Commit Graph

1931 Commits

Author SHA1 Message Date
littledan
dd50262933 Revert of Rewrite scopes of non-simple default arguments (patchset #5 id:80001 of https://codereview.chromium.org/2077283004/ )
Reason for revert:
Seems to close tree (but it could be an infra issue)

Original issue's description:
> Rewrite scopes of non-simple default arguments
>
> Default parameters have additional declaration block scopes inserted
> around them when something in the function scope calls eval. This
> patch sets the parent scope of the expressions introduced due to
> those defaults to the new block scope.
>
> R=adamk
> BUG=chromium:616386
>
> Committed: https://crrev.com/0e14baf712955a1993f742647bb2adc293702b80
> Cr-Commit-Position: refs/heads/master@{#37198}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2081323006
Cr-Commit-Position: refs/heads/master@{#37201}
2016-06-22 19:58:10 +00:00
littledan
0e14baf712 Rewrite scopes of non-simple default arguments
Default parameters have additional declaration block scopes inserted
around them when something in the function scope calls eval. This
patch sets the parent scope of the expressions introduced due to
those defaults to the new block scope.

R=adamk
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2077283004
Cr-Commit-Position: refs/heads/master@{#37198}
2016-06-22 18:22:18 +00:00
mlippautz
7a88ff3cc0 [heap] Filter out stale left-trimmed handles for scavenges
The missing part from
  https://codereview.chromium.org/2078403002/

R=jochen@chromium.org
BUG=chromium:621869
LOG=N

Review-Url: https://codereview.chromium.org/2077353004
Cr-Commit-Position: refs/heads/master@{#37184}
2016-06-22 12:22:46 +00:00
mlippautz
21b55c4aa5 [heap] Fix check in AdvancePage
Failing to do the right check in AdvancePage results in a crash in a CHECK later
in EnsureCurrentCapacity.

BUG=chromium:620750,chromium:622115
LOG=N
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2090013002
Cr-Commit-Position: refs/heads/master@{#37171}
2016-06-22 09:10:09 +00:00
yangguo
5eaf4ac48f [debugger] add test case for scope materialization and rest params.
R=jgruber@chromium.org
BUG=v8:4703

Review-Url: https://codereview.chromium.org/2088703002
Cr-Commit-Position: refs/heads/master@{#37169}
2016-06-22 08:35:28 +00:00
jwolfe
d8147eb98c Reland: change most cases of variable redeclaration from TypeError to SyntaxError.
Reland of https://codereview.chromium.org/2048703002/

Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
(this caused a test262 failure.). However, the code `eval("function NaN() {}");`
should actually throw a TypeError. This patch changes most cases of
redeclaration errors from TypeError to SyntaxError. See the test
mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
references.

The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
ES#sec-evaldeclarationinstantiation

BUG=v8:4955
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
R=adamk

Review-Url: https://codereview.chromium.org/2086063002
Cr-Commit-Position: refs/heads/master@{#37156}
2016-06-21 20:19:59 +00:00
bmeurer
5e0cd389bf [turbofan] MemoryOptimizer cannot deal with dead nodes in use lists.
We need to trim the graph before we execute the MemoryOptimizer, because
that just walks the effect chain from Start to End and cannot deal with
dead nodes in the use lists.

R=jarin@chromium.org
BUG=chromium:614292

Review-Url: https://codereview.chromium.org/2080703003
Cr-Commit-Position: refs/heads/master@{#37133}
2016-06-21 10:40:44 +00:00
bmeurer
7877ddecdb [builtins] Make sure the Math functions and constants agree.
While the EcmaScript specification doesn't define precise values for the
Math constants or the Math functions, we should at least ensure that the
values of the constants and the functions agree, i.e. Math.E should be
exactly the same value as Math.exp(1).

Also make sure that Math.exp(1) returns the expected value; we should
revisit the fdlibm algorithm and figure out why it's wrong in the last
bit.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=chromium:626111,v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2079233005
Cr-Commit-Position: refs/heads/master@{#37128}
2016-06-21 07:02:16 +00:00
mlippautz
d800a65967 [heap] Filter out stale left-trimmed handles
BUG=chromium:620553
LOG=N
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2078403002
Cr-Commit-Position: refs/heads/master@{#37108}
2016-06-20 14:32:15 +00:00
jgruber
198e09de5a [builtins] Use BUILTIN frame in DatePrototype_GetField
Construct a BUILTIN frame before throwing an exception from runtime.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2078443002
Cr-Commit-Position: refs/heads/master@{#37053}
2016-06-17 07:44:42 +00:00
jgruber
f47b9e9810 [builtins] Introduce a proper BUILTIN frame type.
This adds a new BUILTIN frame type, which supports variable number of
arguments for builtins implemented in hand-written native code (we will
extend this mechanism to TurboFan builtins at some point). Convert the
Math.max and Math.min builtins to construct a BUILTIN frame if required.

This does not yet work for C++ builtins, but that'll be the next step.

R=bmeurer@chromium.org, jarin@chromium.org
BUG=v8:4815
LOG=n

Review-Url: https://codereview.chromium.org/2069423002
Cr-Commit-Position: refs/heads/master@{#37051}
2016-06-17 07:41:34 +00:00
mstarzinger
e55384b28e [d8] Make exception reporting more resilient.
This makes sure exception reporting done by the debug shell behaves
gracefully even near the stack limit. When line number determination
fails we just fallback to not printing source information.

R=yangguo@chromium.org
TEST=mjsunit/regress/regress-crbug-620253
BUG=chromium:620253

Review-Url: https://codereview.chromium.org/2069543007
Cr-Commit-Position: refs/heads/master@{#37031}
2016-06-16 10:14:08 +00:00
bmeurer
47fb39e4de Revert of [turbofan] Properly handle dictionary maps in the prototype chain. (patchset #1 id:1 of https://codereview.chromium.org/2067423003/ )
Reason for revert:
As discussed offline with Toon, this is not the correct fix here.

Original issue's description:
> [turbofan] Properly handle dictionary maps in the prototype chain.
>
> Dictionary prototypes don't have stable maps, but still don't matter for
> element access. Generalized the JSNativeContextSpecialization a bit to
> handle everything that Crankshaft can handle in this regard.
>
> R=jarin@chromium.org
> BUG=chromium:616709
>
> Committed: https://crrev.com/1c7bdc7f6f4d9512f4982590bd949f265ee9c8c3
> Cr-Commit-Position: refs/heads/master@{#37019}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2076493002
Cr-Commit-Position: refs/heads/master@{#37029}
2016-06-16 09:17:35 +00:00
bmeurer
1c7bdc7f6f [turbofan] Properly handle dictionary maps in the prototype chain.
Dictionary prototypes don't have stable maps, but still don't matter for
element access. Generalized the JSNativeContextSpecialization a bit to
handle everything that Crankshaft can handle in this regard.

R=jarin@chromium.org
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2067423003
Cr-Commit-Position: refs/heads/master@{#37019}
2016-06-16 05:27:20 +00:00
gsathya
3624a5e110 Promises: Add regression test for promise resolution with proxy
BUG=v8:5004

Review-Url: https://codereview.chromium.org/2070213002
Cr-Commit-Position: refs/heads/master@{#37015}
2016-06-16 02:00:26 +00:00
mstarzinger
d21b50ad6a [test] Bump stack size of regression test.
This is to make sure the test in question does not run out of stack
space during bootstrapping on any configuration. Our fuzzers take the
test an run it against a broad spectrum of configuration. The new size
of 100 is used throughout our test suite as "the smallest" stack size.

R=jkummerow@chromium.org
TEST=mjsunit/regress/regress-1132
BUG=chromium:619744

Review-Url: https://codereview.chromium.org/2068993002
Cr-Commit-Position: refs/heads/master@{#36995}
2016-06-15 11:19:43 +00:00
mlippautz
d6473f5c14 [Heap] Fix comparing against new space top pointer
See bug description.

BUG=chromium:619382
LOG=N
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2065063002
Cr-Commit-Position: refs/heads/master@{#36968}
2016-06-14 13:52:01 +00:00
adamk
56ea2f9731 Array.prototype.slice should only normalize result if it's an array
R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2058013002
Cr-Commit-Position: refs/heads/master@{#36955}
2016-06-14 09:39:23 +00:00
littledan
85c2c8d847 Revert of change most cases of variable redeclaration from TypeError to SyntaxError (patchset #8 id:140001 of https://codereview.chromium.org/2048703002/ )
Reason for revert:
This is going to break the LayoutTest inspector-protocol/console/console-let-const-with-api.html as seen in https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/2247 . Please run this test manually, using instructions at https://www.chromium.org/developers/testing/webkit-layout-tests , and fix on the Chrome side if needed before resubmitting this patch.

