516 Commits

Author	SHA1	Message	Date
rossberg@chromium.org	40880d3206	Fixed spurious character in test case, plus presubmit issues. ... Also addressed Slava's complaint about the personalized comment. R=jkummerow@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7886032 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-14 07:30:51 +00:00
rossberg@chromium.org	28f7136ced	Fix for .bind regression. ... R=jkummerow@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7892013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-13 17:14:39 +00:00
yangguo@chromium.org	321bfc549f	Fixing r9265: moving test case into correct location. ... Review URL: http://codereview.chromium.org/7889008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-13 16:11:05 +00:00
danno@chromium.org	df860eda5c	Don't allow seal or element property re-definition on external arrays. ... R=ricow@chromium.org BUG=95920 TEST=test/mjsunit/regress/regress-95920.js Review URL: http://codereview.chromium.org/7858031 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-09 14:30:00 +00:00
kmillikin@chromium.org	8b165d414f	Fix a bug in abrupt exit from with or catch inside finally. ... When with or catch is nested inside finally, we were not properly restoring the context in the stack for the finally code. Also, as a small optimization, restore it from the handler block instead of iteratively unwinding contexts. R=fschneider@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7837023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-07 09:21:44 +00:00
jkummerow@chromium.org	09c66d20ce	Fix possible crash in FixedDoubleArray::Initialize() ... (this only affected ia32). BUG=95113 TEST=mjsunit/regress/regress-95113.js passes without crashing. Review URL: http://codereview.chromium.org/7833040 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-06 14:07:54 +00:00
vegorov@chromium.org	d451878c91	Fix bug in Page::GetRegionMaskForSpan. ... When checking for a wrap take into account offset of the start address in the region. BUG=http://crbug.com/94425 TEST=test/mjsunit/regress/regress-94425.js Review URL: http://codereview.chromium.org/7779037 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-06 11:24:48 +00:00
ricow@chromium.org	0fbf8c8854	Add regression test for issue 1215, expand regression test for issue 1447. ... Both these issues has now been closed since they are working on bleeding edge. Review URL: http://codereview.chromium.org/7739024 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-06 07:43:51 +00:00
yangguo@chromium.org	86a62d0da3	Added check for trailing whitespaces and corrected existing violations. ... Review URL: http://codereview.chromium.org/7826007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-01 11:28:10 +00:00
ricow@chromium.org	4e94cd8b08	Make arguments and caller always be null on native functions (fixes issue 1548 and issue 1643). ... With this change we follow Firefox, Safari has a slightly different approach where the property is just not there (at least according to GetOwnProperty). Review URL: http://codereview.chromium.org/7792054 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-01 11:09:11 +00:00
vegorov@chromium.org	e833f91eb3	Do constant function check earlier in TryCallApply and ensure correct environment for deopt. ... R=kmillikin@chromium.org BUG=v8:1650 TEST=test/mjsunit/regress/regress-1650.js Review URL: http://codereview.chromium.org/7812033 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-09-01 10:33:59 +00:00
fschneider@chromium.org	ffc6c7e56b	Introduce local function declarations in Crankshaft and fix issue 1647. ... We have to emit code for declarations later into the body block (and not into the start block) so that the environment contains the correct values. In order to capture the environment effect of the declarations that generate code (function declarations) I inserted a separate AST id and a HSimulate after the declarations are visited. Also fixes handling deopt in named function expressions: BUG=v8:1647 TEST=test/mjsunit/regress/regress-fundecl.js, test/mjsunit/regress/regress-1647.js Review URL: http://codereview.chromium.org/7776009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-31 13:26:08 +00:00
lrn@chromium.org	d8a123169b	Make regexp flag parsing stricter. ... BUG=v8:1628 TEST=mjsunit/regress/regress-219 Review URL: http://codereview.chromium.org/7624045 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8973 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-19 11:02:41 +00:00
lrn@chromium.org	7939f9acf2	Make scanner handle invalid unicode escapes in identifiers correctly. ... I.e., don't just convert \u to u in identifiers (like in strings and regexps). Also make the scanning of RegExp flags not interpret the escapes. (Fix and reapply of r8942) BUG=v8:1620 TEST=mjsunit/regress/regress-1620 Review URL: http://codereview.chromium.org/7677012 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-18 12:47:23 +00:00
ricow@chromium.org	d9c1984fe3	Use InternalArray in Object.defineProperties to avoid issues with overwriten properties on Array.prototype ... TEST=mjsunit/regress/regress-1625 BUG=v8:1625 Review URL: http://codereview.chromium.org/7631039 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-18 08:39:06 +00:00
ricow@chromium.org	7f36b52540	Revert 8942 "Make scanner not accept invalid unicode escapes in identifiers" ... This is causing webkit failures, reverting until we figure out if this is a V8 regression or wrong test expectations. Review URL: http://codereview.chromium.org/7669017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-17 08:22:41 +00:00
lrn@chromium.org	7d17c8d5d3	Make scanner not accept invalid unicode escapes in identifiers. ... BUG=v8:1620 TEST=mjsunit/regress/regress-1620 Review URL: http://codereview.chromium.org/7663005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8942 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-16 13:31:08 +00:00
vitalyr@chromium.org	a107387dde	Fix fun.apply(receiver, arguments) optimization. ... R=kmillikin@chromium.org BUG=v8:1592 TEST=mjsunit/regress/regress-1592.js Review URL: http://codereview.chromium.org/7497067 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-10 16:05:17 +00:00
kmillikin@chromium.org	7adb10a48e	Fix a bug in named getter/setter compilation. ... Because these are function literals that have an associated name, we were compiling them as if they were named function expressions. This is incorrect, the property name should not be in scope. R=vegorov@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7599024 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-09 12:43:08 +00:00
kmillikin@chromium.org	d941053dbe	Revert "Revert "Fix a bug in scope analysis."" ... Reapply r8838 with a fix for the issue of function names. Because function names can be added/changed/removed through the API, remember whether the function is anonymous when initially parsed and use that information when compiling. R=vegorov@chromium.org BUG=1583 TEST=regress-1583 Review URL: http://codereview.chromium.org/7491097 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-08 16:14:46 +00:00
lrn@chromium.org	e9bc76c499	Avoid infinite recursion for unterminated non-ASCII JSON string literals. ... BUG=91787 TEST=mjsunit/regress/regress-91787 Review URL: http://codereview.chromium.org/7569008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-05 12:55:29 +00:00
keuchel@chromium.org	c14b08658e	Fix DebugEvaluate crash within a catch in a function without local context. ... BUG=v8:1586 TEST=mjsunit/regress/regress-1586.js Review URL: http://codereview.chromium.org/7491053 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-05 12:00:57 +00:00
lrn@chromium.org	61ae1be609	Fix bug in scanner. ... Checking for end-of-comment truncated to byte before comparing to '*'. BUG=v8:1546 TEST=mjsunit/regress/regress-1546 Review URL: http://codereview.chromium.org/7585004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-05 11:21:04 +00:00
kmillikin@chromium.org	3e28347d55	Revert "Fix a bug in scope analysis." ... This reverts commit revision 8838. TBR=ricow@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7584005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-05 09:20:08 +00:00
kmillikin@chromium.org	b625ce2b6b	Fix a bug in scope analysis. ... When recompiling code (e.g., when optimizing) we could incorrectly hoist some function expressions. This leads to incorrect results or a crash. The root cause was that functions were not correctly categorized as expression or declaration at parse time. This requires some extra hoops to prevent the print name "anonymous" for functions created by 'new Function' from establishing a binding. R=vegorov@chromium.org,kasperl@chromium.org BUG=1583 TEST=regress-1583 Review URL: http://codereview.chromium.org/7572019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-05 08:28:11 +00:00
danno@chromium.org	861c895a34	Add regression test for 91517 ... R=vegorov@chromium.org BUG=91517 TEST=regress-91517.js Review URL: http://codereview.chromium.org/7575007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-04 11:00:32 +00:00
