mstarzinger@chromium.org
2aabf6257d
Add workaround for redefinition of __proto__ property.
...
This is a temporary workaround when the __proto__ property is being
redefined (e.g. by Object.freeze()) to not loose the foreign callback.
Once the __proto__ property is a real JavaScript accessor this hack is
no longer necessary. This change also makes __proto__ configurable.
R=rossberg@chromium.org
BUG=v8:2565
TEST=mjsunit/regress/regress-2565
Review URL: https://codereview.chromium.org/12398010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 17:53:40 +00:00
rossberg@chromium.org
5c93b18eb2
ES6 symbols: Allow symbols as property names
...
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).
Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.
(Baseline CL: https://codereview.chromium.org/12296026/ )
R=verwaest@chromium.org ,mstarzinger@chromium.org
BUG=v8:2158
Review URL: https://codereview.chromium.org/12330012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 15:00:57 +00:00
mvstanton@chromium.org
c4caf766bf
Allocation Info Tracking, continued.
...
Addresses missing cases for array literals.
Adds support for "new Array()" call sites. This isn't complete yet, I have to run with --noinline_new.
BUG=
Review URL: https://codereview.chromium.org/11818021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 16:06:34 +00:00
yangguo@chromium.org
358311e8ec
Limit EatAtLeast recursion by a budget.
...
BUG=178790
Review URL: https://chromiumcodereview.appspot.com/12380026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 14:50:14 +00:00
rossberg@chromium.org
090d09d685
ES6 symbols: Implement Symbol intrinsic and basic functionality
...
- Add --harmony-symbols flag.
- Add Symbol constructor; allow symbols as (unreplaced) return value from constructors.
- Introduce %CreateSymbol and %_IsSymbol natives and respective instructions.
- Extend 'typeof' code generation to handle symbols.
- Extend CompareIC with a UNIQUE_NAMES state that (uniformly) handles internalized strings and symbols.
- Property lookup delegates to SymbolDelegate object for symbols, which only carries the toString method.
- Extend Object.prototype.toString to recognise symbols.
Per the current draft spec, symbols are actually pseudo objects that are frozen with a null prototype and only one property (toString). For simplicity, we do not treat them as proper objects for now, although typeof will return "object". Only property access works as if they were (frozen) objects (via the internal delegate object).
(Baseline CL: https://codereview.chromium.org/12223071/ )
R=mstarzinger@chromium.org
BUG=v8:2158
Review URL: https://codereview.chromium.org/12296026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 13:28:55 +00:00
yangguo@chromium.org
5c264ade8e
Fix wrong test in r13766 (Insert conversion to string in string.replace).
...
R=ulan@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12315130
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 15:36:02 +00:00
yangguo@chromium.org
6e64bdfc6e
Insert conversion to string in string.replace.
...
(missing since r13761)
R=ulan@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12316158
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 15:12:30 +00:00
yangguo@chromium.org
2a3063a7c3
Handle negative input in inlined Math.round on Intel CPUs.
...
R=jkummerow@chromium.org
BUG=v8:2451
Review URL: https://chromiumcodereview.appspot.com/12342037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:44:57 +00:00
mstarzinger@chromium.org
ea5e9edac4
Fix materialization of arguments objects with unknown values.
...
This fixes the deoptimizer to materialize arguments objects of correct
length even in cases where the actual argument values are unknown and
were optimized away by Crankshaft. This can happen if only the length
property or the identity of an arguments object is used.
R=svenpanne@chromium.org
BUG=chromium:163530
TEST=mjsunit/regress/regress-crbug-163530
Review URL: https://codereview.chromium.org/12335132
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:37:51 +00:00
yangguo@chromium.org
4cbe7100e6
Refactor implementation for String.prototype.replace.
...
R=ulan@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12177015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:14:45 +00:00
ulan@chromium.org
211f4a7be0
Disable regress-crbug-160010 for Android because it triggers OOM.
...
