The bug would occur when we try to Reset() to a position already at the end.
This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.
To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).
Minimal repro case:
var r = /foo\u/
r.test("foou") // should be true, was false.
(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)
BUG=v8:3756
LOG=NO
Review URL: https://codereview.chromium.org/802313003
Cr-Commit-Position: refs/heads/master@{#25838}
port d211608a3e
original commit message:
[turbofan] Remove the no-context hack for JSToNumber.
The ToNumberStub is now able to handle all plain primitives (Numbers,
Booleans, Null, Undefined and Strings) without context access.
BUG=
Review URL: https://codereview.chromium.org/810683002
Cr-Commit-Position: refs/heads/master@{#25833}
Relanded with fix for always returning Change for PlainPrimitive even
if there was no change. The performance regression on primes.js and
corrections.js is due to unlucky loop header alignment; will be addressed
separately.
TEST=unittests
R=svenpanne@chromium.org
Committed: 75484e8d16
Review URL: https://codereview.chromium.org/799413002
Cr-Commit-Position: refs/heads/master@{#25832}
There are no users of this infrastructure yet, so it's behind an off-by-default flag.
Review URL: https://codereview.chromium.org/768633002
Cr-Commit-Position: refs/heads/master@{#25829}
The snapshot and natives blob files should be output in the out directory
instead of the gen directory so that they can be picked up by the
executable.
BUG=421063
LOG=N
Review URL: https://codereview.chromium.org/805813004
Cr-Commit-Position: refs/heads/master@{#25827}
Port d211608a3e
Original commit message:
The ToNumberStub is now able to handle all plain primitives (Numbers,
Booleans, Null, Undefined and Strings) without context access.
TEST=cctest,mjsunit,unittests
BUG=
Review URL: https://codereview.chromium.org/803973002
Cr-Commit-Position: refs/heads/master@{#25824}
This adds support for computed property names, under the flag
--harmony-computed-property-names, for both object literals and
classes.
BUG=v8:3754
LOG=Y
Review URL: https://codereview.chromium.org/795573005
Cr-Commit-Position: refs/heads/master@{#25821}
build is the third number of the V8 version, and very likely to change
(in contrast to the patch level which typically is zero on canaries).
BUG=chromium:440984
R=mvstanton@chromium.org,yangguo@chromium.org
LOG=n
Review URL: https://codereview.chromium.org/802363002
Cr-Commit-Position: refs/heads/master@{#25820}
Keyed loads should not unconditionally be compiled to element loads. Update KeyedLoadICs to keep track of the key type, so that Hydrogen can emit ICs for string-keyed loads it doesn't have inline support for.
BUG=v8:3167
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/755513003
Cr-Commit-Position: refs/heads/master@{#25817}
This functionality is now used by both object visitor and store buffer.
TEST=cctest/test-unboxed-doubles
Review URL: https://codereview.chromium.org/726713003
Cr-Commit-Position: refs/heads/master@{#25816}
Reason for revert:
Fix Windows nosnap.
Original issue's description:
> Call DisableInlineAllocation() in heap setup when flag inline_new is off.
>
> BUG=
TBR=ulan@chromium.org,mstarzinger@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=
Review URL: https://codereview.chromium.org/794053003
Cr-Commit-Position: refs/heads/master@{#25815}
The ToNumberStub is now able to handle all plain primitives (Numbers,
Booleans, Null, Undefined and Strings) without context access.
TEST=cctest,mjsunit,unittests
Review URL: https://codereview.chromium.org/801333002
Cr-Commit-Position: refs/heads/master@{#25814}
Add support for Symbol.isConcatSpreadable in Array.prototype.concat. This enables spreading non-Array objects with the symbol.
LOG=N
R=dslomov@chromium.org
BUG=
Review URL: https://codereview.chromium.org/771483002
Cr-Commit-Position: refs/heads/master@{#25808}
Such properties never notified prior to r21558, but the combination of
that change and r23163 led to sending notifications when they were
set via Object.defineProperty (but not when set via other means).
This also allows some cleanup in v8natives.js and objects.cc,
both of which were doing unnecessary contortions to produce the right
change records.
BUG=v8:3745
LOG=n
Review URL: https://codereview.chromium.org/791243002
Cr-Commit-Position: refs/heads/master@{#25806}
The Mac version of GetCurrentThreadId should be used when building the host
build of V8 on Android for Mac.
Review URL: https://codereview.chromium.org/799943003
Cr-Commit-Position: refs/heads/master@{#25805}
We managed to access the scope_ member of CompilationInfo before its
containing object was actually constructed.
Rule of thumb: When constructing an object, never ever pass around
pointers to members which come later in the member initializer list,
you simply can't see locally if this might cause trouble or not.
Review URL: https://codereview.chromium.org/796363002
Cr-Commit-Position: refs/heads/master@{#25796}
