AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
18,213 Commits 1 Branch 0 Tags 839 MiB
71fbe7d4ec
Commit Graph

3146 Commits

Author SHA1 Message Date
adamk@chromium.org
71fbe7d4ec Ensure that JSProxy::Fix gives the generated JSObject map a constructor 
All JSObjects in V8 either have a map()->constructor() field or are
JSFunctions. JSProxy::Fix, however, was not enforcing this, and
Object.observe's use of JSObject::GetCreationContext() exposed this.

Note that this is not Object.observe-specific: the API call
v8::Object::CreationContext() also would have revealed this bug.

This patch chooses Object as a reasonable constructor to put on the
newly-fixed object's map. Note that this has no effect on the "constructor"
property in JS. In doing so, I've also tightened up the code underlying
JSProxy::Fix to only support JSObject and JSFunction as possible output
types.

BUG=405844
LOG=N
R=rossberg@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/505303004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-27 15:54:23 +00:00
mstarzinger@chromium.org
b250a99031 Enable more tests that no longer fail with TF. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/505203004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23415 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-26 16:42:09 +00:00
verwaest@chromium.org
2a37ab79ad Fixed inlining of constant values 
Use CopyToRepresentation to elide HForceRepresentation of HConstant

BUG=v8:3529
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/507613002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-26 11:34:25 +00:00
yangguo@chromium.org
578bff3be0 Enable mjsunit/deserialize-reference for turbofan. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/503273003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-26 09:56:23 +00:00
mstarzinger@chromium.org
0d7f69aac5 Enable test cases that no longer timeout. 
R=bmeurer@chromium.org
BUG=v8:3522,v8:3526
LOG=N

Review URL: https://codereview.chromium.org/505113002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-26 08:44:25 +00:00
wingo@igalia.com
32d9aea9d8 Arguments object has @@iterator 
R=arv@chromium.org, verwaest@chromium.org, rossberg@chromium.org
BUG=v8:3391
LOG=N
TEST=mjsunit/harmony/arguments-iterator.js

Review URL: https://codereview.chromium.org/342453002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-25 09:12:22 +00:00
jarin@chromium.org
d8295050d2 Fix deoptimization address patching in Turbofan to use safepoints. 
Since the deopt patch address needs to be available during GC to
resolve safepoints, we need to move it to the code object (instead of
the deoptimization input data) - accessing a separate fixed array
is not safe during GC. This CL adds a deoptimization_pc field to
each safepoint. The fields points to the deoptimization block.

The CL also fixes wrong register allocator constraints for
frame states on calls. These should always live on the stack
because registers are not preserved during a call.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/504493002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-25 07:02:19 +00:00
arv@chromium.org
74a0d0f373 Fix issue with numeric property names 
We were not correctly treating 1.0 as 1, nor 1.20 as 1.2 in accessors.

BUG=v8:3507
LOG=Y
R=marja@chromium.org

Review URL: https://codereview.chromium.org/493173003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 14:40:38 +00:00
yangguo@chromium.org
ba09fa35fd Handle null receiver in sloppy mode in %GetFrameDetails. 
R=jarin@chromium.org
BUG=405922
LOG=N

Review URL: https://codereview.chromium.org/492303006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 12:55:23 +00:00
yangguo@chromium.org
a6adfd8f82 Blacklist mjsunit/debug-break-inline from turbofan tests. 
Due to GC stress failures.

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/494093004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 09:54:01 +00:00
jarin@chromium.org
4fb93f6461 Black list failing Turbofan debugger test. 
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/501433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 08:28:26 +00:00
jarin@chromium.org
8da0b4eca6 Couple more debugger tests working with Turbofan. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/498493002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 07:44:18 +00:00
yangguo@chromium.org
1fcfacbcd3 Do not run Turbofan tests on mjsunit/deserialize-reference. 
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/490413003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23291 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 07:25:12 +00:00
arv@chromium.org
98f7b7e14a Add back the duplicate property checker 
We're not quite ready to make this change.

