AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
7,671 Commits 1 Branch 0 Tags 839 MiB
7e6a69cfa8
Commit Graph

563 Commits

Author SHA1 Message Date
kmillikin@chromium.org
1f12cc4099 Simplify calling generated code from the runtime. 
Instead of expecting Object** arrays at the outermost level, expect
Handle<Object> arrays and reinterpret_cast them only just before invoking
the generated code.

R=rossberg@chromium.org,fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8133020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9537 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-06 09:31:38 +00:00
rossberg@chromium.org
1e56e29a38 Fix a prototype chain traversal not expecting proxies. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8144011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-06 08:46:38 +00:00
rossberg@chromium.org
ebf6cb7150 Use correct trap for lookup in prototype proxy. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8133023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-06 08:42:10 +00:00
jkummerow@chromium.org
a40462e3bb Refactor JSObject::SetFastElement. 
This fixes a bug where the length of FAST_DOUBLE_ELEMENTS arrays was not
set correctly, and another bug where appending a double element to a
SMI_ONLY array would convert it to FAST_ELEMENTS instead of
FAST_DOUBLE_ELEMENTS.

Review URL: http://codereview.chromium.org/8028026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 13:56:30 +00:00
lrn@chromium.org
ebc0f85e40 Revert "Added ability to lock strings to prevent their representation or encoding from changing." 
This reverts r9424.

Review URL: http://codereview.chromium.org/8143018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 11:09:34 +00:00
rossberg@chromium.org
2c975d6ae2 Make 'Become' safe for retries. 
R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8138003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 09:41:54 +00:00
mstarzinger@chromium.org
2fb58638a6 Fix verification of weak maps during initialization. 
R=rossberg@chromium.org

Review URL: http://codereview.chromium.org/8135003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 15:54:57 +00:00
mstarzinger@chromium.org
c034518442 Fix preparation for sorting of external arrays. 
R=rossberg@chromium.org
BUG=98773
TEST=mjsunit/regress/regress-98773

Review URL: http://codereview.chromium.org/8122020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 13:49:50 +00:00
lrn@chromium.org
8e31371d0e Move logic for hidden properties into the JSObject. 
Previously, the logic using the hidden properties backing object was
spread accross use sites. Now it's all contained in JSObject, with
only simple accessors available.
Also change the backing object to be a StringDictionary rather than a JSObject.
There's still room for improvement by making a hash-table that don't
store property details as well.

Review URL: http://codereview.chromium.org/8050013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9510 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 07:45:25 +00:00
mstarzinger@chromium.org
b5be9fa83a Fix map modification in transition tree traversal. 
While traversing the transition tree we build a work-list using the map
field of maps. Setting those map values with a write barrier causes
black-to-gray changes on maps which are currently not recognized as
such, hence their computed size might be off.

R=vegorov@chromium.org
BUG=v8:1672
TEST=cctest/test-decls/Present

Review URL: http://codereview.chromium.org/8082023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9498 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-30 13:03:48 +00:00
ricow@chromium.org
7810ff70f6 Make sure that we can't access hidden properties by installing accessors on Object.prototype. 
BUG:chromium:97784
TEST=cctest/test-api
Review URL: http://codereview.chromium.org/8041020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 16:54:50 +00:00
ulan@chromium.org
16ae2551ae Search prototypes for accessor setters if interceptor returns empty value. 
Extract the part of SetPropertyForResult that searches the prototype chain
for accessor setters into a separate function SetPropertyInPrototypes.
Call this function in SetPropertyPostInterceptor.

This should fix both optimized and unoptimized cases because
the cache stub for storing with interceptor calls the runtime system.

BUG=v8:1636

TEST=cctest/test-api.cc/EmptyInterceptorDoesNotShadowAccessors

Review URL: http://codereview.chromium.org/7991007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 14:54:57 +00:00
lrn@chromium.org
172c27a6ba Added ability to lock strings to prevent their representation or encoding from changing. 
Use string locking to ensure consistent representation of source string during JSON parsing.

