Commit Graph

1544 Commits

Author SHA1 Message Date
mstarzinger
1321075391 [turbofan] Fix several OSR entries within literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1453733002

Cr-Commit-Position: refs/heads/master@{#32050}
2015-11-17 15:25:30 +00:00
mstarzinger
0c1c80b2af [turbofan] Fix several OSR entries within class literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1452193003

Cr-Commit-Position: refs/heads/master@{#32048}
2015-11-17 14:51:35 +00:00
mstarzinger
f8a7236119 [turbofan] Fix several OSR entries within literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1451423002

Cr-Commit-Position: refs/heads/master@{#32047}
2015-11-17 14:25:30 +00:00
jarin
a77f9179e0 [turbofan] Check for dead node in the common operator reducer.
BUG=chromium:556543
LOG=n

Review URL: https://codereview.chromium.org/1450883003

Cr-Commit-Position: refs/heads/master@{#32025}
2015-11-17 09:03:10 +00:00
adamk
e971005638 Run the materialized literal reindexer on default parameter initializers
R=rossberg@chromium.org
BUG=chromium:554865
LOG=n

Review URL: https://codereview.chromium.org/1442653004

Cr-Commit-Position: refs/heads/master@{#31989}
2015-11-13 17:11:05 +00:00
mstarzinger
c42f188ce2 [turbofan] Fix OSR entry in case label.
With do-expressions any expression used as a case label can turn into an
OSR entry-point. This means the value being switched over is renamed to
an OSR value and needs to be reloaded from the environment at each case.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-case-label

Review URL: https://codereview.chromium.org/1438123007

Cr-Commit-Position: refs/heads/master@{#31986}
2015-11-13 16:05:28 +00:00
cbruni
24e058d0ed [runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1417063011

Cr-Commit-Position: refs/heads/master@{#31983}
2015-11-13 14:14:07 +00:00
mstarzinger
83e9ea1e49 [turbofan] Ensure inlined constructor calls still throw.
This makes sure that inlining a constructor call to a function which
cannot be used as a constructor (e.g. strong mode function) still does
throw correctly when the implicit receiver is created.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-inline-strong-as-construct
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1447443002

Cr-Commit-Position: refs/heads/master@{#31982}
2015-11-13 14:05:48 +00:00
yangguo
a7e50a5e06 [JSON stringifier] Reintroduce fast path with bail out to slow path.
R=verwaest@chromium.org
BUG=chromium:554946
LOG=N

Review URL: https://codereview.chromium.org/1442963002

Cr-Commit-Position: refs/heads/master@{#31977}
2015-11-13 10:09:47 +00:00
yangguo
6df9a1db8c [JSON stringifier] Correctly load array elements.
BUG=chromium:554946
LOG=y
R=jkummerow@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1435083003

Cr-Commit-Position: refs/heads/master@{#31968}
2015-11-12 19:30:58 +00:00
yangguo
ee9020ddd9 Serializer: attach alignment to deferred objects.
R=jkummerow@chromium.org
BUG=chromium:523919
LOG=N

Review URL: https://codereview.chromium.org/1440983002

Cr-Commit-Position: refs/heads/master@{#31956}
2015-11-12 11:28:31 +00:00
verwaest
2ebd5fc7c9 Fix Array.prototype.slice with arguments object with negative length.
BUG=

Review URL: https://codereview.chromium.org/1436813002

Cr-Commit-Position: refs/heads/master@{#31941}
2015-11-11 11:50:38 +00:00
adamk
9a8c0119ef Properly handle parsing a '%'-prefixed runtime call as a binding pattern
R=rossberg@chromium.org
BUG=chromium:552302
LOG=n

Review URL: https://codereview.chromium.org/1425723004

Cr-Commit-Position: refs/heads/master@{#31890}
2015-11-09 15:32:25 +00:00
yangguo
742ae613ec Do not switch to two-byte string in String.fromCharCode if avoidable.
R=bmeurer@chromium.org
BUG=v8:4536
LOG=N

Review URL: https://codereview.chromium.org/1427743008

Cr-Commit-Position: refs/heads/master@{#31872}
2015-11-09 08:53:42 +00:00
ishell
37a9be505a Regression test for JSRegExp literals sharing.
JSRegExp's properties backing stores must not be shared.

