Commit Graph

4913 Commits

Author SHA1 Message Date
adamk
7d1d978654 Rename destructuring flag to "--harmony-destructuring-bind"
This is in preparation for the addition of --harmony-destructuring-assignment.

BUG=v8:811
LOG=n

Review URL: https://codereview.chromium.org/1450193002

Cr-Commit-Position: refs/heads/master@{#32098}
2015-11-18 23:30:09 +00:00
jkummerow
107699483d Fix PropertyDescriptor::ToObject
When adding properties to the result object, that object's prototype chain should be ignored.

Review URL: https://codereview.chromium.org/1458873002

Cr-Commit-Position: refs/heads/master@{#32085}
2015-11-18 13:56:51 +00:00
yangguo
5bcddae76f [crankshaft] only compile string index access with element key.
R=bmeurer@chromium.org
BUG=chromium:554831
LOG=N

Review URL: https://codereview.chromium.org/1455883004

Cr-Commit-Position: refs/heads/master@{#32084}
2015-11-18 13:53:34 +00:00
mstarzinger
279f2aad93 [turbofan] Fix deoptimization from array literal spread.
This fixes the array literal expression stack tracking in the presence
of spread expressions. Deoptimization within a spread expression was
borked.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-deopt-in-array-literal-spread

Review URL: https://codereview.chromium.org/1455953002

Cr-Commit-Position: refs/heads/master@{#32079}
2015-11-18 11:45:41 +00:00
jarin
a9fa0498e1 [turbofan] Only infer signedness for Float64->Word32 representation change from the input type.
If the input type does not help us, we are conservative and truncate (rather than guessing signed).

Review URL: https://codereview.chromium.org/1455103002

Cr-Commit-Position: refs/heads/master@{#32075}
2015-11-18 10:02:33 +00:00
neis
b270813388 [es6] Partially implement Reflect.ownKeys.
Proxies are not properly supported yet.

This is a reland of 1405243006.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1460563002

Cr-Commit-Position: refs/heads/master@{#32065}
2015-11-18 00:52:50 +00:00
pan.deng
81fe5b3c45 Support SAB atomics for offset-TypedArray
BUG=497295
LOG=n

Review URL: https://codereview.chromium.org/1422533009

Cr-Commit-Position: refs/heads/master@{#32064}
2015-11-18 00:19:54 +00:00
mstarzinger
1321075391 [turbofan] Fix several OSR entries within literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1453733002

Cr-Commit-Position: refs/heads/master@{#32050}
2015-11-17 15:25:30 +00:00
mstarzinger
0c1c80b2af [turbofan] Fix several OSR entries within class literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1452193003

Cr-Commit-Position: refs/heads/master@{#32048}
2015-11-17 14:51:35 +00:00
mstarzinger
f8a7236119 [turbofan] Fix several OSR entries within literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1451423002

Cr-Commit-Position: refs/heads/master@{#32047}
2015-11-17 14:25:30 +00:00
caitpotter88
24ff30b740 [es6] refactor Promise resolution
Several changes are included here:

1. Each resolution callback references shared data indicating whether
it has already been resolved or not, as described in 25.4.1.3
http://tc39.github.io/ecma262/#sec-createresolvingfunctions.
Previously this was handled exclusively by the Promise's status,
which does not work correctly with the current chaining behaviour.

2. During fulfillment, When a Promise is resolved with a thenable, the
spec chains the promises together by invoking the thenable's `then`
function with the original Promise's resolve and reject methods (per
section 25.4.2.2, or
http://tc39.github.io/ecma262/#sec-promiseresolvethenablejob, on the
next tick, regardless of whether or not there are pending tasks.

3. Adds a spec compliance fix to ensure that the Promise constructor
is only loaded once when `then()` is called, solving v8:4539 as well.
This involves refactoring PromiseChain to accept a constructor
argument. PromiseChain/PromiseDeferred will hopefully be removed soon,
simplifying the process.

BUG=v8:4162, v8:4539, v8:3237
LOG=N
R=rossberg@chromium.org, littledan@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1394463003

Cr-Commit-Position: refs/heads/master@{#32046}
2015-11-17 14:24:09 +00:00
yangguo
906903acb5 Experimental support for RegExp lookbehind.
R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
Cr-Commit-Position: refs/heads/master@{#32029}

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32043}
2015-11-17 13:33:34 +00:00
jkummerow
9c35e4b23c [proxies] Wire up Object.getOwnPropertyDescriptor
using the new JSReceiver::GetOwnPropertyDescriptor implementation.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1451703003

Cr-Commit-Position: refs/heads/master@{#32037}
2015-11-17 13:08:51 +00:00
yangguo
5b2ae9d908 Revert of Experimental support for RegExp lookbehind. (patchset #18 id:340001 of https://codereview.chromium.org/1418963009/ )
Reason for revert:
gc stress breaks due to string_start_minus_one not being set correctly.

Original issue's description:
> Experimental support for RegExp lookbehind.
>
> R=erikcorry@chromium.org, littledan@chromium.org
> BUG=v8:4545
> LOG=N
>
> Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
> Cr-Commit-Position: refs/heads/master@{#32029}

TBR=littledan@chromium.org,erikcorry@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4545

Review URL: https://codereview.chromium.org/1451373003

Cr-Commit-Position: refs/heads/master@{#32032}
2015-11-17 11:55:21 +00:00
yangguo
37632606bb Experimental support for RegExp lookbehind.
R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32029}
2015-11-17 11:15:06 +00:00
jarin
a77f9179e0 [turbofan] Check for dead node in the common operator reducer.
BUG=chromium:556543
LOG=n

Review URL: https://codereview.chromium.org/1450883003

Cr-Commit-Position: refs/heads/master@{#32025}
2015-11-17 09:03:10 +00:00
adamk
fd3ff03da2 Fix harmony sloppy block scoping dynamic redeclaration check
The previous code did not properly check for harmony const when
doing the dynamic redeclaration check. This was masked in the
test because each eval had an initializer, and the initializer was what
triggered the exception.

This patch tightens the test by removing initializers and fixes the bug in
DeclareLookupSlot.

Also change the test to use assertThrows where possible.

BUG=v8:4550
LOG=n

Review URL: https://codereview.chromium.org/1437003006

Cr-Commit-Position: refs/heads/master@{#31995}
2015-11-13 21:04:15 +00:00
adamk
e971005638 Run the materialized literal reindexer on default parameter initializers
R=rossberg@chromium.org
BUG=chromium:554865
LOG=n

Review URL: https://codereview.chromium.org/1442653004

Cr-Commit-Position: refs/heads/master@{#31989}
2015-11-13 17:11:05 +00:00
danno
ff283f7ded [turbofan] Better and more sane support for tail calls
* Limit triggering of tail calls to explicit use of a new inline runtime
  function %_TailCall. %_TailCall works just like %_Call except for using
  tail-calling mechanics (currently only in TF).
* Remove hack that recognized some specific usages of %_Call and converted them
  into tail calls.
* Support tail calls for all calls where the number of callee stack parameters
  is less than or equal to the number of caller stack parameters.
* Use the gap resolver to swizzle parameters and registers to tail calls.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1439613003

Cr-Commit-Position: refs/heads/master@{#31987}
2015-11-13 16:08:30 +00:00
mstarzinger
c42f188ce2 [turbofan] Fix OSR entry in case label.
With do-expressions any expression used as a case label can turn into an
OSR entry-point. This means the value being switched over is renamed to
an OSR value and needs to be reloaded from the environment at each case.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-case-label

Review URL: https://codereview.chromium.org/1438123007

Cr-Commit-Position: refs/heads/master@{#31986}
2015-11-13 16:05:28 +00:00
cbruni
24e058d0ed [runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1417063011

Cr-Commit-Position: refs/heads/master@{#31983}
2015-11-13 14:14:07 +00:00
mstarzinger
83e9ea1e49 [turbofan] Ensure inlined constructor calls still throw.
This makes sure that inlining a constructor call to a function which
cannot be used as a constructor (e.g. strong mode function) still does
throw correctly when the implicit receiver is created.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-inline-strong-as-construct
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1447443002

Cr-Commit-Position: refs/heads/master@{#31982}
2015-11-13 14:05:48 +00:00
yangguo
a7e50a5e06 [JSON stringifier] Reintroduce fast path with bail out to slow path.
R=verwaest@chromium.org
BUG=chromium:554946
LOG=N

Review URL: https://codereview.chromium.org/1442963002

Cr-Commit-Position: refs/heads/master@{#31977}
2015-11-13 10:09:47 +00:00
neis
69d218c03f [proxies] Remove "fix" functionality, add (still unused) target property.
BUG=

Review URL: https://codereview.chromium.org/1427743011

Cr-Commit-Position: refs/heads/master@{#31972}
2015-11-12 22:12:06 +00:00
yangguo
6df9a1db8c [JSON stringifier] Correctly load array elements.
BUG=chromium:554946
LOG=y
R=jkummerow@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1435083003

Cr-Commit-Position: refs/heads/master@{#31968}
2015-11-12 19:30:58 +00:00
yangguo
ee9020ddd9 Serializer: attach alignment to deferred objects.
R=jkummerow@chromium.org
BUG=chromium:523919
LOG=N

Review URL: https://codereview.chromium.org/1440983002

Cr-Commit-Position: refs/heads/master@{#31956}
2015-11-12 11:28:31 +00:00
mstarzinger
11d5d09ce1 [turbofan] Initial support for constructor call inlining.
This implements a first version of support for constructor call inlining
in the inlining machinery. For now we can only inline calls where the
actual constructor and the original constructor coincide (i.e. no super
constructor calls). Note that the target of a super constructor call is
loaded with a runtime call, so there is no way for it to be constant
promoted at the moment.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1435873002

Cr-Commit-Position: refs/heads/master@{#31954}
2015-11-12 08:51:28 +00:00
verwaest
2ebd5fc7c9 Fix Array.prototype.slice with arguments object with negative length.
BUG=

Review URL: https://codereview.chromium.org/1436813002

Cr-Commit-Position: refs/heads/master@{#31941}
2015-11-11 11:50:38 +00:00
rmcilroy
0609ed27a0 [Interpreter] Disable Arm/Arm64 tests on release as well as debug for ignition.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1423803009

Cr-Commit-Position: refs/heads/master@{#31923}
2015-11-10 17:39:48 +00:00
rmcilroy
6e599ce9d8 [Interpreter] Disable mjsunit/array-sort on Arm/Arm64
BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1410883009

Cr-Commit-Position: refs/heads/master@{#31920}
2015-11-10 16:55:50 +00:00
rmcilroy
1820acb9c9 [Interpreter] Skip some more tests on Arm64 for Ignition.
Skips some more tests which started failing after https://codereview.chromium.org/1414183006 landed.

BUG=v8:4280
LOG=N
NOTRY=True

Review URL: https://codereview.chromium.org/1412343009

Cr-Commit-Position: refs/heads/master@{#31919}
2015-11-10 15:21:57 +00:00
yangguo
9a569ec2c8 [es6] Implement @@split subclassing.
RegExp.prototye[@@split] is not yet implement to spec regarding creating
new RegExp object with the SpeciesConstructor.

R=littledan@chromium.org
BUG=v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1427573005

Cr-Commit-Position: refs/heads/master@{#31911}
2015-11-10 07:00:44 +00:00
yangguo
483d8b9bd8 Unify setting accessor properties in native code.
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1416093006

Cr-Commit-Position: refs/heads/master@{#31910}
2015-11-10 06:58:41 +00:00
neis
ec0f891d1e Revert of "[es6] Partially implement Reflect.ownKeys."
Reason for revert: failed tests on a Windows build.

TBR=rossberg,cbruni,neis
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1426943007

Cr-Commit-Position: refs/heads/master@{#31907}
2015-11-10 00:05:21 +00:00
neis
4194d0ebad [es6] Partially implement Reflect.ownKeys.
Proxies are not properly supported yet.

R=cbruni, rossberg
BUG=

Review URL: https://codereview.chromium.org/1405243006

Cr-Commit-Position: refs/heads/master@{#31906}
2015-11-09 23:30:53 +00:00
rmcilroy
aca03dfca1 [Interpreter] Disable mjsunit/readonly test on ignition due to flakes.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1438463002

Cr-Commit-Position: refs/heads/master@{#31900}
2015-11-09 20:46:21 +00:00
rmcilroy
8b5a010242 [Interpreter] Skip failing tests on arm.debug in Ignition.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1424263004

Cr-Commit-Position: refs/heads/master@{#31894}
2015-11-09 17:13:56 +00:00
rmcilroy
fd6c005982 [Ignition] Skip another failing mjsunittest on ignition.
Skips regress-446389.

