=Y

Review URL: https://codereview.chromium.org/728103008

Cr-Commit-Position: refs/heads/master@{#25400}
 2014-11-18 14:57:48 +00:00
Jakob Kummerow
bf22724e0d Fix one more missing c0_ < 0 check in scanner 
BUG=chromium:433766
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/731953003

Cr-Commit-Position: refs/heads/master@{#25371}
 2014-11-17 09:43:31 +00:00
Jaroslav Sevcik
c3af691e72 [turbofan] Remove int32 narrowing during typed lowering. 
With Int32Add we lose the int/uint distinction, so later, in simplified lowering we can make a wrong decision. E.g., see the attached test case, where we lower NumberAdd -> Int32Add because inputs are Uint32, but during simplified lowering we change the inputs to Int32, so we get a wrong result.

Simplified lowering will lower the NumberAdd operations anyway, so we should lose performance.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/721723004

Cr-Commit-Position: refs/heads/master@{#25368}
 2014-11-17 09:04:52 +00:00
ishell@chromium.org
2e38f33911 Revert "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Revert "Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136."

This revert is made in order to revert r25099 which potentially causes renderer hangs.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/722873004

Cr-Commit-Position: refs/heads/master@{#25332}
 2014-11-13 15:31:04 +00:00
ishell@chromium.org
bc8c41c08d Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions. 
It started showing after r25253.

BUG=v8:3687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/715313003

Cr-Commit-Position: refs/heads/master@{#25324}
 2014-11-13 10:56:31 +00:00
Jaroslav Sevcik
2d075e2298 Reland "[turbofan] Weakening of types must weaken ranges inside unions." 
This relands commit 4c1f4b796d.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/723023002

Cr-Commit-Position: refs/heads/master@{#25317}
 2014-11-13 09:02:14 +00:00
Yang Guo
b96309b776 Move public symbols to the root set. 
This allows serializing public symbols that are embedded in code.

BUG=v8:3689
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722723002

Cr-Commit-Position: refs/heads/master@{#25315}
 2014-11-13 08:48:08 +00:00
Jaroslav Sevcik
c513297f9f Revert "[turbofan] Weakening of types must weaken ranges inside unions." 
This reverts commit 4c1f4b796d.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722943003

Cr-Commit-Position: refs/heads/master@{#25312}
 2014-11-13 06:10:42 +00:00
Jaroslav Sevcik
4c1f4b796d [turbofan] Weakening of types must weaken ranges inside unions. 
BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/712623002

Cr-Commit-Position: refs/heads/master@{#25311}
 2014-11-13 05:31:47 +00:00
dslomov@chromium.org
0e2f7e3c35 Re-enable serialization under harmony-scoping. 
R=yangguo@chromium.org
BUG=v8:3689
LOG=N

Review URL: https://codereview.chromium.org/717153002

Cr-Commit-Position: refs/heads/master@{#25294}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 13:12:50 +00:00
yangguo@chromium.org
1dbd6369b1 Correctly compute line numbers in functions from the function constructor. 
R=aandrey@chromium.org
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/701093003

Cr-Commit-Position: refs/heads/master@{#25289}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 10:06:47 +00:00
adamk@chromium.org
1386257c55 Correctly handle Array unshift/splices that move elements past the max length of an Array 
BUG=v8:2615
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/679113003

Cr-Commit-Position: refs/heads/master@{#25270}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 19:08:14 +00:00
jkummerow@chromium.org
3b3929fdc7 Reland "Avoid some unnecessary fast-properties map creations." 
This relands commit ea74f0f85a.

The revert was due to failures in cctest/test-heap/ReleaseOverReservedPages,
caused by apparent changes to memory layout and fragmentation of the
first page. Eliminating a situation in messages.js where this CL has had
an effect on map transitions seems to solve the issue.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/714883003

Cr-Commit-Position: refs/heads/master@{#25266}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 15:41:30 +00:00
jkummerow@chromium.org
d3b68cf370 Fix has_constant_parameter_count() confusion in LReturn 
BUG=chromium:431602
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/714663002

Cr-Commit-Position: refs/heads/master@{#25249}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 15:25:50 +00:00
arv@chromium.org
c24ebcd387 Revert "Avoid some unnecessary fast-properties map creations." 
This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2.

Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa..

BUG=None
LOG=N
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/709123002

Cr-Commit-Position: refs/heads/master@{#25224}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 18:49:45 +00:00
jkummerow@chromium.org
ea74f0f85a Avoid some unnecessary fast-properties map creations. 
(1) When we have just normalized and re-fastified a map, we don't need to copy it again to set the is_prototype bit.
(2) When defining accessors causes a non-prototype object to go slow, don't force re-fastification.

BUG=v8:3267
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/706243002

Cr-Commit-Position: refs/heads/master@{#25221}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 16:33:47 +00:00
marja@chromium.org
2b026851ac Scanner: disallow unicode escapes in regexp flags. 
The spec explicitly forbids them. V8 never handled them properly either, just
the Scanner accepted them (it had code to add them literally to the
LiteralBuffer) and later on, Regexp constructor disallowed them.