Original issue's description:
> change most cases of variable redeclaration from TypeError to SyntaxError.
>
> Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
> (this caused a test262 failure.). However, the code `eval("function NaN() {}");`
> should actually throw a TypeError. This patch changes most cases of
> redeclaration errors from TypeError to SyntaxError. See the test
> mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
> references.
>
> The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
> ES#sec-evaldeclarationinstantiation
>
> BUG=v8:4955
> LOG=y
>
> Committed: https://crrev.com/2b787561763d0f7e8dab698652715a742cf78291
> Cr-Commit-Position: refs/heads/master@{#36940}

TBR=adamk@chromium.org,jwolfe@igalia.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4955

Review-Url: https://codereview.chromium.org/2064793002
Cr-Commit-Position: refs/heads/master@{#36941}
2016-06-13 18:23:57 +00:00
jwolfe
2b78756176 change most cases of variable redeclaration from TypeError to SyntaxError.
Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
(this caused a test262 failure.). However, the code `eval("function NaN() {}");`
should actually throw a TypeError. This patch changes most cases of
redeclaration errors from TypeError to SyntaxError. See the test
mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
references.

The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
ES#sec-evaldeclarationinstantiation

BUG=v8:4955
LOG=y

Review-Url: https://codereview.chromium.org/2048703002
Cr-Commit-Position: refs/heads/master@{#36940}
2016-06-13 18:14:41 +00:00
mstarzinger
e95cfafb67 Fix arguments object stubs for large arrays.
This fixes FastNewStrictArgumentsStub and FastNewRestParameterStub to no
longer assume that the strict arguments object being allocated will fit
into new-space. The case where said object needs to move to large object
space is now handled in the runtime.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-614727
BUG=chromium:614727

Review-Url: https://codereview.chromium.org/2054853002
Cr-Commit-Position: refs/heads/master@{#36917}
2016-06-13 08:25:43 +00:00
neis
6899f878ac [generators] Improve a test.
R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2056283002
Cr-Commit-Position: refs/heads/master@{#36895}
2016-06-10 13:27:27 +00:00
jkummerow
3b87e9aa03 Fix stale IC::receiver_map_ after prototype fastification
BUG=chromium:618845

Review-Url: https://codereview.chromium.org/2058063002
Cr-Commit-Position: refs/heads/master@{#36891}
2016-06-10 11:43:33 +00:00
neis
54b405ce65 [generators] Make runtime functions more robust.
Only look at the --ignition-generators flag when determining whether to use
Ignition (in compiler.cc).  In generator runtime functions, instead of looking
at the flag, determine the generator kind based on whether the generator has a
bytecode array.  This allows compiling some generator function using
full-codegen and others using Ignition, e.g when using --ignition-filter.

R=mstarzinger@chromium.org
BUG=chromium:618657,v8:4907

Review-Url: https://codereview.chromium.org/2052873002
Cr-Commit-Position: refs/heads/master@{#36864}
2016-06-09 14:20:58 +00:00
mstarzinger
206cf39851 [runtime] Deprecate RUNTIME_ASSERT from object ops.
This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=bmeurer@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2045193002
Cr-Commit-Position: refs/heads/master@{#36852}
2016-06-09 11:22:19 +00:00
bmeurer
eb1c9e2723 [es6] Fix prototype chain walk for instanceof.
When walking up the prototype chain during OrdinaryHasInstance, we first
check if the current prototype equals the expected one, and only
afterwards check the current prototype against null. That's obviously
wrong if we check something like Proxy, whose prototype is null.

R=yangguo@chromium.org
BUG=v8:5085

Review-Url: https://codereview.chromium.org/2041103007
Cr-Commit-Position: refs/heads/master@{#36840}
2016-06-09 06:26:03 +00:00
jkummerow
be0494ba5b Keep prototype maps in dictionary mode until ICs see them
Adding properties to prototypes is faster when we don't force their
maps into fast mode yet. Once a prototype shows up in the IC system,
its setup phase is likely over, and it makes sense to transition it
to fast properties.
This patch speeds up the microbenchmark in the bug by 20x.
Octane-Typescript sees a 3% improvement.

BUG=chromium:607010

Review-Url: https://codereview.chromium.org/2036493006
Cr-Commit-Position: refs/heads/master@{#36828}
2016-06-08 14:43:47 +00:00
yangguo
7c3cad2d14 [crankshaft] do not sign-extend int32 immediate in DoMathMinMax.
R=bmeurer@chromium.org
BUG=chromium:495493

Review-Url: https://codereview.chromium.org/2044353002
Cr-Commit-Position: refs/heads/master@{#36818}
2016-06-08 10:12:16 +00:00
mstarzinger
8e02f47ea1 [runtime] Deprecate RUNTIME_ASSERT from primitive ops.
This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=verwaest@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2041353003
Cr-Commit-Position: refs/heads/master@{#36815}
2016-06-08 09:29:27 +00:00
yangguo
ada6fa1fda Add test case for 85b8c2dc (fix observable array access in messages.js).
R=bmeurer@chromium.org
BUG=chromium:617527

Review-Url: https://codereview.chromium.org/2045153002
Cr-Commit-Position: refs/heads/master@{#36813}
2016-06-08 07:54:26 +00:00
machenbach
67af060318 Revert of [heap] Clear out of live range remembered set slots in large objects. (patchset #2 id:20001 of https://codereview.chromium.org/2043713006/ )
Reason for revert:
Fails arm sim:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/1012

Original issue's description:
> [heap] Clear out of live range remembered set slots in large objects.
>
> BUG=chromium:617882
> LOG=n
>
> Committed: https://crrev.com/38ad63ff15d7e379423be4c57ae94ae2c9ffb4af
> Cr-Commit-Position: refs/heads/master@{#36795}

TBR=ulan@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:617882

Review-Url: https://codereview.chromium.org/2042403002
Cr-Commit-Position: refs/heads/master@{#36799}
2016-06-07 18:32:33 +00:00
hpayer
38ad63ff15 [heap] Clear out of live range remembered set slots in large objects.
BUG=chromium:617882
LOG=n

Review-Url: https://codereview.chromium.org/2043713006
Cr-Commit-Position: refs/heads/master@{#36795}
2016-06-07 15:21:37 +00:00
ishell
3e0be8d7fc [runtime] Don't use ElementsTransitionAndStoreStub for transitions that involve instance rewriting.
BUG=chromium:617524, v8:5009
LOG=Y

Review-Url: https://codereview.chromium.org/2044003003
Cr-Commit-Position: refs/heads/master@{#36780}
2016-06-07 09:50:04 +00:00
yangguo
0b65799534 Remove accidentally added files.
These files somehow got added due to some rebase issues I had locally.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2042203002
Cr-Commit-Position: refs/heads/master@{#36772}
2016-06-07 07:13:53 +00:00
Yang Guo
7c3748a9c4 [debug] load correct stack slot for frame details.
R=bmeurer@chromium.org
BUG=v8:5071

Review URL: https://codereview.chromium.org/2045863002 .

Cr-Commit-Position: refs/heads/master@{#36769}
2016-06-07 06:25:15 +00:00
titzer
0b91952913 [asmjs] Validator should reject modules with repeated functions.
R=ahaas@chromium.org,aseemgarg@chromium.org,bradnelson@chromium.org
BUG=chromium:617525

Review-Url: https://codereview.chromium.org/2040983002
Cr-Commit-Position: refs/heads/master@{#36748}
2016-06-06 13:40:42 +00:00
titzer
dc98fabf15 [asmjs] Validator should reject assignments to heap variables in functions.
BUG=chromium:617529

Review-Url: https://codereview.chromium.org/2041843002
Cr-Commit-Position: refs/heads/master@{#36747}
2016-06-06 13:30:13 +00:00
mstarzinger
826627d9fd [turbofan] Make FindFrameStateBefore handle dead paths.
This makes sure {NodeProperties::FindFrameStateBefore} can deal with
effect chains that are marked as dead. This can happen when reducers
looking for frame states run together with other reducers killing some
execution paths within the same reduction phase.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-617567
BUG=chromium:617567,chromium:617224

Review-Url: https://codereview.chromium.org/2041833002
Cr-Commit-Position: refs/heads/master@{#36743}
2016-06-06 12:34:53 +00:00
bmeurer
f2da19fe39 [builtins] Migrate Math.log to TurboFan.
Introduce a dedicated Float64Log machine operator, that is either
implemented by a direct C call or by platform specific code, i.e.
using the FPU on x64 and ia32.

This operator is used to implement Math.log as a proper TurboFan
builtin on top of the CodeStubAssembler.

Also introduce a NumberLog simplified operator on top of Float64Log
and use that for the fast inline path of Math.log inside TurboFan
optimized code.

