Port r10356 (69da81).
Original commit message:
Loosen the requirement for Map equivalency on several map checks, including checks up the prototype chain, that are not sensitive to ElementsKinds. These selected map checks should also match against FAST_DOUBLE_ELEMENT and FAST_ELEMENT transitions of the original map. This specifically helps all variants of transitioned JSArrays to still efficiently call builtins like push, pop and sort.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9265007
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
for call-sites with mismatched number of arguments.
Port r10424 (92a05c9c).
Original commit message:
Adjust InvokeFunction to avoid generating dead code when number when arity mismatch is detected in compile time.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9150026
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10374 (03bbe39).
Note: the MIPS version was not affected by the bug. This is merely a style cleanup.
Original commit message:
An off-by-one in the register allocator could lead to allocating (and
clobbering) the reserved 0.0 double register. This required a function with
14 or more live double values.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9150025
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
CPU-eating DOS attacks against node.js servers. Based on code from
Bert Belder. This version only solves the issue for those that compile
V8 themselves or those that do not use snapshots. A snapshot-based
precompiled V8 will still have predictable string hash codes.
Review URL: http://codereview.chromium.org/9086006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10280 (5f6aec5).
Original commit message:
Tell the register allocator the value is not overwritten. Never use
temporary registers on ia32, avoid them on x64 and ARM. Restore the
original copyright date on assembler.cc.
BUG=
TEST=
Review URL: http://codereview.chromium.org/9004017
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10281 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This introduces an additional check into the StoreIC_ArrayLength builtin
checking that the array still has fast properties. Redifinitions of the
length property that would cause it's type or attributes to change, will
switch to slow properties, thereby invalidating said optimization.
R=svenpanne@chromium.org
BUG=v8:1756
TEST=test262
Review URL: http://codereview.chromium.org/8895025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10220 (1dae466).
Original commit message:
This CL adds support for loading from and storing to context slots
belonging to harmony let or const bound variables. Checks for the
hole value are performed and the function is deoptimized if they fail.
The full-codegen generated code will take care of properly throwing
a reference error in these cases.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8897025
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10219 (56686b).
Original commit message:
Now with arm and x64 support. Additionally, added default unreachable case to switch statement in CompareIC::TargetState to make win and mac compilers happy.
Reviewer guide:
This is an exact copy of 10216 except:
src/arm/*
src/x64/*
src/ic.cc (added default case to swith in CompareIC::TargetState)
BUG=
TEST=
Review URL: http://codereview.chromium.org/8896022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10085 (1ef7d5eb2).
This patch also contains a fix for StoreArrayLiteralElementStub::Generate which is only used from this code.
Original commit message:
Includes general array boilerplate copier and re-introduction FAST_ELEMENT optimizations in full-codegen.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8743010
Patch from Daniel Kalmard <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10061 (c648e1d1)
Original commit message:
This generates optimized code for deep-copying of nested object literal
boilerplates which are statically known. Most of the boilerplates have
already been generated at crankshaft time, so this optimization should
kick in for virtually every object literal. Only nested object literal
graphs up to a certain depth and containing up to a certain total number
of properties are considered for this optimization. This will prevent
explosion of code size due to large object literals (e.g. eval on JSON).
Improves splay performance because object literals are created often.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8745012
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10064 (9c6789a3)
Original commit message:
There is no test case to trigger any crash. This is only to guard against the case that the native function is called with unsafe arguments.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8742012
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10097 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