BUG=chromium:548580
LOG=N

Review URL: https://codereview.chromium.org/1429743006

Cr-Commit-Position: refs/heads/master@{#31867}
2015-11-07 08:19:27 +00:00
bmeurer
925a2006f5 [turbofan] Fix wrong parameter indices in JSFrameSpecialization.
We forgot to add the number of arguments parameter in
JSFrameSpecialization, which was added before the context.

R=jarin@chromium.org
BUG=chromium:552304
LOG=n

Review URL: https://codereview.chromium.org/1429233004

Cr-Commit-Position: refs/heads/master@{#31856}
2015-11-06 13:12:51 +00:00
yangguo
2237ba0dba Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
Cr-Commit-Position: refs/heads/master@{#31782}

Committed: https://crrev.com/152163c1646b45f5fc5d31a4ec2eb55d7f4a2ffc
Cr-Commit-Position: refs/heads/master@{#31804}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31824}
2015-11-05 13:08:55 +00:00
verwaest
44c44521ae Remove CallFunctionStub, always call through the Call builtin (also from CallIC).
This fixes receiver conversion since the Call builtin does it correctly.

BUG=v8:4526
LOG=n

Review URL: https://codereview.chromium.org/1407373007

Cr-Commit-Position: refs/heads/master@{#31823}
2015-11-05 12:46:01 +00:00
bmeurer
a210c3757e [runtime] Remove the very dangerous %_CallFunction intrinsic.
The %_CallFunction doesn't implement the call sequence properly, it
doesn't do the receiver wrapping, nor does it check for
classConstructor. Also the eager deoptimization for %_CallFunction was
seriously b0rked (we must have been lucky with TurboFan so far).

R=yangguo@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1419813010

Cr-Commit-Position: refs/heads/master@{#31821}
2015-11-05 11:48:21 +00:00
yangguo
ca49355aba Revert of Implement flag and source getters on RegExp.prototype. (patchset #6 id:110001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
browser_tests failure with --gtest_filter=ExternallyConnectableMessagingTest.EnablingAndDisabling

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}
>
> Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
> Cr-Commit-Position: refs/heads/master@{#31782}
>
> Committed: https://crrev.com/152163c1646b45f5fc5d31a4ec2eb55d7f4a2ffc
> Cr-Commit-Position: refs/heads/master@{#31804}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1426413002

Cr-Commit-Position: refs/heads/master@{#31818}
2015-11-05 09:08:51 +00:00
yangguo
152163c164 Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
Cr-Commit-Position: refs/heads/master@{#31782}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31804}
2015-11-04 20:42:33 +00:00
hablich
a77aa3a2b4 Revert of Implement flag and source getters on RegExp.prototype. (patchset #6 id:110001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
Breaks Chromium tests and blocks the roll: http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_chromeos_rel_ng/builds/124490

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}
>
> Committed: https://crrev.com/85494e90bb63a3a9e19a1bf862cb6bfcb0162ee9
> Cr-Commit-Position: refs/heads/master@{#31782}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1432683002

Cr-Commit-Position: refs/heads/master@{#31801}
2015-11-04 18:34:27 +00:00
yangguo
85494e90bb Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
Cr-Commit-Position: refs/heads/master@{#31773}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31782}
2015-11-04 12:28:48 +00:00
yangguo
5ee1a75c6d Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
Performance issue.

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}
>
> Committed: https://crrev.com/b5c80a31ad266eb38a0cf2ff756be59c66d34aa5
> Cr-Commit-Position: refs/heads/master@{#31773}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1409013006

Cr-Commit-Position: refs/heads/master@{#31780}
2015-11-04 10:58:24 +00:00
yangguo
b5c80a31ad Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
Cr-Commit-Position: refs/heads/master@{#31753}

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31773}
2015-11-04 09:11:19 +00:00
machenbach
16e25179ec Revert of Implement flag and source getters on RegExp.prototype. (patchset #3 id:50001 of https://codereview.chromium.org/1419823010/ )
Reason for revert:
[Sheriff] Changes layout tests. Please rebase upstream first. E.g.:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2686

Original issue's description:
> Implement flag and source getters on RegExp.prototype.
>
> R=littledan@chromium.org
> BUG=v8:3715, v8:4528
> LOG=Y
>
> Committed: https://crrev.com/60e8877e161fe6175e19fafce2d6ed1c3999cdb1
> Cr-Commit-Position: refs/heads/master@{#31753}

TBR=littledan@chromium.org,jochen@chromium.org,ulan@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3715, v8:4528

Review URL: https://codereview.chromium.org/1427733005

Cr-Commit-Position: refs/heads/master@{#31758}
2015-11-03 17:28:13 +00:00
ishell
babe50f083 Reland "[es6] Fix Function and GeneratorFunction built-ins subclassing."
Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

The problem was in another CL, this is a clean reland with improved tests.

BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1415683007

Cr-Commit-Position: refs/heads/master@{#31756}
2015-11-03 16:42:43 +00:00
yangguo
60e8877e16 Implement flag and source getters on RegExp.prototype.
R=littledan@chromium.org
BUG=v8:3715, v8:4528
LOG=Y

Review URL: https://codereview.chromium.org/1419823010

Cr-Commit-Position: refs/heads/master@{#31753}
2015-11-03 16:17:03 +00:00
jkummerow
b4d46bc5a0 Fix accessor map transitions vs. Object.defineProperty
BUG=v8:4534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413723011

Cr-Commit-Position: refs/heads/master@{#31750}
2015-11-03 14:41:53 +00:00
yangguo
538197dada RegExp.prototype is an ordinary object.
R=littledan@chromium.org
BUG=v8:4003
LOG=N

Review URL: https://codereview.chromium.org/1423993006

Cr-Commit-Position: refs/heads/master@{#31730}
2015-11-03 06:18:44 +00:00
ishell
2210cc84de Revert of [es6] Fix Function and GeneratorFunction built-ins subclassing. (patchset #4 id:80001 of https://codereview.chromium.org/1428823002/ )
Reason for revert:
Buildbot failures

Original issue's description:
> [es6] Fix Function and GeneratorFunction built-ins subclassing.
>
> BUG=v8:3101, v8:3330
> LOG=Y
>
> Committed: https://crrev.com/99e7f872d3d0a5fb799dcbafb05537cda491314a
> Cr-Commit-Position: refs/heads/master@{#31708}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3101, v8:3330

Review URL: https://codereview.chromium.org/1413723008

Cr-Commit-Position: refs/heads/master@{#31709}
2015-11-02 11:59:14 +00:00
ishell
99e7f872d3 [es6] Fix Function and GeneratorFunction built-ins subclassing.
BUG=v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1428823002

Cr-Commit-Position: refs/heads/master@{#31708}
2015-11-02 11:45:51 +00:00
jkummerow
70a2f537f6 Fix cached EnumLength retrieval in JSObject::NumberOfOwnProperties
BUG=chromium:549162
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1424293002

Cr-Commit-Position: refs/heads/master@{#31677}
2015-10-30 10:35:43 +00:00
mstarzinger
26f90c95cc [turbofan] Fix super property calls to act as method calls.
This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}
2015-10-29 17:19:39 +00:00
mstarzinger
d3c4adfd78 [turbofan] Fix and rework deopt in call to super property.
This refactors the handling of calls of type Call::PROPERTY_CALL to
super properties in AstGraphBuilder::VisitCall. It ensures that the
operand stack is kept in sync with full-codegen so that deopts while
evaluating sub-expressions behave as expected.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4521
BUG=v8:4521
LOG=n

Review URL: https://codereview.chromium.org/1426893003

Cr-Commit-Position: refs/heads/master@{#31652}
2015-10-29 12:32:49 +00:00
yangguo
200315cb26 Make AstRawString deduplication encoding-agnostic.
R=jkummerow@chromium.org
BUG=v8:4450
LOG=N

Review URL: https://codereview.chromium.org/1411103006

Cr-Commit-Position: refs/heads/master@{#31624}
2015-10-28 11:28:55 +00:00
mstarzinger
f8465b45f7 [turbofan] Fix OSR-ed callee trigged ty do-expressions.
This fixes a missing SSA-renaming of the callee value used in the frame
state of a call node. An OSR-entry within do-expressions contained in
one of the argument expression can trigger that renaming.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-crbug-546968
BUG=chromium:546968
LOG=n

Review URL: https://codereview.chromium.org/1430483002

Cr-Commit-Position: refs/heads/master@{#31613}
2015-10-27 17:21:10 +00:00
bmeurer
7709e41aec [turbofan] Try hard(er) to use smi representation for float64 values.
Previously ChangeLowering would always box float64 values when going to
tagged representation, but that introduces a lot of deoptimizer loops
and polymorphism into TurboFan, which is unfortunate and unnecessary.