BUG=v8:5065

Review-Url: https://codereview.chromium.org/2029413005
Cr-Commit-Position: refs/heads/master@{#36703}
2016-06-03 09:48:25 +00:00
jarin
0d4c526a1d [crankshaft] Reland "Only exclude explicit 'arguments' (and 'this') from liveness analysis."
Reland of https://codereview.chromium.org/2026173003 (reverted by
https://codereview.chromium.org/2029563002).

Additionally, we need to record environment markers even for the
case of a.length, where a is aliased arguments (which crankshaft
optimizes to constant for the inlined case or to HArgumentsLength
when not inlined).

BUG=chromium:612146

Review-Url: https://codereview.chromium.org/2028243002
Cr-Commit-Position: refs/heads/master@{#36662}
2016-06-02 04:30:17 +00:00
gsathya
a7d091ffe3 math.js: Use %_TypedArrayGetLength to get length
https://codereview.chromium.org/2001393004 makes TypedArray
length property writable, which means we shouldn't depend on it.
Instead, use %_TypedArrayGetLength% to get length.

Attached regression test.

BUG=chromium:615776

Review-Url: https://codereview.chromium.org/2020203006
Cr-Commit-Position: refs/heads/master@{#36655}
2016-06-01 18:44:30 +00:00
ishell
9fa206e1f4 [runtime] Ensure that all elements kind transitions are chained to the root map.
This CL also updates the elements kind transition lookup logic:
1) First we go back to the root map,
2) Follow elements kind transitions,
3) Replay the property transitions.

BUG=v8:5009
LOG=Y
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2015513002
Cr-Commit-Position: refs/heads/master@{#36652}
2016-06-01 15:55:11 +00:00
machenbach
8b0a6dd652 Revert of [crankshaft] Only exclude explicit 'arguments' (and 'this') from liveness analysis. (patchset #2 id:20001 of https://codereview.chromium.org/2026173003/ )
Reason for revert:
Triggers crashes on the deopt fuzzer:
https://build.chromium.org/p/client.v8/builders/V8%20Deopt%20Fuzzer/builds/10608

Repro:
out/Release/d8 --test --random-seed=849179141 --deopt-every-n-times 149 --nohard-abort --nodead-code-elimination --nofold-constants --noconcurrent-recompilation test/webkit/resources/standalone-pre.js test/webkit/dfg-arguments-mixed-alias.js test/webkit/resources/standalone-post.js

Original issue's description:
> [crankshaft] Only exclude explicit 'arguments' (and 'this') from liveness analysis.
>
> Currently, we do not emit EnvironmentMarkers if the hydrogen value
> in the environment is arguments object. As the hydrogen value can change
> for local variables, we emit only some environment markers. That can
> cause environment liveness analysis to mark part of live range as live
> and part as dead. The zapping phase then only inserts zaps in
> live->dead transitions, potentially zapping a live value.
>
> With this CL, we only emit EnvironmentMarkers for 'this' and
> 'arguments' local variables, disregarding the hydrogen value.
>
> BUG=chromium:612146
> LOG=n
>
> Committed: https://crrev.com/1428fbe224dc2df0cb6f59e4959430f7aa614064
> Cr-Commit-Position: refs/heads/master@{#36641}

TBR=jkummerow@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:612146

Review-Url: https://codereview.chromium.org/2029563002
Cr-Commit-Position: refs/heads/master@{#36644}
2016-06-01 12:45:06 +00:00
jarin
1428fbe224 [crankshaft] Only exclude explicit 'arguments' (and 'this') from liveness analysis.
Currently, we do not emit EnvironmentMarkers if the hydrogen value
in the environment is arguments object. As the hydrogen value can change
for local variables, we emit only some environment markers. That can
cause environment liveness analysis to mark part of live range as live
and part as dead. The zapping phase then only inserts zaps in
live->dead transitions, potentially zapping a live value.

With this CL, we only emit EnvironmentMarkers for 'this' and
'arguments' local variables, disregarding the hydrogen value.

BUG=chromium:612146
LOG=n

Review-Url: https://codereview.chromium.org/2026173003
Cr-Commit-Position: refs/heads/master@{#36641}
2016-06-01 12:04:35 +00:00
bmeurer
7554360f28 [builtins] Migrate String.fromCharCode to TurboFan code stub.
When we moved the String.fromCharCode builtin to C++, we slightly
regressed the fast single character code argument case. Recovered some
of the performance by implementing the builtin using the TurboFan
CodeStubAssembler.

Drive-by-fix: Make sure the stack trace from the implicit ToNumber
conversion in String.fromCharCode includes the builtin by adding a
regression test for that.

R=yangguo@chromium.org
BUG=chromium:609831,chromium:613947,v8:5049

Review-Url: https://codereview.chromium.org/2021143003
Cr-Commit-Position: refs/heads/master@{#36611}
2016-05-31 11:39:05 +00:00
clemensh
25c2203a8f Check CallSite arguments more rigorously
Before, it was possible to construct invalid CallSite objects, which
would trigger a runtime assert when any function is called on it.
This check ensures to throw a TypeError when invalid information is
passed to the CallSite constructor.

This reverts part of this CL: https://codereview.chromium.org/2006603002

R=ishell@chromium.org, titzer@chromium.org, yangguo@chromium.org
BUG=chromium:614295

Review-Url: https://codereview.chromium.org/2010493002
Cr-Commit-Position: refs/heads/master@{#36578}
2016-05-30 10:30:13 +00:00
franzih
8c31bd81f2 [builtins] Rewrite uri.js as builtin functions.
Rewrite decodeURI and decodeURIComponent as builtin functions
and install them in the bootstrapper.

Delete unused runtime functions:
 - TruncateString
 - NewString
 - OneByteSeqStringGetChar
 - OneByteSeqStringSetChar
 - TwoByteSeqStringGetChar
 - TwoByteSeqStringSetChar

Add regression test for decoding large strings. Clusterfuzz detected
a problem with %TruncateString, see
https://bugs.chromium.org/p/chromium/issues/detail?id=612109#c6
This is automatically fixed by this rewrite because %TruncateString
is deleted anyways.

Crude benchmark on 585 decodeURI and decodeURIComponent tests
averaged over five runs:

* builtin functions
real	0m9.69s
user	2m39.8816s
sys    	0m12.6398s

* JS functions calling into the runtime e.g., for %TruncateString
real	0m11.0598s
user	3m6.7026s
sys	0m13.5756s

By running:
$  time tools/run-tests.py   --arch=x64  --mode=Release --buildbot
  test262/built-ins/decodeURI* mjsunit/uri
>>> Running tests for x64.Release

BUG=v8:4912, chromium:612109
R=yangguo@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1994733003
Cr-Commit-Position: refs/heads/master@{#36543}
2016-05-27 09:57:07 +00:00
gsathya
91e2039df0 TypedArray: Make byteOffset, byteLength, and length configurable
Removes the DONT_DELETE enum bit from the properties to make them
configurable.

Also, updates the regress-typedarray-length test to --
- Check for true boolean return value on deletion of these
  properties.
- Check for undefined return value on trying to access these
  properties after deletion.

BUG=v8:4902
LOG=Y

Review-Url: https://codereview.chromium.org/2001393004
Cr-Commit-Position: refs/heads/master@{#36528}
2016-05-25 19:09:56 +00:00
yangguo
5d93296a5c [regexp] fix /ui regexp desugaring for text nodes.
R=littledan@chromium.org
BUG=v8:5036

Review-Url: https://codereview.chromium.org/2005753003
Cr-Commit-Position: refs/heads/master@{#36453}
2016-05-23 22:23:43 +00:00
danno
f43aa0bc6c [turbofan] Correctly call ArrayNoArgumentConstructor stub from TF code
BUG=chromium:612412
LOG=N

Review-Url: https://codereview.chromium.org/1999783004
Cr-Commit-Position: refs/heads/master@{#36448}
2016-05-23 16:44:13 +00:00
mstarzinger
3cc2adb319 [deoptimizer] Fix materialization of sloppy arguments.
This makes sure the deoptimizer can materialize sloppy arguments objects
with the FAST_SLOPPY_ARGUMENTS_ELEMENTS elements kind. TurboFan's escape
analysis treates those as normal JSObject types and hence materializes
them differently than Crankshaft does.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919

Review-Url: https://codereview.chromium.org/2001133002
Cr-Commit-Position: refs/heads/master@{#36440}
2016-05-23 13:52:35 +00:00
mstarzinger
dbd7d5a59f [turbofan] Skip data-flow analysis of code entry field.
This makes escape analysis skip analyzing the code entry field within
JSFunction objects. Said field is an untagged pointer field and hence
cannot be tracked by an ObjectState node.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-613494
BUG=chromium:613494

Review-Url: https://codereview.chromium.org/1997353002
Cr-Commit-Position: refs/heads/master@{#36436}
2016-05-23 10:40:29 +00:00
yangguo
46aeb2aed8 [json] fix encoding change for two-byte gap strings.
R=mstarzinger@chromium.org
BUG=chromium:613570

Review-Url: https://codereview.chromium.org/1997003002
Cr-Commit-Position: refs/heads/master@{#36433}
2016-05-23 09:18:58 +00:00
ishell
a7a14fdebc [runtime] Don't crash when trying to access manually constructed CallSite object.
... but hit the runtime assert instead.
|
| Runtime error in ../src/runtime/runtime-internal.cc, line 409
|
| call_site.IsJavaScript() || call_site.IsWasm()
|

BUG=chromium:613905
LOG=N

Review-Url: https://codereview.chromium.org/2006603002
Cr-Commit-Position: refs/heads/master@{#36430}
2016-05-23 09:01:29 +00:00
bmeurer
cc71837fda [builtins] Migrate String.fromCharCode to C++.
The previous JavaScript version created way too many ConsStrings for
longer strings, i.e. when using String.fromCharCode together with
Function.prototype.apply and arrays of char codes.