ricow@chromium.org	9721eddc1f	Ensure that the length property of bound functions are actual unique ... for the individually bound functions. Our existing code will generate a new function on every call to bind, but it will use the same shared function. When setting the lenght this will be set on the shared function, i.e., the length of all bound functions will be that of the last bound function. Review URL: http://codereview.chromium.org/7475002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-03 12:44:17 +00:00
kmillikin@chromium.org	4487f8c050	Revert "Revert "Fix a bug in scope analysis."" ... Reapply r8783 with an additional fix. Because the preparser and parser do not use the same scope analysis to determine if a function can be lazily compiled, the parser can have false positives. Rather than treating this as a parse error, treat the preparser as authoritative and eagerly compile the function. R=lrn@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7565003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-03 09:10:35 +00:00
kmillikin@chromium.org	a129c95a54	Revert "Fix a bug in scope analysis." ... This reverts r8783. R=vegorov@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7550013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 17:02:24 +00:00
kmillikin@chromium.org	f37f6e88ca	Fix a bug in scope analysis. ... Function declarations inside catch are hoisted to the nearest enclosing function scope, but we compiled their bodies as if occurring inside the catch scope. BUG=chrome:91120 TEST=regress/regress-91120 attached Review URL: http://codereview.chromium.org/7548011 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 15:04:31 +00:00
danno@chromium.org	b333719607	Properly handle FixedDoubleArrays in sort() ... R=jkummerow@chromium.org BUG=91008 TEST=regress-91008.js Review URL: http://codereview.chromium.org/7542008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 14:05:11 +00:00
vegorov@chromium.org	9226cfe5b7	Ensure that GenerateStoreFastDoubleElement returns stored value on all paths. ... BUG=chromium:91013 TEST=test/mjsunit/regress/regress-91013.js Review URL: http://codereview.chromium.org/7551009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 13:36:38 +00:00
vegorov@chromium.org	a547d333f0	Check for phi-uses of arguments object before eliminating dead phi's. ... HGraphBuilder::TryArgumentsAccess does not emit any uses for receiver and will generate incorrect code when receiver for a property access is defined by a phi that returns either arguments object or something else. BUG=v8:1582 TEST=test/mjsunit/regress/regress-1582.js Review URL: http://codereview.chromium.org/7553006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 09:32:28 +00:00
danno@chromium.org	008f834117	Properly handle FastDoubleArrays in Runtime_MoveArrayContents ... BUG=91013 TEST=regress91013.js Review URL: http://codereview.chromium.org/7551004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-08-02 09:28:55 +00:00
danno@chromium.org	1f9801bb9e	Fix bug in ARM pixel array clamping ... Properly handle undefined conversion to zero in Crankshaft. R=yangguo@chromium.org BUG=none TEST=regress-1563.js Review URL: http://codereview.chromium.org/7461028 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-22 16:01:53 +00:00
jkummerow@chromium.org	9de5255b60	Revert "Make window.undefined, window.NaN, window.Infinitiy read-only (ES5 section 15.1.1)" ... This reverts r8691. Review URL: http://codereview.chromium.org/7457020 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-20 10:51:11 +00:00
jkummerow@chromium.org	6768c5e24e	Make window.undefined, window.NaN, window.Infinitiy read-only (ES5 section 15.1.1) ... BUG=89490 TEST=manual: "Infinity = 42;" doesn't change the value of "Infinity" Review URL: http://codereview.chromium.org/7457019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-20 10:06:53 +00:00
ager@chromium.org	85f5afb717	Correctly mark functions from our natives files during compilation. ... When creating a CompilationInfo we always have the script and can determine if it is a natives script. Now that all natives functions are recognized as such, many of them are called with undefined as the receiver. We have to use different filtering for builtins functions when printing stack traces. Also, fixed one call of CALL_NON_FUNCTION to be correctly marked as a method call (with fixed receiver). Now that CALL_NON_FUNCTION is marked as a native function this caused the receiver to be undefined. R=svenpanne@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7395030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-19 08:19:31 +00:00
jkummerow@chromium.org	d4779286b6	Add map check for COW elements to crankshaft array handling code. ... BUG=1560 TEST=mjsunit/regress/regress-1560.js Review URL: http://codereview.chromium.org/7366008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-14 14:45:20 +00:00
kmillikin@chromium.org	890bc1607a	Fix a potential crash in const declaration. ... Declaration of const lookup slots would trigger an assertion if there was a setter somewhere in the prototype chain, and that setter was shadowed by a non-readonly data property also in the prototype chain. R=ager@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7324048 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-11 14:07:12 +00:00
kmillikin@chromium.org	cbaf1bc98b	Allow JSObject::PreventExtensions to work for arguments objects. ... R=karlklose@chromium.org Review URL: http://codereview.chromium.org/7335002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-11 06:48:19 +00:00
kmillikin@chromium.org	fe23339bdd	Fix a bug in for/in iteration of arguments objects. ... We did not properly combine the property names from the parameter map and the arguments backing store. They could overwrite each other and be unsorted. Also fix an unrelated bug: deleting from a dictionary-mode arguments backing store could corrupt the parameter map. R=rossberg@chromium.org BUG=1531 TEST=mjsunit/regress/regress-1531.js Review URL: http://codereview.chromium.org/7278033 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-08 07:31:48 +00:00
ricow@chromium.org	82e53270dc	Ensure that regexps always have code object, even if GC happened while running multiple times in runtime. ... Review URL: http://codereview.chromium.org/7316018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8560 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-07 10:04:56 +00:00
sgjesse@chromium.org	ca3787f395	Fix debug break on binary boolean operators ... The syntax checker finding breakable statements did not take into account that the right hand side of a boolean binary opration might never get evaluated. R=svenpanne@chromium.org BUG=v8:1523 TEST=test/mjsunit/regress/regress-1523.js Review URL: http://codereview.chromium.org//7212027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8544 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-06 10:16:57 +00:00
vitalyr@chromium.org	8f60208324	Fix bug 1529: check for NULL handle in v8::TryCatch::StackTrace. ... Internal HandleScope::CloseAndEscape crashes on NULL handles. R=kmillikin@chromium.org BUG=v8:1529 TEST=mjsunit/regress/regress-1529 Review URL: http://codereview.chromium.org/7309004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-04 13:29:56 +00:00
kmillikin@chromium.org	57c29c1f29	Fix a bug in with and catch context allocation. ... We were only looking one level up the scope chain to decide which closure to use in the fresh context. Instead, we should look to the first non-catch scope. R=vegorov@chromium.org BUG=1528 TEST=regress-1528 Review URL: http://codereview.chromium.org/7309002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-04 09:34:47 +00:00
kmillikin@chromium.org	a48c03bb2a	Fix an issue with optimization of functions inside catch. ... When optimizing a function defined inside a catch, we did not count the catch context as part of the context chain. R=vegorov@chromium.org BUG=1521 TEST=regress-1521 Review URL: http://codereview.chromium.org/7285032 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-07-01 14:05:46 +00:00
karlklose@chromium.org	c0e2268c8c	Fix problem with arguments object ICs not checking for dictionary mode elements. ... R=kmillikin@chromium.org BUG=1514 TEST=mjsunit/regress/regress-1513.js Review URL: http://codereview.chromium.org/7282029 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-30 14:56:06 +00:00
ager@chromium.org	0d8c343c90	Do not pass the global object as the receiver to strict-mode and ... builtin replace and sort functions. R=ricow@chromium.org BUG=v8:1360 TEST=mjsunit/regress/regress-1360.js Review URL: http://codereview.chromium.org/7283006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-30 12:29:19 +00:00
kmillikin@chromium.org	6543526a9d	Remove failing test while working on a fix. ... TBR=ricow@chromium.org Review URL: http://codereview.chromium.org/7283040 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-30 12:07:33 +00:00