BUG=v8:3498
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/491053002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23284 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 15:32:22 +00:00
dslomov@chromium.org
22d5ceb1f2 Implement Function.prototype.toMethod. 
R=arv@chromium.org, verwaest@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/475423003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23274 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 12:39:33 +00:00
wingo@igalia.com
edfd4cdd33 Stage ES6 generators 
R=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/479543003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 12:06:25 +00:00
jarin@chromium.org
e5081792f9 Initial support for debugger frame state in Turbofan. 
Bunch of changes were necessary:
- refactor attaching the frame states/lazy bailouts in AstGraphBuilder
  (essentialy reland of r23096),
- attaching frame state to some JS nodes in a similar way to attaching
  context (this is quite ugly and we should take another look at this),
- new bailout point for the debugger statement,
- register allocation constraints for the frame states,
- generating translations and deopt entries, attaching them to
  safepoints,
- enabled one mjsunit test for debugger state that uses the generated
  frame state.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/492203002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 11:56:46 +00:00
wingo@igalia.com
8239897e5d Simplify array iterator tests 
R=arv@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/344223006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 09:04:24 +00:00
bmeurer@chromium.org
0142786cea Don't inline Array.shift() if receiver map is not extensible. 
TEST=mjsunit/regress/regress-crbug-405517
BUG=405517
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/491863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 06:23:44 +00:00
dslomov@chromium.org
93489e7695 Make all global private symbols own symbols. 
R=arv@chromium.org, rossberg@chromium.org, wingo@igalia.com, yangguo@chromium.org

Review URL: https://codereview.chromium.org/486763002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 19:21:56 +00:00
Jacob.Bramley@arm.com
da48f1246c ARM64: Fix SHR logic error. 
The `right == 0` checks only worked for `0 <= right < 32`. This patch
replaces the checks with simple tests for negative results.

The attached test can detect this error, but the test relies on a broken
flag (--noopt-safe-uint32-operations), so it is skipped for now. See
issue 3487 for details.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/487913005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 14:58:18 +00:00
arv@chromium.org
cfdfbb885e ES6: Duplicate properties are no longer an error 
This removes the duplicate property checker and updates the tests.

BUG=v8:3498
LOG=Y
R=marja@chromium.org

Review URL: https://codereview.chromium.org/459463002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 14:25:48 +00:00
yangguo@chromium.org
930e5ccc3e Implement Math.expm1 using port from fdlibm. 
R=rtoy@chromium.org
BUG=v8:3479
LOG=N

Review URL: https://codereview.chromium.org/465353002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23238 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 14:24:07 +00:00
yangguo@chromium.org
8cb41618ce Blacklist %InternalSetProperty from runtime test fuzzing. 
R=verwaest@chromium.org
BUG=405499
LOG=N

Review URL: https://codereview.chromium.org/491843002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 12:51:48 +00:00
yangguo@chromium.org
f7947b8ec4 Fix --expose-debug-as with number as argument. 
R=jkummerow@chromium.org
BUG=405491
LOG=N

Review URL: https://codereview.chromium.org/468803004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 11:52:22 +00:00
yangguo@chromium.org
b4a35fe7e5 Remove RegExp.$input. 
R=arv@chromium.org, mathiasb@opera.com
BUG=v8:3486
LOG=Y

Review URL: https://codereview.chromium.org/465273002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 09:43:00 +00:00
verwaest@chromium.org
1a8bed477e Use LookupIterator to transition to accessors 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/490533002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23210 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 17:02:04 +00:00
arv@chromium.org
8d189e84b4 ES6: Make sure we do not store -0 as the key in Map/Set 
BUG=v8:3515
LOG=Y
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/478683002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23204 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 15:15:41 +00:00
arv@chromium.org
eb7fcad7c5 Remove removed flags from tests 
BUG=None
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/454003002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23203 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 15:09:38 +00:00
rossberg@chromium.org
30af557955 Implement ES6 Array.of() 
BUG=v8:3427
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/364853009

Patch from Diego Pino <dpino@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 11:38:38 +00:00
hpayer@chromium.org
91599ffc6c Do not install fillers when right trimming large objects. 
BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/487703002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 08:35:39 +00:00
jkummerow@chromium.org
dacca11cb9 Correctly handle holes when concat()ing double arrays 
BUG=chromium:403409
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/468863003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-18 08:51:35 +00:00
yangguo@chromium.org
cf75a0b6e6 Fix PromiseHasRejectHandler. 
The odd-numbered items in the queue are deferred objects, not promises.

R=aandrey@chromium.org

Review URL: https://codereview.chromium.org/473803003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-18 08:43:11 +00:00
dslomov@chromium.org
eebb61a3f9 Fix OrderedHashTabelIterator accessors. 
They might be undefined for uninitialized iterators.
The rest of the code is ready for this eventuality.