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12314150
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 12:14:21 +00:00
jkummerow@chromium.org
732a2af96a
Clean up mjsunit/array-bounds-check-removal
...
Review URL: https://codereview.chromium.org/12317142
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 10:50:37 +00:00
ulan@chromium.org
87265114c4
Emit VMLS for multiply-subtract on ARM.
...
BUG=none
Review URL: https://chromiumcodereview.appspot.com/12319113
Patch from Hans Wennborg <hans@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 10:24:40 +00:00
dcarney@chromium.org
52a015b1af
Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString
...
R=yangguo@chromium.org
BUG=
Review URL: https://codereview.chromium.org/12326120
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 11:02:39 +00:00
mstarzinger@chromium.org
ce1e10f5fc
Make __proto__ a foreign callback on Object.prototype.
...
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.
The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.
R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262
Review URL: https://codereview.chromium.org/12212011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 10:46:00 +00:00
yangguo@chromium.org
0d63cef35b
Constant fold math and string operations.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12315005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-21 11:40:37 +00:00
mstarzinger@chromium.org
300413b5a9
Fix f.apply() optimization when declared arguments are mutated.
...
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539
Review URL: https://codereview.chromium.org/12255033
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 15:12:49 +00:00
mstarzinger@chromium.org
05e95eee0e
Allow full inlining of f.apply(this, arguments) calls.
...
This allows Crankshaft to completely inline a f.apply() dispatch if the
exact number of arguments is known and the function is constant. The
deoptimizer doesn't generate the f.apply() frame during deoptimization,
so the materialized frames look like f.apply() did a tailcall.
R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-function-apply
Review URL: https://codereview.chromium.org/12263004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 09:55:50 +00:00
jkummerow@chromium.org
19dab057b4
Fix NegateCompareOp and InvertCompareOp
...
BUG=v8:2537
Review URL: https://codereview.chromium.org/12217136
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-13 14:36:19 +00:00
jkummerow@chromium.org
b09cc0be50
Adjust the stack-size value for big-array-literal.js
...
Review URL: https://codereview.chromium.org/12114002
Patch from Haitao Feng <haitao.feng@intel.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:45:47 +00:00
jkummerow@chromium.org
e83ff197bf
Add regression test for r13617
...
Many thanks to Vyacheslav Egorov for coming up with this test!
BUG=173907
Review URL: https://codereview.chromium.org/12212066
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:38:24 +00:00
mstarzinger@chromium.org
79607d20e6
Make the GC stress builder go green.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/12218034
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-06 13:21:28 +00:00
adamk@chromium.org
dbf50cf948
Object.observe: change array truncation logic to efficiently handle large sparse arrays
...
Review URL: https://codereview.chromium.org/12041084
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 21:03:08 +00:00
verwaest@chromium.org
aca87c2fcd
Tag stubs that rely on instance types as MEGAMORPHIC.
...
BUG=chromium:173974
Review URL: https://chromiumcodereview.appspot.com/12178017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 13:12:03 +00:00
danno@chromium.org
0c3575c874
Generate the TransitionElementsStub using Crankshaft
...
This includes:
* Adding support for saving callee-clobbered double registers in Crankshaft code.
* Adding a new "HTrapAllocationMemento" hydrogen instruction to handle AllocationSiteInfo data in crankshafted stubs.
* Adding a new "HAllocate" hydrogen instruction that can allocate raw memory from the GC in crankshafted code.
* Support for manipulation of the hole in HChange instructions for Crankshafted stubs.
* Utility routines to manually build loops and if statements containing hydrogen code.
Review URL: https://codereview.chromium.org/11659022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 12:01:59 +00:00
adamk@chromium.org
c001d928df
Object.observe: don't unnecessarily emit oldValue for reconfigurations of data properties
...
When a data property has its attributes changed but its value remains the same,
don't emit an oldValue. This makes the API more consistent by only emitting
oldValue when the value of a property has actually changed (or been removed,
in the case of a reconfiguration as an accessor property or a deletion).