kmillikin@chromium.org	3f84fcf6c9	Fix a bug in Object.defineProperty. ... There was a bug in Object.defineProperty when used to add an indexed property to an arguments object. When converting the elements backing store to dictionary mode, the parameter map in front of the backing store does not change. R=ager@chromium.org,karlklose@chromium.org Review URL: http://codereview.chromium.org/7289011 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-30 11:11:19 +00:00
keuchel@chromium.org	3f70c456eb	Fix "illegal access" when calling parseInt with a radix that is not a smi. ... BUG=v8:1246 TEST=regress-1246.js Review URL: http://codereview.chromium.org/7206019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-28 12:31:42 +00:00
ager@chromium.org	89cc886ba7	Fix receiver check in arguments ICs. ... The receiver needs to be checked in the same way as all other KeyedLoadICs to take non-JSObject and objects that require access checks or has interceptors into account. R=sgjesse@chromium.org BUG=87478 TEST=mjsunit/regress/regress-crbug-87478.js Review URL: http://codereview.chromium.org/7259015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8429 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-27 13:02:51 +00:00
fschneider@chromium.org	4bc671c2b0	Add missing write barrier for arguments store ICs. ... Review URL: http://codereview.chromium.org/7207006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8390 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-23 09:20:07 +00:00
ager@chromium.org	a96b9156a3	Correctly handle non-array receivers in Array length setter. ... BUG=v8:1491 TEST=mjsunit/regress/regress-1491.js Review URL: http://codereview.chromium.org/7206038 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8343 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-21 08:07:45 +00:00
erik.corry@gmail.com	c95ecb1fcd	Refix issue 1472. The previous fix worked for the example in the bug ... report, but was not general enough to catch all cases. This is a new approach. Includes regression test! Review URL: http://codereview.chromium.org/7193007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-17 08:01:12 +00:00
lrn@chromium.org	ee59eff127	Make line-terminators inside multi-line comments count. ... Now follows the specification. Follows WebKit change in revision 89100. BUG=86431 TEST=regress-892742 Review URL: http://codereview.chromium.org/7184034 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-17 07:23:07 +00:00
karlklose@chromium.org	f4e4bc43a8	Merge arguments branch to bleeding edge (second try). ... Review URL: http://codereview.chromium.org/7187007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-16 14:12:58 +00:00
karlklose@chromium.org	cc19d1e278	Revert "Merge arguments branch to bleeding merge." ... This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d. TBR=kmillikin@chromium.org Review URL: http://codereview.chromium.org/7172030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-16 06:37:49 +00:00
vegorov@chromium.org	14bf246dfa	Add missing branches in code generated for LModI with power-of-2 divisor. ... BUG=v8:1476 TEST=test/mjsunit/regress/regress-1476.js Review URL: http://codereview.chromium.org/7097015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-15 19:57:39 +00:00
karlklose@chromium.org	6cfeb2d400	Merge arguments branch to bleeding merge. ... Review URL: http://codereview.chromium.org/7167006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-15 15:09:28 +00:00
ricow@chromium.org	23d0aa614b	Ensure that bound functions does not have a prototype (fixes issue 794) ... Review URL: http://codereview.chromium.org/7148014 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-15 10:47:37 +00:00
ager@chromium.org	aa7ad8ee9d	Fix issue 1447 by not redefining properties unneccesarily in seal and freeze. ... This avoids attempting to redefine function.arguments with a different value than the current one. function.arguments returns a new copy on each invocation. R=lrn@chromium.org BUG=v8:1447 TEST=mjsunit/regress/regress-1447.js Review URL: http://codereview.chromium.org/7044104 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-10 09:45:02 +00:00
whesse@chromium.org	c40aa827bf	Add boolean flag to HChange and LNumberUntagD to not convert undefined to NaN. ... This is needed so that HCompare, optimized for double inputs, works correctly on undefined inputs. BUG=v8:1434 TEST=mjsunit/bugs/bug-1434.js Review URL: http://codereview.chromium.org/7044049 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-09 12:27:28 +00:00
fschneider@chromium.org	68eab4a8d8	Fix bug with GVN on array loads. ... This fixes a bug where an array load was incorrectly hoisted by GVN. BUG=85177 TEST=mjsunit/regress/regress-85177.js Review URL: http://codereview.chromium.org/7003054 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-09 11:15:03 +00:00
ager@chromium.org	626cdffaef	Fix Array.prototype.{reduce,reduceRight} to pass undefined as receiver for strict mode callbacks. ... Propagate strict mode information from pre-parser to parser for lazily compiled functions. R=lrn@chromium.org BUG=v8:1436 TEST=mjsunit/regress/regress-1436.js Review URL: http://codereview.chromium.org/7044054 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-09 09:05:15 +00:00
whesse@chromium.org	1ea14c2041	Limit the number of arguments in a function call to 32766. ... Limit the number of arguments in a function call to 32766. This is identical to the limit on the number of parameters to a function. BUG=v8:1413 TEST= Review URL: http://codereview.chromium.org/7054074 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-07 08:15:47 +00:00
fschneider@chromium.org	7c9cf0b3a1	Re-land r8140: Deoptimize on never-executed code-paths. ... Original cl: http://codereview.chromium.org/7105015 I'm removing the test GlobalLoadICGC test that was introduced for testing inlined global cell loads (in the classic backend) and has an invalid assumption about the number of global objects referenced from a v8 context. We don't have this feature with Crankshaft anymore. Review URL: http://codereview.chromium.org/7112032 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-06 14:57:25 +00:00
kmillikin@chromium.org	6a81642f31	Fix a bug in Lithium environment iteration. ... The Advance() function of the class responsible for iterating environment uses didn't always advance as far as it could (relying on the HasNext predicate to finish advancing). This is brittle. The HasNext predicate also didn't advance as far as it could when it was at the end of an environment level. This is a bug. R=jkummerow@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/6993023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-06 11:30:17 +00:00
erik.corry@gmail.com	0023cacc22	Fix traversal of the map transition tree to take the prototype ... transitions into account. Review URL: http://codereview.chromium.org/7074052 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-03 14:48:09 +00:00
fschneider@chromium.org	ff76d1ab0c	Revert r8140. ... It breaks test when running with nosnapshot. TBR=ager@chromium.org Review URL: http://codereview.chromium.org/7027029 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-01 13:34:15 +00:00
fschneider@chromium.org	0aa422923c	Eagerly deoptimize on never-executed code-paths. ... If type-feedback indicates that an expression was never executed in the non-optimized code, we insert a forced deoptimization right away to enable re-optimization if we ever hit this path. With this change we still continue to build the graph. As a next step, we should remove the dead code after the deoptimize. I had to remove one assert about the optimization status in a test since we now immediately deoptimize after exiting the loop that triggers OSR. Also remove a restriction that control-flow from an inlined function in a test context always reaches both true- and false-target. Review URL: http://codereview.chromium.org/7105015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-06-01 11:04:40 +00:00
ager@chromium.org	544191e718	Update apply with arguments optimization for strict mode functions and builtins. ... Do not convert to object for values for strict-mode functions and builtins. R=ricow@chromium.org BUG=v8:1412 TEST=mjsunit/regress/regress-1412.js Review URL: http://codereview.chromium.org/7096006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-31 10:38:41 +00:00
ager@chromium.org	a01b45df58	Fix a number of tests that incorrectly used assertUnreachable. ... Our testing infrastructure uses exceptions to indicate errors. assertUnreachable therefore throws an exception to indicate that it was reached. Therefore, it cannot be used to check that an exception was thrown using the pattern: try { shouldThrow(); assertUnreachable(); } catch(e) { } Such a test will always pass because assertUnreachable will throw an exception if shouldThrow does not. R=ricow@chromium.org Review URL: http://codereview.chromium.org/7053035 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-31 08:08:42 +00:00
ager@chromium.org	bfa2ef1f11	Fix receiver for calls to strict-mode and builtin functions that are ... potentially shadowed by eval. R=sgjesse@chromium.org TEST=mjsunit/regress/regress-124.js Review URL: http://codereview.chromium.org/7096004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-31 07:57:22 +00:00
