Commit Graph

21145 Commits

Author SHA1 Message Date
bmeurer
72bc4b5c8a [es6] Introduce a dedicated JSIteratorResult type.
Use a single JSIteratorResult type for all implementation provided
iterator results (i.e. the String, Array and collection iterators,
and also for generators).  This removes one source of unnecessary
polymorphism in for-of loops.  It is accomplished by a new intrinsic
%_CreateIterResultObject() that should be used to create iterator
result objects from JavaScript builtins (there's a matching factory
method for C++ code).

Also restructure the %StringIteratorPrototype%.next() and
%ArrayIteratorPrototype%.next() functions to be a bit more friendly
to optimizing compilers.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1302173007

Cr-Commit-Position: refs/heads/master@{#30557}
2015-09-03 12:16:25 +00:00
titzer
963d664581 [turbofan] support for Int64 in CheckedLoad/CheckedStore on 64-bit platforms.
This is to support WebAssembly 64-bit ints in the short term, since it
currently uses CheckedLoad/CheckedStore for accesses to the memory. In the
long run, we'll change this to be explicit bounds checks that throw on out
of bounds.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1310323006

Cr-Commit-Position: refs/heads/master@{#30555}
2015-09-03 10:45:54 +00:00
mstarzinger
92e85aed10 [presubmit] Fix build/include linter violations.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1318863004

Cr-Commit-Position: refs/heads/master@{#30554}
2015-09-03 07:56:14 +00:00
mstarzinger
f9255550eb [presubmit] Fix whitespace/empty_loop_body linter violations.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1327523003

Cr-Commit-Position: refs/heads/master@{#30553}
2015-09-03 07:15:17 +00:00
bmeurer
8a378f46d5 [es6] Initial steps towards a correct implementation of IsCallable.
This turns the has_instance_call_handler bit on Map into an is_callable
bit, that matches the spec definition of IsCallable (i.e. instances have
[[Call]] internal methods).

Also fix the typeof operator to properly say "function" for everything
that is callable.

Also remove the (unused) premature %_GetPrototype optimization from
Crankshaft, which just complicated the Map bit swap.

R=mstarzinger@chromium.org, rossberg@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg

Review URL: https://codereview.chromium.org/1316933002

Cr-Commit-Position: refs/heads/master@{#30552}
2015-09-03 06:01:32 +00:00
caitpotter88
510baeacba [es6] Re-implement rest parameters via desugaring.
Kills the kRestParameter bailout/disabled optimization, and fixes
lazily parsed arrow functions with rest parameters.

Supercedes https://crrev.com/1235153006/

BUG=chromium:508074, v8:2160, v8:2700
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1272673003

Cr-Commit-Position: refs/heads/master@{#30550}
2015-09-02 21:11:05 +00:00
oth
22983f71f9 [Intepreter] Extend and move Register class.
Add methods for converting parameter index to a register and vice-versa.

Move Register class into bytecodes.h.

Update Bytecodes::Decode to pretty print parameters.

BUG=v8:4280
LOG=NO

Review URL: https://codereview.chromium.org/1325983002

Cr-Commit-Position: refs/heads/master@{#30549}
2015-09-02 17:48:24 +00:00
mstarzinger
310f2ece0f [heap] Move ObjectStatsVisitor into the proper component.
This is a follow-up to a previous change and moved object statistics
tracking into its own component. It is no longer intertwinded with the
normal marking logic, but separated out into ObjectStatsVisitor.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1310953008

Cr-Commit-Position: refs/heads/master@{#30548}
2015-09-02 17:09:54 +00:00
mstarzinger
c7de3e7f27 [heap] Separate ObjectStats out into its own class.
Note that this is only pulling out the bookkeeping side of things, the
marking visitor that actually records the statistics should also move
into the ObjectStats class. That will be done as a follow-up.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1326793002

Cr-Commit-Position: refs/heads/master@{#30547}
2015-09-02 16:43:40 +00:00
cbruni
a369ab1838 Adding ElementsAccessor::Shift
- Use the new ElementsAccessor methods
- improve test coverage

BUG=

Review URL: https://codereview.chromium.org/1317053006

Cr-Commit-Position: refs/heads/master@{#30546}
2015-09-02 15:29:40 +00:00
mbrandy
e5fc7fe5fd PPC: VectorICs: Cleanup, remove unnecessary arguments from HandleArrayCases()
Port c29a4061c9

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1325103003

Cr-Commit-Position: refs/heads/master@{#30545}
2015-09-02 15:22:51 +00:00
oth
d779181b88 Remove code link from serialization state.
Code::WipeOutHeader now nulls out the next code link to avoid
embedding that address in snapshot.