Review URL: https://codereview.chromium.org/11820004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-30 21:07:28 +00:00
yangguo@chromium.org
c5883d442e
Add option to limit tick processor to a time range.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12077043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-29 14:41:02 +00:00
verwaest@chromium.org
c8636a2809
Do not try to collect the map if the monomorphic IC stub has no map.
...
This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.
BUG=chromium:172345
Review URL: https://chromiumcodereview.appspot.com/12082023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-28 13:19:53 +00:00
mstarzinger@chromium.org
fe8e97798e
Allow inlining of multiple closures from shared function.
...
This allows Crankshaft to allow inlining of multiple different closures
that were all derived from the same shared function info. This pattern
appears when libraries provide generic closures that are used over and
over again at different call-sites.
R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-closures
Review URL: https://codereview.chromium.org/12071002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 16:55:00 +00:00
yangguo@chromium.org
24ec13cbd2
Fix additional spec violations wrt RegExp.lastIndex.
...
R=svenpanne@chromium.org
BUG=v8:2437
Review URL: https://chromiumcodereview.appspot.com/12033099
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 10:53:26 +00:00
mstarzinger@chromium.org
44ffa0dcd3
Allow monomorphic loads when static type is known.
...
This allows Crankshaft to generate monomorphic loads when the receiver
type is statically known even though the load site has polymorphic type
feedback. This applies to inlined constructor calls and literals.
R=jkummerow@chromium.org
TEST=mjsunit/compiler/property-static
Review URL: https://codereview.chromium.org/12051058
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 17:54:30 +00:00
ulan@chromium.org
e6224d275f
Make embedded maps in optimized code weak.
...
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.
BUG=v8:2073
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11575007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 11:55:05 +00:00
ulan@chromium.org
d29826544e
Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.
...
After r13289 the divisor can be non-constant, so we should check for zero.
BUG=171641
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 15:58:49 +00:00
yangguo@chromium.org
9296975c04
Correctly reset lastIndex in an RegExp object.
...
R=svenpanne@chromium.org
BUG=170856
Review URL: https://chromiumcodereview.appspot.com/11896060
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 12:28:16 +00:00
ulan@chromium.org
79a0e3b017
Fix pattern detection for replacing shifts by rotation.
...
BUG=2499
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047015
Patch from Hirofumi Mako <mkhrfm@gmail.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 13:55:22 +00:00
mstarzinger@chromium.org
f8d5260af7
Allow loading constant function from proto chain.
...
This enables Crankshaft to use HConstant for loading constant functions
on the prototype chain when building a monomorphic load. This pattern
appears in several JavaScript frameworks.
R=svenpanne@chromium.org
TEST=mjsunit/compiler/proto-chain-constant
Review URL: https://codereview.chromium.org/12052008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13463 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 12:03:35 +00:00
mvstanton@chromium.org
90d0f18007
Incorrect ARM assembly in MacroAssembler::TestJSArrayForAllocationSiteInfo
...
Restored test code in allocation-site-info.js that was failing on ARM because of this bug.
BUG=
Review URL: https://codereview.chromium.org/12045017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 10:49:23 +00:00
mvstanton@chromium.org
c3746b4388
allocation-site-info.js broken on arm with new changes. Reverting to previous version until diagnosed.
...
Regress-2185.js test takes too long on slow path when allocation site info is discovered.
BUG=
Review URL: https://codereview.chromium.org/12049003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:15:08 +00:00
yangguo@chromium.org
0c822b21cb
Fix some latin-1 webkit units tests
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11962035
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:11:31 +00:00
yangguo@chromium.org
7f331f6280
Make HCheckPrototypeMaps compatible with parallel recompilation.
...
HCheckPrototypeMaps currently records the prototype and the holder of the
prototype chain (both ends of the chain) and assumes that the chain elements
and their maps did not change in during the entirety of Crankshaft. The actual
traversal of the prototype chain happens in Lithium at code generation.
With parallel compilation, this assumption is not longer correct.
