sgjesse@chromium.org
1a6c821b05
Increase coverage of global loads in optimized code
...
In the cases where a global property cell cannot be used in the optimized code use standard load ic to get the property instead of bailing out.
Review URL: http://codereview.chromium.org/6665026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7212 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-17 08:16:12 +00:00
ager@chromium.org
4f7fe371b2
Fix Array::New(length) in the API to return an array with the provided length.
...
The internal factory method initializes the elements but does not set
the length property of the array.
Add array api test case for length.
R=antonm@chromium.org
BUG=v8:1256
TEST=cctest/test-api/Array
Review URL: http://codereview.chromium.org/6674034
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7210 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-16 19:55:31 +00:00
antonm@chromium.org
a7bb1d5278
Introduce one way dependencies into object grouping.
...
Those are necessary to properly manage relationship between objects in cases
when they don't form proper tree structure.
Review URL: http://codereview.chromium.org/6686053
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-16 12:02:28 +00:00
ager@chromium.org
e181bd2b6f
Use full paths for cctests.
...
Review URL: http://codereview.chromium.org/6670045
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7201 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-16 11:16:18 +00:00
ager@chromium.org
8a5e4837f8
Add a V8 benchmark suite run to test.py to catch failures on the buildbot.
...
Review URL: http://codereview.chromium.org/6698029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7198 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-16 09:45:28 +00:00
erik.corry@gmail.com
5ea0364a6a
Fix incorrect assumption on bit-and on ARM
...
Review URL: http://codereview.chromium.org/6696037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 21:56:12 +00:00
ricow@chromium.org
e8ff324583
Follow Safari on not throwing when __defineGetter__ fails.
...
In addition, this fixes defineOwnProperty to actually not throw when
the should_throw flag is false (we had no usage of this priorly).
Review URL: http://codereview.chromium.org/6695018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 14:19:18 +00:00
ricow@chromium.org
7cb35bcfa5
Reapply 7143 after fixing issue 1250
...
Review URL: http://codereview.chromium.org/6698027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 12:25:13 +00:00
karlklose@chromium.org
984135cb32
ARM: Improved double to integer truncation.
...
Patch from ARM Ltd.
BUG=none
TEST=Added to cctest/test-assembler-arm.cc and cctest/test-disasm-arm.cc
Review URL: http://codereview.chromium.org/6625084
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 11:19:13 +00:00
ager@chromium.org
6428822811
Revert "Strict mode ThrowTypeError functions for"
...
TBR=mmaly@chromium.org
Review URL: http://codereview.chromium.org/6696018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 11:01:21 +00:00
erik.corry@gmail.com
941701d0b9
Fix SmiCompare on 64 bit to distinguish between comparisons where
...
we know that both sides are Smi and those where we don't. Fix inlined
symbol table probes to cope with strings, undefined and null (indicating
a deleted entry). Some changes to other architectures that were found
with the new asserts.
Review URL: http://codereview.chromium.org/6682026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7172 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 10:03:57 +00:00
ricow@chromium.org
fc38a2e509
Do not set value on host objects in Object.defineProperty (fixes issue 1250).
...
To be compatible with safari we should not change the value on API
objects in Object.defineProperty (e.g., the window.location object).
Review URL: http://codereview.chromium.org/6673042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 09:16:12 +00:00
mmaly@chromium.org
80bd958df2
Strict mode ThrowTypeError functions for
...
- function.caller
- function.arguments
Review URL: http://codereview.chromium.org/6691003/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7168 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-14 17:46:37 +00:00
whesse@chromium.org
f6e1b82fd4
Fix a problem where Object.getOwnPropertyDescriptor and related functions unintentionally called toString on the values of an object's properties. Fixes issue 1233.
...
Review URL: http://codereview.chromium.org/6677017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-11 13:57:20 +00:00
ricow@chromium.org
c00631b86e
Fix presubmit by deleting regress-1240 not deleted by last patch.
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-11 09:08:52 +00:00
ricow@chromium.org
f2730d2ab8
Revert revision 7143, this causes a number of webkit tests to fail.
...
This includes a security test. Reverting to investigate further.
Review URL: http://codereview.chromium.org/6673019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-11 09:02:54 +00:00
ricow@chromium.org
fa9e57e326
Change __defineGetter__ and __defineSetter__ to respect non-configurable.
...
This makes us compatible with firefox. Earlier on we were somehow
compatible with safari - which will allow defining a getter even when
an existing getter is present and non-configurable. We would, however,
in addition to overwriting the getter also change configurable to
true. The approach used by firefox seems much more sound, i.e., why
should it be possible to use __defineGetter__ or __defineSetter__ to
overwrite a non-configurable getter or setter respectively.
I will file a bug on the webkit bugtracker.
Review URL: http://codereview.chromium.org/6658037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-11 08:05:59 +00:00
whesse@chromium.org
b7d7aa8ad2
Fix error in sin-cos.js test introduced in r7129.
...
Review URL: http://codereview.chromium.org/6659034
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-10 14:04:18 +00:00
whesse@chromium.org
fc8f77e398
X64 Crankshaft: Fix error in computation of sine and cosine.
...
Review URL: http://codereview.chromium.org/6646047
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-10 13:34:23 +00:00
mikhail.naganov@gmail.com
dee9c00267
Add an interface for an embedder to provide information about native
...
objects retained by object groups and global handles.
This information is then used during heap snapshot generation
to provide a more complete memory picture.
This patch will be needed to fix https://bugs.webkit.org/show_bug.cgi?id=53659 .
