Commit Graph

1890 Commits

Author SHA1 Message Date
ulan@chromium.org
211f4a7be0 Disable regress-crbug-160010 for Android because it triggers OOM.
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12314150

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 12:14:21 +00:00
jkummerow@chromium.org
732a2af96a Clean up mjsunit/array-bounds-check-removal
Review URL: https://codereview.chromium.org/12317142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 10:50:37 +00:00
ulan@chromium.org
87265114c4 Emit VMLS for multiply-subtract on ARM.
BUG=none

Review URL: https://chromiumcodereview.appspot.com/12319113
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 10:24:40 +00:00
dcarney@chromium.org
52a015b1af Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12326120

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 11:02:39 +00:00
mstarzinger@chromium.org
ce1e10f5fc Make __proto__ a foreign callback on Object.prototype.
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.

The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.

R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262

Review URL: https://codereview.chromium.org/12212011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 10:46:00 +00:00
yangguo@chromium.org
0d63cef35b Constant fold math and string operations.
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12315005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-21 11:40:37 +00:00
mstarzinger@chromium.org
300413b5a9 Fix f.apply() optimization when declared arguments are mutated.
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539

Review URL: https://codereview.chromium.org/12255033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 15:12:49 +00:00
mstarzinger@chromium.org
05e95eee0e Allow full inlining of f.apply(this, arguments) calls.
This allows Crankshaft to completely inline a f.apply() dispatch if the
exact number of arguments is known and the function is constant. The
deoptimizer doesn't generate the f.apply() frame during deoptimization,
so the materialized frames look like f.apply() did a tailcall.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-function-apply

Review URL: https://codereview.chromium.org/12263004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 09:55:50 +00:00
jkummerow@chromium.org
19dab057b4 Fix NegateCompareOp and InvertCompareOp
BUG=v8:2537

Review URL: https://codereview.chromium.org/12217136

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-13 14:36:19 +00:00
jkummerow@chromium.org
b09cc0be50 Adjust the stack-size value for big-array-literal.js
Review URL: https://codereview.chromium.org/12114002
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:45:47 +00:00
jkummerow@chromium.org
e83ff197bf Add regression test for r13617
Many thanks to Vyacheslav Egorov for coming up with this test!

BUG=173907

Review URL: https://codereview.chromium.org/12212066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:38:24 +00:00
mstarzinger@chromium.org
79607d20e6 Make the GC stress builder go green.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12218034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-06 13:21:28 +00:00
adamk@chromium.org
dbf50cf948 Object.observe: change array truncation logic to efficiently handle large sparse arrays
Review URL: https://codereview.chromium.org/12041084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 21:03:08 +00:00
verwaest@chromium.org
aca87c2fcd Tag stubs that rely on instance types as MEGAMORPHIC.
BUG=chromium:173974

Review URL: https://chromiumcodereview.appspot.com/12178017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 13:12:03 +00:00
danno@chromium.org
0c3575c874 Generate the TransitionElementsStub using Crankshaft
This includes:
* Adding support for saving callee-clobbered double registers in Crankshaft code.
* Adding a new "HTrapAllocationMemento" hydrogen instruction to handle AllocationSiteInfo data in crankshafted stubs.
* Adding a new "HAllocate" hydrogen instruction that can allocate raw memory from the GC in crankshafted code.
* Support for manipulation of the hole in HChange instructions for Crankshafted stubs.
* Utility routines to manually build loops and if statements containing hydrogen code.

Review URL: https://codereview.chromium.org/11659022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 12:01:59 +00:00
adamk@chromium.org
c001d928df Object.observe: don't unnecessarily emit oldValue for reconfigurations of data properties
When a data property has its attributes changed but its value remains the same,
don't emit an oldValue. This makes the API more consistent by only emitting
oldValue when the value of a property has actually changed (or been removed,
in the case of a reconfiguration as an accessor property or a deletion).

Review URL: https://codereview.chromium.org/11820004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-30 21:07:28 +00:00
yangguo@chromium.org
c5883d442e Add option to limit tick processor to a time range.
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12077043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-29 14:41:02 +00:00
verwaest@chromium.org
c8636a2809 Do not try to collect the map if the monomorphic IC stub has no map.
This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.