This version now always allocates sequential strings and therefore uses
way less memory when turning longer character sequences into strings,
and therefore fixes the memory regression on Google Maps.

BUG=chromium:609831
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2004733002
Cr-Commit-Position: refs/heads/master@{#36427}
2016-05-21 16:59:59 +00:00
jkummerow
43547df9c7 [crankshaft] Don't inline "dont_crankshaft" functions
Crankshaft shouldn't try to inline functions it knows it can't handle.

BUG=v8:5033

Review-Url: https://codereview.chromium.org/2000703002
Cr-Commit-Position: refs/heads/master@{#36417}
2016-05-20 15:20:15 +00:00
mvstanton
b71f1cc2f4 Bugfix: Crankshaft array literals with incorrect values.
In VisitArrayLiteral(), we stopped creating boilerplates during
 compilation. This created a bug, because we'd emit an HStoreKeyed with an
 ElementsKind based on the initial elements kind of the boilerplate. Since
 boilerplates may transition as part of elements transition feedback, this can
 lead to incorrect values (storing a smi in a double array).

BUG=chromium:606021

Review-Url: https://codereview.chromium.org/2000673002
Cr-Commit-Position: refs/heads/master@{#36408}
2016-05-20 13:07:52 +00:00
adamk
de7d47e22f Remove now-incorrect DataView accessor optimization
In ES2015, the "byteLength" and "byteOffset" properties of DataViews are
getters on the prototype, so the previously-used strategy of special-casing
them using only the receiver map is invalid.

A future CL will need to use the same strategy which will be taken for
TypedArray "length", "byteLength", and "byteOffset": adding a prototype
chain check.

BUG=v8:5018, chromium:593634

Review-Url: https://codereview.chromium.org/1984043002
Cr-Commit-Position: refs/heads/master@{#36382}
2016-05-19 19:49:35 +00:00
mstarzinger
d5aa995e3c [turbofan] Make escape analysis non-experimental.
This promotes the escape analysis from an experimental feature to be a
fully supported feature. The main goal is to unleach ClusterFuzz on the
implementation so that we can stabilize it.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1989833002
Cr-Commit-Position: refs/heads/master@{#36324}
2016-05-18 13:51:01 +00:00
bmeurer
33e571ff4b [turbofan] Kill type Guard nodes during effect/control linearization.
These guards are useless anyways once you make it throw the
effect/control linearizer because all memory operations and
calls are connected to the control and/or effect chain anyways
afterwards.

Drive-by-fix: Fail in the InstructionSelector if we ever see
a Guard node.

R=jarin@chromium.org
BUG=chromium:612142

Review-Url: https://codereview.chromium.org/1980383002
Cr-Commit-Position: refs/heads/master@{#36302}
2016-05-18 05:38:22 +00:00
mstarzinger
7cef5593e4 [turbofan] Escape analysis treats guard nodes as escaping.
This makes escape analysis treat all guard nodes in the graph as an
escaping use. We eventually want to properly handle guard nodes, this
just serves as a temporary workaround to get things going.

R=bmeurer@chromium.org
BUG=v8:602595
LOG=n

Review-Url: https://codereview.chromium.org/1972323004
Cr-Commit-Position: refs/heads/master@{#36286}
2016-05-17 15:47:35 +00:00
yangguo
8e303dd0b3 Fix %FunctionGetName and %_ClassOf for bound functions.
R=bmeurer@chromium.org
BUG=v8:5010

Review-Url: https://codereview.chromium.org/1980463002
Cr-Commit-Position: refs/heads/master@{#36276}
2016-05-17 11:26:00 +00:00
gsathya
d33aedb7b9 Revert "Fix TypedArray Property optimizations", add regression test and eliminate dead code
This reverts commit 41d571dfe8.

Reason for revert: This patch breaks the correctness of the typedarray
properties such as length, byteOffset, byteLength.

The accessor check optimization code is dead code eliminated. A follow
up patch will fix this optimization correctly.

BUG=chromium:593634

Review-Url: https://codereview.chromium.org/1977983002
Cr-Commit-Position: refs/heads/master@{#36254}
2016-05-13 22:31:07 +00:00
bmeurer
fa7460adbc [turbofan] Fix optimized lowering of Math.imul.
We eagerly inserted Int32Mul for Math.imul during builtin lowering and
messed up with the types, which confused the representation selection.
This adds a proper NumberImul operator, and fixes the builtin reducer to
do the right thing according to the spec.

R=mstarzinger@chromium.org
BUG=v8:5006
LOG=n

Review-Url: https://codereview.chromium.org/1971163002
Cr-Commit-Position: refs/heads/master@{#36219}
2016-05-12 18:43:32 +00:00
yangguo
ea0dcad0a6 [debugger] keep scope and context chain for hidden scopes in sync.
R=jgruber@chromium.org
BUG=chromium:609046
LOG=N

Review-Url: https://codereview.chromium.org/1957303002
Cr-Commit-Position: refs/heads/master@{#36160}
2016-05-11 08:24:33 +00:00
mstarzinger
afb69f7438 [fullcodegen] Add missing bailout points for super calls.
The bailout points for named and keyed property loads when doing super
property calls are not being prepared by full-codegen, even though we
are using them in TurboFan for deopts and stack traces.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-4971
BUG=v8:4971
LOG=n

Review-Url: https://codereview.chromium.org/1960083002
Cr-Commit-Position: refs/heads/master@{#36109}
2016-05-09 13:44:40 +00:00
mstarzinger
434ef2ccfd [turbofan] Remove deprecated --turbo-osr flag.
The flag in question used to fall-back to Crankshaft whenever an OSR
request couldn't be handled by TurboFan. By now OSR in TurboFan is
sufficiently stabilized that one single --use-osr flag should do it.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1960043002
Cr-Commit-Position: refs/heads/master@{#36102}
2016-05-09 09:12:01 +00:00
ishell
8758245a62 Don't crash when load eval origin of a call site.
BUG=chromium:610207
LOG=N

Review-Url: https://codereview.chromium.org/1958043002
Cr-Commit-Position: refs/heads/master@{#36101}
2016-05-09 09:00:52 +00:00
ishell
e17a283f92 [es6] Properly handle the case when an inlined getter/setter/constructor does a tail call.
Deoptimizer is now able to reconstruct topmost accessor and constructor frames.

BUG=chromium:608278, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1936043002
Cr-Commit-Position: refs/heads/master@{#36075}
2016-05-06 12:37:13 +00:00
adamk
75f2d65f00 Don't treat catch scopes as possibly-shadowing for sloppy eval
Scope analysis is over-conservative when treating variable resolutions
as possibly-shadowed by a sloppy eval. In the attached bug, this comes
into play since catch scopes have different behavior with respect to
the "calls eval" in eager vs lazy compilation (in the latter, they
are never marked as "calls eval" because CatchContexts don't have
an associated ScopeInfo).

This patch changes the scope-type check to also eliminate a few other
cases where shadowing isn't possible, such as non-declaration block scopes.

BUG=chromium:608279
LOG=n

Review-Url: https://codereview.chromium.org/1950803002
Cr-Commit-Position: refs/heads/master@{#36046}
2016-05-04 21:36:13 +00:00
titzer
f82b33781d [wasm] Fix for 608630: allow proxies as FFI.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:608630
LOG=Y

Review-Url: https://codereview.chromium.org/1943313002
Cr-Commit-Position: refs/heads/master@{#36008}
2016-05-04 08:54:00 +00:00
bmeurer
c3218375c1 [turbofan] Implement %_NewObject using FastNewObjectStub.
The inline allocation sequence in the optimizing compilers cannot deal
well with funky types like JSRegExp, which have some magic fields in
addition to the inobject properties. In Crankshaft we already use the
FastNewObjectStub for %_NewObject in general, so fix TurboFan to the same.
Hopefully one day we can kill %_NewObject completely.