ager@chromium.org	017935408d	Reapply change to Pass undefined to JS builtins when called with ... implicit receiver. A couple of corner cases have to be treated specially to not break everything: eval and getter/setter definitions. R=fschneider@chromium.org BUG=v8:1365 TEST=mjsunit/regress/regress-1365.js Review URL: http://codereview.chromium.org/7085034 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-30 13:49:22 +00:00
ricow@chromium.org	7eb6f5c1ba	Correctly set the length of string before creating filler object in the json parser (fixes crbug 84186). ... Testcase created based on the supplied test case from the bug report, but using json parse directly instead of through the chrome javascript console. Review URL: http://codereview.chromium.org/7084023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-30 06:04:36 +00:00
ager@chromium.org	c832c467a4	Revert "Pass undefined to JS builtins when called with implicit receiver." ... Presubmit and failing test. TBR=lrn@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7071009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-26 11:22:29 +00:00
ager@chromium.org	19b718fe73	Pass undefined to JS builtins when called with implicit receiver. ... A couple of corner cases have to be treated specially to not break everything: eval and getter/setter definitions. R=lrn@chromium.org BUG=v8:1365 TEST=mjsunit/regress/regress-1365.js Review URL: http://codereview.chromium.org/7068009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-26 11:07:48 +00:00
lrn@chromium.org	02c4e8bfcb	Make RegExp objects not callable. ... Review URL: http://codereview.chromium.org/6930006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-26 07:35:09 +00:00
ricow@chromium.org	f675db651d	Change calls to undefined property setters to not throw (fixes issue 1355). ... We currently throw when there is only a getter defined on the property, but this should only be the case in strict mode. Review URL: http://codereview.chromium.org/7064027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-25 08:37:38 +00:00
sgjesse@chromium.org	eff2946b9b	Handle changes to the Object prototype in fast handling of arrays ... R=ager@chromium.org BUG=v8:1403 TEST=test/mjsunit/regress/regress-1403.js Review URL: http://codereview.chromium.org//7067019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-24 12:28:10 +00:00
ricow@chromium.org	ab67432ed0	Change strict mode poison pill to be the samme type error function (fixes issue 1387). ... We are now following the spec, and with regards to the error message we are following firefox (webkit still has different type errors in their nightly) Review URL: http://codereview.chromium.org/7067017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-24 11:07:06 +00:00
sgjesse@chromium.org	825a433900	Add regression test for issue 1401 ... R=ager@chromium.org BUG=v8:1401 TEST=test/regress/regress-1401.js Review URL: http://codereview.chromium.org//7062002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-23 13:03:45 +00:00
ager@chromium.org	98778dc802	Remove execScript from V8. No longer present i neither Firefox nor Safari. ... R=ricow@chromium.org BUG= TEST= Review URL: http://codereview.chromium.org/7046002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7948 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-19 08:10:27 +00:00
vegorov@chromium.org	7fba506f23	Add regression test for http://crbug.com/82769 ... Review URL: http://codereview.chromium.org/7034025 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-18 12:46:21 +00:00
whesse@chromium.org	0eca2b4fc1	Fix error in postfix ++ in Crankshaft. ... Add HForceRepresentation, to represent the implicit ToNumber applied to the input of a count operation. BUG=v8:1389 TEST= Review URL: http://codereview.chromium.org/7033008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7913 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-17 11:41:59 +00:00
ricow@chromium.org	964dbff40d	Only send null or undefined as receiver for es5 natives, not generally ... for builtin functions. Review URL: http://codereview.chromium.org/7012012 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7879 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-13 07:26:44 +00:00
ricow@chromium.org	7f8a918f08	Allow strict mode flag as extraicstate for keyed external array store ic ... We currently hit an assertion in computeflags, but the extra_ic_state is used to pass the strict mode flag in. BUG: 1383 Review URL: http://codereview.chromium.org/7003022 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-11 08:53:46 +00:00
jkummerow@chromium.org	1eedd8056d	Fix timeout of test regress-1118.js ... TEST=mjsunit/regress/regress-1118.js no longer times out when run in the ARM simulator. Review URL: http://codereview.chromium.org/6994010 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-10 15:07:30 +00:00
ager@chromium.org	0961b1a936	Check that receiver is JSObject on API calls. ... R=sgjesse@chromium.org BUG=v8:1369 TEST=mjsunit/regress/regress-1369.js Review URL: http://codereview.chromium.org/6931056 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-06 14:14:16 +00:00
karlklose@chromium.org	d43066050a	Replace loops by OptimizeFunctionOnNextCall in regress-1085 and regress-1210. ... Review URL: http://codereview.chromium.org/6938001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-06 09:10:28 +00:00
ricow@chromium.org	e0eb110130	Reapply 7763, including arm and x64 variants. ... The only difference to revision 7763 is the implementation in the builtins file for arm and x64, plus a move of Array.prototype.toString and Array.prototype.toLocaleString from should throw on null or undefined to the non generic test cases in the function-call test (due to us not currently supporting generic cases with these to functions) Review URL: http://codereview.chromium.org/6928007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-05 05:21:30 +00:00
karlklose@chromium.org	8b917d4d96	Replace long running loops by OptimizeFunctionOnNextCall in some tests that are often timing out on ARM. ... Review URL: http://codereview.chromium.org/6910022 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-03 13:53:08 +00:00
ricow@chromium.org	4d890da191	Revert 7763, missing implementation on x64 and arm for call and apply with null or undefined. ... Review URL: http://codereview.chromium.org/6913024 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-03 13:45:19 +00:00
ricow@chromium.org	2b730c2bf6	Don't exchange null and undefined with the global object in function.prototype.{call, apply} for natives. ... This makes us compatible with firefox in throwing an exception when call is invoked on a builtin with null as the this argument. Review URL: http://codereview.chromium.org/6902104 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-03 13:19:04 +00:00
lrn@chromium.org	d1411602a7	Don't allow whitespace after sign characters in parseInt. ... BUG=v8:955 TEST=mjsunit/regress/regress-955 Review URL: http://codereview.chromium.org/6903171 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-03 07:11:17 +00:00
kmillikin@chromium.org	1af840ad4c	Be more discriminating about uses of the arguments object in optimized code. ... Because we track the value of the arguments object, we need to check values whenever plugged into a forbidden value context. It is not enough to check at only variable references as we did previously. R=fschneider@chromium.org BUG=1351 TEST=regress-1351.js Review URL: http://codereview.chromium.org/6902202 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-05-02 11:35:51 +00:00
vegorov@chromium.org	1c950e04cc	Fix missing writebarrier in ArraySplice builtin. ... Review URL: http://codereview.chromium.org/6883227 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-28 16:03:40 +00:00
karlklose@chromium.org	3b6fe22c4d	Make throw inlineable only if the exception is inlineable. ... BUG=1337 TEST=regress-1337 Review URL: http://codereview.chromium.org/6881079 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-20 09:15:52 +00:00
lrn@chromium.org	7aec228dbb	Cleanup of mjsunit.js code and make assertEquals more strict. ... Encapsulate the helper functions in mjsunit.js. Now only exposes the exception class and the assertXXX functions. Make assertEquals use === instead of ==. This prevents a lot of possiblefalse positives in tests, and avoids having to do assertTrue(expected === actual) when you need it. Fixed some tests that were either buggy or assuming == test. Review URL: http://codereview.chromium.org/6869007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-15 11:35:36 +00:00
jkummerow@chromium.org	1d774ac5ca	Fix load/store of external float arrays on ARM ... BUG=1323 TEST=mjsunit/regress/regress-1323.js, run with simulator=arm Review URL: http://codereview.chromium.org/6822054 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-12 15:20:26 +00:00
