AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
7,254 Commits 1 Branch 0 Tags 839 MiB
a40462e3bb
Commit Graph

510 Commits

Author SHA1 Message Date
jkummerow@chromium.org
a40462e3bb Refactor JSObject::SetFastElement. 
This fixes a bug where the length of FAST_DOUBLE_ELEMENTS arrays was not
set correctly, and another bug where appending a double element to a
SMI_ONLY array would convert it to FAST_ELEMENTS instead of
FAST_DOUBLE_ELEMENTS.

Review URL: http://codereview.chromium.org/8028026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 13:56:30 +00:00
lrn@chromium.org
ebc0f85e40 Revert "Added ability to lock strings to prevent their representation or encoding from changing." 
This reverts r9424.

Review URL: http://codereview.chromium.org/8143018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 11:09:34 +00:00
rossberg@chromium.org
2c975d6ae2 Make 'Become' safe for retries. 
R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8138003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 09:41:54 +00:00
mstarzinger@chromium.org
2fb58638a6 Fix verification of weak maps during initialization. 
R=rossberg@chromium.org

Review URL: http://codereview.chromium.org/8135003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 15:54:57 +00:00
mstarzinger@chromium.org
c034518442 Fix preparation for sorting of external arrays. 
R=rossberg@chromium.org
BUG=98773
TEST=mjsunit/regress/regress-98773

Review URL: http://codereview.chromium.org/8122020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 13:49:50 +00:00
lrn@chromium.org
8e31371d0e Move logic for hidden properties into the JSObject. 
Previously, the logic using the hidden properties backing object was
spread accross use sites. Now it's all contained in JSObject, with
only simple accessors available.
Also change the backing object to be a StringDictionary rather than a JSObject.
There's still room for improvement by making a hash-table that don't
store property details as well.

Review URL: http://codereview.chromium.org/8050013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9510 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 07:45:25 +00:00
mstarzinger@chromium.org
b5be9fa83a Fix map modification in transition tree traversal. 
While traversing the transition tree we build a work-list using the map
field of maps. Setting those map values with a write barrier causes
black-to-gray changes on maps which are currently not recognized as
such, hence their computed size might be off.

R=vegorov@chromium.org
BUG=v8:1672
TEST=cctest/test-decls/Present

Review URL: http://codereview.chromium.org/8082023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9498 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-30 13:03:48 +00:00
ricow@chromium.org
7810ff70f6 Make sure that we can't access hidden properties by installing accessors on Object.prototype. 
BUG:chromium:97784
TEST=cctest/test-api
Review URL: http://codereview.chromium.org/8041020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 16:54:50 +00:00
ulan@chromium.org
16ae2551ae Search prototypes for accessor setters if interceptor returns empty value. 
Extract the part of SetPropertyForResult that searches the prototype chain
for accessor setters into a separate function SetPropertyInPrototypes.
Call this function in SetPropertyPostInterceptor.

This should fix both optimized and unoptimized cases because
the cache stub for storing with interceptor calls the runtime system.

BUG=v8:1636

TEST=cctest/test-api.cc/EmptyInterceptorDoesNotShadowAccessors

Review URL: http://codereview.chromium.org/7991007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 14:54:57 +00:00
lrn@chromium.org
172c27a6ba Added ability to lock strings to prevent their representation or encoding from changing. 
Use string locking to ensure consistent representation of source string during JSON parsing.

Review URL: http://codereview.chromium.org/7977001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9424 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 11:14:41 +00:00
danno@chromium.org
d21902b25e Cache multiple ElementsKind map transition per map. 
R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8017003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9417 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-23 15:09:00 +00:00
rossberg@chromium.org
3df2602037 Handle function proxies as getters/setters. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7849021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 17:12:41 +00:00
rossberg@chromium.org
d938560d59 Implement identity hashes for proxies. 
R=mstarzinger@chromium.org
BUG=v8:1543,v8:1565
TEST=

Review URL: http://codereview.chromium.org/7754015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 13:54:53 +00:00
fschneider@chromium.org
c6a3422c04 Give each function prototype a fresh copy of the object function map. 
This avoid unwanted sharing between different function prototypes and in
general should help inlining because constant function properties on one
prototype don't affect other prototypes anymore.

BUG=v8:1716
Review URL: http://codereview.chromium.org/7994001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9393 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 12:57:54 +00:00
danno@chromium.org
f48c9f6557 Basic support for tracking smi-only arrays on ia32. 
Activated by the flag --smi-only-arrays

Currently not crankshaft support, using flag on non-ia32 platforms will lead to write barrier misses and crashes.