BUG=
LOG=NO

Review URL: https://codereview.chromium.org/1310503006

Cr-Commit-Position: refs/heads/master@{#30544}
2015-09-02 14:44:13 +00:00
rmcilroy
d8df7468b4 [Interpreter] Add support for property load operations.
Adds support for property load operations via Load/KeyedLoad ICs. Adds the
following bytecodes:
 - LoadIC
 - KeyedLoadIC
Also adds support to the interpreter assembler for loading the type feedback
vector from the function on the stack, and calling ICs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1309843007

Cr-Commit-Position: refs/heads/master@{#30543}
2015-09-02 13:03:22 +00:00
mvstanton
c29a4061c9 VectorICs: Cleanup, remove unnecessary arguments from HandleArrayCases()
BUG=

Review URL: https://codereview.chromium.org/1314503003

Cr-Commit-Position: refs/heads/master@{#30542}
2015-09-02 12:29:03 +00:00
conradw
db440dfe8d [strong] weak classes can't inherit from strong ones
Prerequisite for sealing strong class instances.

Depends on https://codereview.chromium.org/1314203002/

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1316333002

Cr-Commit-Position: refs/heads/master@{#30541}
2015-09-02 11:36:20 +00:00
mtrofin
59cb9c1834 [turbofan] Greedy: Unset hints at eviction.
BUG=

Review URL: https://codereview.chromium.org/1313023003

Cr-Commit-Position: refs/heads/master@{#30540}
2015-09-02 10:52:34 +00:00
fedor
15a0ace533 heap: make array buffer maps disjoint
Remove intersection from the `std::map`s representing current live
ArrayBuffers. While being simpler to understand, it poses significant
performance issue for the active ArrayBuffer users (like node.js).

Store buffers separately, and process them together during mark-sweep
phase.

BUG=
R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1326613002

Cr-Commit-Position: refs/heads/master@{#30539}
2015-09-02 10:05:13 +00:00
ishell
85f6e16844 [arm64] Don't try convert binary operation to shifted form when both operands are the same.
BUG=chromium:523307
LOG=N

Review URL: https://codereview.chromium.org/1304923003

Cr-Commit-Position: refs/heads/master@{#30538}
2015-09-02 09:32:44 +00:00
hablich
93f1f198a6 Revert of [turbofan] Greedy: using hints (patchset #2 id:60001 of https://codereview.chromium.org/1329493004/ )
Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20greedy%20allocator/builds/1338

Original issue's description:
> [turbofan] Greedy: using hints
>
> This is a rudimentary introduction of hints. Primarily this helps with
> allocating on the same register variables are defined (from instructions)
> For dealing with phis, we need to introduce groups, in a subsequent
> CL.
>
> From the last CL (memory ops heuristics), this CL improves some
> benchmarks - notably Life (11.94%) in Emscripten x64, and Memops
> (Emscripten), 24% on x86; notable regressions: Memops in
> AreWeFastYet (-14%, x64) and Corrections -25% on x86.
>
> BUG=
>
> Committed: https://crrev.com/038f5eaf3bd6796ed6b7519de83c21d4e1f54850
> Cr-Commit-Position: refs/heads/master@{#30534}

TBR=jarin@chromium.org,bmeurer@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1324763005

Cr-Commit-Position: refs/heads/master@{#30537}
2015-09-02 08:35:17 +00:00
mlippautz
61d1cedfb8 [heap] Throw OOM upon failing to expand a PagedSpace above old gen limits.
The AlwaysAllocate scope make it impossible to enforce a DCHECK on the maximum
old generation sizes as e.g. large objects can still be allocated using this
scope. Returning false here results in OOM.

R=mstarzinger@chromium.org
BUG=chromium:525448
LOG=N

Review URL: https://codereview.chromium.org/1316183004

Cr-Commit-Position: refs/heads/master@{#30535}
2015-09-02 07:20:13 +00:00
mtrofin
038f5eaf3b [turbofan] Greedy: using hints
This is a rudimentary introduction of hints. Primarily this helps with
allocating on the same register variables are defined (from instructions)
For dealing with phis, we need to introduce groups, in a subsequent
CL.

From the last CL (memory ops heuristics), this CL improves some
benchmarks - notably Life (11.94%) in Emscripten x64, and Memops
(Emscripten), 24% on x86; notable regressions: Memops in
AreWeFastYet (-14%, x64) and Corrections -25% on x86.