This adds some logic to ChangeFloat64ToTagged to try harder to create a
Smi when going from Float64 to Tagged, instead of always allocating a
HeapNumber.  This might need some additional tweaking, but at least it
makes it possible to start comparing TurboFan and Crankshaft for some
regular JavaScript.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420913003

Cr-Commit-Position: refs/heads/master@{#31609}
2015-10-27 16:18:15 +00:00
mstarzinger
e121aabe39 [turbofan] Fix representation type for JSArray::length.
This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410393006

Cr-Commit-Position: refs/heads/master@{#31558}
2015-10-26 12:04:16 +00:00
verwaest
b694266bb1 Fix Object.preventExtensions, .seal, .freeze on typed arrays
BUG=v8:4460
LOG=n

Review URL: https://codereview.chromium.org/1419823008

Cr-Commit-Position: refs/heads/master@{#31556}
2015-10-26 11:08:02 +00:00
verwaest
f464f12a8b Ensure we never inline class constructors in Crankshaft, as it currently is entirely unsupported.
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1415723005

Cr-Commit-Position: refs/heads/master@{#31480}
2015-10-22 14:39:07 +00:00
jkummerow
fdfab67243 [Crankshaft] Don't do HMathFloorOfDiv optimization for kUint32 values
BUG=v8:4507
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1409353005

Cr-Commit-Position: refs/heads/master@{#31474}
2015-10-22 13:22:09 +00:00
bmeurer
d168a1e844 [turbofan] We cannot unconditionally flatten cons strings in the JSGraph.
It is not always safe to allocate new heap objects in the JSGraph. We
might have to revisit this later once we do the canonicalization for
HeapConstants.

R=jarin@chromium.org
BUG=chromium:545364
LOG=n

Review URL: https://codereview.chromium.org/1413373002

Cr-Commit-Position: refs/heads/master@{#31421}
2015-10-20 15:48:07 +00:00
bmeurer
2abd768e87 [turbofan] Respect effect input when lowering JSToBoolean for string inputs.
This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}
2015-10-20 15:24:26 +00:00
littledan
c227dd5734 Refactor array construction for map, filter
This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}
2015-10-20 09:57:08 +00:00
mvstanton
2f2302f08b VectorICs: Bugfix in KeyedStore dispatcher.
The dispatcher failed to MISS properly when configured as a monomorphic
keyed string store, causing a crash.

BUG=v8:4495
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1415533003

Cr-Commit-Position: refs/heads/master@{#31362}
2015-10-19 09:51:46 +00:00
jarin
f9a9c6be0e [turbofan] Introduce lazy bailout, masked as a call.
This introduces an explicit lazy bailout. It is wrapped in the call
node, mostly because the lazy deoptimization processing is married
to the call processing in the instruction selector and the code generator.

It is still a terrible hack.

R=bmeurer@chromium.org,mstarzinger@chromium.org
BUG=chromium:543994,v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1412443003

Cr-Commit-Position: refs/heads/master@{#31353}
2015-10-19 06:21:26 +00:00
yangguo
30715157fa Install iterator meta objects via utils object.
R=cbruni@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411653002

Cr-Commit-Position: refs/heads/master@{#31331}
2015-10-16 11:27:33 +00:00
yangguo
f2bfa12654 Do not coerce lastIndex of a global RegExp in @@match and @@replace.
R=rossberg@chromium.org
BUG=v8:4471
LOG=N

Review URL: https://codereview.chromium.org/1410753002

Cr-Commit-Position: refs/heads/master@{#31330}
2015-10-16 11:25:37 +00:00
jkummerow
102e3e87e7 [arm64] Fix jssp based spill slot accesses in Crankshaft
Review URL: https://codereview.chromium.org/1401703003

Cr-Commit-Position: refs/heads/master@{#31304}
2015-10-15 13:34:15 +00:00