BUG=none
TEST=elements_kind.js

Review URL: http://codereview.chromium.org/7901016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 11:30:04 +00:00
rossberg@chromium.org
e04d0b23a8 Make integer indexed properties ("elements") work for proxies. 
Rehome some Object/JSReceiver/JSObject methods.

R=ricow@chromium.org,kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7795055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 10:45:37 +00:00
rossberg@chromium.org
6c8472bd3a Fix and test use of property descriptor objects. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7828080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 12:45:51 +00:00
rossberg@chromium.org
647ad8f500 Fix GC hazard. 
R=jkummerow@chromium.org
BUG=v8:1698
TEST=

Review URL: http://codereview.chromium.org/7977021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 09:58:40 +00:00
kmillikin@chromium.org
22ef98dc66 Fix a deoptimization bug. 
We reset the count of outgoing arguments, used for the index in the
frame's outgoing arguments, for each level of inlining.  This could
result in the arguments overlapping, rather than stacking on top of
each other.

R=whesse@chromium.org,fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7932022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 07:14:30 +00:00
vegorov@chromium.org
ac36cb4504 Merge experimental/gc branch to the bleeding_edge. 
Review URL: http://codereview.chromium.org/7945009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-19 18:36:47 +00:00
rossberg@chromium.org
42f0a73a96 Make proxies work as prototypes. 
Fix a couple of other proxy bugs along the way.
Refactor trap invocation in native code.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7799026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-16 13:38:30 +00:00
danno@chromium.org
6a5e0448c8 Share Maps for ElementsKind transitions 
Support sharing maps after an changing an object's ElementsKind for element kinds other then external elements.

R=svenpanne@chromium.org
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7862036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9304 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 16:38:47 +00:00
rossberg@chromium.org
ff5c242a47 Test (and fix) all exception paths that can occur with proxies. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 13:07:20 +00:00
kmillikin@chromium.org
40cd59f238 Remove in-loop tracking for call ICs. 
We passed this flag around in a lot of places and had differenc call
ICs based on it, but never did any real specialization based on its
value.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7869009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 12:53:28 +00:00
rossberg@chromium.org
e645597aa7 Implement function proxies (except for their use as constructors). 
Introduce new %Apply native.

Extend Execution::Call to optionally handle receiver rewriting (needed for %Apply).

Fix Function.prototype.bind for functions that have .apply modified.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 11:42:57 +00:00
mikhail.naganov@gmail.com
f8e5c71e18 Rename SmartPointer to SmartArrayPointer. 
As pointed out in: http://codereview.chromium.org/7754007/#msg5

"SmartPointer should have been named SmartArrayPointer as it expects an input
allocated using new[] and deallocates it using delete[]. Using it as a simple
scoped pointer for a single object is incorrect."

R=mnaganov@chromium.org

Review URL: http://codereview.chromium.org/7860011
Patch from Thiago Farina <tfarina@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 22:39:47 +00:00
danno@chromium.org
ab26d8356c Key external array map transitions on ElementsKind instead of ExternalArrayType 
R=jkummrow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7787007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 14:47:37 +00:00
danno@chromium.org
df860eda5c Don't allow seal or element property re-definition on external arrays. 
R=ricow@chromium.org
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js

Review URL: http://codereview.chromium.org/7858031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 14:30:00 +00:00
danno@chromium.org
9b2de409f9 Mechanical refactor to move ElementsKind type out of JSObject. 
R=svenpanne@chromium.org
BUG=none
TEST=all

Review URL: http://codereview.chromium.org/7849017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 09:35:57 +00:00
lrn@chromium.org
689f3cb314 Rename scanner.* to scanner-character-streams.*. and scanner-base.* to scanner.* 
R=lrn@chromium.org

Signed-off-by: Thiago Farina <tfarina@chromium.org>

Review URL: http://codereview.chromium.org/7739020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-08 13:06:44 +00:00
kmillikin@chromium.org
690efb3a04 Fix deoptimization data printing. 
Remove a spurious newline.

R=whesse@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7792052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9090 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-01 08:00:40 +00:00
yangguo@chromium.org
77141f78ff Tentative implementation of string slices (hidden under the flag --string-slices). 
TEST=test/mjsunit/string-slices.js

Review URL: http://codereview.chromium.org/7477045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-26 13:03:30 +00:00
lrn@chromium.org
13dd915a2a Fix typo in assert. 
Also remove the requirement to have an AssertNoAllocation object when getting the flat content. We actually do allow allocation, it's just GC's we don't allow.