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1412313010

Cr-Commit-Position: refs/heads/master@{#31891}
2015-11-09 16:23:42 +00:00
adamk
9a8c0119ef Properly handle parsing a '%'-prefixed runtime call as a binding pattern
R=rossberg@chromium.org
BUG=chromium:552302
LOG=n

Review URL: https://codereview.chromium.org/1425723004

Cr-Commit-Position: refs/heads/master@{#31890}
2015-11-09 15:32:25 +00:00
rmcilroy
cdc1fe5c3f [Ignition] Fix typo in ignition mjsunit status.
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1429423002

Cr-Commit-Position: refs/heads/master@{#31889}
2015-11-09 14:56:07 +00:00
rmcilroy
aa858ffbbd [Ignition] Skip some more mjsunit and test262 tests on ignition.
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1415143009

Cr-Commit-Position: refs/heads/master@{#31886}
2015-11-09 14:16:26 +00:00
caitpotter88
e63248f6d7 [regexp] remove no-op RegExp.multiline accessor and alias
Remove some non-standard code that doesn't do anything anyways.

While FireFox uses this to set the default value for the multiline flag,
it is nonstandard and slated for removal. The matching behaviour has
never been implemented in either JSC or V8, so there is little
web-compat risk.

The only possible risk could be someone depending on the ToBoolean()
behaviour of the flag, but this seems unlikely.

BUG=v8:3870
LOG=N
R=adamk@chromium.org, littledan@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1417733012

Cr-Commit-Position: refs/heads/master@{#31882}
2015-11-09 14:03:26 +00:00
yangguo
742ae613ec Do not switch to two-byte string in String.fromCharCode if avoidable.
R=bmeurer@chromium.org
BUG=v8:4536
LOG=N

Review URL: https://codereview.chromium.org/1427743008

Cr-Commit-Position: refs/heads/master@{#31872}
2015-11-09 08:53:42 +00:00
ishell
37a9be505a Regression test for JSRegExp literals sharing.
JSRegExp's properties backing stores must not be shared.

BUG=chromium:548580
LOG=N

Review URL: https://codereview.chromium.org/1429743006

Cr-Commit-Position: refs/heads/master@{#31867}
2015-11-07 08:19:27 +00:00
rmcilroy
fb9ad89fea [Interpreter]: Add ignition blacklist to mjsunit.status and test262.status.
Adds a blacklist of tests which are currently unsupported or broken in Ignition to
the mjsunit and test262 test status.

Also removes --ignition-script-filter flag, and adds a
--ignition_fallback_on_eval_and_catch flag which fallsback to fullcodegen for
functions which call eval or contain a catch block.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1420963009

Cr-Commit-Position: refs/heads/master@{#31864}
2015-11-06 18:52:51 +00:00
adamk
7b556cd24f Split default parameters that require destructuring into their own file
This allows testing the configuration where --harmony-default-parameters
is passed without --harmony-destructuring.

R=rossberg@chromium.org
BUG=v8:2160
LOG=n

Review URL: https://codereview.chromium.org/1410023015

Cr-Commit-Position: refs/heads/master@{#31863}
2015-11-06 15:49:01 +00:00
bmeurer
925a2006f5 [turbofan] Fix wrong parameter indices in JSFrameSpecialization.
We forgot to add the number of arguments parameter in
JSFrameSpecialization, which was added before the context.

R=jarin@chromium.org
BUG=chromium:552304
LOG=n

Review URL: https://codereview.chromium.org/1429233004

Cr-Commit-Position: refs/heads/master@{#31856}
2015-11-06 13:12:51 +00:00
adamk
e33c4b450f Re-re-land "[es6] Implement destructuring binding in try/catch"
http://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860 was reverted
due to a Blink test failure. That test has been marked as failing on
the Blink side in https://chromium.googlesource.com/chromium/src/+/ac11c6df133.

BUG=v8:811
LOG=y
TBR=rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1409093005

Cr-Commit-Position: refs/heads/master@{#31842}
2015-11-05 20:21:50 +00:00
machenbach
35a60c211e Revert of Revert "Revert of [es6] Implement destructuring binding in try/catch" (patchset #2 id:20001 of https://codereview.chromium.org/1411323008/ )
Reason for revert:
[Sheriff] Breaks a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2750

Please request rebase upstream first if intended.

Original issue's description:
> Revert "Revert of [es6] Implement destructuring binding in try/catch"
>
> Reland try/catch destructuring with a fix for the MemorySanitizer failure:
> initialization_pos needs to be initialized in the DeclarationDescriptor.
>
> This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860
> Cr-Commit-Position: refs/heads/master@{#31834}

TBR=littledan@chromium.org,rossberg@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1421193006

Cr-Commit-Position: refs/heads/master@{#31840}
2015-11-05 19:29:08 +00:00
cbruni
83f60ab5ac [crankshaft] Do not optimize ClassConstructor calls and apply.
LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1425293007

Cr-Commit-Position: refs/heads/master@{#31839}
2015-11-05 19:21:20 +00:00
adamk
80a1e004f4 Revert "Revert of [es6] Implement destructuring binding in try/catch"
Reland try/catch destructuring with a fix for the MemorySanitizer failure:
initialization_pos needs to be initialized in the DeclarationDescriptor.

This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1411323008

Cr-Commit-Position: refs/heads/master@{#31834}
2015-11-05 17:27:57 +00:00
yangguo
2237ba0dba Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
Cr-Commit-Position: refs/heads/master@{#31782}

Committed: https://crrev.com/152163c1646b45f5fc5d31a4ec2eb55d7f4a2ffc
Cr-Commit-Position: refs/heads/master@{#31804}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31824}
2015-11-05 13:08:55 +00:00
verwaest
44c44521ae Remove CallFunctionStub, always call through the Call builtin (also from CallIC).
This fixes receiver conversion since the Call builtin does it correctly.

BUG=v8:4526
LOG=n

Review URL: https://codereview.chromium.org/1407373007

Cr-Commit-Position: refs/heads/master@{#31823}
2015-11-05 12:46:01 +00:00
bmeurer
a210c3757e [runtime] Remove the very dangerous %_CallFunction intrinsic.
The %_CallFunction doesn't implement the call sequence properly, it
doesn't do the receiver wrapping, nor does it check for
classConstructor. Also the eager deoptimization for %_CallFunction was
seriously b0rked (we must have been lucky with TurboFan so far).

R=yangguo@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1419813010

Cr-Commit-Position: refs/heads/master@{#31821}
2015-11-05 11:48:21 +00:00
yangguo
ca49355aba Revert of Implement flag and source getters on RegExp.prototype. (patchset #6 id:110001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
browser_tests failure with --gtest_filter=ExternallyConnectableMessagingTest.EnablingAndDisabling

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}
>
> Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
> Cr-Commit-Position: refs/heads/master@{#31782}
>
> Committed: https://crrev.com/152163c1646b45f5fc5d31a4ec2eb55d7f4a2ffc
> Cr-Commit-Position: refs/heads/master@{#31804}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1426413002

Cr-Commit-Position: refs/heads/master@{#31818}
2015-11-05 09:08:51 +00:00
caitpotter88
096125deaa [es6] allow any LeftHandSideExpression in for-of loops
Fix an earlier regression which forbid non-VariableProxy LHS from being
used in for-of loops. Like for-in loops, the spec allows any LHS to be used,
with the sole exception that ObjectLiterals and ArrayLiterals must be valid
AssignmentPatterns.

Also fixes a bug in TurboFan which resulted in incorrectly replacing a variable load with a constant value in some instances, due to the AstLoopAssignmentAnalyzer failing to record the assignment to ForOfStatement's value.

BUG=v8:4418, v8:2720
LOG=N
R=wingo@igalia.com, littledan@chromium.org, adamk@chromium.org, bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1411873004

Cr-Commit-Position: refs/heads/master@{#31816}
2015-11-05 06:47:56 +00:00
littledan
5d44bf0263 Ship Harmony ToLength
This patch moves ES2015 ToLength semantics on array operations, etc
to from staging to shipping.

R=adamk
BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1433473003

Cr-Commit-Position: refs/heads/master@{#31810}
2015-11-05 00:45:05 +00:00
yangguo
152163c164 Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
Cr-Commit-Position: refs/heads/master@{#31782}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31804}
2015-11-04 20:42:33 +00:00
caitpotter88
55e1cfebfd [parser] early error when declaration Pattern missing Initializer
Emit an early error when BindingPatterns are used in a VariableDeclaration
or LexicalBinding without an Initializer.

BUG=v8:4532
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1416753009

Cr-Commit-Position: refs/heads/master@{#31802}
2015-11-04 19:26:40 +00:00
hablich
a77aa3a2b4 Revert of Implement flag and source getters on RegExp.prototype. (patchset #6 id:110001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
Breaks Chromium tests and blocks the roll: http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/124490

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}
>
> Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
> Cr-Commit-Position: refs/heads/master@{#31782}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1432683002

Cr-Commit-Position: refs/heads/master@{#31801}
2015-11-04 18:34:27 +00:00
adamk
f687c4f4e6 Revert of [es6] Implement destructuring binding in try/catch (patchset #3 id:40001 of https://codereview.chromium.org/1417483014/ )
Reason for revert:
MSAN errors on arm64: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/5123/

Original issue's description:
> [es6] Implement destructuring binding in try/catch
>
> The approach is to desugar
>
>   try { ... }
>   catch ({x, y}) { ... }
>
> into
>
>   try { ... }
>   catch (.catch) {
>     let x = .catch.x;
>     let y = .catch.y;
>     ...
>   }
>
> using the PatternRewriter's normal facilities. This has the side benefit
> of throwing the appropriate variable conflict errors for declarations
> made inside the catch block.
>
> No change is made to non-destructured cases, which will hopefully save
> us some work if https://github.com/tc39/ecma262/issues/150 is adopted
> in the spec.
>
> There's one big problem with this patch, which is a lack of PreParser
> support for the redeclaration errors. But it seems we're already lacking
> good PreParser support for such errors, so I'm not sure that should
> block this moving forward.
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
> Cr-Commit-Position: refs/heads/master@{#31797}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1408063013

Cr-Commit-Position: refs/heads/master@{#31798}
2015-11-04 16:39:59 +00:00
adamk
a316db995e [es6] Implement destructuring binding in try/catch
The approach is to desugar

  try { ... }
  catch ({x, y}) { ... }

into

  try { ... }
  catch (.catch) {
    let x = .catch.x;
    let y = .catch.y;
    ...
  }

using the PatternRewriter's normal facilities. This has the side benefit
of throwing the appropriate variable conflict errors for declarations
made inside the catch block.

No change is made to non-destructured cases, which will hopefully save
us some work if https://github.com/tc39/ecma262/issues/150 is adopted
in the spec.

There's one big problem with this patch, which is a lack of PreParser
support for the redeclaration errors. But it seems we're already lacking
good PreParser support for such errors, so I'm not sure that should
block this moving forward.

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1417483014

Cr-Commit-Position: refs/heads/master@{#31797}
2015-11-04 16:06:38 +00:00
cbruni
ab84025977 [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31790}
2015-11-04 14:30:09 +00:00
cbruni
f1bb688e80 Revert of [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor. (patchset #20 id:370001 of https://codereview.chromium.org/1418623007/ )
Reason for revert:
failing build bot

Original issue's description:
> [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
>
> The current implementation of classes throws the TypeError at the wrong
> point, after activating a new context when directly calling a class
> constructor. According to the spec, the TypeError has to be thrown
> in the caller context.
>
> LOG=N
> BUG=v8:4428
>
> Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
> Cr-Commit-Position: refs/heads/master@{#31786}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4428

Review URL: https://codereview.chromium.org/1415783006

Cr-Commit-Position: refs/heads/master@{#31787}
2015-11-04 13:56:44 +00:00
cbruni
6a06bc0a77 [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31786}
2015-11-04 13:24:09 +00:00
mstarzinger
f89286f5a2 [turbofan] Re-enable mjsunit tests that no longer fail.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1405963011

Cr-Commit-Position: refs/heads/master@{#31784}
2015-11-04 13:00:59 +00:00
yangguo
85494e90bb Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31782}
2015-11-04 12:28:48 +00:00
yangguo
5ee1a75c6d Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
Performance issue.

