AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
13,471 Commits 1 Branch 0 Tags 839 MiB
b8dd056fa2
Commit Graph

2323 Commits

Author SHA1 Message Date
rossberg@chromium.org
af824eab8f When using an Object as a set in Object.getOwnPropertyNames, null out the proto 
Also apply the same fix elsewhere in v8natives.js

BUG=v8:2410

Review URL: https://codereview.chromium.org/11364237
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12982 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-16 09:32:39 +00:00
verwaest@chromium.org
a08194c83a Support all fast elements kinds in the major array operations. 
Currently missing support for unshift.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11377132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 12:19:14 +00:00
rossberg@chromium.org
4fb992a872 Object.observe: Handle oldValue for elements with accessors properly. 
Extended ElementAccessor interface to allow querying PropertyType and
AccessorPair. Also added respective functionality to JSObject.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358234

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12967 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 11:31:40 +00:00
rossberg@chromium.org
5e7b796479 Object.observe: Move notification of JSArray length changes to JSArray::SetElementsLength 
The previous implementation in Accessors::ArraySetLength failed when array length was set through StoreIC_ArrayLength. But that stub and the accessor both delegate to JSArray::SetElementsLength, so moving the code there allows notifications to be sent in both cases.

Review URL: https://codereview.chromium.org/11275292
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 16:51:21 +00:00
jkummerow@chromium.org
1c086d1202 Lattice-based representation inference, powered by left/right specific type feedback for BinaryOps and comparisons 
Review URL: https://chromiumcodereview.appspot.com/10837165

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 15:59:45 +00:00
ulan@chromium.org
74492ab2d4 Emit VMLA for multiply-add on ARM 
Review URL: https://chromiumcodereview.appspot.com/11293061
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12958 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 11:01:18 +00:00
yangguo@chromium.org
4783d3c31b Remove 'type' and 'arguments' properties from Error object. 
R=svenpanne@chromium.org
BUG=v8:2397

Review URL: https://chromiumcodereview.appspot.com/11358214

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 09:14:47 +00:00
peter.rybin@gmail.com
bb53dc6890 Issue 2368: LiveEdit crashes when new object/array literal is added 
Review URL: https://codereview.chromium.org/11191039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 19:13:27 +00:00
rossberg@chromium.org
36c3d01589 Object.unobserve(obj, callback) now throws a TypeError when callback is not a function. 
Review URL: https://codereview.chromium.org/11293248
Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12950 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 15:50:59 +00:00
yangguo@chromium.org
693ee09cf3 Correctly check for stack overflow even when interrupt is pending. 
BUG=v8:214

Review URL: https://chromiumcodereview.appspot.com/11362007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:56:25 +00:00
yangguo@chromium.org
4c27298d27 Collect stack trace on stack overflow. 
BUG=v8:2394

Review URL: https://chromiumcodereview.appspot.com/11275186

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:54:29 +00:00
yangguo@chromium.org
e3e899fe53 Correctly fix test expectations. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11369183

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:07:21 +00:00
yangguo@chromium.org
eea60ff76a Fix test expectations. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11361217

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12928 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 12:29:15 +00:00
yangguo@chromium.org
4cca6c6081 Make formatting error message side-effect-free. 
BUG=v8:2398

Review URL: https://chromiumcodereview.appspot.com/11359130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 10:33:20 +00:00
yangguo@chromium.org
ef1b3d3a76 Fix length check in JSON.stringify. 
R=verwaest@chromium.org
BUG=160010

Review URL: https://chromiumcodereview.appspot.com/11410031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 10:20:07 +00:00
rossberg@chromium.org
0e7306cc92 Implement Object.getNotifier() and remove Object.notify() 
Updated all tests to use getNotifier or actual object mutation instead of notify, and added tests for new behavior of getNotifier.

Review URL: https://codereview.chromium.org/11369154
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 16:14:42 +00:00
rossberg@chromium.org
af7bfe0e27 Minimal implementation and tests of observable array methods 
Bail out of any special-casing in array methods.
Further optimization is possible, but can be left for later.