R=jarin@chromium.org
BUG=chromium:609029
LOG=n

Review-Url: https://codereview.chromium.org/1943403004
Cr-Commit-Position: refs/heads/master@{#36006}
2016-05-04 07:35:22 +00:00
adamk
c8a342a582 Fix 'eval' in class extends clauses to be always-strict
Compiler backends get their language mode from the current
function, but should instead be deriving it from the current scope.
This allows proper handling of the always-strictness of class declarations
and expressions, and in particular the treatment of 'eval' calls in an
extends clause as a strict eval.

Also fix the parser's RecordEvalCall logic to only reach out to the
DeclarationScope in sloppy mode, which fixes the strange case of a
sloppy function thinking it contains a sloppy eval when in fact
it contains only a strict eval.

BUG=v8:4970
LOG=n

Review-Url: https://codereview.chromium.org/1931003003
Cr-Commit-Position: refs/heads/master@{#36001}
2016-05-03 22:36:29 +00:00
titzer
d622c3a8bd [wasm] Disallow runtime calls in asm.js modules.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:592352
LOG=Y

Review-Url: https://codereview.chromium.org/1943373002
Cr-Commit-Position: refs/heads/master@{#35992}
2016-05-03 15:57:23 +00:00
titzer
98c2312995 [wasm] Fix bug with empty input to Wasm.instantiateModuleFromAsm()
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:605488
LOG=Y

Review-Url: https://codereview.chromium.org/1940243002
Cr-Commit-Position: refs/heads/master@{#35974}
2016-05-03 11:15:24 +00:00
littledan
4f374bbc94 Use InternalArrays from certain Intl code
The ECMA 402 implementation previously pushed directly to real
Arrays, which risks having observably incorrect behavior in the
presence of monkey patching. This patch uses InternalArrays instead
to avoid that hazard.

R=jshin@chromium.org,yangguo@chromium.org
BUG=chromium:604299
LOG=N

Review-Url: https://codereview.chromium.org/1923803002
Cr-Commit-Position: refs/heads/master@{#35949}
2016-05-02 18:19:25 +00:00
adamk
567aa1be6d [full-codegen] Fix stack depth tracking when reporting unsupported super usages
Also mark VisitSuperCallReference as unreachable, as it's handled by VisitCall.

R=mstarzinger@chromium.org
BUG=v8:4967
LOG=n

Review-Url: https://codereview.chromium.org/1929213002
Cr-Commit-Position: refs/heads/master@{#35945}
2016-05-02 17:28:54 +00:00
ishell
b83edcc8b1 [runtime] Don't crash when creating an instance of a class inherited from a Proxy.
BUG=v8:4972
LOG=N

Review-Url: https://codereview.chromium.org/1925803005
Cr-Commit-Position: refs/heads/master@{#35911}
2016-04-29 15:07:35 +00:00
machenbach
819371c628 Revert of Remove more dead code after Object.observe removal (patchset #5 id:80001 of https://codereview.chromium.org/1904313004/ )
Reason for revert:
[Sheriff] Looks like this breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/6442

Original issue's description:
> Remove more dead code after Object.observe removal
>
> This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

TBR=verwaest@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1929293002
Cr-Commit-Position: refs/heads/master@{#35886}
2016-04-29 06:31:02 +00:00
littledan
3d66e5d1d7 Add checks for detached ArrayBuffers to ArrayBuffer.prototype.slice
These checks ensure that a TypeError is thrown, per spec, rather than
a runtime assert failure.

BUG=v8:4964
R=adamk
LOG=Y

Review-Url: https://codereview.chromium.org/1929123002
Cr-Commit-Position: refs/heads/master@{#35885}
2016-04-28 22:50:56 +00:00
jkummerow
15e106382e Remove more dead code after Object.observe removal
This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

Review-Url: https://codereview.chromium.org/1904313004
Cr-Commit-Position: refs/heads/master@{#35876}
2016-04-28 18:35:42 +00:00
verwaest
f1cc6e646f Check the state of the current binary op IC before patching smi code
Between the miss and patching, we run user code. That may already patch the same code. IC refactoring broke this (again), so including a regression test this time around.

BUG=chromium:601392
LOG=n

Review URL: https://codereview.chromium.org/1925583002

Cr-Commit-Position: refs/heads/master@{#35811}
2016-04-27 09:19:15 +00:00
yangguo
d1e08e7a72 [debugger] do not expose temporary variables introduced by the parser.
R=bmeurer@chromium.org, kozyatinskiy@chromium.org
BUG=chromium:582048
LOG=N

Review URL: https://codereview.chromium.org/1916343002

Cr-Commit-Position: refs/heads/master@{#35805}
2016-04-27 04:49:46 +00:00
adamk
967a04634d Forward accept_IN to ParseYieldExpression
This allows "yield 'x' in o" as an expression in a generator.

R=ishell@chromium.org
BUG=v8:4945
LOG=n

Review URL: https://codereview.chromium.org/1916183003

Cr-Commit-Position: refs/heads/master@{#35798}
2016-04-26 17:24:49 +00:00
yangguo
eee6ddb2ac [debugger] add test case for debug-evaluate for values in TDZ.
R=jkummerow@chromium.org
BUG=chromium:605581
LOG=N

Review URL: https://codereview.chromium.org/1920953003

Cr-Commit-Position: refs/heads/master@{#35794}
2016-04-26 14:11:21 +00:00
verwaest
1678bb557c MigrateInstance(target) before Object.assign(target, ...)
If the target is deprecated, the object will be updated on first store. If the source for that store equals the target, this will invalidate the cached representation of the source. Preventively upgrade the target.

BUG=chromium:604300
LOG=n

Review URL: https://codereview.chromium.org/1905933002

Cr-Commit-Position: refs/heads/master@{#35770}
2016-04-25 15:41:21 +00:00
yangguo
6f67d171f1 [regexp] Fix non-match and max match length in RegExpCharacterClass.
R=mstarzinger@chromium.org
BUG=chromium:605862
LOG=N

Review URL: https://codereview.chromium.org/1916763002

Cr-Commit-Position: refs/heads/master@{#35764}
2016-04-25 13:32:14 +00:00
yangguo
3c7391093b [debugger] fix mjsunit/regress/regress-crbug-119800 for ignition.
R=vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1907293002

Cr-Commit-Position: refs/heads/master@{#35758}
2016-04-25 11:37:12 +00:00
rmcilroy
11e3ba34f5 [Interpreter] Fix incorrect Register OperandSize calculation for ExtraWide.
Fixes a mistake made in r35618 for register OperandSize calculations.

BUG=605470
LOG=N

Review URL: https://codereview.chromium.org/1908033002

Cr-Commit-Position: refs/heads/master@{#35719}
2016-04-22 10:32:14 +00:00
jkummerow
f4a9a50147 [tests] Add testcase for r35397
This is a follow-up to 58429beb7b
"Fix KeyedStore stub selection for STRING_WRAPPER_ELEMENTS".

BUG=chromium:602184
LOG=n

Review URL: https://codereview.chromium.org/1912443004

Cr-Commit-Position: refs/heads/master@{#35715}
2016-04-22 09:08:46 +00:00
adamk
6a370a6f01 Remove support for Object.observe
The feature was deprecated in M49 and flagged off in M50.
This patch removes it entirely from the codebase.

Review URL: https://codereview.chromium.org/1909433003

Cr-Commit-Position: refs/heads/master@{#35714}
2016-04-22 09:02:41 +00:00
jkummerow
9bebebd909 [ic] Restore PROPERTY key tracking in keyed ICs
Non-vectorized KeyedLoadICs used to remember whether they had seen Names
as keys; Crankshaft uses this information to avoid emitting elements
accesses which would always deopt. This CL restores that functionality
for vector ICs.

BUG=chromium:594183
LOG=y
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1912593002

Cr-Commit-Position: refs/heads/master@{#35706}
2016-04-21 13:18:28 +00:00
verwaest
7dfb5beeec Fix 'typeof null' canonicalization in crankshaft
BUG=

Review URL: https://codereview.chromium.org/1912553002

Cr-Commit-Position: refs/heads/master@{#35699}
2016-04-21 11:24:31 +00:00
verwaest
4a6a0f5530 Make sure we always try to make prototypes fast again when transitioning accessors
BUG=chromium:605060
LOG=n

Review URL: https://codereview.chromium.org/1907953002

Cr-Commit-Position: refs/heads/master@{#35697}
2016-04-21 11:18:08 +00:00
ishell
b4dbb2f710 [deoptimizer] Do not modify stack_fp which is used as a key for lookup of previously materialized objects.
BUG=chromium:604680, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1904663003

Cr-Commit-Position: refs/heads/master@{#35693}
2016-04-21 09:54:33 +00:00
adamk
e96cbdcdd6 More accurately record an end position for default parameters in arrows
Our previous over-conservative answer caused us to emit hole checks in
full-codegen when eagerly parsing but not when lazily parsing.