R=mstarzinger@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11864013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 15:49:00 +00:00
mvstanton@chromium.org
3414a514cd
Fixed test failure.
...
A test case erroneously expected a transition to a double array, but the array remains FAST_SMI.
In person LGTM from Danno...
BUG=
Review URL: https://codereview.chromium.org/12038008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13447 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 13:21:53 +00:00
mvstanton@chromium.org
d7d917e6f0
Out of bounds memory access in TestJSArrayForAllocationSiteInfo.
...
The function intended to check the map pointer of an AllocationSiteInfo object, but neglected to
subtract an offset to do so.
BUG=169928
Review URL: https://codereview.chromium.org/11931037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 12:26:29 +00:00
jkummerow@chromium.org
7924492ce3
tools/run-tests.py: Fixes for Windows
...
Review URL: https://codereview.chromium.org/11926015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-18 14:55:23 +00:00
yangguo@chromium.org
284a28e797
Temporarily disable deferred stack trace formatting.
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11859027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-18 13:05:03 +00:00
mvstanton@chromium.org
7884216804
Additional work to get array literal allocation tracking working, even with --always-opt
...
BUG=
Review URL: https://codereview.chromium.org/11817017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-17 08:41:27 +00:00
mstarzinger@chromium.org
0484ddcf50
Fix arguments materialization for inlined apply().
...
This fixes materialization of the arguments object in case the constant
function check if TryCallApply() inside an inlined frame fails.
R=svenpanne@chromium.org
BUG=v8:2489
TEST=mjsunit/regress/regress-2489
Review URL: https://codereview.chromium.org/11931012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-16 09:25:45 +00:00
yangguo@chromium.org
f15f294127
Sync laziness between BuildFunctionInfo and MakeFunctionInfo.
...
BuildFunctionInfo compiles the function eagerly when there are debug
break points. However, the AST may have been parsed lazily since
MakeFunctionInfo does not check for debug break points.
This fixes a regression introduced in r11866.
BUG=147497
Review URL: https://chromiumcodereview.appspot.com/11661008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-15 10:16:52 +00:00
yangguo@chromium.org
eadcc1c10c
Reland r13188, r13194, r13256 (Deferred formatting of error stack trace during GC).
...
BUG=
Review URL: https://chromiumcodereview.appspot.com/11880018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13371 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-14 13:19:27 +00:00
mstarzinger@chromium.org
c5cff2c75a
Make recent regression test resilient against GC stress.
...
R=danno@chromium.org
TEST=mjsunit/regress/regress-165637
Review URL: https://codereview.chromium.org/11824062
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 14:21:27 +00:00
mstarzinger@chromium.org
1079642c97
Fix missing exception check in typed array constructor (2).
...
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11791052
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 11:45:29 +00:00
yangguo@chromium.org
e41c17084f
Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag.
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 15:47:53 +00:00
yangguo@chromium.org
45f20e366a
Introduce ENABLE_LATIN_1 compile flag
...
Mostly a bunch of renaming when flag is disabled.
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 10:30:54 +00:00
svenpanne@chromium.org
0aacbf9619
Added %FlattenString and use it to speed up a regression test.
...
Flattening strings is relatively costly and by doing it after every duplication
we avoid combinatorial explosion.
Note that flattening could have been done by e.g. using a regular expression,
too, but this is just another implementation detail and %FlattenString seems
general enough to be useful in other tests, too.
Review URL: https://codereview.chromium.org/11828014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 09:32:12 +00:00
mvstanton@chromium.org
529f801fde
Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array,
...
we store an AllocationSiteInfo object right after the JSArray, with a pointer to the
boilerplate object. Later, if the array transitions we check for the continued existence
of the temporary AllocationSiteInfo object (has no roots). If found, we'll use it to
transition the boilerplate array as well.
Danno's original changeset: https://codereview.chromium.org/10615002/
Review URL: https://codereview.chromium.org/11663005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-08 09:03:16 +00:00
mstarzinger@chromium.org
0e46919c32
Fix missing exception check in typed array constructor.