jkummerow@chromium.org	ed968b1042	Introduce runtime function %OptimizeFunctionOnNextCall to manually trigger optimization. ... TEST=existing unit tests still pass Review URL: http://codereview.chromium.org/6821009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7572 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-11 13:24:50 +00:00
vegorov@chromium.org	8a8d3bbbee	In LCodeGen::DoDeferredLInstanceOfKnownGlobal emit safepoint with registers for the call to stub. ... Review URL: http://codereview.chromium.org/6793017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-07 13:32:45 +00:00
peterhal@chromium.org	e3d788329a	1309 fix ... BUG= TEST= Review URL: http://codereview.chromium.org/6800018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-06 16:22:06 +00:00
vegorov@chromium.org	ae65366f0b	Fix SlotRef::SlotAddress for parameters indices. ... Fix %NewObjectFromBound to correctly handle optimized frames (including those with inlined functions). Fix %_IsConstructCall handling in hydrogen: when called from inlined function return false constant directly instead of emiting HIsConstructCall. Fix success case in TraceInline. BUG=v8:1229 TEST=test/mjsunit/regress/regress-1229.js Review URL: http://codereview.chromium.org/6740023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-04-01 11:41:36 +00:00
sgjesse@chromium.org	1eb224c2a2	ARM: Check for minus zero when converting binary operation result to smi ... The result of an Int32 binary operation will be converted to a smi if it fits. However a minus zero check was missing. BUG=v8:1278 TEST=test/mjsunit/regress/regress-1278.js R=ager@chromium.org Review URL: http://codereview.chromium.org/6755009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-29 07:43:27 +00:00
ricow@chromium.org	fb6d7e17df	Follow jsc on not throwing when trying to add a property to a non-extensible object. ... This change makes us compatible with Safari on not throwing when trying to add a property to a non-extensible object. Review URL: http://codereview.chromium.org/6712059 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-28 06:11:08 +00:00
ager@chromium.org	a7d44c49a5	Add regression test. ... git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-24 11:03:08 +00:00
vegorov@chromium.org	c83f0a715e	Make HDeoptimize to explicitly use environment values. ... Otherwise dead phi elimination can actually remove some of the implicitly used phis. BUG=1257 TEST=test/mjsunit/regress/regress-1257.js Review URL: http://codereview.chromium.org/6672066 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-17 12:22:49 +00:00
ricow@chromium.org	e8ff324583	Follow Safari on not throwing when __defineGetter__ fails. ... In addition, this fixes defineOwnProperty to actually not throw when the should_throw flag is false (we had no usage of this priorly). Review URL: http://codereview.chromium.org/6695018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-15 14:19:18 +00:00
ricow@chromium.org	7cb35bcfa5	Reapply 7143 after fixing issue 1250 ... Review URL: http://codereview.chromium.org/6698027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-15 12:25:13 +00:00
whesse@chromium.org	f6e1b82fd4	Fix a problem where Object.getOwnPropertyDescriptor and related functions unintentionally called toString on the values of an object's properties. Fixes issue 1233. ... Review URL: http://codereview.chromium.org/6677017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-11 13:57:20 +00:00
ricow@chromium.org	c00631b86e	Fix presubmit by deleting regress-1240 not deleted by last patch. ... git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-11 09:08:52 +00:00
ricow@chromium.org	f2730d2ab8	Revert revision 7143, this causes a number of webkit tests to fail. ... This includes a security test. Reverting to investigate further. Review URL: http://codereview.chromium.org/6673019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-11 09:02:54 +00:00
ricow@chromium.org	fa9e57e326	Change __defineGetter__ and __defineSetter__ to respect non-configurable. ... This makes us compatible with firefox. Earlier on we were somehow compatible with safari - which will allow defining a getter even when an existing getter is present and non-configurable. We would, however, in addition to overwriting the getter also change configurable to true. The approach used by firefox seems much more sound, i.e., why should it be possible to use __defineGetter__ or __defineSetter__ to overwrite a non-configurable getter or setter respectively. I will file a bug on the webkit bugtracker. Review URL: http://codereview.chromium.org/6658037 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-11 08:05:59 +00:00
lrn@chromium.org	a8b41a0edd	Fix bug in X64 RegExpExec stub. ... Used incorrect register for referencing RegExp data, so it always failed to match the fast case. When modifiying the object layout, it was possible to make it crash instead. BUG=v8:1236 TEST=test/mjsunit/regress/regress-1236.js Review URL: http://codereview.chromium.org/6635041 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-08 14:15:25 +00:00
kmillikin@chromium.org	4a9056cbce	Fix a stack-height mismatch during deoptimization. ... When deoptimizing after a conditional expression in an effect context, we should not see the value of the conditional expression. BUG=v8:1237 Review URL: http://codereview.chromium.org/6625057 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-07 17:01:12 +00:00
fschneider@chromium.org	8a72161585	Add lazy deoptimization environment to instanceof by marking it as a call. ... This fixes an assert when an exception is thrown inside instanceof. BUG=v8:1207 TEST=mjsunit/regress/regress-1207.js Review URL: http://codereview.chromium.org/6588083 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-01 15:37:24 +00:00
kmillikin@chromium.org	6b1530ea6d	Fix a stack height mismatch when deoptimizing. ... When deoptimizing from the key subexpression of a keyed arguments access, the unoptimized code expects to find the value of the receiver on the expression stack. The environment of the optimizing compiler did not contain this value during evaluation of the key subexpression. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-01 09:32:45 +00:00
ricow@chromium.org	c63d9c97cf	Do not allow non-configurable global properties to be made configurable (fixes issue 1213). ... We do not currently check that a global property is actually configurable before overwriting it with a new property. Review URL: http://codereview.chromium.org/6597045 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-03-01 08:09:17 +00:00
ager@chromium.org	7c561be519	Remove Error.prototype.toStrings prototype property. ... I did not use the helper function for adding this builtin function which meant that I missed the removal of the prototype property. BUG= TEST= Review URL: http://codereview.chromium.org/6588050 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6971 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-28 13:29:05 +00:00
vegorov@chromium.org	88b70c8941	When checking number of parameters in MakeCrankshaft code don't forget about receiver. ... BUG=v8:1209 TEST=test/mjsunit/regress/regress-1209.js Review URL: http://codereview.chromium.org/6591042 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-28 13:20:10 +00:00
lrn@chromium.org	485f4ea0d9	Clear exceptions set during attempts to lazily optimize. ... Resubmit of patch for issue 1145 with a few additions: - Now also clears exceptions when calling Runtime_LazyRecompile. - Sets function where parsing fails to not be optimizable. BUG=v8:1145 TEST=test/mjsunit/regress/regress-1145.js Review URL: http://codereview.chromium.org/6469050 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-25 11:17:31 +00:00
antonm@chromium.org	da463ab484	Get property may throw an exception thanks to JS accessors. ... Check result before and bail out if exception has been thrown. BUG=v8:1172 TEST=test/mjsunit/regress/regress-1172-bis.js Review URL: http://codereview.chromium.org/6580030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-24 17:42:56 +00:00
karlklose@chromium.org	5572d24fc5	ARM: Fix DoubleToI. ... BUG=1811 TEST=test/mjsunit/regress/regress-1181.js Review URL: http://codereview.chromium.org/6573004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-24 10:07:35 +00:00
ager@chromium.org	ae328e61b0	Properly reset external catcher if exception couldn't be externally caught. ... We can wrongly assume that exception which is not intended to be caught by external try/catch should be caught if this exception inherits external catcher from some previous exception. To prevent that, clear external catcher when processing exceptions which cannot be externally caught. BUG=v8:1184 TEST=test/mjsunit/regress/regress-1184.js Review URL: http://codereview.chromium.org/6538081 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-23 06:55:47 +00:00
mmaly@chromium.org	3ff7aa0ea9	Fix for bug http://code.google.com/p/v8/issues/detail?id=1176. ... Review URL: http://codereview.chromium.org/6469083/ git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-22 17:20:25 +00:00