Review URL: https://codereview.chromium.org/11369151
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 12:28:22 +00:00
rossberg@chromium.org
13f8fb47da Add more test coverage for setting Array.length 
Covers truncation of holey arrays and defineProperty('length').

Review URL: https://codereview.chromium.org/11369150
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 11:00:13 +00:00
rossberg@chromium.org
b72e5811e7 Object.observe: notify when element addition causes array growth 
Review URL: https://codereview.chromium.org/11369135
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 10:57:54 +00:00
mstarzinger@chromium.org
2d69a2b12e ES6: Add support for Set and Map clear method 
http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts, section
15.14.5.3 and 15.14.5.2

BUG=v8:2400

Review URL: https://codereview.chromium.org/11409002
Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 09:01:29 +00:00
yangguo@chromium.org
64da47559c Turn message property of the error object into a data property. 
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11368142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 08:22:02 +00:00
rossberg@chromium.org
2af4744889 Handle Object.observe notifications for setting Array.length 
Also handles notification of deleted properties when an array
is truncated by setting length.

Review URL: https://codereview.chromium.org/11338048
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 16:12:12 +00:00
rossberg@chromium.org
8eb704257f Object.observe: Fixed missing case for turning off ICs. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358122

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 13:15:54 +00:00
rossberg@chromium.org
fbc6e0d883 Object.observe: generate change records for indexed properties. 
Details:
- Extend ElementAccessors with GetAttributes method.
- Add HasLocalElement, Get[Local]ElementAttribute methods to JSReceiver/JSObject.
- Otherwise, mirror implementation for named properties.

Cannot correctly handle the cases yet where an accessor is redefined or deleted.

Also fixed handling of object info table.

(Based on CL https://codereview.chromium.org/11362115/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11365111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 12:58:08 +00:00
mstarzinger@chromium.org
a31889e2de Fix slack tracking when instance prototype changes. 
This fixes a corner case when the instance prototype of a function is
changed while inobject slack tracking is still in progress. This caused
the intial map to be unrelated for functions with the same shared info
and hence the shared construct stub is no longer generic enough to work
for all those functions.

R=danno@chromium.org
BUG=chromium:157019
TEST=mjsunit/regress/regress-crbug-157019

Review URL: https://codereview.chromium.org/11293059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 11:56:44 +00:00
rossberg@chromium.org
e059e64c98 Object.observe: include oldValue in change records, 
plus more accurate distinction of different change types.

Required handlifying more code.

Also fixed a handlification bug in JSProxy::GetElementAttributeWithHandler.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11362115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-07 14:14:50 +00:00
yangguo@chromium.org
ecb6126e45 Remove check for recursion depth for JSON.stringify. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11368119

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-07 12:12:52 +00:00
mstarzinger@chromium.org
e405ff84b4 ES6: Adding support for size to Set and Map 
Section 15.14.5.10 and 15.16.5.7 in the October 26, 2012 ES6 draft,
http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts

This adds a getter for "size" to Set.prototype and Map.prototype which reflects
the number of elements in the Set and Map respectively.

BUG=v8:2395

Review URL: https://codereview.chromium.org/11360089
Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 18:14:45 +00:00
rossberg@chromium.org
b80cbd7922 Object.observe: generate change records for named properties. 
In more detail:
- Set observation bit for observed objects (and make NormalizedMapCache respect it).
- Mutation of observed objects is always delegated from ICs to runtime.
- Introduce JS runtime function for notifying generated changes.
- Invoke this function in the appropriate places (including some local refactoring).
- Inclusion of oldValue field is not yet implemented, nor element properties.

Also, shortened flag to --harmony-observation.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11347037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 12:32:36 +00:00
ulan@chromium.org
f106c9c9f7 Add rotate-right instruction to hydrogen and use it instead of bitwise operations 
of the form ((x >>> i) | (x << (32 - i))).

