Commit Graph

131 Commits

Author SHA1 Message Date
danno@chromium.org
9cca7d2733 Combine typed and pixel arrays.
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.

Review URL: http://codereview.chromium.org/6546036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-09 15:01:16 +00:00
mmaly@chromium.org
3c51baa1ac Throw if setting length of a string in strict mode.
BUG=
TEST=test/mjsunit/strict-mode.js

Review URL: http://codereview.chromium.org/6623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 21:12:29 +00:00
mmaly@chromium.org
9dc156ac62 Passing strict mode throughout SetElement.
Throw if assigning to read only element.
Adding tests for element assignment in strict mode.

Fix tests for strict mode SetElement.

Review URL: http://codereview.chromium.org/6613005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 00:21:52 +00:00
mmaly@chromium.org
1d040083b0 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 04:53:43 +00:00
mmaly@chromium.org
749b69853a Revert "Assignment to read only properties throws in strict mode."
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 01:42:37 +00:00
antonm@chromium.org
da463ab484 Get property may throw an exception thanks to JS accessors.
Check result before and bail out if exception has been thrown.

BUG=v8:1172
TEST=test/mjsunit/regress/regress-1172-bis.js

Review URL: http://codereview.chromium.org/6580030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 17:42:56 +00:00
mmaly@chromium.org
fb20f7fc75 CallIC and KeyedCallIC not wrapping this for strict mode functions.
Fix CallIC and KeyedCallIC to correctly use Handle<Object>.

Review URL: http://codereview.chromium.org/6523052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6874 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 00:39:21 +00:00
mmaly@chromium.org
f0df4a6c9e Revert "This is not wrapped for strict mode and builtin functions."
This reverts commit 6845

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 21:56:37 +00:00
mmaly@chromium.org
bb7b014988 This is not wrapped for strict mode and builtin functions.
CallIC and KeyedCallIC do not wrap this when calling builtin
and strict mode functions.

Review URL: http://codereview.chromium.org/6523052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 17:52:03 +00:00
danno@chromium.org
36088cb64f Implement specialized IC code stubs for pixel array stores.
Review URL: http://codereview.chromium.org/6478027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 21:21:33 +00:00
mmaly@chromium.org
e0be3072b5 Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-13 16:19:53 +00:00
mmaly@chromium.org
3f4701df7f Revert r6756. Check failed on V8 arm - debug - crankshaft.
Need to investigate.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 23:25:07 +00:00
mmaly@chromium.org
fd6338bdda Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 21:39:59 +00:00
whesse@chromium.org
13e8360d94 X64 Crankshaft: Add TypeRecordingBinaryStub to X64
Review URL: http://codereview.chromium.org/6366028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 15:36:44 +00:00
danno@chromium.org
a2fb4a12bb Create specialized code stubs for PixelArray loads.
Review URL: http://codereview.chromium.org/6287030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 12:50:50 +00:00
kmillikin@chromium.org
78b9981b90 Revert "Add custom typed ICs for pixel array loads. "
This change caused failures in (out of bounds) keyed loads of strings.

TBR'd.

Review URL: http://codereview.chromium.org/6298019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-28 15:07:04 +00:00
danno@chromium.org
afd0906204 Add custom typed ICs for pixel array loads.
Review URL: http://codereview.chromium.org/6323002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-28 14:06:20 +00:00
vitalyr@chromium.org
76483f871b Support StringLength in hydrogen (similar to ArrayLength).
To avoid deopts a few extra changes were needed:

o Enable megamorphic state for special property loads on
  primitives. We used to flip between monomorphic stubs.
o Extract pure string (no string wrapper support) version of the
  string length stub.

Review URL: http://codereview.chromium.org/6334015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-25 15:51:10 +00:00
sgjesse@chromium.org
99a5b9f713 ARM: Initial type recording binary operation stub
This implements the type recording binary operation stub for ARM. This first iteration only supports ADD. Handling of 32-bit integers is currently not implemented but just transitions. The generic case for now delegates to the generic binary operation stub.
Review URL: http://codereview.chromium.org/6342019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-25 14:52:35 +00:00
kbr@chromium.org
cbc1c0fca6 Truncate rather than round to nearest when performing float-to-integer
conversions for external array types, which implement the Typed Array
spec. (Revision of http://codereview.chromium.org/6315004 .)

Prefer SSE2 code path on x86 processors. Non-SSE2 processors now make
a slow runtime call for float-to-int conversions. Use SSE3 for 32-bit
signed and unsigned int array types where possible.

The movement of code from ic-arm.cc to stub-cache-arm.cc caused the
VFP3 code path to be tested for the first time. Fixed bugs in the
register usage and in the constant value stored into integer arrays
for NaN and +/-Infinity.

Added new truncation test to test-api.cc. Storage of NaN and +/-Inf
was already covered. Ran unit tests on x86, x64 and ARM simulator.
Tested ia32 and x64 code in Chromium on Mac and Linux respectively
with Typed Array unit tests and WebGL content.