ricow@chromium.org	45c63ffa6a	Add more generic version of reloc info padding to ensure enough space for reloc patching during deoptimization (fixes issue 1174). ... The old version only added extra space when we did indirect calls, but the problem remains the same with normal calls that can be represented as a single byte. When doing patching each call will always be at least 2 bytes long because we use RUNTIME_ENTY as the reloc mode. Review URL: http://codereview.chromium.org/6541053 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-22 12:28:33 +00:00
ricow@chromium.org	8162d9029d	Fix second half of issue 1151, the first change (r6765) only fixed FunctionGetPrototype, not FunctionSetPrototype. ... Review URL: http://codereview.chromium.org/6548008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-22 12:27:36 +00:00
kmillikin@chromium.org	123dbb2f5e	Change the baseline compiler to match the Hydrogen graph builder. ... The Hydrogen graph translation does not build a branch for unary negation in an effect context, so the baseline compiler should not do so either. Review URL: http://codereview.chromium.org/6546050 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6871 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-21 16:49:39 +00:00
antonm@chromium.org	e79bfcaf3f	Use [[DefineOwnProperty]] to put 'constructor' field on the protoype object. ... That better follows ECMA-262 (see 13.2 Creating Function Objects) and allows to ignore nasty JS accessors for 'constructor' property. BUG=v8:1172 TEST=test/mjsunit/regress/regress-1172.js Review URL: http://codereview.chromium.org/6531037 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-18 10:53:38 +00:00
ager@chromium.org	963472c516	Change behavior of global declarations in the presence of setters. ... Call accessors in the global object prototype when initializing global variables. Function declarations are special cased for compatibility with Safari and setters are not called for them. If this special casing was not done webkit layout tests would fail. Make the declaration of global const variables in the presence of callbacks a redeclaration error. Handle const context slot declarations conflicting with a CALLBACK as a redeclaration error. That is, unless it is on a context extension object which is not a real object and therefore conceptually have no accessors in prototype chains. Accessors in prototype chains of context extension objects are explicitly ignored in SetProperty. Review URL: http://codereview.chromium.org/6534029 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 21:04:53 +00:00
ager@chromium.org	65addc5165	Revert change to const and global variable declarations. It causes ... may WebKit layout test failures. I will look into it tomorrow. TBR=kmillikin@chromium.org Review URL: http://codereview.chromium.org/6537021 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 16:54:49 +00:00
ager@chromium.org	dc38755aba	Call accessors in the global object prototype when initializing global ... variables. Make the declaration of global const variables in the presence of callbacks a redeclaration error. Handle const context slot declarations conflicting with a CALLBACK as a redeclaration error. That is, unless it is on a context extension object which is not a real object and therefore conceptually have no accessors in prototype chains. Accessors in prototype chains of context extension objects are explicitly ignored in SetProperty. Review URL: http://codereview.chromium.org/6519050 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6841 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 16:30:15 +00:00
lrn@chromium.org	246560b902	Revert 6832. ... The test contains a syntax error that shouldn't be detected, but it sometimes is. TBR: kmillikin@chromium.org Review URL: http://codereview.chromium.org/6519049 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6836 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 14:13:25 +00:00
kmillikin@chromium.org	b02107284a	Fix incorrect deoptimization for logical not in an effect context. ... The baseline compiler does not materialize a value for expressions of the form !expr in an effect context so the graph translation should not produce such an environment, otherwise we risk targeting it by deoptimization. BUG=v8:1167 Review URL: http://codereview.chromium.org/6537018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 13:05:49 +00:00
lrn@chromium.org	cf50c5e27c	Handle exceptions thrown while parsing lazy functions for inlining. ... We currently leave the exception as pending without returning a Failure::Exception() value. This is either caught immediately if running with --debug-code, or caught later by an assert in debug mode. This change makes the pending exception be cleared before returning from the failed optimization attempt. BUG=v8::1145 TEST=test/mjsunit/regress/regress-1145.js Review URL: http://codereview.chromium.org/6524039 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 12:23:18 +00:00
kmillikin@chromium.org	82cdd48b2f	Fix a bug in deoptimization after logical expressions in an effect context. ... When deoptimizing to after an expression of the form (expr0 || expr1) or (expr0 && expr1) in an effect context, the unoptimized code could incorrectly see the value of the expression. Handle the short-circuit binary operators specially in effect contexts. This fixes the issue and will generate better code when the left subexpression is boolean-valued. BUG=v8:1166 Review URL: http://codereview.chromium.org/6519046 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-17 11:06:50 +00:00
vitalyr@chromium.org	4143e4c097	Fix issue 1160: check array elements in ArrayJoin. ... Review URL: http://codereview.chromium.org/6529020 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-15 15:12:51 +00:00
ricow@chromium.org	a8d4360d65	Make sure we always have room for patching the reloc info during lazy deoptimization (fixes issue 1156). ... Before we could have calls to builtins that would not be in the relocation info since this used a register as target. Whenever we have this case (from lithium codegen) we now emit a comment in the reloc info. Review URL: http://codereview.chromium.org/6499015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-15 14:36:12 +00:00
fschneider@chromium.org	ad70b7de39	Fix a potential crash bug in keyed calls for non-string keys. ... BUG=v8:1146 Review URL: http://codereview.chromium.org/6517010 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-14 13:13:41 +00:00
kmillikin@chromium.org	c73ce4f126	Fix a duplicate AST ID recorded for for/in. ... Avoid visiting the subexpressions of a variable that rewrites to a property when occurring as the 'left-hand side' of for/in. BUG=v8:1149 Review URL: http://codereview.chromium.org/6475009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-14 12:51:25 +00:00
ricow@chromium.org	34eeb88ee4	Use ForceSetObjectProperty in DefineOrRedefineDataProperty (fixes crbug 72736). ... The current version uses SetObjectProperty which will not set the value in case this is a readonly property. The spec explictly says that a configurable but non writable property can have its value changed with Object.defineProperty (because the same thing can be accomplished by doing 3 calls (set writable to true, update the value, set writable to false). Review URL: http://codereview.chromium.org/6518004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-14 10:43:21 +00:00
ricow@chromium.org	6d9fde492c	Do not allow calls to SetProtoType on functions that should not have a prototype (fixes issue 1151) ... Review URL: http://codereview.chromium.org/6518003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-14 09:37:56 +00:00
ricow@chromium.org	46bde305b5	Add support for the global object in Object.keys (fixes issue 1150) ... We do not currently handle the case where the JSGlobalProxy is passed as argument to LocalKeys in runtime.cc. Review URL: http://codereview.chromium.org/6516008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-14 07:49:13 +00:00
antonm@chromium.org	e96c24bf03	Properly treat exceptions thrown while compiling. ... BUG=v8:1132 TEST=test/mjsunit/regress/regress-1132.js Review URL: http://codereview.chromium.org/6487021 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-11 14:26:56 +00:00
lrn@chromium.org	fdfbdfbcf5	Fix typo in ASSERT in object-verifier for RegExp. ... BUG=v8::1129 TEST=test/mjsunit/regress/regress-1129.js Review URL: http://codereview.chromium.org/6476027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-10 16:43:01 +00:00
antonm@chromium.org	ab24485760	Bypass JS accessors when building error array. ... In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement may throw or its behaviour can be altered. Instead operate on plain FixedArrays and turn them into JSArry later. BUG=v8:1130 TEST=test/mjsunit/regress/regress-1130.js Review URL: http://codereview.chromium.org/6481001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-10 15:02:13 +00:00
fschneider@chromium.org	5b753cecb6	Check holder before optimizing calls to global functions. ... In the case where the function is not found in the global object, we have to generate a generic call. BUG=v8:1106 TEST=mjsunit/regress/regress-1106.js Review URL: http://codereview.chromium.org/6483010 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-10 12:33:51 +00:00