This CL is based on https://chromiumcodereview.appspot.com/10984057/
by Jay Conrod <dconrod@codeaurora.org>.

R=danno@chromium.org,mstarzinger@chromium.org,dconrod@codeaurora.org

Review URL: https://chromiumcodereview.appspot.com/11033005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 13:28:10 +00:00
yangguo@chromium.org
e452c10702 Add fast path for FastProperty objects in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11363078

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 12:59:35 +00:00
yangguo@chromium.org
e26012e771 Fix JSON.stringify wrt harmony proxies. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11312063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 10:53:56 +00:00
svenpanne@chromium.org
9de1d40d28 Improve handling of property loads on the proto chain. 
Previously Crankshaft emitted a generic load for these, now we emit a load of a
named field, guarded by a proto chain check.

LCheckPrototypeMaps now returns the holder, which is for free, because it
already had to check its map as the last step, anyway. This is in sync with what
StubCompiler::CheckPrototype does.

Review URL: https://codereview.chromium.org/11338030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 08:53:54 +00:00
yangguo@chromium.org
e8d91b424c Handle edge cases in basic JSON.stringify. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11315009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-02 14:46:57 +00:00
verwaest@chromium.org
14abf05bd5 Ensure reducing the length of an array doesn't make it go holey. 
Also only transition and/or change anything to the backing store if we are
actually going to delete anything.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11358011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-02 10:24:56 +00:00
yangguo@chromium.org
fe7ec01096 Fix handling arrays with holes in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11273112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-30 15:29:34 +00:00
yangguo@chromium.org
8ed2e560ea Treat leading zeros in JSON.parse correctly. 
R=verwaest@chromium.org
BUG=158185

Review URL: https://chromiumcodereview.appspot.com/11273075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-29 12:01:29 +00:00
mstarzinger@chromium.org
e363cd3425 Fix ugly typo in GenerateNewNonStrictFast. 
R=svenpanne@chromium.org
BUG=chromium:157520
TEST=mjsunit/regress/regress-crbug-157520

Review URL: https://codereview.chromium.org/11300008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-26 10:55:25 +00:00
yangguo@chromium.org
f6ed7f5e23 Relax test expectations for json-recursive.js 
R=mvstanton@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11311002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-26 07:52:18 +00:00
rossberg@chromium.org
ae93cf665d Initial JS stub implementation of Object.observe. Adds support for .object/.unobserve/.notify/.deliverChangeRecords. No delivery mechanism is implemented for end-of-microtask. 
Review URL: https://codereview.chromium.org/11225058
Patch from Rafael Weinstein <rafaelw@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 14:56:44 +00:00
yangguo@chromium.org
e91473f057 Relax test expectations to appease mac build. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11272029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:39:41 +00:00
yangguo@chromium.org
58c82e93b3 Catch stack overflow in JSON.parse. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11275039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:36:40 +00:00
yangguo@chromium.org
e40b33d39e Correctly check for stack limit in JSON.stringify. 
Changes include:
 - inline functions in a way as not to waste stack space.
 - reset StackReserveSize to the value prior to r12808.
 - check stack overflow dynamically.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11271021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:18:24 +00:00
yangguo@chromium.org
b2d41f8fe8 Fix stack overflow in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11265011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-24 15:49:59 +00:00
yangguo@chromium.org
e50ee08ad6 Reland JSON.stringify reimplementation. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11189112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 14:22:58 +00:00
jkummerow@chromium.org
5ea870f855 tools/run-tests.py: A few timeout-related fixes 
Review URL: https://codereview.chromium.org/11230029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 14:13:01 +00:00
yangguo@chromium.org
e41250a390 Revert r12760 (JSON.stringify). 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11225026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 11:11:22 +00:00
yangguo@chromium.org
8148f972e8 Stress GC less by allocating exponentially growing string chunks in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11232002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 12:39:43 +00:00
yangguo@chromium.org
f910052543 Always invoke the default Array.sort functions from builtin functions, part 2. 
R=vegorov@chromium.org
BUG=v8:2372

Review URL: https://chromiumcodereview.appspot.com/11175007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 12:30:18 +00:00
ulan@chromium.org
06a9f51ccb Adjust Android test expectations. 
Disable long running tests:
- test-threads/ThreadJoinSelf in release and debug modes.
- regress/regress-1122 in debug mode.