BUG=http://code.google.com/p/chromium/issues/detail?id=50972
TEST=test-api/ExternalArrays

Review URL: http://codereview.chromium.org/6303012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-21 23:58:00 +00:00
ager@chromium.org
6b4d29766c Revert r6376 and r6373 which changes external array support. The ARM
version did not work.

TBR=kbr@chromium.org
Review URL: http://codereview.chromium.org/6295013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-19 08:20:42 +00:00
kbr@chromium.org
27f0ae7aad Truncate rather than round to nearest when performing float-to-integer
conversions for external array types, which implement the Typed Array
spec. The new code paths are for SSE3 and SSE2 capable processors.
The code for non-SSE2 processors is unchanged for now. The ARM port
appears to already be correct.

Moved the generation of the external array load and store intrinsics
to the stub cache (on all platforms) so that they are generated at run
time and can take advantage of CPU features.

This functionality is covered by the array-unit-tests.html test in the
WebGL conformance test suite:
http://khronos.org/webgl/wiki/Testing/Conformance
https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/array-unit-tests.html

Manually verified all of the SSE3/SSE2/non-SSE2 code paths by enabling
each in turn. Tested in Chromium on 32-bit Mac OS X and 64-bit Linux.

BUG=http://code.google.com/p/chromium/issues/detail?id=50972
TEST=none (see above)

Review URL: http://codereview.chromium.org/6315004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6373 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-18 21:51:50 +00:00
vitalyr@chromium.org
11a4cb5718 Introduce extra IC state to record additional feedback from IC-s.
Extra IC state is only two bits and only supported for call IC-s for
now. To change its extra state an IC stub jumps to a new miss stub
that goes to runtime as usual but then instead of going megamorphic
generates a monomorphic stub with the updated state.

Review URL: http://codereview.chromium.org/6344005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-18 16:54:48 +00:00
fschneider@chromium.org
b93a0f5d9a Second attempt: Improve our type feedback by recogizining never-executed IC calls for binary operations.
This is an improved version of my earlier change r5970. It avoids degrading the
non-optimized code.

Initially we emit a conditional branch that is either always- or never-taken
after a smi-check (depending on whether we test for smi for for non-smi)
Since test-eax always sets the carry-flag to 0 we use jump-if-carry and
jump-if-not-carry.

The first invocation of the stub patches a jc with a jz and
jnc with a jnz-instruction so that the code looks exactly as it was
without patching. The only difference is the test- or nop-instruction
after the IC-call.

Review URL: http://codereview.chromium.org/5763004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 13:56:41 +00:00
fschneider@chromium.org
b1a2cc1e48 Revert r5970 and r5975.
Review URL: http://codereview.chromium.org/5717005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 10:41:50 +00:00
fschneider@chromium.org
b50b98421c Land Vitaly's change to fix compare IC performance.
Original change: http://codereview.chromium.org/5733004/

When we have inlined smi code can transition to heap number state before going to the generic state. Without inlined smi code the behaviour is unchanged.

Review URL: http://codereview.chromium.org/5689005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5975 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 10:05:19 +00:00
fschneider@chromium.org
b16df72475 Improve our type feedback by recogizining never-executed IC calls for binary operations.
In the case of inlined smi code in non-optimzied code we could not 
distinguish between the smi-only case and the case that the operation was
never executed.

With this change the first execution of a binary operation always jumps
to the stub which in turn patches the smi-check into the correct
conditional branch, so that we benefit from inlined smi code after the
first invocation.

A nop instruction after the call to the BinaryOpIC indicates that no
smi code was inlined. A "test eax" instruction says that there was smi
code inlined and encodes the delta to the patch site and the condition
code of the branch at the patch site to restore the original jump.

Review URL: http://codereview.chromium.org/5714001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5970 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-10 14:33:20 +00:00
kasperl@chromium.org
90b3370374 Update V8 to version 3.0 (re-land r5920).
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:31:57 +00:00
kasperl@chromium.org
51b494d096 Revert r5920. Will re-land shortly.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:01:02 +00:00
kasperl@chromium.org
e5860bd6a8 Update V8 to version 3.0.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 09:11:56 +00:00
erik.corry@gmail.com
0dcaac1939 Make Failure inherit from MaybeObject instead of Object.
Review URL: http://codereview.chromium.org/3970005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-25 15:22:03 +00:00
vitalyr@chromium.org
7228d867cb Use existing global cell status as a hint when generating loads.
Review URL: http://codereview.chromium.org/3537003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-30 17:39:31 +00:00
kmillikin@chromium.org
4d04e9d5d4 Remove some unused fields from class CompilationInfo.
Review URL: http://codereview.chromium.org/3533007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5557 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-29 17:38:37 +00:00
vitalyr@chromium.org
ceb9d79d73 Generate inline code for contextual loads.
Contextual load requires only a map check followed by a cell hole
check so we can generate pretty compact code for that. The fact that
we have inlined code is marked by mov ecx, offset instruction after
the IC call. Inlining is only enabled inside loops and in non-builtin
functions.