Review URL: http://codereview.chromium.org/7977001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9424 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 11:14:41 +00:00
danno@chromium.org
d21902b25e Cache multiple ElementsKind map transition per map. 
R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8017003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9417 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-23 15:09:00 +00:00
rossberg@chromium.org
3df2602037 Handle function proxies as getters/setters. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7849021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 17:12:41 +00:00
rossberg@chromium.org
d938560d59 Implement identity hashes for proxies. 
R=mstarzinger@chromium.org
BUG=v8:1543,v8:1565
TEST=

Review URL: http://codereview.chromium.org/7754015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 13:54:53 +00:00
fschneider@chromium.org
c6a3422c04 Give each function prototype a fresh copy of the object function map. 
This avoid unwanted sharing between different function prototypes and in
general should help inlining because constant function properties on one
prototype don't affect other prototypes anymore.

BUG=v8:1716
Review URL: http://codereview.chromium.org/7994001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9393 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 12:57:54 +00:00
danno@chromium.org
f48c9f6557 Basic support for tracking smi-only arrays on ia32. 
Activated by the flag --smi-only-arrays

Currently not crankshaft support, using flag on non-ia32 platforms will lead to write barrier misses and crashes.

BUG=none
TEST=elements_kind.js

Review URL: http://codereview.chromium.org/7901016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 11:30:04 +00:00
rossberg@chromium.org
e04d0b23a8 Make integer indexed properties ("elements") work for proxies. 
Rehome some Object/JSReceiver/JSObject methods.

R=ricow@chromium.org,kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7795055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 10:45:37 +00:00
rossberg@chromium.org
6c8472bd3a Fix and test use of property descriptor objects. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7828080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 12:45:51 +00:00
rossberg@chromium.org
647ad8f500 Fix GC hazard. 
R=jkummerow@chromium.org
BUG=v8:1698
TEST=

Review URL: http://codereview.chromium.org/7977021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 09:58:40 +00:00
kmillikin@chromium.org
22ef98dc66 Fix a deoptimization bug. 
We reset the count of outgoing arguments, used for the index in the
frame's outgoing arguments, for each level of inlining.  This could
result in the arguments overlapping, rather than stacking on top of
each other.

R=whesse@chromium.org,fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7932022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 07:14:30 +00:00
vegorov@chromium.org
ac36cb4504 Merge experimental/gc branch to the bleeding_edge. 
Review URL: http://codereview.chromium.org/7945009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-19 18:36:47 +00:00
rossberg@chromium.org
42f0a73a96 Make proxies work as prototypes. 
Fix a couple of other proxy bugs along the way.
Refactor trap invocation in native code.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7799026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-16 13:38:30 +00:00
danno@chromium.org
6a5e0448c8 Share Maps for ElementsKind transitions 
Support sharing maps after an changing an object's ElementsKind for element kinds other then external elements.

R=svenpanne@chromium.org
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7862036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9304 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 16:38:47 +00:00
rossberg@chromium.org
ff5c242a47 Test (and fix) all exception paths that can occur with proxies. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 13:07:20 +00:00
kmillikin@chromium.org
40cd59f238 Remove in-loop tracking for call ICs. 
We passed this flag around in a lot of places and had differenc call
ICs based on it, but never did any real specialization based on its
value.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7869009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 12:53:28 +00:00
rossberg@chromium.org
e645597aa7 Implement function proxies (except for their use as constructors). 
Introduce new %Apply native.

Extend Execution::Call to optionally handle receiver rewriting (needed for %Apply).

Fix Function.prototype.bind for functions that have .apply modified.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 11:42:57 +00:00
mikhail.naganov@gmail.com
f8e5c71e18 Rename SmartPointer to SmartArrayPointer. 
As pointed out in: http://codereview.chromium.org/7754007/#msg5

"SmartPointer should have been named SmartArrayPointer as it expects an input
allocated using new[] and deallocates it using delete[]. Using it as a simple
scoped pointer for a single object is incorrect."