Review URL: http://codereview.chromium.org/6626043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-10 12:05:31 +00:00
lrn@chromium.org
d57a8b0a07
X64: Change kSmiConstantRegister to r12.
...
We never use the smi register in places where it matters that r12 as
a base register needs an extra SIB byte. Might as well free up the
unencumbered r15 register instead.
Review URL: http://codereview.chromium.org/6647015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7113 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-10 10:14:24 +00:00
danno@chromium.org
9cca7d2733
Combine typed and pixel arrays.
...
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.
Review URL: http://codereview.chromium.org/6546036
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-09 15:01:16 +00:00
lrn@chromium.org
a8b41a0edd
Fix bug in X64 RegExpExec stub.
...
Used incorrect register for referencing RegExp data, so it always failed
to match the fast case.
When modifiying the object layout, it was possible to make it crash instead.
BUG=v8:1236
TEST=test/mjsunit/regress/regress-1236.js
Review URL: http://codereview.chromium.org/6635041
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-08 14:15:25 +00:00
mmaly@chromium.org
927f341d3c
Strict mode arguments do not share binding with formal parameters.
...
Move strict mode flag from TemporaryScope to Scope so that it can be accessed from variable binding code.
Arguments do not alias in strict mode (ia32, x64 and arm, codegen and full codegen).
Hydrogen tolerates null arguments_shadow().
In codegen-<arch> arguments object is allocated eagerly to capture values before they get modified.
Review URL: http://codereview.chromium.org/6625048/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-07 19:23:46 +00:00
kmillikin@chromium.org
4a9056cbce
Fix a stack-height mismatch during deoptimization.
...
When deoptimizing after a conditional expression in an effect context, we
should not see the value of the conditional expression.
BUG=v8:1237
Review URL: http://codereview.chromium.org/6625057
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-07 17:01:12 +00:00
mmaly@chromium.org
3c51baa1ac
Throw if setting length of a string in strict mode.
...
BUG=
TEST=test/mjsunit/strict-mode.js
Review URL: http://codereview.chromium.org/6623002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 21:12:29 +00:00
mmaly@chromium.org
9dc156ac62
Passing strict mode throughout SetElement.
...
Throw if assigning to read only element.
Adding tests for element assignment in strict mode.
Fix tests for strict mode SetElement.
Review URL: http://codereview.chromium.org/6613005/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 00:21:52 +00:00
mmaly@chromium.org
1d040083b0
Assignment to read only properties throws in strict mode.
...
Review URL: http://codereview.chromium.org/6594037/
Revert "Revert "Assignment to read only properties throws in strict mode.""
This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 04:53:43 +00:00
vitalyr@chromium.org
d9b0c93d23
Allow eval to be overridden with a callable non-function object.
...
We simply need to remove early checks in the resolve eval runtime
functions. CallFunctionStub that follows will handle non-functions in
the right way.
Review URL: http://codereview.chromium.org/6591075
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 19:05:06 +00:00
fschneider@chromium.org
8a72161585
Add lazy deoptimization environment to instanceof by marking it as a call.
...
This fixes an assert when an exception is thrown inside instanceof.
BUG=v8:1207
TEST=mjsunit/regress/regress-1207.js
Review URL: http://codereview.chromium.org/6588083
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 15:37:24 +00:00
sgjesse@chromium.org
7b0f5d4110
ARM: Support inlined version of %_FastAsciiArrayJoin on ARM
...
Review URL: http://codereview.chromium.org/6594071
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6994 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 14:09:23 +00:00
ricow@chromium.org
78a21647b9
Remove exception for mjsunit/regress/regress-deopt-gc on arm and x64.
...
This was wrongly marked as skip since we do not need to patch reloc info on x64 and arm when doing deoptization (issue 1094).
Review URL: http://codereview.chromium.org/6597067
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6984 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 11:36:45 +00:00
kmillikin@chromium.org
6b1530ea6d
Fix a stack height mismatch when deoptimizing.
...
When deoptimizing from the key subexpression of a keyed arguments access,
the unoptimized code expects to find the value of the receiver on the
expression stack. The environment of the optimizing compiler did not
contain this value during evaluation of the key subexpression.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 09:32:45 +00:00
ricow@chromium.org
c63d9c97cf
Do not allow non-configurable global properties to be made configurable (fixes issue 1213).
...
We do not currently check that a global property is actually
configurable before overwriting it with a new property.
Review URL: http://codereview.chromium.org/6597045
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 08:09:17 +00:00
mmaly@chromium.org
749b69853a
Revert "Assignment to read only properties throws in strict mode."
...
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353
Assignment to read only properties throws in strict mode.
...
Review URL: http://codereview.chromium.org/6594037/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 01:42:37 +00:00
mmaly@chromium.org
bb0c22f11c
Strict mode - allow function only in SourceElements.
...
Review URL: http://codereview.chromium.org/6598023/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6975 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-28 19:07:02 +00:00
mmaly@chromium.org
180b6ec6b4
Disable const in strict mode.
...
Using const in strict mode yields SyntaxError.
Review URL: http://codereview.chromium.org/6592031/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-28 18:38:17 +00:00
ager@chromium.org
7c561be519
Remove Error.prototype.toStrings prototype property.
...
I did not use the helper function for adding this builtin function which meant that I missed the removal of the prototype property.
BUG=
TEST=
Review URL: http://codereview.chromium.org/6588050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6971 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-28 13:29:05 +00:00
vegorov@chromium.org
88b70c8941
When checking number of parameters in MakeCrankshaft code don't forget about receiver.
...
BUG=v8:1209
TEST=test/mjsunit/regress/regress-1209.js
Review URL: http://codereview.chromium.org/6591042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-28 13:20:10 +00:00
lrn@chromium.org
485f4ea0d9
Clear exceptions set during attempts to lazily optimize.