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1409013006

Cr-Commit-Position: refs/heads/master@{#31780}
2015-11-04 10:58:24 +00:00
mstarzinger
124efdd3e8 Remove obsolete 'arguments' local variable handling.
This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}
2015-11-04 10:36:07 +00:00
jkummerow
41775a3e73 Fix HasProperty/HasElement for Proxies on the prototype chain
Review URL: https://codereview.chromium.org/1414403003

Cr-Commit-Position: refs/heads/master@{#31775}
2015-11-04 10:17:43 +00:00
yangguo
b5c80a31ad Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31773}
2015-11-04 09:11:19 +00:00
ishell
059478165c [es6] Fix Object built-in subclassing.
BUG=v8:3886
LOG=Y

Review URL: https://codereview.chromium.org/1422853004

Cr-Commit-Position: refs/heads/master@{#31760}
2015-11-03 18:20:44 +00:00
ishell
208744bc10 [es6] Fix WeakMap/Set built-ins subclasssing.
BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1424283002

Cr-Commit-Position: refs/heads/master@{#31759}
2015-11-03 18:00:12 +00:00
machenbach
16e25179ec Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
[Sheriff] Changes layout tests. Please rebase upstream first. E.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2686

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1427733005

Cr-Commit-Position: refs/heads/master@{#31758}
2015-11-03 17:28:13 +00:00
ishell
babe50f083 Reland "[es6] Fix Function and GeneratorFunction built-ins subclassing."
Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

The problem was in another CL, this is a clean reland with improved tests.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1415683007

Cr-Commit-Position: refs/heads/master@{#31756}
2015-11-03 16:42:43 +00:00
ishell
0ac0e52847 [turbofan] Fix new.target when a function is inlined to a constructor.
Review URL: https://codereview.chromium.org/1432493003

Cr-Commit-Position: refs/heads/master@{#31754}
2015-11-03 16:20:28 +00:00
yangguo
60e8877e16 Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31753}
2015-11-03 16:17:03 +00:00
neis
b5d0e31582 Fix another corner-case behavior of Object::SetSuperProperty.
If the property is a data property on the holder (or does not exist) and is a readonly data property in the receiver, then we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1424233005

Cr-Commit-Position: refs/heads/master@{#31751}
2015-11-03 14:53:09 +00:00
jkummerow
b4d46bc5a0 Fix accessor map transitions vs. Object.defineProperty
BUG=v8:4534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413723011

Cr-Commit-Position: refs/heads/master@{#31750}
2015-11-03 14:41:53 +00:00
ishell
678a5583d6 [es6] Fix RegExp built-in subclassing.
1) The Map::CopyInitialMap() did not set descriptor's array if
the source initial map had one.
2) Subclasses are temporarily disallowed to have more in-object
properties than the parent class (for GC reasons).

BUG=v8:3101, v8:3330, v8:4531
LOG=N

Review URL: https://codereview.chromium.org/1431593003

Cr-Commit-Position: refs/heads/master@{#31743}
2015-11-03 12:16:15 +00:00
bmeurer
eee597209b [turbofan] We can inline property access for all primitives.
TurboFan is actually able to generate property access to all prototypes
of all primitives, except the special Oddball primitives that have no
wrapper counterparts (namely null and undefined from the ES6 point of
view).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1409163007

Cr-Commit-Position: refs/heads/master@{#31739}
2015-11-03 10:44:57 +00:00
yangguo
e9a8d6ef09 Skip mjsunit/accessor-map-sharing on GC stress.
R=machenbach@chromium.org
BUG=v8:4534
LOG=N

Review URL: https://codereview.chromium.org/1426453005

Cr-Commit-Position: refs/heads/master@{#31737}
2015-11-03 10:06:46 +00:00
yangguo
2200c3898a Skip mjsunit/debug-references in gc-stress.
R=machenbach@chromium.org
BUG=v8:3079
LOG=N

Review URL: https://codereview.chromium.org/1406293010

Cr-Commit-Position: refs/heads/master@{#31734}
2015-11-03 08:20:48 +00:00
neis
8c1377a5b4 Fix corner-case behavior of Object::SetSuperProperty.
When the property is an accessor property in the receiver but not on the
holder (ES6 "target"), we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1427113002

Cr-Commit-Position: refs/heads/master@{#31733}
2015-11-03 08:04:32 +00:00
yangguo
538197dada RegExp.prototype is an ordinary object.
R=littledan@chromium.org
BUG=v8:4003
LOG=N

Review URL: https://codereview.chromium.org/1423993006

Cr-Commit-Position: refs/heads/master@{#31730}
2015-11-03 06:18:44 +00:00
ishell
2210cc84de Revert of [es6] Fix Function and GeneratorFunction built-ins subclassing. (patchset #4 id:80001 of https://codereview.chromium.org/1428823002/ )
Reason for revert:
Buildbot failures

Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1413723008

Cr-Commit-Position: refs/heads/master@{#31709}
2015-11-02 11:59:14 +00:00
ishell
99e7f872d3 [es6] Fix Function and GeneratorFunction built-ins subclassing.
BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1428823002

Cr-Commit-Position: refs/heads/master@{#31708}
2015-11-02 11:45:51 +00:00
ishell
4490ce8520 Reland "[es6] Better support for built-ins subclassing."
Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype
> transition on the base constructor's initial map. This approach fixes in-object slack tracking
> for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

It also fixes typed array map smashing done during typed array initialization.

BUG=v8:3101, v8:3330, v8:4419
LOG=Y

Review URL: https://codereview.chromium.org/1413033006

Cr-Commit-Position: refs/heads/master@{#31701}
2015-11-02 08:25:43 +00:00
baptiste.afsa
ec61253786 Enable ARMv8 32-bit build.
R=danno@chromium.org

Review URL: https://codereview.chromium.org/1427003006

Cr-Commit-Position: refs/heads/master@{#31690}
2015-10-30 14:10:55 +00:00
neis
5820adf276 [es6] Partially implement Reflect.set.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1415883007

Cr-Commit-Position: refs/heads/master@{#31685}
2015-10-30 11:48:43 +00:00
bmeurer
08ca3f240c Revert of [es6] Better support for built-ins subclassing. (patchset #8 id:200001 of https://codereview.chromium.org/1427483002/ )
Reason for revert:
Breaks test on win32 nosnap.http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/9680

Original issue's description:
> [es6] Better support for built-ins subclassing.
>
> Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
> This CL also fixes subclassing from String.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/cd5f48302a502154a0106d12e3066bd563c6340c
> Cr-Commit-Position: refs/heads/master@{#31680}

TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1416943005

Cr-Commit-Position: refs/heads/master@{#31684}
2015-10-30 11:36:35 +00:00
ishell
cd5f48302a [es6] Better support for built-ins subclassing.
Create proper initial map for original constructor (new.target) instead of doing prototype transition on the base constructor's initial map. This approach fixes in-object slack tracking for subclass instances.
This CL also fixes subclassing from String.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1427483002

Cr-Commit-Position: refs/heads/master@{#31680}
2015-10-30 10:58:29 +00:00
machenbach
8a2618a986 Revert of Remove RegExp.multiline accessors. (patchset #3 id:40001 of https://codereview.chromium.org/1410993008/ )
Reason for revert:
[Sheriff] Causes layout test failures.

Original issue's description:
> Remove RegExp.multiline accessors.
>
> This is non-standard and not even documented on MDN.
>
> On Firefox, setting RegExp.multiline to true adds the multiline flag to all
> newly created RegExp objects (both from constructor and from literal).
>
> In V8 this has no effect.
>
> Source archaelogy shows that this is from the initial commit.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/e8f752ce0c2a488e88cd87fe75f3907b4303d0a0
> Cr-Commit-Position: refs/heads/master@{#31673}

TBR=bmeurer@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1431433004

Cr-Commit-Position: refs/heads/master@{#31679}
2015-10-30 10:47:17 +00:00
jkummerow
70a2f537f6 Fix cached EnumLength retrieval in JSObject::NumberOfOwnProperties
BUG=chromium:549162
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1424293002

Cr-Commit-Position: refs/heads/master@{#31677}
2015-10-30 10:35:43 +00:00
neis
98dfe024ca [es6] Partially implement Reflect.getOwnPropertyDescriptor.
Proxies are not properly supported yet.

R=rossberg, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1408163005

Cr-Commit-Position: refs/heads/master@{#31674}
2015-10-30 10:05:03 +00:00
yangguo
e8f752ce0c Remove RegExp.multiline accessors.
This is non-standard and not even documented on MDN.

On Firefox, setting RegExp.multiline to true adds the multiline flag to all
newly created RegExp objects (both from constructor and from literal).

In V8 this has no effect.

Source archaelogy shows that this is from the initial commit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410993008

Cr-Commit-Position: refs/heads/master@{#31673}
2015-10-30 09:46:21 +00:00
yangguo
798ce4e463 Debugger: correctly break in default constructor.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1423673003

Cr-Commit-Position: refs/heads/master@{#31665}
2015-10-29 17:22:50 +00:00
mstarzinger
26f90c95cc [turbofan] Fix super property calls to act as method calls.
This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}
2015-10-29 17:19:39 +00:00
neis
8e35d8ebec [es6] Partially implement Reflect.defineProperty.
Proxies are not properly supported yet.

R=rossberg,jkummerow@chromium.org
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1421033002

Cr-Commit-Position: refs/heads/master@{#31661}
2015-10-29 15:39:49 +00:00
adamk
0bdaa4d877 Fix eval calls in initializers of arrow function parameters
This requires copying usage flags from the outer scope to the
arrow scope upon encountering the arrow token.

In order to properly pass-on the calls_eval bit, now record
that bit on script scopes just like everywhere else, and add
necessary code to scopes.cc to handle that change in behavior.

Also factored out scope flag propagation to its own method to
make the call site simple (though note that only the eval
bit makes any difference for arrows).

BUG=v8:4395
LOG=n

Review URL: https://codereview.chromium.org/1423613002

Cr-Commit-Position: refs/heads/master@{#31660}
2015-10-29 15:16:40 +00:00
adamk
4c3c89c1de Properly handle direct evals referencing super in arrow functions
The fix is to broaden the set of cases for when NeedsHomeObject()
returns true. Note that this is broader than it needs to be (since,
e.g., non-arrow function scopes inside a method can't reference
super). But we don't track the types of inner scopes at the moment,
so this is the best we can do.

R=rossberg@chromium.org
BUG=v8:4522
LOG=n

Review URL: https://codereview.chromium.org/1411093008

Cr-Commit-Position: refs/heads/master@{#31659}
2015-10-29 15:09:51 +00:00
mstarzinger
d3c4adfd78 [turbofan] Fix and rework deopt in call to super property.
This refactors the handling of calls of type Call::PROPERTY_CALL to
super properties in AstGraphBuilder::VisitCall. It ensures that the
operand stack is kept in sync with full-codegen so that deopts while
evaluating sub-expressions behave as expected.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4521
BUG=v8:4521
LOG=n

Review URL: https://codereview.chromium.org/1426893003

Cr-Commit-Position: refs/heads/master@{#31652}
2015-10-29 12:32:49 +00:00
adamk
720c531a70 Remove --harmony-new-target flag
It was shipped in M46 without incident.

Review URL: https://codereview.chromium.org/1411723007

Cr-Commit-Position: refs/heads/master@{#31636}
2015-10-28 16:47:08 +00:00
adamk
a4689fc21f Remove flags for spread calls and arrays
These features shipped in M46 without issue.

Review URL: https://codereview.chromium.org/1429653006

Cr-Commit-Position: refs/heads/master@{#31635}
2015-10-28 15:57:27 +00:00
yangguo
200315cb26 Make AstRawString deduplication encoding-agnostic.
R=jkummerow@chromium.org
BUG=v8:4450
LOG=N

Review URL: https://codereview.chromium.org/1411103006

Cr-Commit-Position: refs/heads/master@{#31624}
2015-10-28 11:28:55 +00:00
littledan
b436635ac4 Update to ES2015 == semantics for Symbol/SIMD wrappers
When == is invoked on a Symbol or SIMD vector and an object, the object should
be converted to a primitive with ToPrimitive and then compared again. This means,
for example, that for a Symbol or SIMD vector s, s == Object(s). This patch makes
that change in the implementation of ==. Only the runtime function needed to be
changed, as the code stubs and compiler specializations don't operate on Symbols
or SIMD vectors, and on these types, a fallback to the runtime function is always
used.

