antonm@chromium.org
e96c24bf03
Properly treat exceptions thrown while compiling.
...
BUG=v8:1132
TEST=test/mjsunit/regress/regress-1132.js
Review URL: http://codereview.chromium.org/6487021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 14:26:56 +00:00
erik.corry@gmail.com
1f6ed9304d
Fix http://code.google.com/p/chromium/issues/detail?id=72555 incorrect
...
value for Math.LOG10E
Review URL: http://codereview.chromium.org/6489027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 14:23:47 +00:00
sandholm@chromium.org
1efb5784ab
Fix sputnik regression introduced in r6747.
...
Review URL: http://codereview.chromium.org/6485025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 13:30:37 +00:00
kmillikin@chromium.org
3ef7ca6c28
Remove the uses of the arguments from all calls.
...
Before, Hydrogen call instructions had uses of the PushArgument instructions
for their arguments. These operands were unneeded, bloated the IR, and
caused calls to be the only Hydrogen instructions with an unpredictable
number of operands.
Now, PushArgument is a pure side-effecting instruction that has no uses.
Review URL: http://codereview.chromium.org/6480030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 13:20:06 +00:00
fschneider@chromium.org
bbba0dbd61
Add a genuine unary minus instruction to Crankshaft.
...
This change introduces an instruction for negation instead
of generating a multiplication with -1.
The code for x64 and ARM is not included in this change.
Review URL: http://codereview.chromium.org/6461021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 12:56:30 +00:00
sandholm@chromium.org
356c8ec24b
Improve StringIndexOf.
...
Review URL: http://codereview.chromium.org/6489028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 12:33:30 +00:00
mikhail.naganov@gmail.com
efe7129277
removed
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 12:25:41 +00:00
kmillikin@chromium.org
2e08148b06
Fix the semantics of delete on parameters.
...
Before, an attempt to delete a parameter in a function that used the
arguments object in any way would succeed with true and delete both
the parameter and the corresponding arguments object property.
Now, an attempt to delete such a parameter does not delete and
evaluates to false.
Parameters can be deleted, as before, from functions that use the
arguments object, by deleting the corresponding arguments object
property (this is a spec violation).
BUG=fixes v8:1136
Review URL: http://codereview.chromium.org/6484023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6745 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 11:57:11 +00:00
kmillikin@chromium.org
bea46a2723
Port bug fixes to optimized Function.prototype.apply to ARM.
...
There were a couple of bug fixes to this code on IA32 which have not yet
been ported to ARM. They are: failure to correctly handle non-JSObject
receivers and failure to restore the context register after calling JS code.
Review URL: http://codereview.chromium.org/6479019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6744 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 11:24:38 +00:00
sgjesse@chromium.org
e3fd635f26
Small cleanup of bug ids
...
Review URL: http://codereview.chromium.org/6486028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 10:36:58 +00:00
kmillikin@chromium.org
7bb857db19
Prohibit moving instructions with side effects via 'EmitAtUses'.
...
It's not generally safe to decide to delay the evaluation of an expression
with side effects until it is used.
BUG=v8:1138
Review URL: http://codereview.chromium.org/6474035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6742 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 10:17:52 +00:00
sgjesse@chromium.org
505b46753e
ARM: Add shift operations to the type recording binary operation stub
...
Review URL: http://codereview.chromium.org/6471023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 20:04:54 +00:00
ricow@chromium.org
b02f9c2ba1
Fix presubmit.
...
TBR: ager
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6736 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:45:03 +00:00
lrn@chromium.org
fdfbdfbcf5
Fix typo in ASSERT in object-verifier for RegExp.
...
BUG=v8::1129
TEST=test/mjsunit/regress/regress-1129.js
Review URL: http://codereview.chromium.org/6476027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:43:01 +00:00
ricow@chromium.org
512a02764f
X64: Add DoCallNamed, DoContext, DoCallGlobal, and DoLoadFunctionPrototype lithium instructions.
...
Review URL: http://codereview.chromium.org/6471025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:33:01 +00:00
ricow@chromium.org
091237ce5b
Port revision 6732 to arm.
...
I discussed with Soeren, and they do need this on arm as well.
Review URL: http://codereview.chromium.org/6478029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:26:44 +00:00
ricow@chromium.org
eda4c9126f
X64: Add VisitGlobalPropertyCell to the relocinfo visitor.
...
This fixes GC issues when in the threading tests.
Review URL: http://codereview.chromium.org/6478026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6732 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:13:21 +00:00
ricow@chromium.org
1c8a1bc492
X64: Fix Generate_NotifyLazyDeoptimized to actually call with the LAZY flag.
...
This should fix the flaky cctest failure on the debug run of x64 with
crankshaft enabled.