BUG=

Review URL: https://codereview.chromium.org/1329493004

Cr-Commit-Position: refs/heads/master@{#30534}
2015-09-02 07:12:54 +00:00
bmeurer
9427d3255b [es6] Fix invalid ToObject in String/Array iterator next.
The spec says that the "this value" has to be an Object.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1325023003

Cr-Commit-Position: refs/heads/master@{#30533}
2015-09-02 06:59:15 +00:00
cbruni
fb44484ffd ElementsAccessor Array Builtins Cleanup
Repeat the same signatures for future refactoring

BUG=

Review URL: https://codereview.chromium.org/1302413006

Cr-Commit-Position: refs/heads/master@{#30532}
2015-09-02 06:42:09 +00:00
bradnelson
29d793728a Eliminate use of CompilationInfo in several AstVisitor descendants.
We're moving away from using CompilationInfo as a big bag o' stuff.
Passing in just what we need to several AstVisitors to avoid
increasing the problem.

BUG=None
TEST=trybots
R=titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1318823010

Cr-Commit-Position: refs/heads/master@{#30529}
2015-09-01 23:06:37 +00:00
cbruni
ec2518eedb Adding ElementsAccessor::Unshift
Move BackingStore specific implementation from builtins.cc tp ElementsAccessor

BUG=

Review URL: https://codereview.chromium.org/1322803002

Cr-Commit-Position: refs/heads/master@{#30526}
2015-09-01 21:19:53 +00:00
littledan
a2841eb0dc Stage sloppy let
Move the --harmony-sloppy-let flag to staging for further testing, and
update test262 for the new passing tests. Also increase the strictness
of the parser, even in sloppy mode, to disallow "new legacy compat" for

  for (let x = 5 in {}) {}

which is now a SyntaxError.

BUG=v8:3305
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1321013005

Cr-Commit-Position: refs/heads/master@{#30525}
2015-09-01 20:03:27 +00:00
mlippautz
277795e28f [heap,cctest] Fix CodeRange tests that use AllocateRawMemory directly.
* Enforce invariants on the way.
* Unmark flaky CodeRange test.

BUG=v8:4141
BUG=v8:3005
LOG=N

Review URL: https://codereview.chromium.org/1325853003

Cr-Commit-Position: refs/heads/master@{#30524}
2015-09-01 18:39:32 +00:00
binji
196d6aeec1 Remove harmony-atomics flag and collapse it into sharedarraybuffer flag
Having both flags is tedious, and it is unlikely you'd ever want them
separately.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1304163010

Cr-Commit-Position: refs/heads/master@{#30523}
2015-09-01 18:34:00 +00:00
alph
6184f1fef6 Fix CPU profiler deadlock on Windows + AMD CPU.
Implement a lock free version of RolloverProtectedTickClock::Now
to eliminate a deadlock.

BUG=chromium:521420
LOG=Y

Committed: https://crrev.com/d6db8e5902af1f067f0f149844f4e92824ee93f3
Cr-Commit-Position: refs/heads/master@{#30489}

Review URL: https://codereview.chromium.org/1304873011

Cr-Commit-Position: refs/heads/master@{#30522}
2015-09-01 18:32:50 +00:00
bradnelson
546d9a70ac Add asm.js typer / validator.
Walk asm.js module ASTs, attach concrete type information
in preparation for generating a WASM module.

cctest test coverage (mjsunit coming in later CL).
Expressions, function tables, and foreign functions have coverage.
Statement coverage to be expanded in a later CL.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=rossberg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1322773002

Cr-Commit-Position: refs/heads/master@{#30520}
2015-09-01 18:30:43 +00:00
conradw
05f01b3f8e [strong] Class constructor bodies cannot contain "use strong" directive
Since the constructor is also the class object itself, allowing it to
retroactively become a strong object would have unintuitive consequences
wrt the strength of the other functions of the class, and whether instances
would be considered instances of a strong class.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1314203002

Cr-Commit-Position: refs/heads/master@{#30519}
2015-09-01 18:29:35 +00:00
littledan
d1fa7bccc8 Revert of Stage sloppy let (patchset #7 id:120001 of https://codereview.chromium.org/1327483002/ )
Reason for revert:
Fails a test262 test with --always-opt.