Disable failing test:
- preparser/strict-octal-regexp (v8 issue 2265).

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11185073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 09:28:23 +00:00
verwaest@chromium.org
fa53250dd2 Fixed json regression 
BUG=v8:2374

Review URL: https://chromiumcodereview.appspot.com/11186059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 08:23:45 +00:00
verwaest@chromium.org
7bc94a92c5 Fixed error introduced in r12761. 
BUG=2373

Review URL: https://chromiumcodereview.appspot.com/11198068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 18:43:19 +00:00
yangguo@chromium.org
7a653c1675 Reimplement a simpler version of JSON.stringify. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11186025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 14:42:26 +00:00
yangguo@chromium.org
a7f3edb818 Make sure the fast case of ScanJsonString bails out to the slow case correctly. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11185050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 13:15:05 +00:00
fschneider@chromium.org
971e834a8d Always invoke the default Array.sort functions from builtin functions. 
TEST=mjsunit/regress/regress-builtin-array-op.js
BUG=v8:2372
Review URL: https://chromiumcodereview.appspot.com/10559005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 11:18:08 +00:00
mstarzinger@chromium.org
02490829dd Fix bug in deletion of indexed properties 
The delete operator always return true in case of indexed property. It
should return false if an indexed property can't be deleted (eg.
DontDelete attribute is set or a string object is the holder).

Contributed by Peter Varga <pvarga@inf.u-szeged.hu>

BUG=none
TEST=mjsunit/delete-non-configurable

Review URL: https://codereview.chromium.org/11094021
Patch from Peter Varga <pvarga@inf.u-szeged.hu>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12736 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-15 15:23:22 +00:00
verwaest@chromium.org
7c28995e5d Invalidate the enum cache when converting a transition across which the descriptors are shared. 
Review URL: https://chromiumcodereview.appspot.com/11145017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-15 08:38:51 +00:00
ulan@chromium.org
c969afe137 Reland r12342: Flush monomorphic ICs on context disposal instead of context exit. 
The crashes that caused r12342 to be reverted are fixed in r12563.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11092081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-12 13:49:12 +00:00
verwaest@chromium.org
b75705f07b Don't clear EnumLength but rather copy the enum cache. Added regression test for crashes from chromecrash. 
Review URL: https://chromiumcodereview.appspot.com/11103036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 15:33:34 +00:00
rossberg@chromium.org
348736efaa Find a stack limit for the test that works on both Win32 and Linux64. 
R=mstarzinger@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11086073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 13:10:24 +00:00
rossberg@chromium.org
ddbd426821 Increase stack size for test to work on x64. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11098070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 12:11:46 +00:00
rossberg@chromium.org
00132da734 Bump variable limit further to 2^17. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11099063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 11:40:10 +00:00
verwaest@chromium.org
dde1cdfb8e Fix transition conversion from CONSTANT_FUNCTION to FIELD. 
Review URL: https://chromiumcodereview.appspot.com/11094044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 12:31:50 +00:00
verwaest@chromium.org
55e924c595 Fix CNLT regression. 
This happens when a map A with no descriptors in fast_holey_elements
mode first gets some properties, making it share descriptor arrays with
a map B to which it transitions. Then map A transitions elements kind to
dictionary_elements in map C. C stores the empty_descriptor_array in its
own transition array. When adding a property to C, C transitions to D
and shares the descriptors. If D dies, a CNLT clears the transition
array of C, making the descriptor array of A (and thus also of B) shine
through. If a property is now added to an object in state C, it'll inherit
all the properties of A (and B). If those properties had high field indices,
we do not have a large enough backing store for the single newly added
property, and we'll write out of bounds.