...
Resubmit of patch for issue 1145 with a few additions:
- Now also clears exceptions when calling Runtime_LazyRecompile.
- Sets function where parsing fails to not be optimizable.
BUG=v8:1145
TEST=test/mjsunit/regress/regress-1145.js
Review URL: http://codereview.chromium.org/6469050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-25 11:17:31 +00:00
antonm@chromium.org
da463ab484
Get property may throw an exception thanks to JS accessors.
...
Check result before and bail out if exception has been thrown.
BUG=v8:1172
TEST=test/mjsunit/regress/regress-1172-bis.js
Review URL: http://codereview.chromium.org/6580030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 17:42:56 +00:00
antonm@chromium.org
4718466e48
Landing for Zaheer.
...
Direct call accessor getter callbacks (arm implementation).
Original review: http://codereview.chromium.org/6462029/
Review URL: http://codereview.chromium.org/6576035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 15:39:09 +00:00
lrn@chromium.org
68f1c73a06
Fix array concat to follow the specification in the presence of element getters.
...
Also fix issue 1175 and 1177.
BUG=v8:1175
Review URL: http://codereview.chromium.org/6568007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 14:00:52 +00:00
karlklose@chromium.org
5572d24fc5
ARM: Fix DoubleToI.
...
BUG=1811
TEST=test/mjsunit/regress/regress-1181.js
Review URL: http://codereview.chromium.org/6573004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 10:07:35 +00:00
ricow@chromium.org
0d6d0e6cd1
Land update to sputnik tests.
...
Original cl:
http://codereview.chromium.org/6542066/
Landing to ensure sync with buildbot update.
Review URL: http://codereview.chromium.org/6579032
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 06:38:45 +00:00
ager@chromium.org
ae328e61b0
Properly reset external catcher if exception couldn't be externally caught.
...
We can wrongly assume that exception which is not intended to be caught
by external try/catch should be caught if this exception inherits
external catcher from some previous exception. To prevent that,
clear external catcher when processing exceptions which cannot be
externally caught.
BUG=v8:1184
TEST=test/mjsunit/regress/regress-1184.js
Review URL: http://codereview.chromium.org/6538081
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-23 06:55:47 +00:00
mmaly@chromium.org
3ff7aa0ea9
Fix for bug http://code.google.com/p/v8/issues/detail?id=1176 .
...
Review URL: http://codereview.chromium.org/6469083/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 17:20:25 +00:00
mikhail.naganov@gmail.com
56788625b6
Fix CPU profiling for Crankshaft.
...
The main issue was due to multiple recompilations of functions. Now
code objects are grouped by function using SFI object address.
JSFunction objects are no longer tracked, instead we track SFI object
moves. To pick a correct code version, we now sample return addresses
instead of JSFunction addresses.
tools/{linux|mac|windows}-tickprocessor scripts differentiate
between code optimization states for the same function
(using * and ~ prefixes introduced earlier).
DevTools CPU profiler treats all variants of function code as
a single function.
ll_prof treats each optimized variant as a separate entry, because
it can disassemble each one of them.
tickprocessor.py not updated -- it is deprecated and will be removed.
BUG=v8/1087,b/3178160
TEST=all existing tests pass, including Chromium layout tests
Review URL: http://codereview.chromium.org/6551011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 16:31:24 +00:00
ricow@chromium.org
45c63ffa6a
Add more generic version of reloc info padding to ensure enough space for reloc patching during deoptimization (fixes issue 1174).
...
The old version only added extra space when we did indirect calls, but
the problem remains the same with normal calls that can be represented
as a single byte. When doing patching each call will always be at
least 2 bytes long because we use RUNTIME_ENTY as the reloc mode.
Review URL: http://codereview.chromium.org/6541053
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 12:28:33 +00:00
ricow@chromium.org
8162d9029d
Fix second half of issue 1151, the first change (r6765) only fixed FunctionGetPrototype, not FunctionSetPrototype.
...
Review URL: http://codereview.chromium.org/6548008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 12:27:36 +00:00
fschneider@chromium.org
031062d246
Fix bug with input representation of HValueOf.
...
The class did not correctly implement the RequiredInputRepresentation.
I changed this functions to be abstract so that all hydrogen classes
must implement it.
As a convention instructions with zero input operands return None as input
representation.
Instructions that can handle all input representations without converting before
also have None as required input representation (e.g. HTest)
All other instructions need a proper required input representation.
Review URL: http://codereview.chromium.org/6538088
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 12:14:53 +00:00
mmaly@chromium.org
fb20f7fc75
CallIC and KeyedCallIC not wrapping this for strict mode functions.
...
Fix CallIC and KeyedCallIC to correctly use Handle<Object>.
Review URL: http://codereview.chromium.org/6523052
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6874 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-22 00:39:21 +00:00
kmillikin@chromium.org
123dbb2f5e
Change the baseline compiler to match the Hydrogen graph builder.
...
The Hydrogen graph translation does not build a branch for unary negation in
an effect context, so the baseline compiler should not do so either.
Review URL: http://codereview.chromium.org/6546050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6871 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-21 16:49:39 +00:00
ager@chromium.org
c2969bfb1a
Implement pixel array elements access in the presence of an
...
interceptor that does not handle the elements load.
Review URL: http://codereview.chromium.org/6551001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-21 15:59:23 +00:00
ager@chromium.org
01cd10569f
Remove passing tests from ARM test expectations. Yay!
...