Review URL: http://codereview.chromium.org/6480032
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 15:17:38 +00:00
antonm@chromium.org
ab24485760
Bypass JS accessors when building error array.
...
In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement
may throw or its behaviour can be altered. Instead operate on plain FixedArrays and
turn them into JSArry later.
BUG=v8:1130
TEST=test/mjsunit/regress/regress-1130.js
Review URL: http://codereview.chromium.org/6481001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 15:02:13 +00:00
antonm@chromium.org
2a25c444d5
Fix various places which do not check if SetProperty threw an exception.
...
Review URL: http://codereview.chromium.org/6480003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 14:41:16 +00:00
antonm@chromium.org
5d3430a509
Fix forging of object's identity hashes.
...
Do not do standard property lookup on hidden properties object as it might
reach Object.prototype which can be altered to forge identity hashes.
Instead do only local lookup.
Review URL: http://codereview.chromium.org/6472001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 14:09:52 +00:00
fschneider@chromium.org
5b753cecb6
Check holder before optimizing calls to global functions.
...
In the case where the function is not found in the global object,
we have to generate a generic call.
BUG=v8:1106
TEST=mjsunit/regress/regress-1106.js
Review URL: http://codereview.chromium.org/6483010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:33:51 +00:00
vegorov@chromium.org
49adfd0f0a
Bailout from PrepareSlowElementsForSort when hiting a key outside of smi-range.
...
BUG=v8:1131
TEST=test/mjsunit/regress/regress-1131.js
Review URL: http://codereview.chromium.org/6469006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:33:34 +00:00
danno@chromium.org
1bd9f602be
Implement crankshaft support for pixel array loads.
...
Review URL: http://codereview.chromium.org/6410112
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:02:36 +00:00
fschneider@chromium.org
73fe82426f
Strengthen requirements for fixed registers at calls.
...
Already done on ia-32. This change is for x64 and ARM.
We now always require fixed input registers at calls to
avoid overlap with temp registers.
This fixes the affected instructions on ARM.
Review URL: http://codereview.chromium.org/6471021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 10:31:55 +00:00
kmillikin@chromium.org
c0fd053982
Fix a representation change bug in the Hydrogen graph construction.
...
We could try to treat an HPhi as an HInstruction because the code did
not properly handle the case of a phi in a block with itself as one of
the predecessors.
BUG=v8:1134
Review URL: http://codereview.chromium.org/6471020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 10:28:59 +00:00
kmillikin@chromium.org
e88f25f6dc
Insert a space to please our presubmit overlords.
...
Review URL: http://codereview.chromium.org/6480027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 09:16:33 +00:00
fschneider@chromium.org
de06cd58a3
Fix bug in register requirements for function.apply.
...
Whenever we use a fixed temp at a call that can eagerly deopt we
now allow fixed register exclusively to avoid any overlap.
Review URL: http://codereview.chromium.org/6479014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 09:12:38 +00:00
kmillikin@chromium.org
ebebcae4c2
Allow esi to be an allocatable register on IA32.
...
Make esi available to the register allocator rather than dedicating it
permanently to the context.
The context is still passed in register esi to JavaScript and to the runtime
as part of the calling convention. Because some stubs might end up calling
JS or the runtime, it is also conservatively passed to stubs.
Roughly half the calls have been modified to use the context as an input
value in fixed register esi. The other half are marked as calls or deferred
code so esi is spilled and can be explicitly set.
It is no longer necessary to restore the context to esi after a call that
might change it.
Review URL: http://codereview.chromium.org/6452001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 09:00:50 +00:00
mikhail.naganov@gmail.com
12e62e7154
Shorten constructor names in JS tickprocessor.
...
As they are no more used in DevTools profiler, there is no
need to prefix them with "devtools.profiler" namespace.
Review URL: http://codereview.chromium.org/6456025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 07:47:28 +00:00
antonm@chromium.org
2f17f3e5d7
Do not invoke any setters when forming stack trace JS object.
...
Review URL: http://codereview.chromium.org/6463022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 19:34:04 +00:00
antonm@chromium.org
47a22dcecd
Reapply http://code.google.com/p/v8/source/detail?r=6555
...
Compare JSObjects by identity immediately.
When invoking EQUALS JS builtin, 1st argument is passed as a receiver and
if it's a global object, it gets overwritten with global proxy object and
thus one gets incorrect results.
BUG=v8:1082
TBR=ricow@chromium.org
Review URL: http://codereview.chromium.org/6461028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 19:09:26 +00:00
kmillikin@chromium.org
dc91c4218b
Make optimized Function.prototype.apply safe for non-JSObject first arguments.
...
If we have a property access of the form this.x, where the access site sees
the global object, we can specialize the IC stub so that it performs a map
check without first performing a heap object check.