Original issue's description:
> Stage sloppy let
>
> Move the --harmony-sloppy-let flag to staging for further testing, and
> update test262 for the new passing tests. Also increase the strictness
> of the parser, even in sloppy mode, to disallow "new legacy compat" for
>
>   for (let x = 5 in {}) {}
>
> which is now a SyntaxError.
>
> BUG=v8:3305
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/07bc0117be8dc9e63ec14d5f9645c483d60a1bec
> Cr-Commit-Position: refs/heads/master@{#30515}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3305

Review URL: https://codereview.chromium.org/1324033002

Cr-Commit-Position: refs/heads/master@{#30518}
2015-09-01 17:37:07 +00:00
yurys
f987e30a75 Extract common debugger code for processing compile events
BUG=chromium:520702
LOG=N

Review URL: https://codereview.chromium.org/1316213005

Cr-Commit-Position: refs/heads/master@{#30517}
2015-09-01 16:36:28 +00:00
mbrandy
e7027442dc PPC: Crankshaft is now able to compile top level code even if there is a ScriptContext.
Port 29ebcc3205

Original commit message:
    This CL introduces HPrologue instruction which does the context allocation work and supports deoptimization.

R=ishell@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1324023002

Cr-Commit-Position: refs/heads/master@{#30516}
2015-09-01 16:18:20 +00:00
littledan
07bc0117be Stage sloppy let
Move the --harmony-sloppy-let flag to staging for further testing, and
update test262 for the new passing tests. Also increase the strictness
of the parser, even in sloppy mode, to disallow "new legacy compat" for

  for (let x = 5 in {}) {}

which is now a SyntaxError.

BUG=v8:3305
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1327483002

Cr-Commit-Position: refs/heads/master@{#30515}
2015-09-01 15:57:43 +00:00
mstarzinger
093f7260e9 [presubmit] Fix runtime/indentation_namespace linter violations.
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1302413007

Cr-Commit-Position: refs/heads/master@{#30514}
2015-09-01 15:20:09 +00:00
mvstanton
e1b46f7a18 Vector ICs: Adapting store ic classes for vectors.
BUG=

Review URL: https://codereview.chromium.org/1326483002

Cr-Commit-Position: refs/heads/master@{#30512}
2015-09-01 14:09:24 +00:00
mtrofin
6009697eb2 Revert "Revert of [turbofan] greedy: heuristic for memory operands
(patchset #2 id:40001 of https://codereview.chromium.org/1306823005/ )"

This reverts commit f68cd33bdd.

BUG=

Review URL: https://codereview.chromium.org/1314423006

Cr-Commit-Position: refs/heads/master@{#30509}
2015-09-01 12:33:13 +00:00
mvstanton
fa530822fd Make type-feedback-vector.h usable without objects-inl.h header (and others).
Pure refactoring to further reduce the header dependency tangle.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1309303008

Cr-Commit-Position: refs/heads/master@{#30508}
2015-09-01 12:28:24 +00:00
bmeurer
af1b95217b [runtime] Remove unused TO_NUMBER and TO_STRING functions.
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1304363012

Cr-Commit-Position: refs/heads/master@{#30507}
2015-09-01 11:27:54 +00:00
jarin
e0241e42ab [crankshaft] Cleanup representation calculation for Phis.
This replaces the counters for use representations with
simple tracking of most-general representation seen so far.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1315193010

Cr-Commit-Position: refs/heads/master@{#30506}
2015-09-01 11:16:04 +00:00
mstarzinger
c87bd340af [turbofan] Remove obsolete unique.h includes in TurboFan.
Now that it is no longer needed, this also removes the invalid inclusion
of "object-inl.h" within the "unique.h" header file.

Note that this change still leaves 2 violations of that rule in the
code, checked with the "tools/check-inline-includes.sh" tool.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1321223002

Cr-Commit-Position: refs/heads/master@{#30503}
2015-09-01 10:30:57 +00:00
mlippautz
bb7b53110e Revert of heap: make array buffer maps disjoint (patchset #8 id:140001 of https://codereview.chromium.org/1316873004/ )
Reason for revert:
Precautionary revert. The change is incomplete.

Original issue's description:
> heap: make array buffer maps disjoint
>
> Remove intersection from the `std::map`s representing current live
> ArrayBuffers. While being simpler to understand, it poses significant
> performance issue for the active ArrayBuffer users (like node.js).
>
> Store buffers separately, and process them together during mark-sweep phase.
>
> The results of benchmarks are:
>
> $ ./node-slow bench && ./node-fast bench
> 4997.4 ns/op
> 4685.7 ns/op
>
> NOTE: `fast` - was a patched node.js, `slow` - unpatched node.js with vanilla v8.
>
> BUG=
>
> Committed: https://crrev.com/9e3676da9ab1aaf7de3e8582cb3fdefcc3dbaf33
> Cr-Commit-Position: refs/heads/master@{#30495}