According to the spec, unicode escapes in regexp flags should be an early error
("It is a Syntax Error if IdentifierPart contains a Unicode escape sequence.").

Note that Scanner is still more relaxed about regexp flags than the
spec. Especially, it accepts any identifier parts (not just a small set of
letters) and doesn't check for duplicates.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/700373003

Cr-Commit-Position: refs/heads/master@{#25215}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 14:32:19 +00:00
ishell@chromium.org
e1f93a82f2 Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136. 
BUG=chromium:430846
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/704183002

Cr-Commit-Position: refs/heads/master@{#25185}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 11:50:33 +00:00
jarin@chromium.org
91eeae5849 [turbofan] Fix deopt for assignments in non-effect context. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/701853002

Cr-Commit-Position: refs/heads/master@{#25151}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 13:09:14 +00:00
ishell@chromium.org
33dde8d92c TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/661133002

Cr-Commit-Position: refs/heads/master@{#25136}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 09:26:48 +00:00
rossberg@chromium.org
357882a8e5 1..isPrototypeOf.call(null) should return false, not throw TypeError. 
BUG=v8:3483
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/433413002

Cr-Commit-Position: refs/heads/master@{#25116}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 16:14:18 +00:00
mstarzinger@chromium.org
cd3273b562 Properly handle stack overflows in the AST graph builder. 
R=jarin@chromium.org
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159
LOG=N

Review URL: https://codereview.chromium.org/697473006

Cr-Commit-Position: refs/heads/master@{#25037}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-31 14:02:46 +00:00
yangguo@chromium.org
76292d2daf Fix assertion scope in Runtime_GetScript. 
The HeapIterator implies DisallowHeapAllocation, but Script::GetWrapper
may allocate.

LOG=N
R=jkummerow@chromium.org
BUG=chromium:410033

Review URL: https://codereview.chromium.org/680283002

Cr-Commit-Position: refs/heads/master@{#25001}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 07:25:43 +00:00
yangguo@chromium.org
64cef0b2e9 Reland "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
BUG=chromium:424142
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/692453002

Cr-Commit-Position: refs/heads/master@{#24970}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24970 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 10:19:44 +00:00
yangguo@chromium.org
67b76ebaea Revert "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
This reverts commit r24964.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/687163002

Cr-Commit-Position: refs/heads/master@{#24966}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 09:23:10 +00:00
yangguo@chromium.org
7668c4c29a In PrepareForBreakPoints, also purge shared function info not referenced by functions. 
R=ulan@chromium.org
BUG=chromium:424142
LOG=N

Review URL: https://codereview.chromium.org/685753002

Cr-Commit-Position: refs/heads/master@{#24964}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 08:11:41 +00:00
yangguo@chromium.org
0dfbf83468 Use shared function info for eval cache key. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/678843004

Cr-Commit-Position: refs/heads/master@{#24927}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 10:01:44 +00:00
yangguo@chromium.org
efc01f4736 Prevent recursion in the debug event listener. 
R=ulan@chromium.org
BUG=chromium:409614
LOG=N

Review URL: https://codereview.chromium.org/684573005

Cr-Commit-Position: refs/heads/master@{#24924}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 09:44:43 +00:00
adamk@chromium.org
f1954232b0 SimpleMove now calls [[Has]] before [[Get]] when moving elements 
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/678753002

Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-27 13:05:13 +00:00
jarin@chromium.org
23df66ee24 Add more missing deopts 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/639883002

Cr-Commit-Position: refs/heads/master@{#24886}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-26 10:25:48 +00:00
adamk@chromium.org
c9ea8d6512 SimpleSlice now calls [[Get]] before [[Has]] when generating copy 
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.

BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/674003002

Cr-Commit-Position: refs/heads/master@{#24884}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:08:13 +00:00
adamk@chromium.org
02d37b8f10 Widen definition of %HasComplexElements() to include non-enumerability 
This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:04:13 +00:00
adamk@chromium.org
0ef073d556 Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/673893002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 21:13:29 +00:00
adamk@chromium.org
5f1ae66d56 Narrow cases where Sparse/Smart versions of Array methods are used 
Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/656423004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 18:21:50 +00:00
ishell@chromium.org
5509cc2c07 Fixed mutable heap numbers leak in JSON parser. 
BUG=chromium:423687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/669403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 14:41:39 +00:00
dslomov@chromium.org
96105a90fc harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=24834

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 12:30:20 +00:00
dslomov@chromium.org
707ed29a51 Revert "harmony-scoping: Allow 'const' iteration variables in strict mode." 
This reverts commit r24834 for breaking debug tests.

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/672193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:55:19 +00:00
dslomov@chromium.org
b54f7d3c46 harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:18:50 +00:00