BUG=chromium:151749

Review URL: https://chromiumcodereview.appspot.com/11017054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 12:29:44 +00:00
svenpanne@chromium.org
5d11c5ee69 Fixed Accessors::FunctionGetPrototype's proto chain traversal. 
Actually it didn't traverse that far... ;-) Did some cleanup on the way.

R=rossberg@chromium.org
BUG=chrome:143967
TEST=regress/regress-143967.js

Review URL: https://codereview.chromium.org/11087004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-08 12:58:46 +00:00
rossberg@chromium.org
329cf12363 Make sure that names of temporaries do not clash with real variables. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11035054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 12:47:34 +00:00
rossberg@chromium.org
b07f38a46b Reject local module declarations. 
R=mstarzinger@chromium.org
BUG=150628

Review URL: https://codereview.chromium.org/11033025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 09:14:08 +00:00
rossberg@chromium.org
3f7b5c338a Reject uses of lexical for-loop variable on the RHS. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11031045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 09:07:53 +00:00
verwaest@chromium.org
efe955587e Allow optimistically hoisting elements transitions over accesses. 
Review URL: https://chromiumcodereview.appspot.com/10972011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-01 16:22:43 +00:00
mmassi@chromium.org
8fbfad63cd Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339). 
BUG=v8:2339

Review URL: https://chromiumcodereview.appspot.com/10963032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-26 09:57:30 +00:00
erik.corry@gmail.com
72e9f1bea1 x64 and ARM: Fix issue 2346 (order of operations in keyed store 
on arrays) and turn get-own-property-descriptor.js test into
a regression test.
Review URL: https://chromiumcodereview.appspot.com/10985017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12604 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-25 13:35:42 +00:00
rossberg@chromium.org
20b1c426cf Bump number of allowed variables per scope to 65535, to address GWT. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/10965063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12600 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 16:22:17 +00:00
jkummerow@chromium.org
43f038d4cd Split test/mjsunit/debug-stepout-scope into smaller chunks 
Review URL: https://codereview.chromium.org/10969061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 11:18:29 +00:00
jkummerow@chromium.org
8a3ec89824 Delete test/mjsunit/regress-1969. 
It was flaky, and its usefulness was doubtful.

Review URL: https://codereview.chromium.org/10961075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:48:14 +00:00
jkummerow@chromium.org
cc6fe90b2b Remove trailing whitespace 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/10969064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:44:04 +00:00
jkummerow@chromium.org
1e1470fca0 Speed up test/mjsunit/compiler/regress-or 
Review URL: https://codereview.chromium.org/10969063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12593 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:08:01 +00:00
jkummerow@chromium.org
6dc2af06dc Speed up test/mjsunit/compiler/regress-gvn 
Review URL: https://codereview.chromium.org/10956059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:07:09 +00:00
jkummerow@chromium.org
d600358e6d Split test/mjsunit/numops-fuzz into smaller chunks 
Review URL: https://codereview.chromium.org/10961065

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12591 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:06:06 +00:00
jkummerow@chromium.org
fbf5965db4 Split test/mjsunit/mul-exhaustive into smaller chunks 
Review URL: https://codereview.chromium.org/10958064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:04:58 +00:00
jkummerow@chromium.org
a2fc134169 Split test/mjsunit/fuzz-natives into smaller chunks 
Review URL: https://codereview.chromium.org/10970058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:03:49 +00:00
jkummerow@chromium.org
1bfbfc34ad Split test/mjsunit/math-floor into smaller chunks 
Review URL: https://codereview.chromium.org/10967064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:02:44 +00:00
jkummerow@chromium.org
bafa150f99 Speed up test/mjsunit/greedy.js 
Review URL: https://codereview.chromium.org/10969062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:01:35 +00:00
jkummerow@chromium.org
d88069821c Speed up test/mjsunit/debug-multiple-breakpoints 
Review URL: https://codereview.chromium.org/10961064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:00:25 +00:00
jkummerow@chromium.org
6a617a7b23 Speed up test/mjsunit/d8-os by reducing sleep times 
Review URL: https://codereview.chromium.org/10973003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:57:16 +00:00
jkummerow@chromium.org
cf0cae7eb1 Speed up test/mjsunit/regress/regress-crbug-119926 
Review URL: https://codereview.chromium.org/10958063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:56:11 +00:00
jkummerow@chromium.org
975d6e2170 First commit of new tools/run-tests.py 
Review URL: https://codereview.chromium.org/10919265