TBR=karlklose@chromium.org
Review URL: http://codereview.chromium.org/6548006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-21 11:58:19 +00:00
ager@chromium.org
0bd776a94f
Remove passing tests from expectations. Yay!
...
Review URL: http://codereview.chromium.org/6488028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6864 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-21 11:55:45 +00:00
ager@chromium.org
fc7e79a838
x64: Implement the missing generic load and store operations.
...
Review URL: http://codereview.chromium.org/6541019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6852 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 12:54:43 +00:00
antonm@chromium.org
e79bfcaf3f
Use [[DefineOwnProperty]] to put 'constructor' field on the protoype object.
...
That better follows ECMA-262 (see 13.2 Creating Function Objects) and allows
to ignore nasty JS accessors for 'constructor' property.
BUG=v8:1172
TEST=test/mjsunit/regress/regress-1172.js
Review URL: http://codereview.chromium.org/6531037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 10:53:38 +00:00
ricow@chromium.org
95892799e1
Add access checks to Object.preventExtensions + add regression test for 1027.
...
Object.preventExtensions can currently be used cross-domain. With this
change we follow firefox (IE9 has our current behaviour). In addition
this includes a regression test for 1027 and access tests for
Object.seal and Object.freeze.
Review URL: http://codereview.chromium.org/6534019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 10:39:02 +00:00
mmaly@chromium.org
f0df4a6c9e
Revert "This is not wrapped for strict mode and builtin functions."
...
This reverts commit 6845
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 21:56:37 +00:00
ager@chromium.org
963472c516
Change behavior of global declarations in the presence of setters.
...
Call accessors in the global object prototype when initializing global
variables. Function declarations are special cased for compatibility
with Safari and setters are not called for them. If this special
casing was not done webkit layout tests would fail.
Make the declaration of global const variables in the presence of
callbacks a redeclaration error.
Handle const context slot declarations conflicting with a CALLBACK as
a redeclaration error. That is, unless it is on a context extension
object which is not a real object and therefore conceptually have no
accessors in prototype chains. Accessors in prototype chains of
context extension objects are explicitly ignored in SetProperty.
Review URL: http://codereview.chromium.org/6534029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 21:04:53 +00:00
mmaly@chromium.org
bb7b014988
This is not wrapped for strict mode and builtin functions.
...
CallIC and KeyedCallIC do not wrap this when calling builtin
and strict mode functions.
Review URL: http://codereview.chromium.org/6523052
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 17:52:03 +00:00
ager@chromium.org
65addc5165
Revert change to const and global variable declarations. It causes
...
may WebKit layout test failures.
I will look into it tomorrow.
TBR=kmillikin@chromium.org
Review URL: http://codereview.chromium.org/6537021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 16:54:49 +00:00
ager@chromium.org
dc38755aba
Call accessors in the global object prototype when initializing global
...
variables.
Make the declaration of global const variables in the presence of
callbacks a redeclaration error.
Handle const context slot declarations conflicting with a CALLBACK as
a redeclaration error. That is, unless it is on a context extension
object which is not a real object and therefore conceptually have no
accessors in prototype chains. Accessors in prototype chains of
context extension objects are explicitly ignored in SetProperty.
Review URL: http://codereview.chromium.org/6519050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6841 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 16:30:15 +00:00
lrn@chromium.org
246560b902
Revert 6832.
...
The test contains a syntax error that shouldn't be detected, but it sometimes is.
TBR: kmillikin@chromium.org
Review URL: http://codereview.chromium.org/6519049
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6836 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 14:13:25 +00:00
kmillikin@chromium.org
b02107284a
Fix incorrect deoptimization for logical not in an effect context.
...
The baseline compiler does not materialize a value for expressions of
the form !expr in an effect context so the graph translation should
not produce such an environment, otherwise we risk targeting it by
deoptimization.
BUG=v8:1167
Review URL: http://codereview.chromium.org/6537018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 13:05:49 +00:00
lrn@chromium.org
cf50c5e27c
Handle exceptions thrown while parsing lazy functions for inlining.
...
We currently leave the exception as pending without returning a Failure::Exception() value. This is either caught immediately if running with --debug-code, or caught later by an assert in debug mode.
This change makes the pending exception be cleared before returning from the failed optimization attempt.
BUG=v8::1145
TEST=test/mjsunit/regress/regress-1145.js
Review URL: http://codereview.chromium.org/6524039
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 12:23:18 +00:00
kmillikin@chromium.org
82cdd48b2f
Fix a bug in deoptimization after logical expressions in an effect context.
...
When deoptimizing to after an expression of the form (expr0 || expr1)
or (expr0 && expr1) in an effect context, the unoptimized code could
incorrectly see the value of the expression.
Handle the short-circuit binary operators specially in effect contexts.
This fixes the issue and will generate better code when the left
subexpression is boolean-valued.
BUG=v8:1166
Review URL: http://codereview.chromium.org/6519046
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 11:06:50 +00:00
ager@chromium.org
ec841bb97d
Attempt to disambiguate RUNTIME_FUNCTION for win64 build in serialization tests.
...
BUG=
TEST=
Review URL: http://codereview.chromium.org/6526049
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6821 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 13:56:23 +00:00
ager@chromium.org
a504d4bc01
Blargh. Yet another shot in the dark attempt to fix win64 compile.
...
BUG=
TEST=
Review URL: http://codereview.chromium.org/6480116
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 13:42:26 +00:00
ager@chromium.org
cde03d2fba
Another attempt to fix win64 compile.
...
BUG=
TEST=
Review URL: http://codereview.chromium.org/6525051
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 13:37:26 +00:00
danno@chromium.org
12b4e0efe7
Implement crankshaft support for pixel array stores.