vegorov@chromium.org	49adfd0f0a	Bailout from PrepareSlowElementsForSort when hiting a key outside of smi-range. ... BUG=v8:1131 TEST=test/mjsunit/regress/regress-1131.js Review URL: http://codereview.chromium.org/6469006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-10 12:33:34 +00:00
whesse@chromium.org	0fb5a1fd1a	Add a regression test for issue 1106, optimized access to the prototype chain of the global object. ... Review URL: http://codereview.chromium.org/6459023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 15:50:39 +00:00
lrn@chromium.org	d358e2ecd3	Fix incorrect asserts in scanner. ... BUG=v8::1126 TEST=test/mjsunit/regress/regress-1126.js Review URL: http://codereview.chromium.org/6459021 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 14:16:25 +00:00
whesse@chromium.org	afec61e870	Fix typo in r6697: Use assertThrows correctly in the added test regress-1122.js. ... Review URL: http://codereview.chromium.org/6460030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 13:16:40 +00:00
whesse@chromium.org	602d5cf427	Fix a bug that occurs when functions are defined with more than 16,382 parameters. ... Review URL: http://codereview.chromium.org/6447007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 12:46:22 +00:00
kmillikin@chromium.org	991a1cae12	Fix an assertion failure in stack trace construction. ... When constructing stack traces we interpret the deoptimization data for optimized frames to find the receiver value. This value could sometimes be eliminated from the deoptimization data if we though it was unused. BUG=v8:1118 Review URL: http://codereview.chromium.org/6465023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 11:45:50 +00:00
antonm@chromium.org	d724993138	Use GC-safe version when setting elements. ... BUG=1125 TEST=test/mjsunit/regress/regress-1125.js Review URL: http://codereview.chromium.org/6463001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-09 11:38:10 +00:00
antonm@chromium.org	cf30cefda7	Check if Array.prototype.__proto__ has been reset to null. ... BUG=v8:1121 TEST=test/mjsunit/regress/regress-1121.js Review URL: http://codereview.chromium.org/6454004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 19:56:44 +00:00
antonm@chromium.org	0273e8185b	Propagate exceptions thrown when setting elements. ... Plus use more robust path when formatting messages---work directly with fixed arrays. BUG=v8:1107 TEST=test/mjsunit/getter-in-prototype.js,test/mjsunit/regress/regress-1107.js Review URL: http://codereview.chromium.org/6451004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 19:42:14 +00:00
antonm@chromium.org	da8b72f2b8	1) Return failure if any of property sets failed; ... 2) We cannot assert the declared property will go to the extension in the presence of callbacks and interceptors. BUG=1119 TEST=test/mjsunit/regress/regress-1119.js Review URL: http://codereview.chromium.org/6454011 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 19:04:17 +00:00
ager@chromium.org	096c21522b	Fix wrong assumption in parser that parsing a function literal cannot throw an exception. ... Review URL: http://codereview.chromium.org/6453009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 18:46:13 +00:00
ager@chromium.org	8c6c273236	Fix issues with using defineProperty on the global proxy object. ... Review URL: http://codereview.chromium.org/6452004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 16:31:58 +00:00
ricow@chromium.org	f64966085e	x64: Add MulI and DivI to lithium instructions. ... Review URL: http://codereview.chromium.org/6448001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 14:37:50 +00:00
lrn@chromium.org	2f32f27e8f	Correct propagation of exceptions from setters. ... BUG=v8:1105 TEST=test/mjsunit/regress/regress-1105.js Review URL: http://codereview.chromium.org/6451003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 14:04:27 +00:00
kmillikin@chromium.org	bf3c3eb9cb	Fix a possible duplicate AST ID for deoptimization. ... For redeclarations of variables that alias the parameters in functions using arguments, we need to avoid re-visiting the shared variable rewrite. BUG=v8:1104 Review URL: http://codereview.chromium.org/6453004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 14:00:22 +00:00
ricow@chromium.org	20f2c1c98a	Make sure that we do not call is_extensible on the global proxy. ... When calling Object.isExtensible we did not do a check for the global js proxy. This caused the check on the extensible bit on the map to return true, even when the bit was set to false on the global js object. Review URL: http://codereview.chromium.org/6450003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 13:09:07 +00:00
ricow@chromium.org	81787f986b	Make sure that we never call prevent extension on the global proxy, ... but instead call this on the global object. BUG: 1103 Review URL: http://codereview.chromium.org/6454001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-08 12:41:16 +00:00
vegorov@chromium.org	10f715e3ff	Restore context after LApplyArguments. ... BUG=v8:1099 TEST=test/mjsunit/regress/regress-1099.js Review URL: http://codereview.chromium.org/6246106 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-04 15:42:02 +00:00
peterhal@chromium.org	c894b1f317	Fix bugs 992, 1083 and 1092 ... My previous patch added an assert which uncovered 1092 in the sputnik tests. This patch adds the fix for 1092, which is to ensure that NormalizeProperties does not get called for a JSGlobalProxy along all code paths. Add sputnik tests to .gitignore. BUG= TEST= Review URL: http://codereview.chromium.org/6286060 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-03 19:29:10 +00:00
ricow@chromium.org	a2aa84873e	Add regression test for the deoptimizer immediately followed by gc bug. ... In addition to the regression test I changed the gc-extension to take a boolean flag specifying if compaction should be used (default is false, existing tests will not change behaviour) The regression test is disabled on arm and x64 with crankshaft enabled. I made a bug to track this: http://code.google.com/p/v8/issues/detail?id=1094 Review URL: http://codereview.chromium.org/6312118 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6619 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-03 13:47:27 +00:00
danno@chromium.org	a2fb4a12bb	Create specialized code stubs for PixelArray loads. ... Review URL: http://codereview.chromium.org/6287030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-03 12:50:50 +00:00
kmillikin@chromium.org	ca936dae9e	More of the fix for V8 issue 1079. ... The arguments property of functions, if we find an optimized frame for the function, is always a freshly allocated object. We never try to find an existing arguments object. Review URL: http://codereview.chromium.org/6349050 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-02 15:08:29 +00:00
erik.corry@gmail.com	0097f005fd	Fix code generation bug on ARM in classic codegen. ... Review URL: http://codereview.chromium.org/6246045 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-02 14:14:55 +00:00
kmillikin@chromium.org	f1149734fc	Partial fix for V8 issue 1079. ... Record a safepoint with a deoptimization id for throw in optimized code. We don't seem to much care what the AST ID is because we will not be using it for lazy deoptimization (throw doesn't return to the point of throw). For hygiene we use the actual ID of the throw expression. Throw is no longer a control-flow instruction, but it's followed by an unconditional abnormal exit. This is required to insert a simulate between the throw and the exit. Make our optimized treatment of Function.prototype.apply act like a call and have side effects. This ensures that it will get a lazy deoptimization environment. Use that deoptimization ID in the safepoint for the call. Deleting a property was also missing a deoptimization ID, though there was a deoptimization environment assigned to the instruction. Record the environment and use the deoptimization ID at the safepoint. Review URL: http://codereview.chromium.org/6250105 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-02 13:55:29 +00:00
vegorov@chromium.org	6751627615	Require typed input representation for HTypeof hydrogen instruction. ... BUG=http://code.google.com/p/chromium/issues/detail?id=71647 TEST=test/mjsunit/regress/regress-71647.js Review URL: http://codereview.chromium.org/6410025 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-02 09:52:57 +00:00
peterhal@chromium.org	5ca89179d7	Revert "Fix bugs 992 and 1083" ... This reverts commit 6561 as the new assert caused failures in sputnik. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-01 20:08:01 +00:00
peterhal@chromium.org	9c89aa6dd9	Fix bugs 992 and 1083 ... Fixes JS portion of DefineOwnProperty when there is an existing property and the new descriptor is generic. Makes code follow spec steps more closely. Fixes typo for check for unchanged enumerable in step 6. Adds regression tests. Fixes errors in object-define-property test Don't normalize the JSGlobalProxy. Gets webkit http/tests/security/xss-DENIED-defineProperty.html working. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-02-01 17:08:14 +00:00