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:38:46 +00:00
verwaest@chromium.org
083ee63a83 Fix CNLT for enum indices. 
Review URL: https://chromiumcodereview.appspot.com/10958015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 15:18:00 +00:00
verwaest@chromium.org
ea31f868e8 Deopt on storing undefined into double elements. 
Review URL: https://chromiumcodereview.appspot.com/10963010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12568 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 13:41:00 +00:00
ulan@chromium.org
a0dfdfc273 Revert r12530 "Tentatively reenable previous failing test." 
BUG=v8:2341
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10964015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 11:28:33 +00:00
jkummerow@chromium.org
a8e502fe60 Fix LBoundsCheck on x64 to handle (stack slot + constant) correctly 
BUG=150729

Review URL: https://codereview.chromium.org/10959009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:56:24 +00:00
jkummerow@chromium.org
83da019a46 Move regress-2286.js where it belongs 
Review URL: https://codereview.chromium.org/10957013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:55:19 +00:00
mmassi@chromium.org
9dc822ca13 Fixed minus zero test (fixes v8:2133). 
BUG=v8:2133

Review URL: https://chromiumcodereview.appspot.com/10937013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 12:48:49 +00:00
mstarzinger@chromium.org
c012afb6d4 Fix setting array length to zero for slow elements. 
R=verwaest@chromium.org
BUG=chromium:146910
TEST=mjsunit/regress/regress-crbug-146910

Review URL: https://codereview.chromium.org/10937026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 11:52:33 +00:00
mstarzinger@chromium.org
f0dcaf9a19 Fix lost arguments dropping in HLeaveInlined. 
This fixes HleaveInlined to correctly drop pushed arguments on all code
paths and addresses a corner case where the arguments stack height
mismatched at an OSR entry point.

R=jkummerow@chromium.org
BUG=chromium:150545
TEST=mjsunit/regress/regress-crbug-150545

Review URL: https://codereview.chromium.org/10938016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 08:13:46 +00:00
yangguo@chromium.org
783d10197a Tentatively reenable previous failing test. 
R=mstarzinger@chromium.org
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10907254

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 14:19:11 +00:00
yangguo@chromium.org
73462594ea Change regress-2318 to trigger more quickly and reliably. 
BUG=v8:2336

Review URL: https://chromiumcodereview.appspot.com/10913294

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 13:21:59 +00:00
erik.corry@gmail.com
bafcfe5427 Fix misplaced assert in heap.cc. 
Bug=2336
Review URL: https://chromiumcodereview.appspot.com/10911334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 11:38:24 +00:00
yangguo@chromium.org
cb72bf5735 Fix debugger's eval when close to stack overflow. 
R=verwaest@chromium.org
BUG=v8:2318

Review URL: https://chromiumcodereview.appspot.com/10914290

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:40:32 +00:00
verwaest@chromium.org
ad4746c8a3 CNLT with descriptors but no valid enum fields has to clear the EnumCache. 
Review URL: https://chromiumcodereview.appspot.com/10928204

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:15:43 +00:00
mstarzinger@chromium.org
77a7d9f539 Fix caching of optimized code for OSR. 
This makes sure we do not share optimized code across closures that were
optimized using OSR (for a particular OSR entry AST id) even if caching
of optimized code kicks in.