...
The typed array constructor might fail if the first argument is an
object with a length property. Accessing the property can cause an
exception to be thrown and an explicit check needs to be performed.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11777014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 14:01:04 +00:00
danno@chromium.org
4246ac3009
Generalize calling to C++ on stub deopt
...
Remove code specific to KeyedLoadICs in DoCompiledStubFrame on all platforms, driving stub frame translation by the register parameter information found in a stub's CodeStubInterfaceDescriptor.
Review URL: https://codereview.chromium.org/11635015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 10:06:11 +00:00
yangguo@chromium.org
4ee20d857b
Check for read-only-ness when preparing for array sort.
...
R=verwaest@chromium.org
BUG=v8:2419
Review URL: https://chromiumcodereview.appspot.com/11759022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-04 15:24:47 +00:00
yangguo@chromium.org
e536abb777
Handle non-constant divisor in MathFloorOfDiv, on ia32/x64
...
Zheng Liu
zheng.z.liu@intel.com
Review URL: https://chromiumcodereview.appspot.com/11624022
Patch from Zheng Liu <zheng.z.liu@intel.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-28 15:52:17 +00:00
yangguo@chromium.org
2f821f1ed9
Revert r13188, r13194, r13256 (Deferred formatting of error stack trace during GC).
...
R=ulan@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11678006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-27 13:12:27 +00:00
ulan@chromium.org
b64f834383
Fix x64 MathMinMax for negative untagged int32 arguments.
...
An untagged int32 has zeros in the upper half even if it is negative.
Using cmpq to compare such numbers will incorrectly ignore the sign.
BUG=164442
R=mvstanton@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11665007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-21 17:52:00 +00:00
danno@chromium.org
653a66f527
ARM: Use division instructions in lithium and stubs
...
BUG=none
TEST=Added to test/mjsunit/math-floor-of-div.js, math-floor-of-div-nosudiv.js
Review URL: https://codereview.chromium.org/11316105
Patch from Martyn Capewell <m.m.capewell@googlemail.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-20 16:31:19 +00:00
yangguo@chromium.org
a3f16f8e65
Fix several bugs in error stack trace formatting.
...
GetScriptWrapper can be called recursively:
GetScriptWrapper -> GC -> DeferredFormatStackTrace -> GetScriptWrapper
GC-unsafe code in ErrorObjectList::DeferredFormatStackTrace
Enable overwriting Error.prepareStackTrace by itself while not
causing infinity recursion when it triggers an exception.
R=ulan@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11649037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-20 16:25:26 +00:00
rossberg@chromium.org
97eba9d3cd
Object.observe: fix observation for optimised in/decrement and compound assignment.
...
R=svenpanne@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11642042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-20 15:03:30 +00:00
rossberg@chromium.org
d2ed67a958
Object.observe: temporarily disable one test to unbreak ARM.
...
R=danno@chromium.org
BUG=
Review URL: https://codereview.chromium.org/11646004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-20 14:12:41 +00:00
yangguo@chromium.org
362218a037
Deopt on overflow in integer mod.
...
R=ulan@chromium.org
BUG=166379
Review URL: https://chromiumcodereview.appspot.com/11618017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-19 12:01:22 +00:00
rossberg@chromium.org
c9da5fadcb
Object.observe: Change semantics of deliverChangeRecords to iterate.
...
Added test for recursive change generation.
R=yangguo@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11593028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-19 09:51:46 +00:00
danno@chromium.org
1f4b4625ff
Re-land Crankshaft-generated KeyedLoad stubs.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11528003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 16:25:45 +00:00
ulan@chromium.org
8574054b59
Correctly handle negative codes in String.fromCharCode()
...
BUG=166553
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11576069
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:37:57 +00:00
rossberg@chromium.org
c6bb497437
Simplify implementation of assignment-to-const checks.
...
Also, add test that assignment to function name is a syntax error with harmony scoping.