With this patch, we use the positions of the BinaryOperations making up
the parameter list (which are the positions of the commas) to determine
the appropriate "end position" for each parameter's initializer. This means
that we get accurate-enough positions for the initializers in the eager
parsing step to get the same answers for hole-check-elimination that we
will later during ParseLazy.

In the included test case, for example:

  (function() { ((s = 17, y = s) => s)(); } )();
                        ^2     ^1

The old code would generate a hole check when trying to load
|s| for assignment to |y| (because it treated the closing parentheses
pointed to by "^1" as the "initialization position" of |s|).

The new code uses the comma pointed to by "^2" as the initialization
position of |s|. Since that occurs textually before the load of |s|,
full-codegen knows it can avoid the hole check.

BUG=v8:4908
LOG=n

Review URL: https://codereview.chromium.org/1900343002

Cr-Commit-Position: refs/heads/master@{#35678}
2016-04-20 20:49:16 +00:00
titzer
b994ad45b0 [turbofan] Length and index2 are unsigned in CheckedLoad/CheckedStore.
Also factor out test cases from test-run-machops.cc into test-run-load-store.cc

BUG=chromium:599717
LOG=Y

Review URL: https://codereview.chromium.org/1858323003

Cr-Commit-Position: refs/heads/master@{#35651}
2016-04-20 09:35:06 +00:00
ishell
28113880e3 Fix polymorphic keyed load handler selection for proxies.
BUG=chromium:603463
LOG=N

Review URL: https://codereview.chromium.org/1894203002

Cr-Commit-Position: refs/heads/master@{#35607}
2016-04-19 08:58:43 +00:00
bmeurer
e96c143171 [turbofan] Optimize typeof in abstract/strict equality comparison.
Add support to optimize certain comparisons of typeof with known
strings to utilize the existing ObjectIs<Type> predicates. Also
add a new ObjectIsCallable, which is used to optimize the common
typeof x === "function" pattern.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1898653003

Cr-Commit-Position: refs/heads/master@{#35562}
2016-04-18 07:03:23 +00:00
mvstanton
401450493e Security: type confusion lead to information leak in decodeURI
Quit using the global array in uri code.

R=yangguo@chromium.org
BUG=chromium:602970
LOG=N

Review URL: https://codereview.chromium.org/1889133003

Cr-Commit-Position: refs/heads/master@{#35530}
2016-04-15 13:09:45 +00:00
yangguo
93135d8c0d [regexp] fix assertion failure when parsing close to stack overflow.
R=jkummerow@chromium.org
BUG=chromium:600257
LOG=N

Review URL: https://codereview.chromium.org/1884143002

Cr-Commit-Position: refs/heads/master@{#35496}
2016-04-14 14:44:28 +00:00
hablich
b88d048adf Reland of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1876103002/ )
Reason for revert:
Did not fail on another roll including this CL ..

Original issue's description:
> Revert of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1869693003/ )
>
> Reason for revert:
> Blocks current roll: https://codereview.chromium.org/1876713002/ according to bisect: https://codereview.chromium.org/1872353002/#ps80001
>
> Original issue's description:
> > [compiler] Make feedback vector cope with flag changes.
> >
> > This fixes corner cases where the layout of feedback vectors baked into
> > the snapshot is different from the expected layout, depending on some
> > runtime flags. We make sure the feedback vector is regenereated for
> > functions that are not compiled. Flag changes of this kind are only
> > allowed when code is not serialized.
> >
> > An alternative solution would be to not serialize the feedback vector
> > for such cases in the first place. That solution however would have a
> > higher overhead, as it would required the serializer to be able to
> > recognize feedback vectors while generating a snapshot.
> >
> > R=mvstanton@chromium.org
> > TEST=mjsunit/regress/regress-crbug-600995
> > BUG=chromium:600995
> > LOG=n
> >
> > Committed: https://crrev.com/460bff5fb6af2bd79e610f89afdf6da9dba3cf0c
> > Cr-Commit-Position: refs/heads/master@{#35339}
>
> TBR=mvstanton@chromium.org,mstarzinger@chromium.org
>
> BUG=chromium:600995
> LOG=N
> NOTRY=true
>
> Committed: https://crrev.com/78049e9c4837f053575d6c71e53ae12fec99f1aa
> Cr-Commit-Position: refs/heads/master@{#35392}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:600995

Review URL: https://codereview.chromium.org/1876973002

Cr-Commit-Position: refs/heads/master@{#35398}
2016-04-11 18:56:37 +00:00
hablich
78049e9c48 Revert of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1869693003/ )
Reason for revert:
Blocks current roll: https://codereview.chromium.org/1876713002/ according to bisect: https://codereview.chromium.org/1872353002/#ps80001

Original issue's description:
> [compiler] Make feedback vector cope with flag changes.
>
> This fixes corner cases where the layout of feedback vectors baked into
> the snapshot is different from the expected layout, depending on some
> runtime flags. We make sure the feedback vector is regenereated for
> functions that are not compiled. Flag changes of this kind are only
> allowed when code is not serialized.
>
> An alternative solution would be to not serialize the feedback vector
> for such cases in the first place. That solution however would have a
> higher overhead, as it would required the serializer to be able to
> recognize feedback vectors while generating a snapshot.
>
> R=mvstanton@chromium.org
> TEST=mjsunit/regress/regress-crbug-600995
> BUG=chromium:600995
> LOG=n
>
> Committed: https://crrev.com/460bff5fb6af2bd79e610f89afdf6da9dba3cf0c
> Cr-Commit-Position: refs/heads/master@{#35339}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org

BUG=chromium:600995
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1876103002

Cr-Commit-Position: refs/heads/master@{#35392}
2016-04-11 15:36:30 +00:00
ishell
26c480d13c [deoptimizer] Extend assert to also expect kTailCallerFunction as bottommost frame when accessing arguments for inlined function.
BUG=chromium:601617, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1876753002

Cr-Commit-Position: refs/heads/master@{#35385}
2016-04-11 12:20:37 +00:00
mythria
8982cb5c70 [Interpreter] Handles legacy constants in strict mode.
Function bindings are the only variables in LEGACY_CONST mode.
(https://codereview.chromium.org/1819123002/). Since these variables
can also be accessed in strict mode functions we should support
handling such variables. Assigning to a legacy constant throws
a TypeError in strict mode. Also fixes hydrogen.cc to throw a
TypeError for legacy constants.

BUG=v8:4280,chromium:599068
LOG=N
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1845223006

Cr-Commit-Position: refs/heads/master@{#35383}
2016-04-11 12:04:01 +00:00
adamk
a0a8ecd078 Remove runtime flags for sloppy mode block scoping features
These were all on by default in M49 without complaint.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1858943002

Cr-Commit-Position: refs/heads/master@{#35342}
2016-04-08 00:30:20 +00:00
mstarzinger
460bff5fb6 [compiler] Make feedback vector cope with flag changes.
This fixes corner cases where the layout of feedback vectors baked into
the snapshot is different from the expected layout, depending on some
runtime flags. We make sure the feedback vector is regenereated for
functions that are not compiled. Flag changes of this kind are only
allowed when code is not serialized.

An alternative solution would be to not serialize the feedback vector
for such cases in the first place. That solution however would have a
higher overhead, as it would required the serializer to be able to
recognize feedback vectors while generating a snapshot.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-600995
BUG=chromium:600995
LOG=n

Review URL: https://codereview.chromium.org/1869693003

Cr-Commit-Position: refs/heads/master@{#35339}
2016-04-07 15:35:03 +00:00
cbruni
9478356ed3 Fix representation issue in FastArrayPushStub
Pushing undefined onto a FAST_DOUBLE_ARRAY does not enforce the right representation checks.

BUG=chromuim:599089
LOG=n

Review URL: https://codereview.chromium.org/1868973002

Cr-Commit-Position: refs/heads/master@{#35332}
2016-04-07 12:46:08 +00:00
mvstanton
ce1fe78d7e Bugfix: assert in lithium compile for LMaybeGrowElements
BUG=chromium:585041
LOG=N

Review URL: https://codereview.chromium.org/1854423003

Cr-Commit-Position: refs/heads/master@{#35331}
2016-04-07 11:41:39 +00:00
jarin
3df0a8c1f2 [crankshaft] Make infinite loops preserve control flow.
We have to preserve control flow so that the liveness analysis is less
confused. This CL fixes loops to preserve teh original control flow.