Ensure that we do not get in JS code with a non-JSObject this value by
deoptimizing at Function.prototype.apply if the first argument is not a
JSObject.
BUG=v8:1128
Review URL: http://codereview.chromium.org/6463025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 16:43:23 +00:00
whesse@chromium.org
e0422e5401
Make VS2005 project files compile without errors: changelist http://codereview.chromium.org/6286135/ .
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 15:58:55 +00:00
whesse@chromium.org
0fb5a1fd1a
Add a regression test for issue 1106, optimized access to the prototype chain of the global object.
...
Review URL: http://codereview.chromium.org/6459023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 15:50:39 +00:00
sgjesse@chromium.org
dabc590527
ARM: Add type-feedback recording for compare
...
Change the comparison in the full code generator to use CompareIC instead of the CompareStub to record the types. This also implements the patching in the full code generator where the inlined smi code is de-activated by default to call the CompareIC once and then activating the inlined smi code by patching the code.
Fixed the smi comparison in the ICCompareStub.
Fixed ToBooleanStub to ensure that the scratch register used is not the input. Use r9 as default as that will never be input with Crankshaft.
Implemented lithium instruction CmpTAndBranch.
Make sure that the lithium instruction CmpID have operands in registrers as the current optimized code expects that.
Review URL: http://codereview.chromium.org/6461017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:57:24 +00:00
ager@chromium.org
d5851dcde0
x64: Enable inline smi code patching to reenable the inlined code in
...
the code generated by the full code generator after my previous
change.
The generated code is the same as on ia32 and so is the patching.
Review URL: http://codereview.chromium.org/6456023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:51:38 +00:00
erik.corry@gmail.com
6cfac3c48b
Prepare push to trunk. Now working on version 3.1.4.
...
Review URL: http://codereview.chromium.org/6458026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:41:22 +00:00
lrn@chromium.org
d358e2ecd3
Fix incorrect asserts in scanner.
...
BUG=v8::1126
TEST=test/mjsunit/regress/regress-1126.js
Review URL: http://codereview.chromium.org/6459021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:16:25 +00:00
floitschV8@gmail.com
96c4f62b73
Add two tests to strtod.
...
Review URL: http://codereview.chromium.org/6461018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:12:31 +00:00
whesse@chromium.org
8d3d77055c
Fix assert error on ARM triggered by large numbers of function parameters.
...
Review URL: http://codereview.chromium.org/6458027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 13:56:35 +00:00
whesse@chromium.org
afec61e870
Fix typo in r6697: Use assertThrows correctly in the added test regress-1122.js.
...
Review URL: http://codereview.chromium.org/6460030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 13:16:40 +00:00
whesse@chromium.org
602d5cf427
Fix a bug that occurs when functions are defined with more than 16,382 parameters.
...
Review URL: http://codereview.chromium.org/6447007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 12:46:22 +00:00
fschneider@chromium.org
eec7bc8e60
Change the code for materializing double constants on ia32.
...
Instead of using the stack, use a temporary integer register
and avoid memory access.
Review URL: http://codereview.chromium.org/6452002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 12:39:15 +00:00
ricow@chromium.org
baa3eed710
Change our zap values from hex numbers tagged as a heap object to hex numbers tagged as a failure.
...
Since our zap values are valid heap object addreses we might hit asserts if a heap object gets the value of a zap constant as its address.
Review URL: http://codereview.chromium.org/6456022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 12:35:18 +00:00
kmillikin@chromium.org
991a1cae12
Fix an assertion failure in stack trace construction.
...
When constructing stack traces we interpret the deoptimization data for
optimized frames to find the receiver value. This value could sometimes be
eliminated from the deoptimization data if we though it was unused.
BUG=v8:1118
Review URL: http://codereview.chromium.org/6465023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 11:45:50 +00:00
antonm@chromium.org
d724993138
Use GC-safe version when setting elements.
...
BUG=1125
TEST=test/mjsunit/regress/regress-1125.js
Review URL: http://codereview.chromium.org/6463001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 11:38:10 +00:00
antonm@chromium.org
492ef6ee7a
Do sanity check of exception state when returning from native to JS.
...
If --debug-code is on, check that returned value and Top::has_pending_exception
agree on exception state.
Review URL: http://codereview.chromium.org/6450004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 20:13:08 +00:00
antonm@chromium.org
cf30cefda7
Check if Array.prototype.__proto__ has been reset to null.
...
BUG=v8:1121
TEST=test/mjsunit/regress/regress-1121.js
Review URL: http://codereview.chromium.org/6454004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:56:44 +00:00
ager@chromium.org
40dd216b53
Port fix for duplicate AST ID for deoptimization to ARM and x64.
...
Review URL: http://codereview.chromium.org/6458001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:42:24 +00:00