Does not fix issue 2243 directly, but with ES6, the required behaviour will change to what is implemented already anyway.
R=yangguo@chromium.org
BUG=v8:2243
Review URL: https://codereview.chromium.org/11607016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:00:50 +00:00
yangguo@chromium.org
6e953d51af
Make sure error message formatting does not have side effects.
...
R=vegorov@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11598011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-17 14:00:50 +00:00
peter.rybin@gmail.com
133957e743
Fix set variable value bug: a function argument must be updated in 2 places
...
Review URL: https://codereview.chromium.org/11519020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-14 18:36:51 +00:00
rossberg@chromium.org
1080d2aade
Object.oberve: assertions to narrow down flaky crashes with array length mutation.
...
R=mstarzinger@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11566027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-14 14:19:18 +00:00
rossberg@chromium.org
fb5a5e22ec
Object.observe: Make array length and other magic data properties work correctly.
...
Also, disable TestFastElementsLength test for now, since it flakes on buildbots for yet unknown reasons.
R=mstarzinger@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11554019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-13 09:31:44 +00:00
danno@chromium.org
facad070e9
Remove over-zealous hole checking in Array.slice()
...
R=jkummerow@chromium.org
BUG=chromium:165637
TEST=regress-165637.js
Review URL: https://codereview.chromium.org/11442054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 15:20:45 +00:00
rossberg@chromium.org
76375de29d
Object.observe: prevent observed objects from using fast elements.
...
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.
R=mstarzinger@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11477006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 11:38:24 +00:00
peter.rybin@gmail.com
6eef2f0682
Issue 2399 part 2: In debugger allow modifying local variable values
...
Review URL: https://codereview.chromium.org/11412310
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-11 23:27:38 +00:00
mmassi@chromium.org
ae54f9cfe0
Fix for when array bounds check elimination tries to modify a phi index.
...
BUG=
Review URL: https://chromiumcodereview.appspot.com/11486007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13193 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-11 14:23:04 +00:00
mstarzinger@chromium.org
07077798af
Disable GC stress for mjsunit/fast-prototype.
...
R=yangguo@chromium.org
TEST=mjsunit/fast-prototype --gc-interval=500 --stress-compaction
Review URL: https://codereview.chromium.org/11534004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-11 10:33:04 +00:00
yangguo@chromium.org
72dfb27909
Fire 'stack' getter of error objects after GC.
...
BUG=v8:2340
Review URL: https://chromiumcodereview.appspot.com/11377158
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13188 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-11 10:14:01 +00:00
danno@chromium.org
64fc1f99cb
Revert 13157, 13145 and 13140: Crankshaft code stubs.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/11498006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-10 11:09:12 +00:00
yangguo@chromium.org
c70a0f9334
Improve integer division on IA32 and X64
...
If the divisor is a Power-of-2 constant, we could use shifts instead of the
expensive idiv instructions, which also loose the register constraints.
Review URL: https://chromiumcodereview.appspot.com/11478043
Patch from Yuqiang Xian <yuqiang.xian@intel.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13178 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-10 11:02:22 +00:00
rossberg@chromium.org
9a0623f296
Object.observe support for Function 'prototype' property
...
BUG=v8:2409
Review URL: https://codereview.chromium.org/11416353
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-10 10:53:57 +00:00
rossberg@chromium.org
3348b5c2b4
Allow lazy compilation (and thus optimisation) of functions inside eval.
...
For strict-mode eval, this requires _disabling_ lazy parsing of inner functions,
because we need to collect their free variables to do allocation for the
eval scope properly.
R=mstarzinger@chromium.org
BUG=v8:2315
Review URL: https://codereview.chromium.org/11438042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:35:50 +00:00
yangguo@chromium.org
3388f92e63
Fix spec violations in methods of Number.prototype.
...
R=svenpanne@chromium.org
BUG=v8:2443
Review URL: https://chromiumcodereview.appspot.com/11465005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:20:35 +00:00
yangguo@chromium.org
276c790c61
Iterate through all arguments for side effects in Math.min/max.