BUG=chromium:599710
LOG=n

Review URL: https://codereview.chromium.org/1863123002

Cr-Commit-Position: refs/heads/master@{#35318}
2016-04-07 05:36:44 +00:00
titzer
77a8c2ea86 [asm.js] Fix typing bug for non-literals in heap access.
R=bradnelson@chromium.org
BUG=chromium:599825
LOG=Y

Review URL: https://codereview.chromium.org/1858263002

Cr-Commit-Position: refs/heads/master@{#35273}
2016-04-05 17:24:03 +00:00
littledan
7a38462e8b Ensure CreateDataProperty works correctly on TypedArrays
Previously, CreateDataProperty would fail a DCHECK when used to create
an integer indexed property on a TypedArray. This patch makes it throw
a TypeError instead. The issue came up when Array.prototype.concat
was repaired to use CreateDataProperty rather than SetElement; concat
can be tricked into making a new TypedArray if it is given an Array
whose prototype is a TypedArray. This patch prevents the issue.

R=adamk
LOG=Y
BUG=chromium:596394

Review URL: https://codereview.chromium.org/1821723004

Cr-Commit-Position: refs/heads/master@{#35271}
2016-04-05 16:56:12 +00:00
cbruni
823224f3ee [elements] Fix length bounds precheck for Array.prototype.concat
BUG=chromium:599414
LOG=n

Review URL: https://codereview.chromium.org/1863553003

Cr-Commit-Position: refs/heads/master@{#35269}
2016-04-05 15:35:27 +00:00
jarin
4142bc6bc1 [turbofan] Restrict types in load elimination.
In simplified numbering, we make sanity checks based on types (e.g.,
NumberSubtract should take numbers as inputs), but this can be
violated if optimization passes make types less precise.

In this CL, we fix load elimination to make sure that types are
smaller in the store -> load elimination by taking an intersection
of the load's type with the store value's type and inserting a guard
with that type. Note that the load type comes from type feedback, so
it can be disjoint from the stored value type (in that case, this
must be dead code because the map chack for the load should prevent
us from using the stored value).

BUG=chromium:599412
LOG=n

Review URL: https://codereview.chromium.org/1857133003

Cr-Commit-Position: refs/heads/master@{#35259}
2016-04-05 12:30:14 +00:00
ishell
792bf2a093 [crankshaft] Fix environment handling after leaving inlined tail call.
BUG=chromium:537444, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1859763005

Cr-Commit-Position: refs/heads/master@{#35253}
2016-04-05 09:43:56 +00:00
bmeurer
e5724d958b [frames] Also properly deal with TF builtins in OptimizedFrame::GetFunctions().
This was missing from the previous fix.

R=ishell@chromium.org
BUG=chromium:599714
LOG=n

Review URL: https://codereview.chromium.org/1861583002

Cr-Commit-Position: refs/heads/master@{#35249}
2016-04-05 06:41:20 +00:00
mstarzinger
6ab9c1850f Fix resuming generator marked for optimization.
This fixes a corner case where the generator function of a suspended
generator has been marked for optimization. We assume the optimization
approach will cause a bailout because generators are not optimized. But
resuming is more resilient by always activating the unoptimized code.

R=neis@chromium.org,bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-513471
BUG=chromium:513471
LOG=n

Review URL: https://codereview.chromium.org/1856683002

Cr-Commit-Position: refs/heads/master@{#35234}
2016-04-04 11:52:09 +00:00
ishell
4598356f17 Properly complete in-object slack tracking.
BUG=chromium:599003
LOG=N

Review URL: https://codereview.chromium.org/1856653002

Cr-Commit-Position: refs/heads/master@{#35232}
2016-04-04 10:00:44 +00:00
ishell
c7ff5766cf Display a meaningfull error message when trying to capture a stack trace to a proxy.
... instead of RUNTIME_ASSERT pointing to V8 guts.

BUG=chromium:599067
LOG=N

Review URL: https://codereview.chromium.org/1844223004

Cr-Commit-Position: refs/heads/master@{#35227}
2016-04-04 08:37:30 +00:00
ishell
ecb8fcfcca [crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function.
This CL ensures that we build environments/frame states so that tail caller frame will never become topmost.

BUG=chromium:598998, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1849503002

Cr-Commit-Position: refs/heads/master@{#35188}
2016-04-01 07:22:47 +00:00
bmeurer
6df9a22c3f [ic] Use the CallFunction builtin to invoke accessors.
The HandlerCompiler did not properly handle the weird edge case when a
sloppy mode function was installed as an accessor on one of the value
wrapper prototypes and then accessed via a load from a primitive value.
In this case we just passed the primitive value untouched instead of
properly wrapping it first. The CallFunction builtin properly deals with
all the funny edge cases, so we use it instead of duplicating almost all
of the logic here (the performance difference is neglible).

R=verwaest@chromium.org
BUG=chromium:599073, v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1845243005

Cr-Commit-Position: refs/heads/master@{#35187}
2016-04-01 06:37:57 +00:00
yangguo
297daf6c37 [debugger] allow debug-evaluate to change stack and context values.
R=bmeurer@chromium.org, cbruni@chromium.org, ulan@chromium.org
BUG=chromium:124206,chromium:569811
LOG=N

Review URL: https://codereview.chromium.org/1834633003

Cr-Commit-Position: refs/heads/master@{#35145}
2016-03-31 06:00:21 +00:00
bmeurer
978ad03b92 [crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil.
Fix and re-enable the flexible representation for Math.floor (which is used to
implement Math.ceil) and Math.round, which allows Math.floor and Math.round to
return double results instead of int32, and therefore allows values outside
the int32 range, especially -0 is now a valid result, which doesn't deopt.

Also port this feature to x64 and ia32 when the CPU supports the SSE4.1
extension.

This addresses all the known deoptimization loops related to Math.round
in the Kraken benchmark suite, and seems to also address most of the
deoptimization loops related to Math.floor in the Oort Online benchmark.

Drive-by-fix: Import the regression tests for the broken HMathFloorOfDiv
optimization that caused the initial revert of the feature (for arm64 only
back then).

BUG=chromium:476477,v8:2890,v8:4059
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1841513003

Cr-Commit-Position: refs/heads/master@{#35094}
2016-03-29 10:24:54 +00:00
adamk
06403470e3 Remove --harmony-regexps flag
It's been on since M49. Also moved tests from harmony -> es6,
one of which was merged with another test of the same name.

While moving stuff over to regexp.js, I also noticed that there
were unused calls to %FunctionSetName and %SetNativeFlag (those
calls are already handled by InstallGetter()).

Review URL: https://codereview.chromium.org/1838563003

Cr-Commit-Position: refs/heads/master@{#35076}
2016-03-25 23:02:11 +00:00
binji
88724ec4cb [Atomics] Fix atomic access index validation
BUG=v8:4737
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1676613002

Cr-Commit-Position: refs/heads/master@{#35074}
2016-03-25 21:52:52 +00:00
littledan
97fce6214e Check for proper types from error handling code
A bug in error printing meant that we failed to do proper type checks
before calling into C++ code, which could lead to RUNTIME_ASSERT
failures if methods are called on alternative receivers. This patch
adds the right type checks.

BUG=chromium:596718
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1831053003

Cr-Commit-Position: refs/heads/master@{#35069}
2016-03-25 02:10:02 +00:00
adamk
ed18aa65ea Remove support for legacy const, part 1
Now that ES2015 const has shipped, in Chrome 49, legacy const declarations
are no more. This lets us remove a bunch of code from many parts of the
codebase.

In this patch, I remove parser support for generating legacy const variables
from const declarations. This also removes the special "illegal declaration"
bit from Scope, which has ripples into all compiler backends.

Also gone are any tests which relied on legacy const declarations.

Note that we do still generate a Variable in mode CONST_LEGACY in one case:
function name bindings in sloppy mode. The likely fix there is to add a new
Variable::Kind for this case and handle it appropriately for stores in each
backend, but I leave that for a later patch to make this one completely
subtractive.

Review URL: https://codereview.chromium.org/1819123002

Cr-Commit-Position: refs/heads/master@{#35002}
2016-03-22 17:52:13 +00:00
adamk
249bf75e0c Remove runtime flags for Proxy and Reflect
Both of them shipped in Chrome 49 without incident.