The generated code size increase is about 3%. This descreased the
pc-to-code cache hit rate in some of the benchmarks that trigger
GC. To compensate we now have 4 times as much entries in the cache.

Review URL: http://codereview.chromium.org/3402014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-20 13:50:27 +00:00
kaznacheev@chromium.org
6bd9d953dd Reapplying r5147 (caching maps for slow case objects).
r5147 wrongly assumed that a code cache for a slow case map is always empty.
This patch solves this: whenever we attempt to add a stub to a map's code cache 
we check that this map is cached. If it is we give the object its own copy
of the map and only then modify the map.

Review URL: http://codereview.chromium.org/3134027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-25 13:25:54 +00:00
vegorov@chromium.org
1920692d71 Revert r5174.
Review URL: http://codereview.chromium.org/2868108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-05 11:19:43 +00:00
kaznacheev@chromium.org
5f78dc14c8 Avoid GC when compiling CallIC stubs.
In rare cases GC could be called from ComputeCallMiss function thus
breaking CallIC::LoadFunction.

Review URL: http://codereview.chromium.org/3047027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-05 08:37:12 +00:00
ager@chromium.org
c9c7f8834e Inline in-object property stores on ia32 when in loop and not in top-level code.
Review URL: http://codereview.chromium.org/3046006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5105 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-21 06:59:34 +00:00
serya@chromium.org
43e28a6fea Port prototype-call-stubs for normal objects (http://codereview.chromium.org/2801018).
Review URL: http://codereview.chromium.org/2860049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-12 13:23:42 +00:00
erik.corry@gmail.com
118a421067 Simplify the transitions in the Binary Op ICs. Now a single call
to the runtime will both patch in the more specialized binary op
stub and calculate the answer.  This eliminates the need to call
both the rest of the binary op and the patching runtime call.  The
runtime routines are altered to be more agressive in returning
Smis so we don't get spurious heap numbers as inputs to binary ops
while we are patching the binary op ICs.
Review URL: http://codereview.chromium.org/2843049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-06 12:56:55 +00:00
serya@chromium.org
c56b92d65d This change allows generating call-stubs for objects with normal (non-fast) objects in the prototype chain. StubCompiler::CheckPrototypes does ne
If the top level object is a normal object the stub is stored in its prototype map.

Lookup result of type NORMAL is not covered (since the normal stub currently doesn't check the prototype chain).
Review URL: http://codereview.chromium.org/2801018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-02 14:15:04 +00:00
ager@chromium.org
6044b33766 Implement IC for storing to dictionary case objects.
The IC stub is completely generic, so there will only be one such stub
in the system.

Added a new overloaded version of the macro assembler RecordWrite
method for cases where we have the address we store to computed up
front.

Review URL: http://codereview.chromium.org/2804029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4991 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-30 12:27:49 +00:00
vitalyr@chromium.org
8ab6832203 Add "has fast elements" bit to maps and use it in inlined keyed loads.
A potential issue with this change is creating lots of maps when
objects flip between fast/slow elements modes.  We could add special
transitions to avoid this.  Yet testing this on our benchmarks, gmail,
and wave seems to indicate that this is not a real problem.

Review URL: http://codereview.chromium.org/2870018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4941 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-24 13:56:35 +00:00
erik.corry@gmail.com
7287aff403 Augment trace-ic to provide information on patching inlined loads.
Review URL: http://codereview.chromium.org/2818023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-22 12:12:32 +00:00
ager@chromium.org
8c9958e560 Only update the stub cache tables with monomorphic stubs used by
megamorphic call sites. This removes a lot of contention in the
tables.

Review URL: http://codereview.chromium.org/2813002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-14 10:10:42 +00:00
kaznacheev@chromium.org
1dec9199ca Add logic from KeyedLoadIC generic stub to KeyedCallIC megamorphic stub.
This should make access faster for arrays of functions.

Review URL: http://codereview.chromium.org/2754003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-10 05:06:39 +00:00
kaznacheev@chromium.org
ff61618c4b Extend CallIC to support non-constant names.
This speeds up constructs like this: 
var zz='replace'; '123'[zz]('3','4');

Review URL: http://codereview.chromium.org/2280007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4804 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-07 08:27:32 +00:00
serya@chromium.org
eaa95c523b Inlined load of string.length and array.length.
http://compute1.aar:9013/golem/r4583-v8-serya-length-inlined-vs-4583-v8.html

Review URL: http://codereview.chromium.org/1917006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-06 10:50:22 +00:00
dgozman@chromium.org
8fee5e810a Added ability to remove prototype from function. In this case, [[Construct]] from function will not be allowed.
Added runtime function %FunctionRemovePrototype for this.
Removed prototypes from all builtin functions.
Some sputnik tests marked as fixed.
Added test to check builtins behavior.

Review URL: http://codereview.chromium.org/1722003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-28 12:05:40 +00:00