BUG=v8:3593
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1421413002

Cr-Commit-Position: refs/heads/master@{#31614}
2015-10-27 20:20:24 +00:00
mstarzinger
f8465b45f7 [turbofan] Fix OSR-ed callee trigged ty do-expressions.
This fixes a missing SSA-renaming of the callee value used in the frame
state of a call node. An OSR-entry within do-expressions contained in
one of the argument expression can trigger that renaming.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-crbug-546968
BUG=chromium:546968
LOG=n

Review URL: https://codereview.chromium.org/1430483002

Cr-Commit-Position: refs/heads/master@{#31613}
2015-10-27 17:21:10 +00:00
littledan
8adb1c4705 Reland of Check that array length stays a safe integer in Array.prototype.push (patchset #1 id:1 of https://codereview.chromium.org/1418093007/ )
Reason for revert:
The test failure was unrelated; relanding.

Original issue's description:
> Revert of Check that array length stays a safe integer in Array.prototype.push (patchset #7 id:120001 of https://codereview.chromium.org/1428483002/ )
>
> Reason for revert:
> Caused for-in-opt test to fail
>
> Original issue's description:
> > Check that array length stays a safe integer in Array.prototype.push
> >
> > This patch adds a check in Array.prototype.push to assert that the new
> > length does not become greater than 2**53-1. Such a length would be
> > dangerous because integer arithmetic becomes imprecise after the
> > boundary. The check is also required by a test262 test.
> >
> > R=adamk
> > LOG=Y
> > BUG=v8:3087
> >
> > Committed: https://crrev.com/e68adf4548dd101dc08fcbff14444152fb1b7fe7
> > Cr-Commit-Position: refs/heads/master@{#31588}
>
> TBR=adamk@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3087
>
> Committed: https://crrev.com/78abedb94431a233842fcb2f7a910805a05bed09
> Cr-Commit-Position: refs/heads/master@{#31590}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3087

Review URL: https://codereview.chromium.org/1424823005

Cr-Commit-Position: refs/heads/master@{#31610}
2015-10-27 16:30:45 +00:00
bmeurer
7709e41aec [turbofan] Try hard(er) to use smi representation for float64 values.
Previously ChangeLowering would always box float64 values when going to
tagged representation, but that introduces a lot of deoptimizer loops
and polymorphism into TurboFan, which is unfortunate and unnecessary.

This adds some logic to ChangeFloat64ToTagged to try harder to create a
Smi when going from Float64 to Tagged, instead of always allocating a
HeapNumber.  This might need some additional tweaking, but at least it
makes it possible to start comparing TurboFan and Crankshaft for some
regular JavaScript.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420913003

Cr-Commit-Position: refs/heads/master@{#31609}
2015-10-27 16:18:15 +00:00
jkummerow
cabeb7db3a Fix deoptimization at ForInStatement::BodyId()
Full-codegen prepared for the bailout in the wrong place, causing side
effects to be replayed when they shouldn't. Crankshaft and Turbofan are
in agreement about where the deopt should jump to.

TEST=mjsunit/for-in-opt
R=jarin@chromium.org
BUG=v8:4381
LOG=y

Review URL: https://codereview.chromium.org/1413923005

Cr-Commit-Position: refs/heads/master@{#31607}
2015-10-27 15:17:24 +00:00
mstarzinger
37f5e23b5c [turbofan] Fix receiver binding for inlined callees.
This introduces a JSConvertReceiver operator to model the implicit
conversion of receiver values for sloppy callees. It is used by the
JSInliner for now, but can also be used to model direction function
calls that bypass call stubs.

Also note that a hint is passed to said operator whenever the source
structure constrains the receiver value type. This hint allows for
optimizations in the lowering of the operator.

The underlying specification in ES6, section 9.2.1.2 is the basis for
this implementation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/receiver-conversion
BUG=v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1412223015

Cr-Commit-Position: refs/heads/master@{#31598}
2015-10-27 12:13:49 +00:00
neis
1e6cb603e5 Prettyprint symbols in mjsunit tests.
R=jochen
BUG=

Review URL: https://codereview.chromium.org/1424793004

Cr-Commit-Position: refs/heads/master@{#31595}
2015-10-27 10:23:51 +00:00
yangguo
85e085b770 RegExp: remove last match info override.
With ES6 21.2.5.8, step 13, we no longer have to keep up the illusion
that matching and calling replace function is interleaved. This is
observable through unspec'ed static properties such as RegExp.$1.

Last match info not working yet.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1418703003

Cr-Commit-Position: refs/heads/master@{#31593}
2015-10-27 08:24:08 +00:00
littledan
78abedb944 Revert of Check that array length stays a safe integer in Array.prototype.push (patchset #7 id:120001 of https://codereview.chromium.org/1428483002/ )
Reason for revert:
Caused for-in-opt test to fail

Original issue's description:
> Check that array length stays a safe integer in Array.prototype.push
>
> This patch adds a check in Array.prototype.push to assert that the new
> length does not become greater than 2**53-1. Such a length would be
> dangerous because integer arithmetic becomes imprecise after the
> boundary. The check is also required by a test262 test.
>
> R=adamk
> LOG=Y
> BUG=v8:3087
>
> Committed: https://crrev.com/e68adf4548dd101dc08fcbff14444152fb1b7fe7
> Cr-Commit-Position: refs/heads/master@{#31588}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3087

Review URL: https://codereview.chromium.org/1418093007

Cr-Commit-Position: refs/heads/master@{#31590}
2015-10-27 05:46:23 +00:00
littledan
e68adf4548 Check that array length stays a safe integer in Array.prototype.push
This patch adds a check in Array.prototype.push to assert that the new
length does not become greater than 2**53-1. Such a length would be
dangerous because integer arithmetic becomes imprecise after the
boundary. The check is also required by a test262 test.

R=adamk
LOG=Y
BUG=v8:3087

Review URL: https://codereview.chromium.org/1428483002

Cr-Commit-Position: refs/heads/master@{#31588}
2015-10-27 04:39:25 +00:00
mstarzinger
e45b90bbe5 [turbofan] Re-enable mjsunit/tools/profviz test for GC stress.
R=bmeurer@chromium.org
TEST=mjsunit/tools/profviz
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419333003

Cr-Commit-Position: refs/heads/master@{#31572}
2015-10-26 15:01:27 +00:00
verwaest
34143f09d2 Revert of Ignore test failure for mjsunit/for-in-opt in gc stress. (patchset #1 id:1 of https://codereview.chromium.org/1295513004/ )
Reason for revert:
This test should work.

Original issue's description:
> Ignore test failure for mjsunit/for-in-opt in gc stress.
>
> TBR=hablich@chromium.org
> BUG=v8:4381
>
> Committed: https://crrev.com/22cf0b591968b7b305094d386d6b10e6c0e723cc
> Cr-Commit-Position: refs/heads/master@{#30245}

TBR=hablich@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4381
LOG=n

Review URL: https://codereview.chromium.org/1419823009

Cr-Commit-Position: refs/heads/master@{#31559}
2015-10-26 12:15:46 +00:00
mstarzinger
e121aabe39 [turbofan] Fix representation type for JSArray::length.
This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410393006

Cr-Commit-Position: refs/heads/master@{#31558}
2015-10-26 12:04:16 +00:00
verwaest
b694266bb1 Fix Object.preventExtensions, .seal, .freeze on typed arrays
BUG=v8:4460
LOG=n

Review URL: https://codereview.chromium.org/1419823008

Cr-Commit-Position: refs/heads/master@{#31556}
2015-10-26 11:08:02 +00:00
chunyang.dai
a02d0e96b8 Reland: X87: disable the regress-undefined-nan test case for x87.
The reason is when native_context_specialization flag is ture, X87 turbofan
      will hit the known issue that X87 will change a sNaN to qNaN by default. And
      then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

   reland https://codereview.chromium.org/1414733004/.

BUG=

Review URL: https://codereview.chromium.org/1419573007

Cr-Commit-Position: refs/heads/master@{#31552}
2015-10-26 10:27:48 +00:00
chunyang.dai
e8ff5181d3 Revert of X87: disable the regress-undefined-nan test case for x87. (patchset #1 id:1 of https://codereview.chromium.org/1414733004/ )
Reason for revert:
because of merge mistake, "regress/" is missed when skipping one test case for X87.

 "regress/" will be added when relanding it.

Original issue's description:
> X87: disable the regress-undefined-nan test case for x87.
>
>   The reason is when native_context_specialization flag is ture, X87 turbofan
>   will hit the known issue that X87 will change a sNaN to qNaN by default. And
>   then it will fail when bit-comparing the source (sNaN) and the result (qNaN).
>
> BUG=
>
> Committed: https://crrev.com/b3c719ebbad6c87afefa33a7d0b3f412b2e304db
> Cr-Commit-Position: refs/heads/master@{#31530}

TBR=bmeurer@chromium.org,weiliang.lin@intel.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1417303005

Cr-Commit-Position: refs/heads/master@{#31543}
2015-10-26 04:42:36 +00:00
caitpotter88
b078960e70 [es7] bailout Crankshaft in VisitDoExpression
For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}
2015-10-24 07:06:59 +00:00
chunyang.dai
b3c719ebba X87: disable the regress-undefined-nan test case for x87.
The reason is when native_context_specialization flag is ture, X87 turbofan
  will hit the known issue that X87 will change a sNaN to qNaN by default. And
  then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

BUG=

Review URL: https://codereview.chromium.org/1414733004

Cr-Commit-Position: refs/heads/master@{#31530}
2015-10-23 15:48:35 +00:00
neis
193410062e Fix corner-case behavior of JSObject::SetPrototype.
Setting the prototype to whatever it currently is must succeed even if
the object is not extensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1423603002

Cr-Commit-Position: refs/heads/master@{#31527}
2015-10-23 14:52:26 +00:00
bmeurer
2ab54f109e [turbofan] Add test case for stores to properties that are also present on prototype.
R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1407233006

Cr-Commit-Position: refs/heads/master@{#31517}
2015-10-23 12:09:54 +00:00
neis
8e89e8203b Adapt tests in preparation of shipping --harmony-completion.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1415283003

Cr-Commit-Position: refs/heads/master@{#31507}
2015-10-23 10:26:01 +00:00
mvstanton
e6626cfc67 Alternative approach to using type feedback for Symbol-keyed properties
This patch only treats non-private symbols as valid feedback, thus
avoiding the need to switch to Oddballs for the feedback sentinels
and avoiding breaking the use of private own symbols.

Crankshaft will also optimize these symbol loads into a named load,
just as it does for string keyed loads with type feedback.

BUG=

Review URL: https://codereview.chromium.org/1415333003

Cr-Commit-Position: refs/heads/master@{#31496}
2015-10-23 08:18:02 +00:00
mvstanton
21724d6799 Re-enable accessor-map-sharing test
It doesn't fail on tip of tree, we'll investigate if it recurs.

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=N

Review URL: https://codereview.chromium.org/1416453004

Cr-Commit-Position: refs/heads/master@{#31489}
2015-10-23 06:14:36 +00:00
verwaest
f464f12a8b Ensure we never inline class constructors in Crankshaft, as it currently is entirely unsupported.
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1415723005

Cr-Commit-Position: refs/heads/master@{#31480}
2015-10-22 14:39:07 +00:00
jkummerow
fdfab67243 [Crankshaft] Don't do HMathFloorOfDiv optimization for kUint32 values
BUG=v8:4507
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1409353005

Cr-Commit-Position: refs/heads/master@{#31474}
2015-10-22 13:22:09 +00:00
neis
2c7787ad84 [es6] Partially implement Reflect.setPrototypeOf.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1417243002

Cr-Commit-Position: refs/heads/master@{#31465}
2015-10-22 11:21:43 +00:00
bmeurer
b7985aaeb7 [test] Re-enable mjsunit/constant-folding-2 test that no longer fails.
R=jarin@chromium.org
BUG=v8:4506
LOG=n

Review URL: https://codereview.chromium.org/1413503006

Cr-Commit-Position: refs/heads/master@{#31455}
2015-10-22 08:46:11 +00:00
neis
2803a3d302 [es6] Partially implement Reflect.getPrototypeOf.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1416433003

Cr-Commit-Position: refs/heads/master@{#31447}
2015-10-21 15:45:24 +00:00
jarin
14ba9c3dea Introduce a reference to the code object of inlined functions in CompilationInfo.
The newly introduced root makes sure that we do not flush the
optimized code while the function is being compiled.

BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1415133002

Cr-Commit-Position: refs/heads/master@{#31444}
2015-10-21 15:05:32 +00:00
adamk
7f1504f51e [es6] Handle super properly when rewriting arrow parameter initializers
R=rossberg@chromium.org
BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1414733005

Cr-Commit-Position: refs/heads/master@{#31440}
2015-10-21 13:16:07 +00:00
mstarzinger
d9a5add017 [turbofan] Fix liveness analysis for let variable in TDZ.
This makes sure that initializing assignments of let-declared variables
perform an environment lookup and hence keep the variable alive. This is
needed because full-codegen contains debug code verifying the variable
is still inside the TDZ at the initializing assignment.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-variable-liveness-let
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1420573002

Cr-Commit-Position: refs/heads/master@{#31437}
2015-10-21 12:23:06 +00:00
adamk
02e4d21f4c [es6] Fix scoping for default parameters in arrow functions
When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

This is a revert of the revert https://crrev.com/e41614a058426fb6102e4ab2dd4f98997f00c0fc
with a much-improved (though not yet perfect) Scope::ResetOuterScope
method which properly fixes not only the outer_scope_ pointer but also
fixes the inner_scope_ list in the relevant outer_scopes.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1414283002

Cr-Commit-Position: refs/heads/master@{#31435}
2015-10-21 12:04:20 +00:00
neis
79634a3ffe [es6] Partially implement Reflect.preventExtensions.
Ignore proxies for now.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397853005

Cr-Commit-Position: refs/heads/master@{#31431}
2015-10-21 09:23:47 +00:00
caitpotter88
b6596aa73b [es7] implement |do| expressions proposal
Adds an implementation of "do expression" parsing (https://webcache.googleusercontent.com/search?q=cache:MIGALjqPDNgJ:wiki.ecmascript.org/doku.php%3Fid%3Dstrawman:do_expressions+&cd=1&hl=en&ct=clnk&gl=us).

This feature provides a way to evaluate a block of statements within an expression context, producing the resulting completion value. This is very helpful for implementing certain language features via desugaring.

BUG=v8:4488
LOG=N
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1399893002

Cr-Commit-Position: refs/heads/master@{#31428}
2015-10-21 02:58:32 +00:00
machenbach
7e5d330917 [test] Disable two more failing tests.
TBR=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413223007

Cr-Commit-Position: refs/heads/master@{#31425}
2015-10-20 19:59:17 +00:00
mstarzinger
2607e2b06b [turbofan] Disable two more failing tests.
R=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412573005

Cr-Commit-Position: refs/heads/master@{#31423}
2015-10-20 16:52:36 +00:00
bmeurer
d168a1e844 [turbofan] We cannot unconditionally flatten cons strings in the JSGraph.
It is not always safe to allocate new heap objects in the JSGraph. We
might have to revisit this later once we do the canonicalization for
HeapConstants.

R=jarin@chromium.org
BUG=chromium:545364
LOG=n

Review URL: https://codereview.chromium.org/1413373002

Cr-Commit-Position: refs/heads/master@{#31421}
2015-10-20 15:48:07 +00:00
bmeurer
2abd768e87 [turbofan] Respect effect input when lowering JSToBoolean for string inputs.
This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}
2015-10-20 15:24:26 +00:00
mvstanton
aeffa39e1d Mjsunit/debug-script test fails intermittendly with --vector-stores
The problem is that the gc pattern is different, and the list of debug scripts
may have more or less duplicates than before. The solution is to just turn off
--stress-opt for the test.

R=yangguo@chromium.org
BUG=v8:4502
LOG=N

Review URL: https://codereview.chromium.org/1416883002

Cr-Commit-Position: refs/heads/master@{#31415}
2015-10-20 14:57:23 +00:00
mstarzinger
a64d387ad2 [turbofan] Disable failing mjsunit/harmony/reflect test.
R=bmeurer@chromium.org
TEST=mjsunit/harmony/reflect --exhaustive-variants
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414263002

Cr-Commit-Position: refs/heads/master@{#31412}
2015-10-20 14:16:53 +00:00
karl
b00371b423 Reland: Use simple/fast inline function version of MinMax in JS
Use the simple inline function version of {Min, Max} where possible to
improve performance

Now uses an forced inline js function instead of a python macro
to avoid expressions be evaluated twice

Follow-up to CR: https://codereview.chromium.org/1331993004

Review URL: https://codereview.chromium.org/1410473002

Cr-Commit-Position: refs/heads/master@{#31411}
2015-10-20 13:43:53 +00:00
bmeurer
58befc9b81 [test] Differentiate between exhaustive and default testing variants.
Review URL: https://codereview.chromium.org/1402353006

Cr-Commit-Position: refs/heads/master@{#31409}
2015-10-20 13:16:51 +00:00
bmeurer
d5847622f9 [turbofan] Stage --turbo-inlining behind --turbo flag.
This stages the general purpose inlining mechanism in TurboFan and
also disables the remaining tests that still fail. We do this to get
test coverage early and to avoid regressing inlining as we go along.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419623002

Cr-Commit-Position: refs/heads/master@{#31406}
2015-10-20 10:57:02 +00:00
bmeurer
e41614a058 Revert of [es6] Fix scoping for default parameters in arrow functions (patchset #5 id:80001 of https://codereview.chromium.org/1405313002/ )
Reason for revert:
Breaks nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2407/steps/Check/logs/regress-4395

Original issue's description:
> [es6] Fix scoping for default parameters in arrow functions
>
> When eagerly parsing arrow functions, expressions in default
> parameter initializers are parsed in the enclosing scope,
> rather than in the function's scope (since that scope does not
> yet exist). This leads to VariableProxies being added to the
> wrong scope, and scope chains for FunctionLiterals being incorrect.
>
> This patch addresses these problems by adding a subclass of
> AstExpressionVisitor that moves VariableProxies to the proper
> scope and fixes up scope chains of FunctionLiterals.
>
> More work likely still needs to be done to make this work completely,
> but it's very close to correct.
>
> BUG=v8:4395
> LOG=y
>
> Committed: https://crrev.com/cf72aad39e51de9b7074ea039377c1812f4a2c6b
> Cr-Commit-Position: refs/heads/master@{#31402}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4395

Review URL: https://codereview.chromium.org/1417463004

Cr-Commit-Position: refs/heads/master@{#31404}
2015-10-20 10:36:38 +00:00
littledan
c227dd5734 Refactor array construction for map, filter
This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}
2015-10-20 09:57:08 +00:00
adamk
cf72aad39e [es6] Fix scoping for default parameters in arrow functions
When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1405313002

Cr-Commit-Position: refs/heads/master@{#31402}
2015-10-20 09:15:38 +00:00
Benedikt Meurer
063e2316d7 Revert "[turbofan] Stage --turbo-inlining behind --turbo flag." and "[turbofan] Skip more tests that fail with --turbo-inlining."
This reverts commit 019f9408dc,
6ed05f44af and
e34c343d2a.

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1413183004 .

Cr-Commit-Position: refs/heads/master@{#31393}
2015-10-20 06:23:02 +00:00
yangguo
8be20eee3b Debugger: correctly report uncaught rejections in Promise.all and Promise.race.
The debugger calls PromiseHasUserDefinedRejectHandler to recursively search the
tree of dependent promises for user-defined reject handlers. If no such reject
handler exists, rejecting the promise is considered an uncaught exception.

Promise.race and Promise.all interupt the link of promise dependency wrt the
search. This change fixes that link.

R=rossberg@chromium.org
BUG=chromium:439585
LOG=N

Review URL: https://codereview.chromium.org/1411083003

Cr-Commit-Position: refs/heads/master@{#31392}
2015-10-20 05:40:08 +00:00
Benedikt Meurer
019f9408dc [turbofan] Skip more tests that fail with --turbo-inlining.
TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414173002 .

Cr-Commit-Position: refs/heads/master@{#31389}
2015-10-20 04:44:46 +00:00
mstarzinger
e34c343d2a [turbofan] Stage --turbo-inlining behind --turbo flag.
This stages the general purpose inlining mechanism in TurboFan and also
disables the remaining tests that still fail. We do this to get test
coverage early and to avoid regressing inlining as we go along.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412703002

Cr-Commit-Position: refs/heads/master@{#31386}
2015-10-20 03:54:12 +00:00
hablich
fb8a97eed9 Switch on unit test regarding -Infinity and TypedArrays
Should already work according to issue.

BUG=chromium:424619
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1413913002

Cr-Commit-Position: refs/heads/master@{#31379}
2015-10-19 14:26:38 +00:00
cbruni
df8970a8c7 [runtime] Fancify KeyAccumulator
Separately collect element keys from property keys to avoid slow
corner-cases. Partly deal with keys generated by Proxies.

BUG=chromium:536790
LOG=N

Review URL: https://codereview.chromium.org/1397063002

Cr-Commit-Position: refs/heads/master@{#31378}
2015-10-19 13:47:43 +00:00
mstarzinger
1696275642 [debugger] Add test for Debug.scripts without listener.
This adds a test case that ensures calling Debug.scripts without any
listener attached fails gracefully. For now we are throwing the string
"illegal access", this might change in the future to be a dedicated
exception.

R=yangguo@chromium.org
TEST=mjsunit/debug-scripts-throw

Review URL: https://codereview.chromium.org/1411193002

Cr-Commit-Position: refs/heads/master@{#31377}
2015-10-19 13:34:41 +00:00
mvstanton
2f2302f08b VectorICs: Bugfix in KeyedStore dispatcher.
The dispatcher failed to MISS properly when configured as a monomorphic
keyed string store, causing a crash.

BUG=v8:4495
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1415533003

Cr-Commit-Position: refs/heads/master@{#31362}
2015-10-19 09:51:46 +00:00
bmeurer
e678a0f9a9 [runtime] Implement %_ToLength via ToLengthStub.
Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
that supports a fast path for small integers. Everything else is still
handled in the runtime.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412963002

Cr-Commit-Position: refs/heads/master@{#31358}
2015-10-19 08:35:18 +00:00
jarin
f9a9c6be0e [turbofan] Introduce lazy bailout, masked as a call.
This introduces an explicit lazy bailout. It is wrapped in the call
node, mostly because the lazy deoptimization processing is married
to the call processing in the instruction selector and the code generator.

It is still a terrible hack.

R=bmeurer@chromium.org,mstarzinger@chromium.org
BUG=chromium:543994,v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1412443003

Cr-Commit-Position: refs/heads/master@{#31353}
2015-10-19 06:21:26 +00:00
bmeurer
e1088b27b5 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31352}
2015-10-19 05:24:51 +00:00
jarin
5c53481233 Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset #3 id:100001 of https://codereview.chromium.org/1396333010/ )
Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}
2015-10-16 14:56:25 +00:00
bmeurer
3a0bf860b7 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}
2015-10-16 14:09:17 +00:00
yangguo
47c9e1c904 Implement Math.tanh using fdlibm port.
Contributed by Raymond Toy: http://rtoy.github.io/fdlibm-js/

R=jkummerow@chromium.org
BUG=v8:3495
LOG=N

Review URL: https://codereview.chromium.org/1407213002

Cr-Commit-Position: refs/heads/master@{#31335}
2015-10-16 12:56:37 +00:00
yangguo
30715157fa Install iterator meta objects via utils object.
R=cbruni@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411653002

Cr-Commit-Position: refs/heads/master@{#31331}
2015-10-16 11:27:33 +00:00
yangguo
f2bfa12654 Do not coerce lastIndex of a global RegExp in @@match and @@replace.
R=rossberg@chromium.org
BUG=v8:4471
LOG=N

Review URL: https://codereview.chromium.org/1410753002

Cr-Commit-Position: refs/heads/master@{#31330}
2015-10-16 11:25:37 +00:00
machenbach
5831a243dc [test] Skip flaky test on windows.
BUG=v8:4495
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1410723002

Cr-Commit-Position: refs/heads/master@{#31324}
2015-10-16 07:11:14 +00:00
adamk
e5db1d58e5 Remove stale references to --harmony-arrays flag in mjsunit tests
Also move those tests from mjsunit/harmony to mjsunit/es6.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1403633007

Cr-Commit-Position: refs/heads/master@{#31314}
2015-10-15 17:39:42 +00:00
littledan
5c1ef6ac82 Make RegExp use ToLength on lastIndex when flag is turned on
In the ES2015 spec, RegExp uses ToLength, not ToInteger, on lastIndex
to coerce it to an integer. This patch switches to ToLength when
the --harmony-tolength flag is on, and adds some tests to verify the
new behavior.