R=arv@chromium.org, adamk@chromium.org
BUG=403292
LOG=N

Review URL: https://codereview.chromium.org/468813003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23126 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-14 10:24:19 +00:00
yangguo@chromium.org
efde48fb30 Fix test expectations. 
TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/461233003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23113 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-14 07:11:44 +00:00
yangguo@chromium.org
0ae0b81cdb Ignore default reject handler when looking for reject handlers. 
LOG=N
BUG=v8:3093
R=aandrey@chromium.org

Review URL: https://codereview.chromium.org/461023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23112 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-14 06:57:48 +00:00
arv@chromium.org
fdd094abcf ES6: Make Map/Set constructors support iterable values 
Same for WeakMap/WeakSet

https://bugs.ecmascript.org/show_bug.cgi?id=3111

The change from the reverted version is that LoadIC_Miss now uses Name
instead of String.

BUG=v8:3508
LOG=Y
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/464093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23108 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-13 14:34:15 +00:00
mstarzinger@chromium.org
8b7dd630da Move %IsOptimized runtime helper into test case. 
R=jarin@chromium.org
TEST=cctest/test-run-deopt

Review URL: https://codereview.chromium.org/468153002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23107 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-13 14:09:50 +00:00
arv@chromium.org
0a35d53f7d Revert "ES6: Make Map/Set constructors support iterable values" 
Reason for revert:
TestSetConstructorIterableValue(WeakSet) fails on x64.debug

TBR=adamk@chromium.org,dslomov@chromium.org
LOG=Y
BUG=

Review URL: https://codereview.chromium.org/461193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 21:42:27 +00:00
arv@chromium.org
f95b81a6ef ES6: Make Map/Set constructors support iterable values 
Same for WeakMap/WeakSet

https://bugs.ecmascript.org/show_bug.cgi?id=3111

BUG=v8:3508
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/466003002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 20:09:40 +00:00
arv@chromium.org
6c209206f5 WeakMap/WeakSet: Add test for non object keys 
Add test for non object keys in the iterable passed to the constructor.

BUG=v8:3399
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/451033003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23090 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 19:54:52 +00:00
dslomov@chromium.org
d2fe3e68ea Add "own" symbols support. 
"Own" symbols are symbols that can only denote own properties of
objects.

R=hpayer@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=23056

Review URL: https://codereview.chromium.org/464473002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 15:28:20 +00:00
yangguo@chromium.org
0f81d7698a Implement Math.log1p using port from fdlibm. 
Port contributed by Raymond Toy <rtoy@google.com>.

R=rtoy@chromium.org
LOG=N
BUG=v8:3481

Review URL: https://codereview.chromium.org/457643002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 13:36:33 +00:00
rodolph.perfetta@arm.com
d5f0ecfbd3 ARM64: Enable TF tests. 
Updated the test status file accordingly.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/459093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-12 12:30:45 +00:00
dslomov@chromium.org
dc4c277589 Revert "Add "own" symbols support." 
This reverts commit r23056 for breaking Mac x64 test.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/460803003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 21:44:08 +00:00
machenbach@chromium.org
b50769cc54 Skip test with TF on GC stress. 
BUG=

Review URL: https://codereview.chromium.org/465643002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 19:44:33 +00:00
dslomov@chromium.org
cd30676052 ToNumber(Symbol) should throw TypeError 
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tonumber

Based on patch from caitp <caitpotter88@gmail.com>
https://codereview.chromium.org/454233002/

BUG=v8:3499
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/458753004

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 19:24:05 +00:00
dslomov@chromium.org
88f65f2c52 Add "own" symbols support. 
"Own" symbols are symbols that can only denote own properties of
objects.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/464473002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 18:59:38 +00:00
verwaest@chromium.org
d094d0fb44 Tag all prototypes as proto, except those set using __proto__ 
BUG=
R=ishell@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/450303003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 14:00:58 +00:00
yangguo@chromium.org
413b20b6c1 Make %DebugPushPromise more robust wrt fuzzing. 
If %DebugPushPromise and throwing is called outside its intended context,
we may encounter assertion failures.

R=hpayer@chromium.org
BUG=401915
LOG=N

Review URL: https://codereview.chromium.org/453933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 07:59:10 +00:00