kmillikin@chromium.org	9cfbb240a0	Update regression test. ... With SVN r6465 (reverting changes to scopes), a regression test for deleting parameter variables has to change to reflect a semantic change. It is now again possible to delete parameters from a function that uses 'with' or 'try...catch'. Review URL: http://codereview.chromium.org/6307014 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-25 13:32:36 +00:00
kmillikin@chromium.org	9c2d52eb0e	Fix a bug in delete for lookup slots. ... The function Runtime_LookupContext searches the context chain for a LOOKUP slot and returns the object holding the slot. It returned the global context if the slot was not found or if it was found in a function's context or arguments object. This is not the correct object to use for 'delete'. Since this lookup function is only ever used when deleting LOOKUP slots (those that have to go through a with or a scope with eval), it is simply replaced with a Runtime_DeleteContextSlot function that does the appropriate thing for all kinds of context lookups. This fixes Chromium bug 70066. http://code.google.com/p/chromium/issues/detail?id=70066 Review URL: http://codereview.chromium.org/6280013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-24 14:03:30 +00:00
kmillikin@chromium.org	70910af7a0	Fix an assertion failure in the full code generator. ... We hit an assertion failure when we tried to record the AST ID of the (shared) .arguments variable proxy more than once. This was hit when we had multiple calls to the same parameter in a function that used the arguments object. The fix is to not visit the subexpressions of the (shared) property access expression. BUG=1060 Review URL: http://codereview.chromium.org/6368007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-19 15:26:54 +00:00
lrn@chromium.org	f09705ab9b	Make invalid break/continue statements an early syntax error. ... Previously we delayed the throwing of syntax errors until runtime, so unreachable errors didn't get reported. To match a change in JSC, we now stop parsing and report the error immediately. BUG=69736 TEST= Review URL: http://codereview.chromium.org/6355006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-17 09:36:10 +00:00
antonm@chromium.org	fae90d4f32	Make closures optimizable by Crankshaft compiler. ... Currently only closures which only read from the context are supported. Review URL: http://codereview.chromium.org/5753005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-17 08:11:03 +00:00
lrn@chromium.org	a50e69bda5	Avoid calling inherited setters when creating object literals and their boilerplates. ... Fix issue 1015. Review URL: http://codereview.chromium.org/6118001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-06 14:00:50 +00:00
sgjesse@chromium.org	9bc3a16af0	Fix bug in instanceof stub ... If the instanceof stub was requested to deliver true/false objects as the result instead of 0/1 then 0/1 was actually returned if the builtin INSTANCE_OF ended up being called. This is now fixed. BUG=v8:1020 TEST=test/mjsunit/regress/regress-1020.js Review URL: http://codereview.chromium.org/6014013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-05 14:19:12 +00:00
ricow@chromium.org	aa396c5779	Allow getters and setters on JSArray elements. ... This fixes bug 900 Review URL: http://codereview.chromium.org/5959009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-04 13:59:34 +00:00
lrn@chromium.org	59aea66dfa	Fix bug that happens when the first non-ASCII character of a literal is at a power-of-two position. ... Review URL: http://codereview.chromium.org/6044009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2011-01-04 11:25:59 +00:00
ager@chromium.org	6e30a77ab5	A number of instructions use GVN but do not provide a comparison ... function for the data. This leads to wrong results where operations are wrongly assumed to have the same value as a previous (different) operation. Provide the data comparison functions. BUG=995 Review URL: http://codereview.chromium.org/5898003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-16 15:40:02 +00:00
ricow@chromium.org	357afa385b	Change Object.defineProperty to accept undefined as getters and setters and to correctly accept overriding an accessor with a data property. ... In the past we only accepted functions as argument for setting an accessor. Since one should be able to set an accessor to undefined this had to be changed to take either. In addition, we did not lookup properties in the prototype chain, causing us to call the setter of an existing accessor up the prototype chain when trying to replace an existing accessor (that was not local) with a data property. Review URL: http://codereview.chromium.org/5861006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-16 12:21:08 +00:00
kmillikin@chromium.org	ace6290452	Fix issue 974. ... When entering a finally block in unoptimized code, we unconditionally save the accumulator register in the stack in case it holds a return value or an exception. In the case of a break, continue, or falling off the end of the try or catch block, this value is unpredictable and not necessarily safe for GC. Review URL: http://codereview.chromium.org/5883003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-15 16:14:29 +00:00
vegorov@chromium.org	655b30858d	Fix issue 982. ... When splitting at the beginning of a use interval assign coinciding position to the split child instead of leaving it to parent. BUG=v8:982 Review URL: http://codereview.chromium.org/5898001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-15 14:35:46 +00:00
karlklose@chromium.org	88dfadd090	Fix presubmit error. ... Review URL: http://codereview.chromium.org/5891001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-15 11:43:35 +00:00
karlklose@chromium.org	5f962f2eb2	Add array bound checks to code generated for SwapElements. This fixes a bug that lead to a segfault when an array was modified while it was sorted. ... Review URL: http://codereview.chromium.org/5686006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-15 09:52:58 +00:00
ricow@chromium.org	f89d4f39e6	mjsunit/regress/regress-3247124 takes a long time to run, and the original regression is hit ... with two orders of magnitude less iterations. Review URL: http://codereview.chromium.org/5822001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-14 08:29:33 +00:00
ricow@chromium.org	3b1152aed4	Change the number of iterations in mjsunit/regress-962 ... This test causes the arm simulator to timeout, and the test reveals the original problem with three orders of magnitude less iterations. Review URL: http://codereview.chromium.org/5678007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-14 07:57:14 +00:00
kmillikin@chromium.org	b1c71408d7	Rename regression test and reenable disabled test. ... The regression test for v8 issue 969 was committed with the wrong file name. Also reenable a test that was disabled due to that issue. Review URL: http://codereview.chromium.org/5707008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5992 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-13 16:52:04 +00:00
kmillikin@chromium.org	49f4c39d6d	Deoptimize to the proper target after assignment side effects. ... This fixes V8 issue 989. Before, assignments used the AST ID of the assignment expression to mark the side effect of the store, which became a target for deoptimization bailout for code after the assignment. In effect contexts this environment included the value of the assignment, which was unexpected by the unoptimized code. Now we introduce a new assignment ID for AST node types that include an assignment (Assignment, CountOperation, and ForInStatement) and use it for the side effect of the store. Review URL: http://codereview.chromium.org/5682010 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5990 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-13 16:29:47 +00:00
vegorov@chromium.org	65f98b1e7a	Fix issue 962. ... SplitBetween (formely known as Split with 3 arguments) should select split position from [start, end] instead of [start, end[. This should also improve allocation quality (remove certain redundant move patterns). Also some minor renaming and refactoring to make register allocator code more readable. BUG=v8:962 TEST=test/mjsunit/regress/regress-962.js Review URL: http://codereview.chromium.org/5720001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-10 14:25:10 +00:00
kasperl@chromium.org	90b3370374	Update V8 to version 3.0 (re-land r5920). ... git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-07 11:31:57 +00:00
kasperl@chromium.org	51b494d096	Revert r5920. Will re-land shortly. ... git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-07 11:01:02 +00:00
kasperl@chromium.org	e5860bd6a8	Update V8 to version 3.0. ... git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2010-12-07 09:11:56 +00:00