BUG=v8:4244
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1394023005

Cr-Commit-Position: refs/heads/master@{#31306}
2015-10-15 14:10:48 +00:00
jkummerow
102e3e87e7 [arm64] Fix jssp based spill slot accesses in Crankshaft
Review URL: https://codereview.chromium.org/1401703003

Cr-Commit-Position: refs/heads/master@{#31304}
2015-10-15 13:34:15 +00:00
adamk
b646cb3e50 Take Symbol-keyed properties into account in Object.freeze and friends
R=rossberg@chromium.org
BUG=chromium:539875
LOG=y

Review URL: https://codereview.chromium.org/1393373005

Cr-Commit-Position: refs/heads/master@{#31303}
2015-10-15 13:32:57 +00:00
mstarzinger
2aba89e336 Remove bogus flags from call-counts.js test.
The runtime flag in question makes no sense, because the feature cannot
be disabled without keeping the snapshot in sync. We should avoid having
the flag in our "mjsunit" test suite, so that CluserFuzz doesn't pick it
up. The test in question is already skipped, the change will not affect
test results on our waterfall.

R=mvstanton@chromium.org
TEST=mjsunit/call-counts
BUG=v8:4458
LOG=n

Review URL: https://codereview.chromium.org/1409533003

Cr-Commit-Position: refs/heads/master@{#31302}
2015-10-15 13:31:57 +00:00
neis
2ed1eebe9f [es6] Implement Reflect.enumerate.
R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397443013

Cr-Commit-Position: refs/heads/master@{#31299}
2015-10-15 12:59:37 +00:00
yangguo
73c9be9b31 Debugger: allow stepping into resolver from Promise constructor.
R=rossberg@chromium.org
BUG=chromium:451967
LOG=N

Review URL: https://codereview.chromium.org/1404783002

Cr-Commit-Position: refs/heads/master@{#31296}
2015-10-15 12:27:40 +00:00
ulan
dd3f1ecf71 Revert of Make dates default to the local timezone if none specified (https://codereview.chromium.org/1229903004/)
Even though the change is ES6 spec compliant, we decided to revert
to be consistent with other browsers and work on fixing the spec.

Original issue's description:
> Make dates default to the local timezone if none specified
>
> In ES5, dates were supposed to default to UTC if no timezone was specified. However, this changed in ES6, which specified that dates should be in the local timezone if no timezone was specified. This CL updates our behavior to match that part of the ES6 spec.

> BUG=chromium:391730, v8:4242
> LOG=Y

> Committed: https://crrev.com/f06754a8e1d305a43560705f6c167d85d40e602d
> Cr-Commit-Position: refs/heads/master@{#29854}

BUG=chromium:543320,chromium:539813
LOG=NO

Review URL: https://codereview.chromium.org/1403153003

Cr-Commit-Position: refs/heads/master@{#31295}
2015-10-15 12:18:16 +00:00
mstarzinger
e6a923ab56 [turbofan] Fix various issues with --turbo-inlining enabled.
This is in preparation to enabling --turbo-inlining by default, fixing
various issues when general purpose inlining is running against our
entire test suite.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407533004

Cr-Commit-Position: refs/heads/master@{#31294}
2015-10-15 12:02:06 +00:00
mlippautz
5a3929ea4f Reland "Add bailout for large objects when allocating arrays in optimized code."
This reverts commit dc0adc5668.

NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1392853009

Cr-Commit-Position: refs/heads/master@{#31284}
2015-10-15 09:54:49 +00:00
franziska.hinkelmann
8ed0454332 Emit better error message about writable properties
Section 8.10.5 9a specifies that a property descriptor cannot both have
accessors and specify the writability of the property. The previous
error message was misleading because it referred to writable rather
than specifying the writability (which includes writable: false).

BUG=v8:2536
LOG=N

Review URL: https://codereview.chromium.org/1399693003

Cr-Commit-Position: refs/heads/master@{#31273}
2015-10-14 19:22:27 +00:00
littledan
ab3110e875 Add a lexical scope for the body of a with statement
For an edge case like the following in sloppy mode
  with ({}) function f() {}
a lexical scope needs to be created around the body in order
to hold the function declaration, so it can be hoisted according
to a loose interpretation of Annex B 3.3 (loose because ES2015
does not permit a function declaration as the body of a with
statement). This patch adds that scope.

BUG=chromium:542100
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1404803002

Cr-Commit-Position: refs/heads/master@{#31269}
2015-10-14 17:37:22 +00:00
littledan
d0618585a7 Fix scopes for body of sloppy-mode for-in/of loop
This patch fixes an obscure edge case for functions defined as the
direct body of a for-of/for-in loop, such as the following:

 for (foo in []) function foo() { return foo; }

Here, the first occurrence of foo should point to the outer scope;
however, before this patch, it pointed to the inner foo in an
invalid way which caused an assertion about the scope chain to fail.
This patch fixes the scope chain by inserting an extra scope for
the body of the loop, not including the header.

BUG=chromium:542099
LOG=N
R=rossberg

Review URL: https://codereview.chromium.org/1396663004

Cr-Commit-Position: refs/heads/master@{#31268}
2015-10-14 17:36:16 +00:00
hpayer
24622f5f12 Bailout for large object allocations in full code EmitFastOneByteArrayJoin.
BUG=chromium:542823
LOG=n

Review URL: https://codereview.chromium.org/1391373004

Cr-Commit-Position: refs/heads/master@{#31257}
2015-10-14 12:44:45 +00:00
yangguo
4f7caf2f57 Debugger: fix stepping when break points are deactivated.
The flag for deactivating break points also affects stepping, since both
are implemented via debug break slots. Fixing this by introducing a new
flag solely responsible for deactivating actual break points.

R=mvstanton@chromium.org
BUG=chromium:119800
LOG=N

Review URL: https://codereview.chromium.org/1402913002

Cr-Commit-Position: refs/heads/master@{#31236}
2015-10-13 12:44:28 +00:00
yangguo
82b30828bd Check for validity when accessing call site objects in runtime.
R=jkummerow@chromium.org
BUG=chromium:528379
LOG=N

Review URL: https://codereview.chromium.org/1404613002

Cr-Commit-Position: refs/heads/master@{#31233}
2015-10-13 10:53:22 +00:00
yangguo
1a94bc20a1 Fix Error object value lookups.
Looking up 'name' and 'message' properties at the same time and loading
the properties later can cause assertion failure if one of the properties
is an accessor and calling it changes the holder map. That may invalidate
the other lookup.

R=jkummerow@chromium.org
BUG=chromium:542101
LOG=N

Review URL: https://codereview.chromium.org/1403923002

Cr-Commit-Position: refs/heads/master@{#31229}
2015-10-13 09:26:47 +00:00
adamk
18534dffc9 Don't throw on assignment to function name binding in harmony sloppy mode
BUG=v8:4482
LOG=n

Review URL: https://codereview.chromium.org/1397513004

Cr-Commit-Position: refs/heads/master@{#31218}
2015-10-12 16:55:35 +00:00
mvstanton
76bee80672 Remove FLAG_cache_optimized_code because we always have it on.
The data structure that holds the optimized code is becoming essential for
additional functionality, too.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1399033002

Cr-Commit-Position: refs/heads/master@{#31216}
2015-10-12 16:10:59 +00:00
machenbach
fe6ff6523e Revert of Don't compile functions in a context the caller doesn't have access to (patchset #1 id:1 of https://codereview.chromium.org/1393713006/ )
Reason for revert:
[Sheriff] Breaks layout tests. Please add needsmanualrebaseline upstream first if intended. E.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2263

(one of them is a timeout that only happens with this commit)

Original issue's description:
> Don't compile functions in a context the caller doesn't have access to
>
> Instead, just return undefined.
>
> A side effect of this is that it's no longer possible to compile
> functions in a detached context.
>
> Based on https://codereview.chromium.org/294073002 but taking access
> check callbacks into account
>
> BUG=chromium:541703
> R=verwaest@chromium.org
> LOG=y
>
> Committed: https://crrev.com/9a5e2f512c4aa90563eb575605c2a8c2a92ac9f4
> Cr-Commit-Position: refs/heads/master@{#31208}

TBR=verwaest@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:541703

Review URL: https://codereview.chromium.org/1395583004

Cr-Commit-Position: refs/heads/master@{#31212}
2015-10-12 14:36:00 +00:00
littledan
d515e5138d Test for var declarations in eval which conflict with let
Previously, name conflicts between var and let declarations were only
made into exceptions if they were visible at parse-time. This patch adds
runtime checks so that sloppy-mode direct eval can't introduce conflicting
var declarations. The change is implemented by traversing the scope chain
when a direct eval introduces a var declaration to look for conflicting
let declarations, up to the function boundary.

BUG=v8:4454
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1382513003

Cr-Commit-Position: refs/heads/master@{#31211}
2015-10-12 14:31:01 +00:00
jochen
9a5e2f512c Don't compile functions in a context the caller doesn't have access to
Instead, just return undefined.

A side effect of this is that it's no longer possible to compile
functions in a detached context.

Based on https://codereview.chromium.org/294073002 but taking access
check callbacks into account

BUG=chromium:541703
R=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1393713006

Cr-Commit-Position: refs/heads/master@{#31208}
2015-10-12 12:23:18 +00:00
jochen
2e8181acd5 When converting an mjsunit exception to a string, include the stack
Makes debugging failures a bit easier

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1398703007

Cr-Commit-Position: refs/heads/master@{#31195}
2015-10-09 13:12:10 +00:00
cbruni
3ac2973b29 Improving error messages when adding properties to non JSObject receiver in
strict mode.

LOG=N
BUG=chromium:423739

Review URL: https://codereview.chromium.org/1381083004

Cr-Commit-Position: refs/heads/master@{#31192}
2015-10-09 09:12:47 +00:00
caitpotter88
e2be5ce542 [parser] fix token end position for regexp literals
Make the end position of a regexp literal the first character following the regexp. This matches the behaviour of number literals and string literals, as well as single-character tokens.

This change corrects the lazy-parsing of arrow functions with concise bodies, whose last token is a regular expression literal.

BUG=v8:4474
LOG=N
R=wingo@igalia.com, adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1389313003

Cr-Commit-Position: refs/heads/master@{#31189}
2015-10-09 01:02:02 +00:00
neis
cfe7c9c5ce [es6] Support optional "receiver" argument in Reflect.get.
Also add some more tests.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1392203002

Cr-Commit-Position: refs/heads/master@{#31181}
2015-10-08 14:23:12 +00:00
neis
7a0a682083 [es6] Implement completion value reform (--harmony-completion).
This CL depends on #1362363002.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1361403003

Cr-Commit-Position: refs/heads/master@{#31180}
2015-10-08 13:57:04 +00:00
ishell
77faf5d0f1 Do not run mjsunit/compare-known-objects-slow in GC-stress mode.
NOTRY=true

Review URL: https://codereview.chromium.org/1393713004

Cr-Commit-Position: refs/heads/master@{#31155}
2015-10-07 14:57:00 +00:00
adamk
24565b8598 Use Scope::function_kind_ to distinguish arrow function scopes
Previously, arrow function scopes had a separate ScopeType. However,
Scope::DeserializeScopeChain() erroneously deserialized ARROW_SCOPE
ScopeInfos as FUNCTION_SCOPE. This could lead to bugs such as the
attached one, where "super" was disallowed where it should have
been allowed.