BUG=chromium:172345

Review URL: https://chromiumcodereview.appspot.com/12082023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-28 13:19:53 +00:00
mstarzinger@chromium.org
fe8e97798e Allow inlining of multiple closures from shared function.
This allows Crankshaft to allow inlining of multiple different closures
that were all derived from the same shared function info. This pattern
appears when libraries provide generic closures that are used over and
over again at different call-sites.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-closures

Review URL: https://codereview.chromium.org/12071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 16:55:00 +00:00
yangguo@chromium.org
24ec13cbd2 Fix additional spec violations wrt RegExp.lastIndex.
R=svenpanne@chromium.org
BUG=v8:2437

Review URL: https://chromiumcodereview.appspot.com/12033099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 10:53:26 +00:00
mstarzinger@chromium.org
44ffa0dcd3 Allow monomorphic loads when static type is known.
This allows Crankshaft to generate monomorphic loads when the receiver
type is statically known even though the load site has polymorphic type
feedback. This applies to inlined constructor calls and literals.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/property-static

Review URL: https://codereview.chromium.org/12051058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 17:54:30 +00:00
ulan@chromium.org
e6224d275f Make embedded maps in optimized code weak.
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 11:55:05 +00:00
ulan@chromium.org
d29826544e Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.
After r13289 the divisor can be non-constant, so we should check for zero.

BUG=171641
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 15:58:49 +00:00
yangguo@chromium.org
9296975c04 Correctly reset lastIndex in an RegExp object.
R=svenpanne@chromium.org
BUG=170856

Review URL: https://chromiumcodereview.appspot.com/11896060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 12:28:16 +00:00
ulan@chromium.org
79a0e3b017 Fix pattern detection for replacing shifts by rotation.
BUG=2499
R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047015
Patch from Hirofumi Mako <mkhrfm@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 13:55:22 +00:00
mstarzinger@chromium.org
f8d5260af7 Allow loading constant function from proto chain.
This enables Crankshaft to use HConstant for loading constant functions
on the prototype chain when building a monomorphic load. This pattern
appears in several JavaScript frameworks.

R=svenpanne@chromium.org
TEST=mjsunit/compiler/proto-chain-constant

Review URL: https://codereview.chromium.org/12052008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13463 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 12:03:35 +00:00
mvstanton@chromium.org
90d0f18007 Incorrect ARM assembly in MacroAssembler::TestJSArrayForAllocationSiteInfo
Restored test code in allocation-site-info.js that was failing on ARM because of this bug.

BUG=

Review URL: https://codereview.chromium.org/12045017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 10:49:23 +00:00
mvstanton@chromium.org
c3746b4388 allocation-site-info.js broken on arm with new changes. Reverting to previous version until diagnosed.
Regress-2185.js test takes too long on slow path when allocation site info is discovered.

BUG=

Review URL: https://codereview.chromium.org/12049003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:15:08 +00:00
yangguo@chromium.org
0c822b21cb Fix some latin-1 webkit units tests
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11962035
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:11:31 +00:00
yangguo@chromium.org
7f331f6280 Make HCheckPrototypeMaps compatible with parallel recompilation.
HCheckPrototypeMaps currently records the prototype and the holder of the
prototype chain (both ends of the chain) and assumes that the chain elements
and their maps did not change in during the entirety of Crankshaft. The actual
traversal of the prototype chain happens in Lithium at code generation.
With parallel compilation, this assumption is not longer correct.

R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11864013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 15:49:00 +00:00
mvstanton@chromium.org
3414a514cd Fixed test failure.
A test case erroneously expected a transition to a double array, but the array remains FAST_SMI.

In person LGTM from Danno...
BUG=

Review URL: https://codereview.chromium.org/12038008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13447 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 13:21:53 +00:00
mvstanton@chromium.org
d7d917e6f0 Out of bounds memory access in TestJSArrayForAllocationSiteInfo.
The function intended to check the map pointer of an AllocationSiteInfo object, but neglected to
subtract an offset to do so.

BUG=169928

Review URL: https://codereview.chromium.org/11931037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 12:26:29 +00:00
jkummerow@chromium.org
7924492ce3 tools/run-tests.py: Fixes for Windows
Review URL: https://codereview.chromium.org/11926015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-18 14:55:23 +00:00
yangguo@chromium.org
284a28e797 Temporarily disable deferred stack trace formatting.
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11859027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-18 13:05:03 +00:00
mvstanton@chromium.org
7884216804 Additional work to get array literal allocation tracking working, even with --always-opt
BUG=

Review URL: https://codereview.chromium.org/11817017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-17 08:41:27 +00:00
mstarzinger@chromium.org
0484ddcf50 Fix arguments materialization for inlined apply().
This fixes materialization of the arguments object in case the constant
function check if TryCallApply() inside an inlined frame fails.