TBR=hpayer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1302233007

Cr-Commit-Position: refs/heads/master@{#30502}
2015-09-01 09:58:38 +00:00
machenbach
f68cd33bdd Revert of [turbofan] greedy: heuristic for memory operands (patchset #2 id:40001 of https://codereview.chromium.org/1306823005/ )
Reason for revert:
[Sheriff] Breaks test with greedy allocator:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20greedy%20allocator/builds/1318

Original issue's description:
> [turbofan] greedy: heuristic for memory operands
>
> When we have a memory operand (HasSpillOperand() == true), and it
> doesn't need a register immediately, split in an optimal position, which
> is outside the outermost possible loop - just like Linear does.
>
> This results in some modest improvements in perf, when compared
> to baseline greedy. In particular Jetstream zlib x64: 4.66%, Life
> (Emscripten x64) 11%; largest regression is in AreWeFastYet x64: 8%
> and Corrections (Emsccripten x32) 10%
>
> BUG=
>
> Committed: https://crrev.com/8937bfc1d165ff6d72dede1b0ce6f7c1ab9fb260
> Cr-Commit-Position: refs/heads/master@{#30498}

TBR=jarin@chromium.org,bmeurer@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1311813005

Cr-Commit-Position: refs/heads/master@{#30501}
2015-09-01 09:37:39 +00:00
mstarzinger
5f57ebe222 Make isolate.h usable without objects-inl.h header.
This CL us a pure refactoring that makes an empty compilation unit
including just "isolate.h" or "contexts.h" but not "objects-inl.h"
compile without warnings or errors. This is needed to further reduce
the header dependency tangle.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1322883002

Cr-Commit-Position: refs/heads/master@{#30500}
2015-09-01 09:25:27 +00:00
pcc
e67f5cf4b8 Read all integer op parameters using a signed integer type.
The code was previously reading unsigned integers by performing an invalid cast
of Operator1<intNN_t> objects to Operator1<uintNN_t> and reading the integer
directly. To fix the invalid cast, we cast to the correct type and static_cast
the integer to uintNN_t, which is a no-op on every reasonable target.

Cleanup for cfi_vptr=1; see https://www.chromium.org/developers/testing/control-flow-integrity

BUG=chromium:457523
R=bmeurer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1310633004

Cr-Commit-Position: refs/heads/master@{#30499}
2015-09-01 09:11:13 +00:00
mtrofin
8937bfc1d1 [turbofan] greedy: heuristic for memory operands
When we have a memory operand (HasSpillOperand() == true), and it
doesn't need a register immediately, split in an optimal position, which
is outside the outermost possible loop - just like Linear does.

This results in some modest improvements in perf, when compared
to baseline greedy. In particular Jetstream zlib x64: 4.66%, Life
(Emscripten x64) 11%; largest regression is in AreWeFastYet x64: 8%
and Corrections (Emsccripten x32) 10%

BUG=

Review URL: https://codereview.chromium.org/1306823005

Cr-Commit-Position: refs/heads/master@{#30498}
2015-09-01 08:54:42 +00:00
ishell
29ebcc3205 Crankshaft is now able to compile top level code even if there is a ScriptContext.
This CL introduces HPrologue instruction which does the context allocation work and supports deoptimization.

Review URL: https://codereview.chromium.org/1317383002

Cr-Commit-Position: refs/heads/master@{#30496}
2015-09-01 07:07:05 +00:00
fedor
9e3676da9a heap: make array buffer maps disjoint
Remove intersection from the `std::map`s representing current live
ArrayBuffers. While being simpler to understand, it poses significant
performance issue for the active ArrayBuffer users (like node.js).

Store buffers separately, and process them together during mark-sweep phase.

The results of benchmarks are:

$ ./node-slow bench && ./node-fast bench
4997.4 ns/op
4685.7 ns/op

NOTE: `fast` - was a patched node.js, `slow` - unpatched node.js with vanilla v8.

BUG=

Review URL: https://codereview.chromium.org/1316873004

Cr-Commit-Position: refs/heads/master@{#30495}
2015-09-01 06:52:11 +00:00
pcc
718fc1c9a2 Fix invalid read of language mode from StorePropertyParameters.
Fixes an invalid cast of an Operator1<StorePropertyParameters> object
to Operator1<LanguageMode> by reading the language mode from
StorePropertyParameters. This code happened to work before because
StorePropertyParameters's first field has type LanguageMode.

Cleanup for cfi_vptr=1; see https://www.chromium.org/developers/testing/control-flow-integrity

BUG=chromium:457523
R=bmeurer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1311393008

Cr-Commit-Position: refs/heads/master@{#30493}
2015-09-01 05:05:12 +00:00