This patch utilizes the Scope's FunctionKind to distinguish arrow
functions from others. Besides fixing the above bug, this also
simplifies code in various places that had to deal with two different
ScopeTypes both of which meant "function".

BUG=v8:4466
LOG=n

Review URL: https://codereview.chromium.org/1386253002

Cr-Commit-Position: refs/heads/master@{#31154}
2015-10-07 14:55:45 +00:00
bmeurer
e16dd13d6d [turbofan] Add initial support for global specialization.
Introduce a new JSGlobalSpecialization advanced reducer that runs
during the initial inlining and context specialization, and specializes
the graph to the globals of the native context.  Currently we assume
that we do not inline cross native context, but long-term we will grab
the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
new global load/store ICs that are currently in the workings), and then
this whole specialization will be fully compositional even across
cross-context inlining.

Note that we cannot really handle most of the stores to global object
property cells because TurboFan doesn't have a mechanism to enforce
certain representations.  Also note that we cannot yet fully benefit
from the type feedback collected on the global object property cells,
because the type system cannot deal with maps in a reasonable way.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
Cr-Commit-Position: refs/heads/master@{#31139}

Review URL: https://codereview.chromium.org/1387393002

Cr-Commit-Position: refs/heads/master@{#31148}
2015-10-07 12:10:54 +00:00
Benedikt Meurer
30f1b0e1e2 [turbofan] Disable failing test due to try...catch and lazy deopts.
This seems to be triggered now with global object specialization.

TEST=mjsunit/regress/regress-crbug-450960
TBR=mstarzinger@chromium.org
BUG=v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1388403002 .

Cr-Commit-Position: refs/heads/master@{#31147}
2015-10-07 12:08:38 +00:00
neis
09184acad2 [es6] Implement parts of the Reflect object.
- Reflect.deleteProperty
- Reflect.get
- Reflect.has
- Reflect.isExtensible

Reflect.get doesn't support the receiver argument yet, and
some of the others don't support proxies yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1379313002

Cr-Commit-Position: refs/heads/master@{#31146}
2015-10-07 11:45:25 +00:00
bmeurer
a916059aa7 [turbofan] Don't try to inline non-inlineable functions.
R=mstarzinger@chromium.org
BUG=chromium:540593
LOG=n

Review URL: https://codereview.chromium.org/1395453002

Cr-Commit-Position: refs/heads/master@{#31145}
2015-10-07 11:43:39 +00:00
bmeurer
84065c5f1e Revert of [turbofan] Add initial support for global specialization. (patchset #4 id:60001 of https://codereview.chromium.org/1387393002/ )
Reason for revert:
Breaks GC stress: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1984/steps/Bisect%20c5528ac1.Retry/logs/regress-crbug-450960

Original issue's description:
> [turbofan] Add initial support for global specialization.
>
> Introduce a new JSGlobalSpecialization advanced reducer that runs
> during the initial inlining and context specialization, and specializes
> the graph to the globals of the native context.  Currently we assume
> that we do not inline cross native context, but long-term we will grab
> the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
> new global load/store ICs that are currently in the workings), and then
> this whole specialization will be fully compositional even across
> cross-context inlining.
>
> Note that we cannot really handle most of the stores to global object
> property cells because TurboFan doesn't have a mechanism to enforce
> certain representations.  Also note that we cannot yet fully benefit
> from the type feedback collected on the global object property cells,
> because the type system cannot deal with maps in a reasonable way.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
> Cr-Commit-Position: refs/heads/master@{#31139}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1390073004

Cr-Commit-Position: refs/heads/master@{#31144}
2015-10-07 11:42:21 +00:00
bmeurer
6fbf7903f9 [turbofan] Add initial support for global specialization.
Introduce a new JSGlobalSpecialization advanced reducer that runs
during the initial inlining and context specialization, and specializes
the graph to the globals of the native context.  Currently we assume
that we do not inline cross native context, but long-term we will grab
the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
new global load/store ICs that are currently in the workings), and then
this whole specialization will be fully compositional even across
cross-context inlining.

Note that we cannot really handle most of the stores to global object
property cells because TurboFan doesn't have a mechanism to enforce
certain representations.  Also note that we cannot yet fully benefit
from the type feedback collected on the global object property cells,
because the type system cannot deal with maps in a reasonable way.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1387393002

Cr-Commit-Position: refs/heads/master@{#31139}
2015-10-07 10:26:11 +00:00
erikcorry
9081ee11af RegExp: Fix update of lastIndex on non-global sticky
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1378693004

Cr-Commit-Position: refs/heads/master@{#31133}
2015-10-06 21:24:12 +00:00
littledan
2e7077e02c Destructuring array without initializer throws an exception
Previously, cases like
  var [foo]
led to a parser crash because the parser tried to do something with
the initializer, which was not syntactically present.

This patch fixes the parser issue (implicitly creating an undefined
initializer) and inserts a check for array destructuring that the
right-hand side is coercible to an object, so it can have iterator
methods called on it safely.

BUG=v8:4462
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1384413002

Cr-Commit-Position: refs/heads/master@{#31128}
2015-10-06 17:01:28 +00:00
bmeurer
9c8262f11e [builtins] Make sure argument count is always valid for C++ builtins.
When calling into C++ builtins, we need to make sure that the argument
count register contains the correct number of arguments, otherwise the
CEntryStub will not be able to leave the stack in the correct state.

R=ishell@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1391543002

Cr-Commit-Position: refs/heads/master@{#31120}
2015-10-06 08:23:51 +00:00
littledan
38465598c8 Fix legacy const for-of/in destructuring
Previously, using legacy const in for-of/in loops led to a check-fail
in the parser. This was due to the fact that the destructuring bind
led to an undefined initialization to undefined in the parser, which
caused the for loop code to go down a strange path. This patch
eliminates the undefined initialization in variables declared in
for-in/of loops, so that that path is not used and the error is
fixed.

BUG=v8:4461
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1385913003

Cr-Commit-Position: refs/heads/master@{#31117}
2015-10-05 22:36:33 +00:00
stefan.penner
dcbab0f5fb [es6] Align Promise.resolve with the spec
* Promise.resolve is now works with subclasses
* Spec removed [[PromiseConstructor]] now can simply use constructor
* Promise.resolve ignores species

R=littledan@chromium.org,domenic@chromium.org
BUG=v8:4161,v8:4341
LOG=Y

Review URL: https://codereview.chromium.org/1362773002

Cr-Commit-Position: refs/heads/master@{#31116}
2015-10-05 22:21:25 +00:00
littledan
7e113c47b7 Prohibit let in lexical bindings
This patch prohibits lexical bindings from being called 'let', even in
sloppy mode, following the ES2015 specification. The change affects
multiple cases of lexical bindings, including simple let/const declarations
and both kinds of for loops. var and legacy const bindings still permit
the name to be let, including in destructuring cases. Tests are added to
verify, though some cases are commented out since they led to (pre-existing)
crashes.

BUG=v8:4403
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1371263003

Cr-Commit-Position: refs/heads/master@{#31115}
2015-10-05 20:29:22 +00:00
littledan
2d4085622a Ensure scopes are backed by blocks in the body of for loops
Clusterfuzz testing discovered that sloppy-mode block-scoped function
declarations introduce lexically-scoped variables in scopes that were
thrown away under the expectation that no lexically-scoped variables
were introduced. These cases are:

  for (;;) function foo() {}
  for (x in y) function foo() {}

This patch ensures that a block is created in those cases to hold the
lexically scoped variable. Usually, scope analysis should discover that
that block is not important, and it should not have a runtime
representation.

BUG=chromium:536750,chromium:536751
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1382123002

Cr-Commit-Position: refs/heads/master@{#31109}
2015-10-05 18:52:58 +00:00
cbruni
cfd417202e [runtime-object]: part fix element key list on global object
BUG=v8:2764
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1378323003

Cr-Commit-Position: refs/heads/master@{#31099}
2015-10-05 14:23:26 +00:00
machenbach
e1743816d3 Reland [swarming] Isolate v8 testing.
This reverts commit 280a6f8ec8.

Reland of https://codereview.chromium.org/1380593002/

BUG=chromium:535160
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel;

Review URL: https://codereview.chromium.org/1390473003

Cr-Commit-Position: refs/heads/master@{#31094}
2015-10-05 09:48:42 +00:00
danno
280a6f8ec8 Revert of [swarming] Isolate v8 testing. (patchset #8 id:140001 of https://codereview.chromium.org/1380593002/ )
Reason for revert:
Prime suspect in breakage of V8 Linux -- no snap

Original issue's description:
> [swarming] Isolate v8 testing.
>
> Add gyp support and isolates for default test suites.
> Add two default isolates, one (default) for using the
> test suite collection we call "default" on the bots. One
> (developer_default) for also supporting the way developers
> call the driver (i.e. without argument, which includes
> the unittests).
>
> BUG=chromium:535160
> LOG=n
>
> Committed: https://crrev.com/9bd83f58f29ab0c7c5b71b00bcb1df3a9e641f05
> Cr-Commit-Position: refs/heads/master@{#31081}

TBR=tandrii@chromium.org,jochen@chromium.org,maruel@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:535160

Review URL: https://codereview.chromium.org/1370993008

Cr-Commit-Position: refs/heads/master@{#31084}
2015-10-02 15:45:13 +00:00
machenbach
9bd83f58f2 [swarming] Isolate v8 testing.
Add gyp support and isolates for default test suites.
Add two default isolates, one (default) for using the
test suite collection we call "default" on the bots. One
(developer_default) for also supporting the way developers
call the driver (i.e. without argument, which includes
the unittests).

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1380593002

Cr-Commit-Position: refs/heads/master@{#31081}
2015-10-02 15:15:39 +00:00
cbruni
1cb899046c [cross-context] create new function prototypes in the context of the function
BUG=v8:4217
LOG=Y

Review URL: https://codereview.chromium.org/1381543005

Cr-Commit-Position: refs/heads/master@{#31074}
2015-10-02 13:30:19 +00:00
jkummerow
ecf2327691 Fix FixedArrayBase cast in NumberOfOwnElements
The problem was harmless, but made --enable-slow-asserts unhappy.

BUG=chromium:538086
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1384673003

Cr-Commit-Position: refs/heads/master@{#31069}
2015-10-02 11:49:00 +00:00
ishell
aa6a654a0f Temporarily disable mjsunit/call-counts test until --vector-stores is prermanently enabled.
BUG=v8:4458
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1387533002

Cr-Commit-Position: refs/heads/master@{#31067}
2015-10-02 09:29:10 +00:00
machenbach
366dc81143 [Swarming] Presort tests - slowest first.
Swarming won't support an incremental data file. By just
sorting the lowest hanging fruits to the beginning we
already get a big bang for the buck (>80% of the improvement
we get otherwise).

This will require semi-regular manual updates of the
slowest tests.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1385443002

Cr-Commit-Position: refs/heads/master@{#31061}
2015-10-01 19:19:17 +00:00
ishell
898524afce Disable vector store ICs for mjsunit/call-counts because slot indices change when --vector-stores is enabled.
Review URL: https://codereview.chromium.org/1381073003

Cr-Commit-Position: refs/heads/master@{#31059}
2015-10-01 18:03:46 +00:00
bmeurer
2a0759d3ff [es6] Fix missing bits for full @@toPrimitive support.
Introduce %_ToNumber intrinsic, which just calls to the existing
ToNumberStub, and remove all uses of our custom JavaScript plus
intrinsics based ToNumber and friends.

Also replace the TO_NUMBER_INLINE macro with TO_NUMBER,
which is currently a wrapper for %_ToNumber. Newly written JS
code should use TO_NUMBER (similar to TO_STRING, TO_INT32,
and friends).

Also finally remove the DefaultString/DefaultNumber builtins, which
are basically the ES5 version of ToPrimitive. Now all code uses the
ES6 version, which is implemented in Object::ToPrimitive and
JSReceiver::ToPrimitive in C++.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1384443002

Cr-Commit-Position: refs/heads/master@{#31054}
2015-10-01 16:08:49 +00:00
neis
cf82eea6d7 Fix completion of try..finally.
R=rossberg
BUG=v8:2529
LOG=Y

Review URL: https://codereview.chromium.org/1375203004

Cr-Commit-Position: refs/heads/master@{#31051}
2015-10-01 13:59:56 +00:00
rossberg
2c2848dccf [es6] Scoping & initialization for var shadowing non-simple parameters
Var-bindings may shadow parameters from a non-simple parameter list. When that happens: they create separate bindings, but are initialised with the respective parameter value. Thus:

(function(x, f = () => x) { var x; var y = x; x = 2; return [x, y, f()] })(1) -->  [2, 1, 1]

This CL implements that by inserting a suitable assignment for every shadwowing var-variable (e.g., x = outer_x above) at the beginning of the function's body block.