Review URL: http://codereview.chromium.org/7710018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-23 13:23:30 +00:00
lrn@chromium.org
9eb7d4a53c Replace ToAsciiVector and ToUC16Vector with single function that returns a tagged value. 
The tag tells whether the content is ASCII or UC16, or even if the string wasn't flat.

BUG: v8:1633

Review URL: http://codereview.chromium.org/7709024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-23 12:22:12 +00:00
danno@chromium.org
4c460099a0 Unify GetElement handlers in ElementsAccessor 
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7655030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-18 09:51:08 +00:00
danno@chromium.org
a8b4b4f42a Remove redundant implementation of UnionOfKeys 
R=svenpanne@chromium.org
BUG=none
TEST=external-arrays.js

Review URL: http://codereview.chromium.org/7670037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-18 09:20:32 +00:00
vegorov@chromium.org
4b94137323 Fix GC unsafe place in JSProxy::DeletePropertyWithHandler. 
Review URL: http://codereview.chromium.org/7670023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-17 09:51:20 +00:00
vegorov@chromium.org
bdfceace53 Fix potentially GC unsafe place in JSObject::DeleteElementWithInterceptor. 
Review URL: http://codereview.chromium.org/7660012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-16 15:51:49 +00:00
danno@chromium.org
96f198a4dc Change AddElementsToFixedArray to work on FixedArrayBase rather than JSObject 
In the process, make ElementsAccessors work internally more seamlessly with FixedArrayBase.

R=svenpanne@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7618012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-12 14:52:03 +00:00
danno@chromium.org
48f411a225 Change JSObject elements to be of type FixedArrayBase 
R=kmillikin@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7617010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-12 13:54:27 +00:00
svenpanne@chromium.org
bb81895595 Fixed printing of deoptimization input data without --print-code-verbose. 
Review URL: http://codereview.chromium.org/7617008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-11 13:56:09 +00:00
danno@chromium.org
ff13ab4575 Refactor UnionOfKeys into ElementsAccessor 
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7529046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8870 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-10 10:51:01 +00:00
whesse@chromium.org
92e7656c4d Clean up TranslationIterator and DeoptimizationInputDataPrint. 
Without this refactoring, they break when we add alignment padding in the Translation info.

BUG=
TEST=

Review URL: http://codereview.chromium.org/7569009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-08 07:17:01 +00:00
danno@chromium.org
4a7a47ac8f Move element deletion into element handlers 
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7566004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-04 11:42:14 +00:00
danno@chromium.org
9aa75ed998 Fix out-of-bounds access in fetching propery names 
R=vegorov@chromium.org
BUG=chromium:91517
TEST=none

Review URL: http://codereview.chromium.org/7565009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-04 09:23:25 +00:00
mstarzinger@chromium.org
b05ff5e0b9 Prototype of mark-and-compact support for Harmony weak maps. 
R=vegorov@chromium.org
BUG=v8:1565
TEST=cctest/test-weakmaps

Review URL: http://codereview.chromium.org/7553012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 12:48:30 +00:00
danno@chromium.org
a2eaf852a9 Fix performance regression due to elements refactor 
Consolidate the runtime logic for fetching elements from Objects and JSObjects so that element access in the GetElement cases that are not handled in generated code.

R=svenpanne@chromium.org
BUG=none
TEST=closure.js test faster

Review URL: http://codereview.chromium.org/7569001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 12:42:04 +00:00
mstarzinger@chromium.org
2bb7c74f80 Preliminary Harmony weak maps API implementation. 
R=rossberg@chromium.org,danno@chromium.org
BUG=v8:1565
TEST=mjsunit/harmony/weakmaps

Review URL: http://codereview.chromium.org/7529007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 11:55:13 +00:00
danno@chromium.org
bdf6895bb3 Encapsulate element handling into a class keyed on ElementsKind 
Advantage is that it's much easier to add new element types (like FAST_SMI_ELEMENTS), and that handling logic for each element kind is (more) consolidated.

Currently, only GetElementsWithReceiver uses the new encapsulation, but the goal is to move much more element functionality into the class incrementally.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7527001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 11:12:46 +00:00
danno@chromium.org
b333719607 Properly handle FixedDoubleArrays in sort() 
R=jkummerow@chromium.org
BUG=91008
TEST=regress-91008.js

Review URL: http://codereview.chromium.org/7542008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-02 14:05:11 +00:00