Also move relevant tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1815773002

Cr-Commit-Position: refs/heads/master@{#34964}
2016-03-21 19:40:02 +00:00
ishell
e6dca379b6 [crankshaft] Check if the function is callable before generating a tail call via Call builtin.
This is necessary to ensure that "Called non callable" exception will get a proper message and stack trace even for calls at tail position.

BUG=chromium:595615, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818003002

Cr-Commit-Position: refs/heads/master@{#34962}
2016-03-21 19:24:28 +00:00
bmeurer
cc04776632 [json] Allow any callable object for toJSON.
Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG=chromium:595738, chromium:535408
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}
2016-03-20 19:35:28 +00:00
adamk
6a8de15322 Several mjsunit cleanups
- Move default parameters tests from harmony/ to es6/ and remove
    non-existent --harmony-default-parameters flag.
  - Remove some non-existent tests from mjsunit.status

Review URL: https://codereview.chromium.org/1812313002

Cr-Commit-Position: refs/heads/master@{#34908}
2016-03-18 23:20:44 +00:00
yangguo
1e2d0e1136 [regexp] catch stack overflow when parsing back references.
R=jkummerow@chromium.org
BUG=chromium:595657
LOG=N

Review URL: https://codereview.chromium.org/1811913006

Cr-Commit-Position: refs/heads/master@{#34894}
2016-03-18 14:52:41 +00:00
verwaest
c6f9883d53 Remove oob elements collected from the prototype chain by trimming in GetArrayKeys
BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}
2016-03-18 14:37:36 +00:00
littledan
7acee1ef61 Throw the right exceptions from setting elements in Array.prototype.concat
This patch fixes two bugs in Array.prototype.concat in conjunction with
subclassing Arrays:
- Create a new property rather than calling Set when adding elements to
  the output array. This means setters are not called.
- If there is an exception thrown from DefineProperty, propagate it
  outwards properly, rather than swallowing it. This can occur, e.g., with
  a Proxy as the new output array.

R=adamk
LOG=Y
BUG=chromium:595319

Review URL: https://codereview.chromium.org/1814933002

Cr-Commit-Position: refs/heads/master@{#34876}
2016-03-17 22:42:00 +00:00
mvstanton
2aa070be4f InstanceOfStub incorrectly interprets the hole as a prototype.
Repair this to match what the runtime correctly does, by first checking if the
function is a constructor before we access the prototype.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1810953002

Cr-Commit-Position: refs/heads/master@{#34863}
2016-03-17 14:32:23 +00:00
jarin
c2e82d6e82 [crankshaft] Fix inlining to always connect both branches of test context.
BUG=v8:4839
LOG=n

Review URL: https://codereview.chromium.org/1811693002

Cr-Commit-Position: refs/heads/master@{#34848}
2016-03-17 10:00:21 +00:00
littledan
f9db79ebdb Ship ES2015 restrictions on function declaration locations
Function declarations were previously permitted by V8 in many locations
which no ECMAScript specification allowed; the ECMAScript 2015 spec
enumerates a few locations (in blocks, as well as after labels and in
conditionals when in sloppy mode). This patch ships the flag to restrict
the usage of function declarations to those contexts.

R=adamk
LOG=Y
BUG=v8:4824
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1799233003

Cr-Commit-Position: refs/heads/master@{#34828}
2016-03-16 16:39:23 +00:00
jkummerow
84dd29bb3c Fix polymorphic keyed load handler selection for string elements
The monomorphic case already carefully ensures that we don't try to use
a regular elements load stub on string wrapper elements. The polymorphic
path must perform an equivalent check.

BUG=chromium:594955
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1806543002

Cr-Commit-Position: refs/heads/master@{#34807}
2016-03-16 10:56:16 +00:00
adamk
108efd7f54 Remove Scope::scope_contains_with_ bit
This part of Scope has existed since V8's initial check in, but from what
I can tell it's not required to implement "with". The only tests that
depend upon it are tests of the debugger and the Scope mirrors, but the
resulting test behavior after removing the bit still seems perfectly
reasonable to me. In fact, with the included fix for scope name collection,
the scope mirror is actually improved with this change.

As a bi-product, this fixes the attached bug, about the contains_with
bit having inconsistent values in some arrow function compilation
scenarios.

BUG=chromium:592353
LOG=n
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1804783002

Cr-Commit-Position: refs/heads/master@{#34802}
2016-03-15 22:41:59 +00:00
cbruni
96a2bd8ae8 [builtins] Fix Array.prototype.concat bug
Array.prototype.concat did not work correct with complex elements on the
receiver or the prototype chain.

BUG=chromium:594574
LOG=y

Review URL: https://codereview.chromium.org/1804963002

Cr-Commit-Position: refs/heads/master@{#34798}
2016-03-15 20:29:28 +00:00
caitpotter88
3088979d5c [runtime] fix getting element keys from SLOW_SLOPPY_ARGUMENTS_ELEMENTS
BUG=v8:4825
LOG=N
R=jkummerow@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1778023004

Cr-Commit-Position: refs/heads/master@{#34754}
2016-03-14 17:10:50 +00:00
jarin
4d4bd54f0a [turbofan] Fix operand calculation for constant materialization from frame.
BUG=chromium:582702
LOG=N

Review URL: https://codereview.chromium.org/1781393002

Cr-Commit-Position: refs/heads/master@{#34736}
2016-03-13 20:21:41 +00:00
ishell
690c7a854a [turbofan] Avoid dereferencing empty handle when inlining a tail call.
BUG=chromium:593697,v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1781303002

Cr-Commit-Position: refs/heads/master@{#34716}
2016-03-11 11:41:29 +00:00
adamk
dea9559457 Remove destructuring and default arguments runtime flags
These flags have been on by default since version 4.9, which has been
in stable Chrome for over a week now, demonstrating that they're
here to stay.

Also moved the tests out of harmony/ and into es6/.

Review URL: https://codereview.chromium.org/1776683003

Cr-Commit-Position: refs/heads/master@{#34692}
2016-03-10 23:22:30 +00:00
rossberg
4614c7caaf [strong] Remove all remainders of strong mode
R=mstarzinger@chromium.org,bmeurer@chromium.org,adamk@chromium.org
BUG=v8:3956
LOG=Y

Review URL: https://codereview.chromium.org/1773653002

Cr-Commit-Position: refs/heads/master@{#34669}
2016-03-10 12:45:42 +00:00
littledan
ca5deb1ff8 Ensure appropriate bounds checking for Array subclass concat
When an Array subclass is used as the receiver for concat, or with
certain usages of @@species, the output that's constructed is of
a different type with new slow path logic. This slow path still
made references to elements, so it's important that bounds checking
for a too-long result still be done. This patch repairs that bounds
checking.

R=cbruni
LOG=Y
BUG=chromium:592340

Review URL: https://codereview.chromium.org/1782443002

Cr-Commit-Position: refs/heads/master@{#34636}
2016-03-09 18:54:44 +00:00
jkummerow
32b3d3e931 [arm/arm64][stubs] Fix d16-d31 preservation on stub failure
Reading the registers' values back from the FrameDescription
should use the same offset computation as storing them into it.
The offsets must also match what the deoptimizer expects, which
is rx at offset rx.code() * kDoubleSize, even if some registers
are not saved (leaving gaps).

BUG=v8:4800
LOG=n
R=danno@chromium.org

Review URL: https://codereview.chromium.org/1769833006

Cr-Commit-Position: refs/heads/master@{#34633}
2016-03-09 17:36:07 +00:00
yangguo
d1f68f776e [regexp] fix bogus assertion in CharacterRange constructor.
The CharacterRange constructor checks the input for validity. However,
CharacterRange::Singleton also uses the constructor and may have
kEndMarker as input, causing the check to fail.

The solution is to move the check to CharacterRange::Range and
consistently use it across the code base.

R=jkummerow@chromium.org
BUG=chromium:593282
LOG=N

Review URL: https://codereview.chromium.org/1776013003

Cr-Commit-Position: refs/heads/master@{#34626}
2016-03-09 15:55:38 +00:00
jarin
69c84fe460 [turbofan] Fix deoptimization stack layout for fast literal comparisons.
BUG=chromium:592341
LOG=n

Review URL: https://codereview.chromium.org/1776013002

Cr-Commit-Position: refs/heads/master@{#34615}
2016-03-09 12:36:09 +00:00
jarin
9867a8a26e [turbofan] Fix register constraint for memory barrier.
After fixing the memory barrier for maps (https://codereview.chromium.org/1714513003), we are using a temp register for the map case. The temp register should not be aliased with the stored value (otherwise we perform the mem barrier check with a wrong value). This CL makes sure it is not aliased.

BUG=chromium:590074
LOG=n

Review URL: https://codereview.chromium.org/1775083002

Cr-Commit-Position: refs/heads/master@{#34607}
2016-03-09 09:39:51 +00:00