...
R=svenpanne@chromium.org
BUG=v8:2444
Review URL: https://chromiumcodereview.appspot.com/11444030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-06 13:13:38 +00:00
yangguo@chromium.org
2200972f48
Update test expectations.
...
Test failure has been fixed in r13050.
R=jkummerow@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11450004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-06 13:13:01 +00:00
yangguo@chromium.org
c75ca45000
Improve array to string conversion.
...
BUG=v8:2435
Review URL: https://chromiumcodereview.appspot.com/11348349
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 15:49:22 +00:00
yangguo@chromium.org
6c92aba643
Fix spec violations related to regexp.lastIndex
...
BUG=v8:2437, v8:2438
Review URL: https://chromiumcodereview.appspot.com/11451005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 12:32:25 +00:00
rossberg@chromium.org
6b16d0bcae
Make Object.observe on the global object functional
...
The approach in this change is to handle the unwrapping/wrapping of the global object transparently with respect to the JS implementation of Object.observe. An alternate approach would be to add a runtime method like %IsJSGlobalProxy and %UnwrapJSGlobalProxy, but it seems ugly to give JS (even implementation JS) access to the unwrapped global.
BUG=v8:2409
Review URL: https://codereview.chromium.org/11414094
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 12:03:57 +00:00
rossberg@chromium.org
23850c16b2
Object.observe: notify of __proto__ changes
...
BUG=v8:2409
Review URL: https://codereview.chromium.org/11299260
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13141 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 11:47:45 +00:00
danno@chromium.org
f19959cd22
Enable stub generation using Hydrogen/Lithium (again)
...
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.
Committed: https://code.google.com/p/v8/source/detail?r=13105
Committed: https://code.google.com/p/v8/source/detail?r=13117
Review URL: https://codereview.chromium.org/10701054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 11:04:10 +00:00
peter.rybin@gmail.com
be4418bae0
Issue 2429, core implementation and the protocol change
...
Review URL: https://codereview.chromium.org/11421100
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13123 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 21:47:39 +00:00
peter.rybin@gmail.com
4b3e67070e
Issue 2399 part 1: In debugger allow modifying local variable values
...
Review URL: https://codereview.chromium.org/11415042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13122 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 20:29:29 +00:00
danno@chromium.org
66f6a8182c
Revert 13117: "Enable stub generation using Hydrogen/Lithium (again)"
...
TBR=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/11415261
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 17:16:51 +00:00
yangguo@chromium.org
702cc25def
Optimize non-ASCII string splitting with single-character search pattern
...
Review URL: https://chromiumcodereview.appspot.com/11299163
Patch from Ben Noordhuis <ben@c9.io>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13119 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 16:48:17 +00:00
danno@chromium.org
78b09625d5
Enable stub generation using Hydrogen/Lithium (again)
...
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.
Committed: https://code.google.com/p/v8/source/detail?r=13105
Review URL: https://codereview.chromium.org/10701054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 15:51:05 +00:00
rossberg@chromium.org
45f42b04c1
When notifying observers of a truncated array, don't call getters on deleted element indices
...
BUG=v8:2409
Review URL: https://codereview.chromium.org/11414177
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-03 13:34:08 +00:00
danno@chromium.org
0a3bcc8c05
Revert 13105: "Enable stub generation using Hydrogen/Lithium."
...
TBR=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/11414262
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-30 17:45:45 +00:00
danno@chromium.org
c115ff4e33
Enable stub generation using Hydrogen/Lithium.
...
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.
Review URL: https://codereview.chromium.org/10701054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13105 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-30 17:31:30 +00:00
verwaest@chromium.org
7553f0d68e
CopyPackedSmiToDoubleElements should fill the FixedDoubleArray with holes
...
BUG=v8:2433
Review URL: https://chromiumcodereview.appspot.com/11280223
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-29 08:34:19 +00:00