R=svenpanne@chromium.org
BUG=v8:2489
TEST=mjsunit/regress/regress-2489

Review URL: https://codereview.chromium.org/11931012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-16 09:25:45 +00:00
yangguo@chromium.org
f15f294127 Sync laziness between BuildFunctionInfo and MakeFunctionInfo.
BuildFunctionInfo compiles the function eagerly when there are debug
break points. However, the AST may have been parsed lazily since
MakeFunctionInfo does not check for debug break points.

This fixes a regression introduced in r11866.

BUG=147497

Review URL: https://chromiumcodereview.appspot.com/11661008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-15 10:16:52 +00:00
yangguo@chromium.org
eadcc1c10c Reland r13188, r13194, r13256 (Deferred formatting of error stack trace during GC).
BUG=

Review URL: https://chromiumcodereview.appspot.com/11880018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13371 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-14 13:19:27 +00:00
mstarzinger@chromium.org
c5cff2c75a Make recent regression test resilient against GC stress.
R=danno@chromium.org
TEST=mjsunit/regress/regress-165637

Review URL: https://codereview.chromium.org/11824062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 14:21:27 +00:00
mstarzinger@chromium.org
1079642c97 Fix missing exception check in typed array constructor (2).
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.

R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js

Review URL: https://codereview.chromium.org/11791052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 11:45:29 +00:00
yangguo@chromium.org
e41c17084f Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag.
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 15:47:53 +00:00
yangguo@chromium.org
45f20e366a Introduce ENABLE_LATIN_1 compile flag
Mostly a bunch of renaming when flag is disabled.

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 10:30:54 +00:00
svenpanne@chromium.org
0aacbf9619 Added %FlattenString and use it to speed up a regression test.
Flattening strings is relatively costly and by doing it after every duplication
we avoid combinatorial explosion.

Note that flattening could have been done by e.g. using a regular expression,
too, but this is just another implementation detail and %FlattenString seems
general enough to be useful in other tests, too.

Review URL: https://codereview.chromium.org/11828014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 09:32:12 +00:00
mvstanton@chromium.org
529f801fde Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array,
we store an AllocationSiteInfo object right after the JSArray, with a pointer to the
boilerplate object. Later, if the array transitions we check for the continued existence
of the temporary AllocationSiteInfo object (has no roots). If found, we'll use it to
transition the boilerplate array as well.

Danno's original changeset: https://codereview.chromium.org/10615002/

Review URL: https://codereview.chromium.org/11663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-08 09:03:16 +00:00
mstarzinger@chromium.org
0e46919c32 Fix missing exception check in typed array constructor.
The typed array constructor might fail if the first argument is an
object with a length property. Accessing the property can cause an
exception to be thrown and an explicit check needs to be performed.

R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js

Review URL: https://codereview.chromium.org/11777014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 14:01:04 +00:00
danno@chromium.org
4246ac3009 Generalize calling to C++ on stub deopt
Remove code specific to KeyedLoadICs in DoCompiledStubFrame on all platforms, driving stub frame translation by the register parameter information found in a stub's CodeStubInterfaceDescriptor.

Review URL: https://codereview.chromium.org/11635015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 10:06:11 +00:00
yangguo@chromium.org
4ee20d857b Check for read-only-ness when preparing for array sort.
R=verwaest@chromium.org
BUG=v8:2419

Review URL: https://chromiumcodereview.appspot.com/11759022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-04 15:24:47 +00:00
yangguo@chromium.org
e536abb777 Handle non-constant divisor in MathFloorOfDiv, on ia32/x64
Zheng Liu
zheng.z.liu@intel.com

Review URL: https://chromiumcodereview.appspot.com/11624022
Patch from Zheng Liu <zheng.z.liu@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-28 15:52:17 +00:00
yangguo@chromium.org
2f821f1ed9 Revert r13188, r13194, r13256 (Deferred formatting of error stack trace during GC).
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11678006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-27 13:12:27 +00:00
ulan@chromium.org
b64f834383 Fix x64 MathMinMax for negative untagged int32 arguments.
An untagged int32 has zeros in the upper half even if it is negative.
Using cmpq to compare such numbers will incorrectly ignore the sign.

BUG=164442
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11665007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-21 17:52:00 +00:00