R=mnaganov@chromium.org

Review URL: http://codereview.chromium.org/7860011
Patch from Thiago Farina <tfarina@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 22:39:47 +00:00
danno@chromium.org
ab26d8356c Key external array map transitions on ElementsKind instead of ExternalArrayType 
R=jkummrow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7787007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 14:47:37 +00:00
danno@chromium.org
df860eda5c Don't allow seal or element property re-definition on external arrays. 
R=ricow@chromium.org
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js

Review URL: http://codereview.chromium.org/7858031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 14:30:00 +00:00
danno@chromium.org
9b2de409f9 Mechanical refactor to move ElementsKind type out of JSObject. 
R=svenpanne@chromium.org
BUG=none
TEST=all

Review URL: http://codereview.chromium.org/7849017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 09:35:57 +00:00
lrn@chromium.org
689f3cb314 Rename scanner.* to scanner-character-streams.*. and scanner-base.* to scanner.* 
R=lrn@chromium.org

Signed-off-by: Thiago Farina <tfarina@chromium.org>

Review URL: http://codereview.chromium.org/7739020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-08 13:06:44 +00:00
kmillikin@chromium.org
690efb3a04 Fix deoptimization data printing. 
Remove a spurious newline.

R=whesse@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7792052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9090 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-01 08:00:40 +00:00
yangguo@chromium.org
77141f78ff Tentative implementation of string slices (hidden under the flag --string-slices). 
TEST=test/mjsunit/string-slices.js

Review URL: http://codereview.chromium.org/7477045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-26 13:03:30 +00:00
lrn@chromium.org
13dd915a2a Fix typo in assert. 
Also remove the requirement to have an AssertNoAllocation object when getting the flat content. We actually do allow allocation, it's just GC's we don't allow.

Review URL: http://codereview.chromium.org/7710018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-23 13:23:30 +00:00
lrn@chromium.org
9eb7d4a53c Replace ToAsciiVector and ToUC16Vector with single function that returns a tagged value. 
The tag tells whether the content is ASCII or UC16, or even if the string wasn't flat.

BUG: v8:1633

Review URL: http://codereview.chromium.org/7709024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-23 12:22:12 +00:00
danno@chromium.org
4c460099a0 Unify GetElement handlers in ElementsAccessor 
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7655030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-18 09:51:08 +00:00
danno@chromium.org
a8b4b4f42a Remove redundant implementation of UnionOfKeys 
R=svenpanne@chromium.org
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7670037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-18 09:20:32 +00:00
vegorov@chromium.org
4b94137323 Fix GC unsafe place in JSProxy::DeletePropertyWithHandler. 
Review URL: http://codereview.chromium.org/7670023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-17 09:51:20 +00:00
vegorov@chromium.org
bdfceace53 Fix potentially GC unsafe place in JSObject::DeleteElementWithInterceptor. 
Review URL: http://codereview.chromium.org/7660012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-16 15:51:49 +00:00
danno@chromium.org
96f198a4dc Change AddElementsToFixedArray to work on FixedArrayBase rather than JSObject 
In the process, make ElementsAccessors work internally more seamlessly with FixedArrayBase.

R=svenpanne@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7618012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-12 14:52:03 +00:00
danno@chromium.org
48f411a225 Change JSObject elements to be of type FixedArrayBase 
R=kmillikin@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7617010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-12 13:54:27 +00:00
svenpanne@chromium.org
bb81895595 Fixed printing of deoptimization input data without --print-code-verbose. 
Review URL: http://codereview.chromium.org/7617008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-11 13:56:09 +00:00
danno@chromium.org
ff13ab4575 Refactor UnionOfKeys into ElementsAccessor 
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7529046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8870 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-10 10:51:01 +00:00
whesse@chromium.org
92e7656c4d Clean up TranslationIterator and DeoptimizationInputDataPrint. 
Without this refactoring, they break when we add alignment padding in the Translation info.