...
Review URL: http://codereview.chromium.org/6528013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 13:31:12 +00:00
ager@chromium.org
4235110a82
Speculative fix for win64 build breakage.
...
strstr returns a pointer and we are using an int to store a pointer difference. Using intptr_t instead.
Review URL: http://codereview.chromium.org/6529049
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 13:24:40 +00:00
ager@chromium.org
a0364d795d
Handle indexed properties on value objects correctly.
...
As with named properties, search the value wrapper prototypes for properties.
Review URL: http://codereview.chromium.org/6526046
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 12:10:48 +00:00
antonm@chromium.org
6b4ff18b5b
Properly process try/finally blocks.
...
In some circumstances, try/finally block can actually catch the exception:
function f() {
try {
throw 42;
} finally {
return 0;
}
}
Therefore when propagating exception to v8::TryCatch, we must be sure
there is no try/finally blocks as well.
When bulding the messages we should be more conservative and expect that
any v8::TryCatch with no JS try/catch in between can potentionally
be the right exception handler.
Plus various minor refactorings.
BUG=1147
TEST=cctest/test-api/TryCatchAndFinallyHidingException, cctest/test-api/TryCatchAndFinally
Review URL: http://codereview.chromium.org/6526016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 11:40:48 +00:00
lrn@chromium.org
9ec16dfe68
Fix bug 1137. No longer allow the RegExp /(*)/.
...
BUG=v8:1137
TEST=test/mjsunit/regexp.js
Review URL: http://codereview.chromium.org/6499016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6802 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 08:10:47 +00:00
mmaly@chromium.org
582cf097e9
Strict mode "this" transformation in Function.call/Function.apply.
...
In strict mode the transformation of "this" is skipped.
Code review feedback.
Testing memory operand against 8 bit IMM on ia32 and x64.
Review URL: http://codereview.chromium.org/6524006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 18:57:37 +00:00
vitalyr@chromium.org
4143e4c097
Fix issue 1160: check array elements in ArrayJoin.
...
Review URL: http://codereview.chromium.org/6529020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 15:12:51 +00:00
ricow@chromium.org
a8d4360d65
Make sure we always have room for patching the reloc info during lazy deoptimization (fixes issue 1156).
...
Before we could have calls to builtins that would not be in the
relocation info since this used a register as target. Whenever we have
this case (from lithium codegen) we now emit a comment in the reloc
info.
Review URL: http://codereview.chromium.org/6499015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 14:36:12 +00:00
ricow@chromium.org
0648103e8c
x64: Port OSR to the x64 platform.
...
Review URL: http://codereview.chromium.org/6515012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 13:37:10 +00:00
ricow@chromium.org
4d07390196
Add access check when Object.keys is called on the global js proxy (fixes issue 1154)
...
I will land access checks for a range of ES5 features in another patch (we added a bunch of cases like this in the past few weeks, i.e., cases where we simply use the global object instead of the js global proxy).
Review URL: http://codereview.chromium.org/6499013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 10:39:22 +00:00
mmaly@chromium.org
9adaeb6a17
Strict mode delete of non-configurable property.
...
Strict mode flag is passed to runtime DELETE function
and then to JSObject::Delete(Property/Element) as STRICT_DELETION enum.
When deleting non-configurable property/eleemnt, TypeError is thrown.
Adding mozilla test to .gitignore.
Incorporate CR feedback.
Review URL: http://codereview.chromium.org/6515005/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 23:41:47 +00:00
danno@chromium.org
36088cb64f
Implement specialized IC code stubs for pixel array stores.
...
Review URL: http://codereview.chromium.org/6478027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 21:21:33 +00:00
mmaly@chromium.org
7e6bbab2c8
Strict mode delete of unqualified identifier.
...
SyntaxError is reported in strict mode when deleting
an unqualified identifier. (11.4.1 of Ecma-262 5th ed)
Review URL: http://codereview.chromium.org/6516003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 18:44:26 +00:00
antonm@chromium.org
186d832c79
Introduce new runtime function to make join with lower memory usage.
...
Do not use generic StringBuilderConcat which requires array passed
to keep both elements and separator (which roughly double size
of the array). That should be faster as well.
BUG=crbug.com/54580
Review URL: http://codereview.chromium.org/6520004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 17:25:12 +00:00
whesse@chromium.org
1e4800b918
X64 Crankshaft: Fix error in pushed register indices for safepoints. Fixes issue 1153.
...
BUG=1153
TEST=mjsunit/date-parse
Review URL: http://codereview.chromium.org/6518007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 16:02:02 +00:00
whesse@chromium.org
7233a930b5
X64 Crankshaft: Add test that fails on x64 Crankshaft build to list of skipped mjsunit tests. Fix comments and remove unused function from date.js.
...
BUG=1153
TEST=mjsunit/date-parse
Review URL: http://codereview.chromium.org/6516011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 13:57:15 +00:00
fschneider@chromium.org
ad70b7de39
Fix a potential crash bug in keyed calls for non-string keys.
...
BUG=v8:1146
Review URL: http://codereview.chromium.org/6517010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 13:13:41 +00:00
kmillikin@chromium.org
c73ce4f126
Fix a duplicate AST ID recorded for for/in.
...
Avoid visiting the subexpressions of a variable that rewrites to a property
when occurring as the 'left-hand side' of for/in.
BUG=v8:1149
Review URL: http://codereview.chromium.org/6475009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 12:51:25 +00:00
karlklose@chromium.org
e0552d77cf
ARM: Implement PatchStackCheckCodeAt and RevertStackCheckCode.
...