R=adamk@chromium.org
BUG=v8:4440,v8:811
LOG=N

Review URL: https://codereview.chromium.org/1371333004

Cr-Commit-Position: refs/heads/master@{#31042}
2015-10-01 10:42:33 +00:00
littledan
76da493315 Extend Annex B 3.3 sloppy-mode block-scoped hoisting to scripts, eval
The ES2015 spec is missing an extension of sloppy-mode block-scoped function
behavior to the global scope in scripts, as well as to eval. This patch
brings that hoisting to those two areas. The behavior is not perfectly
spec-compliant since properties created on the global scope should be
set as enumerable even if they are non-enumerable previously, but the
attributes will not be modified if the property already exists under
this patch.

BUG=v8:4441
LOG=Y
R=adamk
TEST=reddit comment functionality seems to be fixed

Review URL: https://codereview.chromium.org/1376623002

Cr-Commit-Position: refs/heads/master@{#31037}
2015-09-30 23:48:34 +00:00
adamk
163419e8fa Remove --harmony-arrow-functions flag
Arrow functions have been enabled by default since the 4.5 branch.

Review URL: https://codereview.chromium.org/1373633002

Cr-Commit-Position: refs/heads/master@{#31031}
2015-09-30 19:50:40 +00:00
kozyatinskiy
ce54e16270 [V8] Add name of function for function's closure scope
Added ScopeDetails.name field for closure scopes. It contains function's debug name of current context of scope.

BUG=493156
LOG=Y
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1375813002

Cr-Commit-Position: refs/heads/master@{#31028}
2015-09-30 17:24:33 +00:00
dusan.m.milosavljevic
8bd431de92 MIPS64: Add big-endian support for mips64.
TEST=
BUG=

Review URL: https://codereview.chromium.org/1334793004

Cr-Commit-Position: refs/heads/master@{#31011}
2015-09-29 17:23:55 +00:00
neis
d3ef8f4b95 [es6] Ship rest parameters.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1371963002

Cr-Commit-Position: refs/heads/master@{#30970}
2015-09-28 11:19:35 +00:00
bmeurer
175edfb470 [turbofan] Rename --context-specialization to --function-context-specialization.
This name makes it clear that the flag (also the variant in the Compiler)
is talking about specializing to the function context instead of i.e. the
native context.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1372513003

Cr-Commit-Position: refs/heads/master@{#30934}
2015-09-25 11:33:38 +00:00
bmeurer
ff2c9eace4 [es6] Remove left-overs from Function.prototype.toMethod.
The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod.  This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.

The original removal of Function.prototype.toMethod was in February
2015 in 68e4897586.

R=jarin@chromium.org
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1366063002

Cr-Commit-Position: refs/heads/master@{#30925}
2015-09-25 04:04:36 +00:00
stefan.penner
ab9898980e Don’t smash globals used by the test helper itself.
Since https://codereview.chromium.org/366103005 the promise tests null out
various globals, to ensure the promise implementation doesn’t itself rely
on functions patchable by monkeys.

Unfortunately, doing so breaks test assertion failures which rely on
those globals.

This isn’t the ideal solution, but does improve the current state.

R=littledan@chromium.org,domenic@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1370583002

Cr-Commit-Position: refs/heads/master@{#30922}
2015-09-24 21:47:17 +00:00
bmeurer
7a7b692b30 [runtime] Replace %to_string_fun with %_ToString.
Introduce a new macro TO_STRING that maps to %_ToString and use that
instead of calling into any of the ToString/NonStringToString JavaScript
builtins. Also remove the TO_STRING_INLINE macro, which is basically
obsolete with %_ToString. We still have a few uses of ToString left (via
the utils export mechanism), where we need to investigate whether we
will tank badly if we replace them with TO_STRING as well.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1323543002

Cr-Commit-Position: refs/heads/master@{#30895}
2015-09-23 21:46:49 +00:00
jkummerow
afa60ff604 [field type tracking] Fix handling of cleared WeakCells
Whenever a generalization is computed, the inputs must be checked for being cleared, and if they are, the generalization must be Type::Any.

Hopefully this fixes Chromium issue 527994 as well.

BUG=v8:4325,chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1361103002

Cr-Commit-Position: refs/heads/master@{#30887}
2015-09-23 12:35:36 +00:00
ishell
f5dc276a2c Exclude test/mjsunit/regress/regress-4121.js from GC stress testing.
NOTRY=true

Review URL: https://codereview.chromium.org/1364583003

Cr-Commit-Position: refs/heads/master@{#30885}
2015-09-23 11:15:58 +00:00
ishell
4dd45e115b Share literals arrays per <NativeContext, SharedFunctionInfo> pair.
This CL also renames wrongly named test for v8:4173.

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1353363002

Cr-Commit-Position: refs/heads/master@{#30879}
2015-09-23 08:46:28 +00:00
adamk
7485da7ace Don't crash when preparsing destructured arguments
This adds the materialized literal count accumulated while parsing the
parameters (in the parser proper) to that accumulated by the preparser.

This should have been caught in cctest/test-parsing, but it's not covered
because the parsing tests call directly into the preparser rather than
using Parser::ParseFunctionLiteral (which fully-parses the parameters
and then calls into the preparser to skip over the function body).

Note that this further-inflates the materialized literal count for
functions with destructured arguments, since some of the counted
literals are actually binding patterns. But that's not specific to
binding patterns in formal parameters: it happens in function bodies, too.

BUG=v8:4400,v8:4407
LOG=n

Review URL: https://codereview.chromium.org/1350913005

Cr-Commit-Position: refs/heads/master@{#30868}
2015-09-22 17:43:43 +00:00
conradw
24ec2a0baa [strong] Implement revised strong class semantics
Weak classes can inherit from strong ones again, a strong base class makes
instances strong.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1347243004

Cr-Commit-Position: refs/heads/master@{#30867}
2015-09-22 16:34:52 +00:00
bmeurer
3d7c45371e [crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.
If @@toStringTag is an accessor property, we cannot assume that the result
of calling Object.prototype.toString() for objects with the same map.

R=adamk@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1360723002

Cr-Commit-Position: refs/heads/master@{#30856}
2015-09-22 04:08:08 +00:00
bmeurer
e56f265f6d [ic] Also collect known map for relational comparison.
Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.

For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1355113002

Cr-Commit-Position: refs/heads/master@{#30852}
2015-09-21 16:05:43 +00:00
littledan
e5ff10d767 Implement sloppy-mode block-defined functions (Annex B 3.3)
ES2015 specifies very particular semantics for functions defined in blocks.
In strict mode, it is simply a lexical binding scoped to that block. In sloppy
mode, in addition to that lexical binding, there is a var-style binding in
the outer scope, which is overwritten with the local binding when the function
declaration is evaluated, *as long as* introducing ths var binding would not
create a var/let conflict in the outer scope.

This patch implements the semantics by introducing a DelegateStatement, which
is initially filled in with the EmptyStatement and overwritten with the
assignment when the scope is closed out and it can be checked that there is
no conflict.

This patch is tested with a new mjsunit test, and I tried staging it and running
test262, finding that the tests that we have disabled due to lack of Annex B
support now pass.

R=adamk,rossberg
LOG=Y
BUG=v8:4285

Review URL: https://codereview.chromium.org/1332873003

Cr-Commit-Position: refs/heads/master@{#30842}
2015-09-21 04:31:09 +00:00
adamk
7462e99667 Remove on-by-default flag --harmony-object
It's been enabled since M45, which is now well into its stable period,
with no problems reported.

Review URL: https://codereview.chromium.org/1356793002

Cr-Commit-Position: refs/heads/master@{#30835}
2015-09-18 18:37:57 +00:00
ben
bfce677866 Pretenure builtin typed arrays.
Typed arrays from the snapshot start out in the young space but they
all seem to end up in the old space sooner or later anyway.  Let's
expedite that by allocating them in the old space right away.

Review URL: https://codereview.chromium.org/1347263003

Cr-Commit-Position: refs/heads/master@{#30804}
2015-09-17 14:47:56 +00:00
ishell
3d964e0b83 Disable tests that are known to be non-deterministic in --verify-predictable mode.
Review URL: https://codereview.chromium.org/1352803002

Cr-Commit-Position: refs/heads/master@{#30799}
2015-09-17 13:02:10 +00:00
jkummerow
9516dccd41 Reland "[test] Fix cctest path separators on Windows"
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Original review: https://codereview.chromium.org/1348653003/

This reverts commit 5f44a91059.

NOTRY=true

Review URL: https://codereview.chromium.org/1356613002

Cr-Commit-Position: refs/heads/master@{#30798}
2015-09-17 13:01:12 +00:00
jkummerow
5f44a91059 Revert of [test] Fix cctest path separators on Windows (patchset #2 id:20001 of https://codereview.chromium.org/1348653003/ )
Reason for revert:
mozilla tests are failing on Windows

Original issue's description:
> [test] Fix cctest path separators on Windows
>
> Now run-tests.py understands "suite/foo/bar" with forward slashes for
> command-line test selection on all test suites on all platforms.
>
> Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
> that behavior is sacrificed here in favor of unification. For the cctest
> suite, OTOH, it wasn't possible on Windows to select specific tests at all.
>
> Committed: https://crrev.com/b36cfdb39ae648b49a1396c4f669df9b1f57996c
> Cr-Commit-Position: refs/heads/master@{#30794}

TBR=machenbach@google.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1349163002

Cr-Commit-Position: refs/heads/master@{#30795}
2015-09-17 12:00:23 +00:00
jkummerow
b36cfdb39a [test] Fix cctest path separators on Windows
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Review URL: https://codereview.chromium.org/1348653003

Cr-Commit-Position: refs/heads/master@{#30794}
2015-09-17 11:24:09 +00:00
aperez
d4e1299f16 ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32
Defines a new --harmony-tolength flag, and a ToLengthFlagged() runtime function,
that is used where ES6 requires ToLength(), but a pre-ES6 conversion existed
before. When the flag is disabled, the function uses TO_UINT32(), which is
the pre-ES6 behaviour. When the flag enabled, the ES6-compliant ToLength()
conversion is used.

Based on a patch initially from Diego Pino <dpino@igalia.com>

BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1309243003

Cr-Commit-Position: refs/heads/master@{#30772}
2015-09-16 18:01:52 +00:00
caitpotter88
b444da41ad [es6] support get and set in shorthand properties
Add support for `get` and `set` as shorthand properties. Also
supports them for CoverInitializedName in BindingPatterns and (once implemented)
AssignmentPatterns.

BUG=v8:4412, v8:3584
LOG=N
R=adamk, aperez, wingo, rossberg

Review URL: https://codereview.chromium.org/1328083002

Cr-Commit-Position: refs/heads/master@{#30769}
2015-09-16 16:02:05 +00:00
binji
f5bec4bcd4 [Atomics] Remove support for atomic accesses on floating-point values.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1318713007

Cr-Commit-Position: refs/heads/master@{#30755}
2015-09-15 21:25:14 +00:00
adamk
f44efd6b31 Fix spread operator in ArrayLiterals when nested in other literals
Mark ArrayLiterals utilizing the spread operator as non-simple.
This causes them to return false for IsCompileTimeValue, and thus
causes spread to work as expected in nested literals.

BUG=v8:4417
LOG=y

Review URL: https://codereview.chromium.org/1336123002

Cr-Commit-Position: refs/heads/master@{#30754}
2015-09-15 16:43:39 +00:00
bmeurer
e2f1c26982 [es6] Move builtin constructors for primitives to strict mode.
The ES6 specification says that "Built-in functions that are ECMAScript
function objects must be strict mode functions", which in particular
means that you can never test for them using the "caller" field of a
sloppy mode function.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:105
LOG=n

Review URL: https://codereview.chromium.org/1347663002

Cr-Commit-Position: refs/heads/master@{#30750}
2015-09-15 14:32:39 +00:00