BUG=
TEST=

Review URL: http://codereview.chromium.org/7569009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-08 07:17:01 +00:00
danno@chromium.org
4a7a47ac8f Move element deletion into element handlers 
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7566004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-04 11:42:14 +00:00
danno@chromium.org
9aa75ed998 Fix out-of-bounds access in fetching propery names 
R=vegorov@chromium.org
BUG=chromium:91517
TEST=none

Review URL: http://codereview.chromium.org/7565009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-04 09:23:25 +00:00
mstarzinger@chromium.org
b05ff5e0b9 Prototype of mark-and-compact support for Harmony weak maps. 
R=vegorov@chromium.org
BUG=v8:1565
TEST=cctest/test-weakmaps

Review URL: http://codereview.chromium.org/7553012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 12:48:30 +00:00
danno@chromium.org
a2eaf852a9 Fix performance regression due to elements refactor 
Consolidate the runtime logic for fetching elements from Objects and JSObjects so that element access in the GetElement cases that are not handled in generated code.

R=svenpanne@chromium.org
BUG=none
TEST=closure.js test faster

Review URL: http://codereview.chromium.org/7569001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 12:42:04 +00:00
mstarzinger@chromium.org
2bb7c74f80 Preliminary Harmony weak maps API implementation. 
R=rossberg@chromium.org,danno@chromium.org
BUG=v8:1565
TEST=mjsunit/harmony/weakmaps

Review URL: http://codereview.chromium.org/7529007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 11:55:13 +00:00
danno@chromium.org
bdf6895bb3 Encapsulate element handling into a class keyed on ElementsKind 
Advantage is that it's much easier to add new element types (like FAST_SMI_ELEMENTS), and that handling logic for each element kind is (more) consolidated.

Currently, only GetElementsWithReceiver uses the new encapsulation, but the goal is to move much more element functionality into the class incrementally.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7527001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 11:12:46 +00:00
danno@chromium.org
b333719607 Properly handle FixedDoubleArrays in sort() 
R=jkummerow@chromium.org
BUG=91008
TEST=regress-91008.js

Review URL: http://codereview.chromium.org/7542008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-02 14:05:11 +00:00
mstarzinger@chromium.org
eef3e8739e Reintroduced dictionary that can use objects as keys. 
R=vitalyr@chromium.org
TEST=cctest/test-dictionary

Review URL: http://codereview.chromium.org/7385006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-28 17:21:22 +00:00
vitalyr@chromium.org
42a2b4ede7 Improve fast to slow elements conversion: 
o Use a more strict limit for old arrays.

o Initial capacity of a slow elements dictionary should be the number
  of used elements and not the old array capacity.

R=danno@chromium.org

Review URL: http://codereview.chromium.org/7464032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8744 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-26 13:56:21 +00:00
jkummerow@chromium.org
0aab25fabf Fix: FunctionTemplate::SetPrototypeAttributes broke prototype object 
BUG=v8:1539
TEST=cctest test-api/SetPrototypeAttributes

Review URL: http://codereview.chromium.org/7324027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-25 15:01:45 +00:00
danno@chromium.org
3e7d642d0a Remaining changes to fully support FastDoubleArray. 
R=ager@chromium.org
BUG=none
TEST=cctests, unboxed-double-array.js

Review URL: http://codereview.chromium.org/7473031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8718 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-22 09:04:16 +00:00
svenpanne@chromium.org
f7138b1427 Implement a type recording ToBoolean IC. 
The IC records the set of types it has seen, e.g. {String} or {Boolean,
Undefined}, etc.  Note that in theory this could lead to a large number of
different ToBoolean ICs (512, to be exact, because we distinguish 9 types),
but in practice only a small handful of them are actually generated.

Currently the type recording part is only implemented on ia32, other platforms
continue to work like they did before, though.

Removed some dead code on the way.
Review URL: http://codereview.chromium.org/7473028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-21 13:51:04 +00:00
rossberg@chromium.org
3ff882ff64 Make proxy fixing GC safe. 
R=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7460009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-21 11:28:18 +00:00
vitalyr@chromium.org
013baa4164 Slightly simplify slow elements conversion check. 
R=danno@chromium.org

Review URL: http://codereview.chromium.org/7460011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 15:14:50 +00:00
danno@chromium.org
92fc85b480 Implement support for getters/setter on FixedDoubleArrays. 
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7459009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 13:41:50 +00:00
danno@chromium.org
8bc3254e4b Implement for..in for FastDoubleArrays 
Also add tests for apply on FastDoubleArrays.