Remove a failing test expectation from mjsunit.status.
Review URL: http://codereview.chromium.org/6410029
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 12:07:48 +00:00
ricow@chromium.org
34eeb88ee4
Use ForceSetObjectProperty in DefineOrRedefineDataProperty (fixes crbug 72736).
...
The current version uses SetObjectProperty which will not set the
value in case this is a readonly property. The spec explictly says
that a configurable but non writable property can have its value
changed with Object.defineProperty (because the same thing can be
accomplished by doing 3 calls (set writable to true, update the value,
set writable to false).
Review URL: http://codereview.chromium.org/6518004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 10:43:21 +00:00
ricow@chromium.org
6d9fde492c
Do not allow calls to SetProtoType on functions that should not have a prototype (fixes issue 1151)
...
Review URL: http://codereview.chromium.org/6518003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 09:37:56 +00:00
ricow@chromium.org
46bde305b5
Add support for the global object in Object.keys (fixes issue 1150)
...
We do not currently handle the case where the JSGlobalProxy is passed
as argument to LocalKeys in runtime.cc.
Review URL: http://codereview.chromium.org/6516008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 07:49:13 +00:00
mmaly@chromium.org
e0be3072b5
Implement assignment to undefined reference in ES5 Strict Mode.
...
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.
Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.
Code Review URL: http://codereview.chromium.org/6474026/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-13 16:19:53 +00:00
mmaly@chromium.org
3f4701df7f
Revert r6756. Check failed on V8 arm - debug - crankshaft.
...
Need to investigate.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 23:25:07 +00:00
mmaly@chromium.org
fd6338bdda
Implement assignment to undefined reference in ES5 Strict Mode.
...
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.
Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.
Code Review URL: http://codereview.chromium.org/6474026/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 21:39:59 +00:00
antonm@chromium.org
e96c24bf03
Properly treat exceptions thrown while compiling.
...
BUG=v8:1132
TEST=test/mjsunit/regress/regress-1132.js
Review URL: http://codereview.chromium.org/6487021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 14:26:56 +00:00
lrn@chromium.org
fdfbdfbcf5
Fix typo in ASSERT in object-verifier for RegExp.
...
BUG=v8::1129
TEST=test/mjsunit/regress/regress-1129.js
Review URL: http://codereview.chromium.org/6476027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:43:01 +00:00
ricow@chromium.org
512a02764f
X64: Add DoCallNamed, DoContext, DoCallGlobal, and DoLoadFunctionPrototype lithium instructions.
...
Review URL: http://codereview.chromium.org/6471025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 16:33:01 +00:00
antonm@chromium.org
ab24485760
Bypass JS accessors when building error array.
...
In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement
may throw or its behaviour can be altered. Instead operate on plain FixedArrays and
turn them into JSArry later.
BUG=v8:1130
TEST=test/mjsunit/regress/regress-1130.js
Review URL: http://codereview.chromium.org/6481001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 15:02:13 +00:00
antonm@chromium.org
5d3430a509
Fix forging of object's identity hashes.
...
Do not do standard property lookup on hidden properties object as it might
reach Object.prototype which can be altered to forge identity hashes.
Instead do only local lookup.
Review URL: http://codereview.chromium.org/6472001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 14:09:52 +00:00
fschneider@chromium.org
5b753cecb6
Check holder before optimizing calls to global functions.
...
In the case where the function is not found in the global object,
we have to generate a generic call.
BUG=v8:1106
TEST=mjsunit/regress/regress-1106.js
Review URL: http://codereview.chromium.org/6483010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:33:51 +00:00
vegorov@chromium.org
49adfd0f0a
Bailout from PrepareSlowElementsForSort when hiting a key outside of smi-range.
...
BUG=v8:1131
TEST=test/mjsunit/regress/regress-1131.js
Review URL: http://codereview.chromium.org/6469006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:33:34 +00:00
danno@chromium.org
1bd9f602be
Implement crankshaft support for pixel array loads.
...
Review URL: http://codereview.chromium.org/6410112
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:02:36 +00:00
mikhail.naganov@gmail.com
12e62e7154
Shorten constructor names in JS tickprocessor.
...
As they are no more used in DevTools profiler, there is no
need to prefix them with "devtools.profiler" namespace.
Review URL: http://codereview.chromium.org/6456025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 07:47:28 +00:00
antonm@chromium.org
2f17f3e5d7
Do not invoke any setters when forming stack trace JS object.
...
Review URL: http://codereview.chromium.org/6463022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 19:34:04 +00:00
antonm@chromium.org
47a22dcecd
Reapply http://code.google.com/p/v8/source/detail?r=6555
...
Compare JSObjects by identity immediately.
When invoking EQUALS JS builtin, 1st argument is passed as a receiver and
if it's a global object, it gets overwritten with global proxy object and
thus one gets incorrect results.
BUG=v8:1082
TBR=ricow@chromium.org
Review URL: http://codereview.chromium.org/6461028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 19:09:26 +00:00
kmillikin@chromium.org
dc91c4218b
Make optimized Function.prototype.apply safe for non-JSObject first arguments.
...
If we have a property access of the form this.x, where the access site sees
the global object, we can specialize the IC stub so that it performs a map
check without first performing a heap object check.
Ensure that we do not get in JS code with a non-JSObject this value by
deoptimizing at Function.prototype.apply if the first argument is not a
JSObject.
BUG=v8:1128
Review URL: http://codereview.chromium.org/6463025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 16:43:23 +00:00
whesse@chromium.org
0fb5a1fd1a
Add a regression test for issue 1106, optimized access to the prototype chain of the global object.
...