R=ager@chromium.org
BUG=none
TEST=unboxed-double-array.js

Review URL: http://codereview.chromium.org/7461018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 10:54:58 +00:00
danno@chromium.org
a85a493f70 Reland 8636: Implement setting the length property for FixedDoubleArrays. 
R=ager@chromium.org
BUG=none
TEST=unboxed-double-arrays.js

Review URL: http://codereview.chromium.org/7460008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 09:11:38 +00:00
whesse@chromium.org
47e03a0000 fix -Wunused-but-set-variable for gcc-4.6 on x64 
* src/third_party/valgrind/valgrind.h: Update from upstream valgrind
  r11899, so as to get around some unused value warnings.  Also adds
  support for darwin.

  This version of valgrind.h differs from the original in that all
  instances of "unsigned long long int" have been replaced with
  "uint64_t", as the former is not allowed in ISO C++ 89.

  See https://bugs.kde.org/show_bug.cgi?id=211926 for the upstream bug
  report.

* src/x64/cpu-x64.cc:
* src/builtins.cc:
* src/conversions-inl.h:
* src/debug.cc:
* src/frames.cc:
* src/full-codegen.cc:
* src/jsregexp.cc:
* src/objects.cc:
* src/parser.cc:
* src/platform-linux.cc:
* src/x64/code-stubs-x64.cc:
* src/x64/deoptimizer-x64.cc:
* src/x64/full-codegen-x64.cc:
* src/x64/lithium-codegen-x64.cc:
* src/x64/regexp-macro-assembler-x64.cc:
* src/x64/stub-cache-x64.cc: Remove a number of assigned but
  unreferenced variables.

* SConstruct (CCTEST_EXTRA_FLAGS): Punt on -Wunused-but-set-variable for
  the test suite.

BUG=1291
TEST=A build and tools/test.py passes.

Review URL: http://codereview.chromium.org/7400023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 08:09:58 +00:00
danno@chromium.org
a1e851e916 Rollback 8683: Implement setting the length property for FixedDoubleArrays 
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7448002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-19 16:34:17 +00:00
danno@chromium.org
837d83ebf3 Implement setting the length property for FixedDoubleArrays. 
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7400020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-19 16:06:17 +00:00
rossberg@chromium.org
f7ff89ea02 Implement `in' for proxies. 
R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7390028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-19 09:38:59 +00:00
rossberg@chromium.org
5e62e325ac Implement sealing, freezing, and related functions for proxies. 
R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7391001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-18 13:04:52 +00:00
rossberg@chromium.org
75a2c49c1d Implement delete trap for proxies. 
R=ager@chromium.org
BUG=1543
TEST=

Review URL: http://codereview.chromium.org/7369001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-15 09:10:20 +00:00
danno@chromium.org
391ef3be33 Implement ICs for FastDoubleArray loads and stores 
Implemented on ia32, x64, ARM. Stubbed out with UNIMPLEMENTED on MIPS.

BUG=none
TEST=unbox-double-arrays.js

Review URL: http://codereview.chromium.org/7307030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 13:50:27 +00:00
whesse@chromium.org
b2e8d72bf5 Revert r8619 because of Webkit failures. 
Review URL: http://codereview.chromium.org/7351014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:13:40 +00:00
yangguo@chromium.org
c0044bb7e2 Added dictionary that can use objects as keys. 
R=vegorov@chromium.org
TEST=cctest/test-dictionary

Review URL: http://codereview.chromium.org/7349005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8619 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-12 15:13:57 +00:00
kmillikin@chromium.org
890bc1607a Fix a potential crash in const declaration. 
Declaration of const lookup slots would trigger an assertion if there was a
setter somewhere in the prototype chain, and that setter was shadowed by a
non-readonly data property also in the prototype chain.

R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7324048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 14:07:12 +00:00
vegorov@chromium.org
3555f82311 Fix bug in Map::TraverseTransitionTree. 
If map has an empty DescriptorArray we have to set map_or_index_field to NULL otherwise we will
reset iteration state for a previously visited map in the transition tree which has a non-empty
DescriptorArray. This might result in visiting the same map several times.

R=whesse@chromium.org
BUG=v8:1526

Review URL: http://codereview.chromium.org/7329043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 12:06:35 +00:00
kmillikin@chromium.org
cbaf1bc98b Allow JSObject::PreventExtensions to work for arguments objects. 
R=karlklose@chromium.org

Review URL: http://codereview.chromium.org/7335002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-11 06:48:19 +00:00
kmillikin@chromium.org
44c4d0e376 Fix compilation error. 
Compiler cannot recognize the typename in template declaration.  Caught by
MSVC.

R=ricow@chromium.org

Review URL: http://codereview.chromium.org/7237047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8572 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 08:03:39 +00:00
kmillikin@chromium.org
fe23339bdd Fix a bug in for/in iteration of arguments objects. 
We did not properly combine the property names from the parameter map
and the arguments backing store.  They could overwrite each other and
be unsorted.

Also fix an unrelated bug: deleting from a dictionary-mode arguments
backing store could corrupt the parameter map.

R=rossberg@chromium.org
BUG=1531
TEST=mjsunit/regress/regress-1531.js

Review URL: http://codereview.chromium.org/7278033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-08 07:31:48 +00:00
vitalyr@chromium.org
8448d09d3b Do a backing store sparseness check on fast element delete. 
R=vegorov@chromium.org

Review URL: http://codereview.chromium.org/7298004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-01 13:18:42 +00:00
vitalyr@chromium.org
90c9f1b989 Suspend runtime profiler as soon as we exit JS. 
Lots of web pages have really frequently firing timers that keep the
profiler thread spinning if we require a period of JS inactivity
before suspending the profiler. While it's possible to throttle it by
increasing the sleep delay and adjusting the duration of the required
inactive period, it seemed much simpler to just stop it immediately on
exiting JS.

Stopping the profiler this way effectively turned off two optimization
heuristics: 1) eager optimization (it's reset on waking up the
profiler and now the profiler wakes up much more frequently) and 2)
optimization throttling based on JS to non-JS state ratio (the ratio
is now 100%). I removed these two heuristics and found no performance
regressions so far.

R=ager@chromium.org
BUG=crbug.com/77625
TEST=none

Review URL: http://codereview.chromium.org/7274024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 14:56:08 +00:00
sgjesse@chromium.org
3878096ed8 Fix compilation of all combinations of disassembler=on/off and objectprint=on/off 
R=jkummerow@chromium.org

BUG=v8:1473
TEST=none

Review URL: http://codereview.chromium.org//7269002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8465 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 13:17:02 +00:00
sgjesse@chromium.org
7d2be7c0e0 Support debugger inspection of locals in optimized frames 
Optimized frames are now handled by the debugger. When discovering optimized frames during stack inspection in the debugger they are "deoptimized" using the normal deoptimization code and the deoptimizer output information is used to provide frame information to the debugger.

Before this change the debugger reported each optimized frame as one frame no matter the number of inlined functuions that might have been called inside of it. Also all locals where reported as undefined. Locals can still be reposted as undefined when their value is not "known" by the optimized frame.

As the structures used to calculate the output frames when deoptimizing are not GC safe the information for the debugger is copied to another structure (DeoptimizedFrameInfo) which is registered with the global deoptimizer data and processed during GC.

R=fschneider@chromium.org

BUG=v8:1140
TEST=test/mjsunit/debug-evaluate-locals-optimized*

Review URL: http://codereview.chromium.org//7230045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-29 13:02:00 +00:00
vegorov@chromium.org
9310a8d78f Fix three GC unsafe places found by gcmole's dead_vars analysis. 
Review URL: http://codereview.chromium.org/7247013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8411 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-24 12:04:14 +00:00
vitalyr@chromium.org
bbd5889f2c Trim fast elements tail on significant length decreases. 
Runtime_RegExpExecMultiple had to be updated because it assumed
setting an array's length to zero still keeps some capacity in the
backing store.

R=ager@chromium.org

Review URL: http://codereview.chromium.org/7237004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-23 11:22:21 +00:00
ager@chromium.org
b652d79b10 Shrink dictionaries on deletion if number of elements are less than a 
quarter of the capacity.