Review URL: http://codereview.chromium.org/6459023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 15:50:39 +00:00
lrn@chromium.org
d358e2ecd3
Fix incorrect asserts in scanner.
...
BUG=v8::1126
TEST=test/mjsunit/regress/regress-1126.js
Review URL: http://codereview.chromium.org/6459021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:16:25 +00:00
floitschV8@gmail.com
96c4f62b73
Add two tests to strtod.
...
Review URL: http://codereview.chromium.org/6461018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 14:12:31 +00:00
whesse@chromium.org
afec61e870
Fix typo in r6697: Use assertThrows correctly in the added test regress-1122.js.
...
Review URL: http://codereview.chromium.org/6460030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 13:16:40 +00:00
whesse@chromium.org
602d5cf427
Fix a bug that occurs when functions are defined with more than 16,382 parameters.
...
Review URL: http://codereview.chromium.org/6447007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 12:46:22 +00:00
fschneider@chromium.org
eec7bc8e60
Change the code for materializing double constants on ia32.
...
Instead of using the stack, use a temporary integer register
and avoid memory access.
Review URL: http://codereview.chromium.org/6452002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 12:39:15 +00:00
kmillikin@chromium.org
991a1cae12
Fix an assertion failure in stack trace construction.
...
When constructing stack traces we interpret the deoptimization data for
optimized frames to find the receiver value. This value could sometimes be
eliminated from the deoptimization data if we though it was unused.
BUG=v8:1118
Review URL: http://codereview.chromium.org/6465023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 11:45:50 +00:00
antonm@chromium.org
d724993138
Use GC-safe version when setting elements.
...
BUG=1125
TEST=test/mjsunit/regress/regress-1125.js
Review URL: http://codereview.chromium.org/6463001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 11:38:10 +00:00
antonm@chromium.org
cf30cefda7
Check if Array.prototype.__proto__ has been reset to null.
...
BUG=v8:1121
TEST=test/mjsunit/regress/regress-1121.js
Review URL: http://codereview.chromium.org/6454004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:56:44 +00:00
antonm@chromium.org
0273e8185b
Propagate exceptions thrown when setting elements.
...
Plus use more robust path when formatting messages---work
directly with fixed arrays.
BUG=v8:1107
TEST=test/mjsunit/getter-in-prototype.js,test/mjsunit/regress/regress-1107.js
Review URL: http://codereview.chromium.org/6451004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:42:14 +00:00
antonm@chromium.org
da8b72f2b8
1) Return failure if any of property sets failed;
...
2) We cannot assert the declared property will go to the extension in the presence of callbacks and interceptors.
BUG=1119
TEST=test/mjsunit/regress/regress-1119.js
Review URL: http://codereview.chromium.org/6454011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:04:17 +00:00
ager@chromium.org
096c21522b
Fix wrong assumption in parser that parsing a function literal cannot throw an exception.
...
Review URL: http://codereview.chromium.org/6453009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 18:46:13 +00:00
ager@chromium.org
8c6c273236
Fix issues with using defineProperty on the global proxy object.
...
Review URL: http://codereview.chromium.org/6452004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 16:31:58 +00:00
ricow@chromium.org
f64966085e
x64: Add MulI and DivI to lithium instructions.
...
Review URL: http://codereview.chromium.org/6448001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 14:37:50 +00:00
lrn@chromium.org
2f32f27e8f
Correct propagation of exceptions from setters.
...
BUG=v8:1105
TEST=test/mjsunit/regress/regress-1105.js
Review URL: http://codereview.chromium.org/6451003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 14:04:27 +00:00
kmillikin@chromium.org
bf3c3eb9cb
Fix a possible duplicate AST ID for deoptimization.
...
For redeclarations of variables that alias the parameters in functions
using arguments, we need to avoid re-visiting the shared variable
rewrite.
BUG=v8:1104
Review URL: http://codereview.chromium.org/6453004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 14:00:22 +00:00
ricow@chromium.org
20f2c1c98a
Make sure that we do not call is_extensible on the global proxy.
...
When calling Object.isExtensible we did not do a check for the global
js proxy. This caused the check on the extensible bit on the map to
return true, even when the bit was set to false on the global js
object.
Review URL: http://codereview.chromium.org/6450003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 13:09:07 +00:00
ricow@chromium.org
81787f986b
Make sure that we never call prevent extension on the global proxy,
...
but instead call this on the global object.
BUG: 1103
Review URL: http://codereview.chromium.org/6454001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 12:41:16 +00:00
lrn@chromium.org
48fadffcc4
Fix bug in JSON.parse for objects containing "__proto__" as key.
...
It added the __proto__ key as a normal key, which made it visible
in enumeration, while reading still hit the hard-coded accessor.
Review URL: http://codereview.chromium.org/6451002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6674 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 11:38:15 +00:00
mmaly@chromium.org
2926151fdc
Clean up es5conform.status per feedback.
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-07 16:51:47 +00:00
ricow@chromium.org
7d530e1950
Re-insert exception for mozilla/ecma/Date/15.9.5.10-2 in release mode on arm
...
The last change to mozilla.status made the assumption that this test always finish on time when in release mode, but that is not the case on arm. This change just skips the test completely on arm.
Review URL: http://codereview.chromium.org/6250193
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-07 12:07:21 +00:00
ricow@chromium.org
0c52785f1e
Remove exceptions for Function.prototype.bind from es5conform.status.
...
These exceptions are no longer valid since we do implement bind.
Review URL: http://codereview.chromium.org/6410116
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-07 08:34:42 +00:00
ricow@chromium.org
75df563bb8
Simplify exceptions for ecma/Date/15.9.5.10-2 in mozilla.status
...