R=vegorov@chromium.org

Review URL: http://codereview.chromium.org/7190032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8391 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-23 09:30:39 +00:00
karlklose@chromium.org
c5a24f64c4 Fix wrong bounds check on arguments object. 
TEST=added to test/mjsunit/arguments.js

Review URL: http://codereview.chromium.org/7217005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-21 09:27:38 +00:00
jkummerow@chromium.org
b789cb8c94 Crankshaft support for polymorphic array handling 
Review URL: http://codereview.chromium.org/7170012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-20 10:19:00 +00:00
karlklose@chromium.org
f4e4bc43a8 Merge arguments branch to bleeding edge (second try). 
Review URL: http://codereview.chromium.org/7187007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 14:12:58 +00:00
jkummerow@chromium.org
a5ef18b9de Fix building in release mode with disassembler=on 
BUG=v8:1473

Review URL: http://codereview.chromium.org/7147014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 07:58:47 +00:00
karlklose@chromium.org
cc19d1e278 Revert "Merge arguments branch to bleeding merge." 
This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d.

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7172030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 06:37:49 +00:00
karlklose@chromium.org
6cfeb2d400 Merge arguments branch to bleeding merge. 
Review URL: http://codereview.chromium.org/7167006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 15:09:28 +00:00
kmillikin@chromium.org
d77fa99e28 Guard an unsafe cast of a catch context's extension object. 
R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7149019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8283 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-14 15:00:57 +00:00
kmillikin@chromium.org
7d527f857f Change the representation of catch contexts. 
Before, they had no extra slots and an extension object with one named
property.  Now, they use the extension slot for the property name and have
an extra slot for the thrown object.  This increases the size of the context
itself, but removes overall allocation and eliminates a level of indirection.

R=ager@chromium.org

Review URL: http://codereview.chromium.org/7152002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-14 12:16:23 +00:00
sgjesse@chromium.org
906fc4cd01 Always print the deoptimization data when disassembling the generated code 
R=jkummerow@chromium.org

BUG=none
TEST=none

Review URL: http://codereview.chromium.org//7003093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-14 09:10:39 +00:00
danno@chromium.org
4de3bb500c Implement core support for FixedDoubleArrays. 
Under a flag without IC or Crankshaft support.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7089002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 10:03:35 +00:00
mikhail.naganov@gmail.com
3b2470d296 Fix presubmit errors catched by a more recent version of cpplint.py. 
Mainly, there were errors concerning blank lines before and after class access
control sections [whitespace/blank_line].

BEFORE an access control section (e.g. public:, private:) there should be a
blank line (except for the section right after the class declaration).

AFTER an access control section there should be no blank line.

TBR=ager@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8193 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-07 07:17:46 +00:00
jkummerow@chromium.org
c0a0c82b70 Per-Isolate cache for polymorphic stubs 
BUG=1385
TEST=Existing tests still pass; running d8 with --dump-counters shows fewer polymorphic stubs being compiled

Review URL: http://codereview.chromium.org/7094003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-06 13:15:11 +00:00
erik.corry@gmail.com
0023cacc22 Fix traversal of the map transition tree to take the prototype 
transitions into account.
Review URL: http://codereview.chromium.org/7074052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 14:48:09 +00:00
ager@chromium.org
22b5dfd395 Reapply: "Make instanceof and Object.getPrototypeOf work for proxies, 
plus a few other tweaks."

The problem with the original patch was that it did not take hidden
prototype objects into account in Runtime_GetPrototype.

R=kmillikin@chromium.org,rossberg@chromium.org
TEST=es5conform

Review URL: http://codereview.chromium.org/7056041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 10:15:49 +00:00
danno@chromium.org
eee5e6c3fc Add complete ElementsKind information directly to Map for objects with elements. 
Review URL: http://codereview.chromium.org/6966041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8162 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 07:41:37 +00:00
ager@chromium.org
ece7700d7c Revert "Make instanceof and Object.getPrototypeOf work for proxies, plus a few other tweaks." 
This change caused errors in es5conform tests for getPrototypeOf.

TBR=rossberg@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7109004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8159 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-02 10:12:00 +00:00