We had a large number of different exceptions for this test in the
mozilla.status file - changing this to only one exception where we
allow fail and timeout in debug mode.
Review URL: http://codereview.chromium.org/6286143
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-07 08:34:33 +00:00
mmaly@chromium.org
6d5e9c88ba
Fix es5conform.status expectation file.
...
The strict mode tests were disabled until now.
The propagation of strict mode flag into eval enabled them but there are
failures due to unimplemented features of strict mode, as well as some
incorrect tests in the suite.
TBR=ager@chromium.org , lrn@chromium.org
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 22:07:10 +00:00
peterhal@chromium.org
39957aa741
Issue 117 - strict mode and future reserved words
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6653 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 18:36:37 +00:00
mmaly@chromium.org
87233c49c8
Pass strict mode to eval.
...
Code review feedback.
Code Review URL: http://codereview.chromium.org/6286043/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 18:15:49 +00:00
vegorov@chromium.org
10f715e3ff
Restore context after LApplyArguments.
...
BUG=v8:1099
TEST=test/mjsunit/regress/regress-1099.js
Review URL: http://codereview.chromium.org/6246106
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 15:42:02 +00:00
whesse@chromium.org
47f425b490
Disable Mozilla date test that times out on X64 crankshaft.
...
BUG=1100
TEST=ecma/Date/15.9.5.10-2.js
Review URL: http://codereview.chromium.org/6246104
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 14:40:23 +00:00
lrn@chromium.org
19b734fd82
Fix potential overwriting of debug jumps of following code.
...
Add JSArrayLength, CallKnownFunction, and InstanceType operations.
Remove LadGlobal and StoreGlobal again (they fail).
Review URL: http://codereview.chromium.org/6347067
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 14:09:03 +00:00
antonm@chromium.org
aecb05354b
Landing for Zaheer Ahmad.
...
Direct call api functions (arm implementation)
See: http://codereview.chromium.org/6170001/
Review URL: http://codereview.chromium.org/6286078
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 13:43:38 +00:00
sgjesse@chromium.org
84de496896
Implements DoubleToI on ARM. Refactor some VFP code at the same time and
...
fix the simulator behaviour.
BUG=none
TEST=added to cctest/test-assembler-arm.cc
Patch by Rodolph Perfetta from ARM Ltd.
Review URL: http://codereview.chromium.org/6368053
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 07:08:50 +00:00
peterhal@chromium.org
c894b1f317
Fix bugs 992, 1083 and 1092
...
My previous patch added an assert which uncovered 1092 in the sputnik tests.
This patch adds the fix for 1092, which is to ensure that NormalizeProperties
does not get called for a JSGlobalProxy along all code paths.
Add sputnik tests to .gitignore.
BUG=
TEST=
Review URL: http://codereview.chromium.org/6286060
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 19:29:10 +00:00
antonm@chromium.org
710fbd2cfb
Do proper security checks when accessing elements with getOwnPropertyDescriptor.
...
This extends logic applied to regular properties to elements.
Review URL: http://codereview.chromium.org/6246055
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 18:09:51 +00:00
whesse@chromium.org
1853458a39
Fix X64 Windows compilation.
...
Review URL: http://codereview.chromium.org/6312120
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6621 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 15:14:46 +00:00
ricow@chromium.org
a2aa84873e
Add regression test for the deoptimizer immediately followed by gc bug.
...
In addition to the regression test I changed the gc-extension to take
a boolean flag specifying if compaction should be used (default is
false, existing tests will not change behaviour)
The regression test is disabled on arm and x64 with crankshaft
enabled. I made a bug to track this:
http://code.google.com/p/v8/issues/detail?id=1094
Review URL: http://codereview.chromium.org/6312118
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6619 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 13:47:27 +00:00
antonm@chromium.org
73348e83ea
Fix array boundary error.
...
It made value of allowed_access_type[v8::ACCESS_KEYS] be a wild value. On most of
platforms it was 0 and tests passed. But on ARM (and on ia32 if you alter test a bit)
it could become true and hence allow enumeration of properties.
Review URL: http://codereview.chromium.org/6334089
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6618 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 13:30:22 +00:00
whesse@chromium.org
3a52b68447
Fix compilation on 64-bit Windows, update Visual Studio projects.
...
Review URL: http://codereview.chromium.org/6312119
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 13:29:10 +00:00
danno@chromium.org
a2fb4a12bb
Create specialized code stubs for PixelArray loads.
...
Review URL: http://codereview.chromium.org/6287030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 12:50:50 +00:00
whesse@chromium.org
fe67b206ca
Fix X64 compilation on Windows.
...
Review URL: http://codereview.chromium.org/6334086
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 11:13:04 +00:00
antonm@chromium.org
0da3dc3e43
Properly process getOwnPropertyDescriptor for elements on global proxy object.
...
We need to go down to actual global object to perform those operations.
Review URL: http://codereview.chromium.org/6246054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6612 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 10:19:41 +00:00
antonm@chromium.org
fed5622671
Better security checks when accessing named properties via Object.getOwnPropertyDescriptor.
...
Current approach returns undefined descriptor if caller is not granted v8::HAS_ACCESS.
If the caller has v8::HAS_ACCESS, for no JS accessors regular v8::GET_ACCESS check is
performed and value property of the descriptor is set to undefined if caller doesn't
have proper access. For JS accessors both v8::GET_ACCESS and v8::SET_ACCESS are checked
and affect if getter and setter would be stored in the descriptor.
Review URL: http://codereview.chromium.org/6286020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-02 17:44:29 +00:00