R=danno@chromium.org
BUG=v8:2326
TEST=mjsunit/regress/regress-2326

Review URL: https://codereview.chromium.org/10933088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 10:41:31 +00:00
verwaest@chromium.org
1d1adaf9d3 Ensure correct enumeration indices in the dict 
BUG=chromium:148376

Review URL: https://chromiumcodereview.appspot.com/10908216

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-13 08:52:55 +00:00
mmassi@chromium.org
22aed1cddd Fixed bounds check removal by restricting it to int32 indexes (and reenabled both ABCR and index dehoisting). 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10905232

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 17:00:25 +00:00
yangguo@chromium.org
67d0506622 Correctly initialize regexp global cache. 
R=ulan@chromium.org
BUG=148378

Review URL: https://chromiumcodereview.appspot.com/10905239

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 15:26:43 +00:00
mstarzinger@chromium.org
f37f504de5 Fix arguments object materialization during deopt. 
This fixes materialization of arguments objects for strict mode functions during
deoptimization. We materialize arguments from the stack area where optimized
code pushes the arguments when entering the inlined environment. For adapted
invocations we use the arguments adaptor frame for materialization.

R=svenpanne@chromium.org
BUG=v8:2261
TEST=mjsunit/regress/regress-2261,mjsunit/compiler/inline-arguments

Review URL: https://chromiumcodereview.appspot.com/10908194

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 12:28:42 +00:00
ulan@chromium.org
a9162af1af Fix delta computation in DoDeferredInstanceOfKnownGlobal() for ARM. 
BUG=v8:2314

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10908195

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-11 11:36:48 +00:00
peter.rybin@gmail.com
bda5ce9cd6 Introduce InternalProperty type and expose internal properties for bound functions 
Committed: https://code.google.com/p/v8/source/detail?r=12346

Review URL: https://chromiumcodereview.appspot.com/10834376

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 23:17:04 +00:00
mstarzinger@chromium.org
f6cd2403e3 Fix deoptimizer for shared optimized code. 
The deoptimizer searched the stack for activations of the same function to
determine whether to trigger lazy deopting. Since we share optimized code we
actually need to search for activations of the same code (but potentially
different functions).

R=jkummerow@chromium.org
BUG=chromium:147475
TEST=mjsunit/regress/regress-crbug-147475

Review URL: https://chromiumcodereview.appspot.com/10917162

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 11:05:17 +00:00
yangguo@chromium.org
1a0c14f12c Add checks to runtime functions. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10915062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 08:35:26 +00:00
svenpanne@chromium.org
7af6883098 Fixed deoptimization of inlined getters. 
It is necessary to explicitly handle the internal frame lying between the caller
of the getter and the getter itself in the deoptimizer: When the getter is
inlined, leaving the internal frame restores the correct context.

BUG=http://crbug/134609
TEST=mjsunit/regress/regress-crbug-134609

Review URL: https://chromiumcodereview.appspot.com/10910110

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-07 09:01:54 +00:00
erik.corry@gmail.com
9ff7ec1c4a Fix binding in new Function(). 
Review URL: https://chromiumcodereview.appspot.com/10916114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-05 11:45:58 +00:00
erik.corry@gmail.com
e5df02834b Fix some corner cases in skipping native methods using caller. 
Review URL: https://chromiumcodereview.appspot.com/10911063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-05 08:19:49 +00:00
verwaest@chromium.org
0c24942be7 Fixed test expectation. 
Review URL: https://chromiumcodereview.appspot.com/10913062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12435 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:54:36 +00:00
verwaest@chromium.org
a8638c1570 Support register as right operand in min/max support. 
R=jkummerow@chromium.org
BUG=chromium:145961
TEST=mjsunit/regress/regress-crbug-145961.js

Review URL: https://chromiumcodereview.appspot.com/10914072

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:35:43 +00:00
yangguo@chromium.org
ddfae013a6 Disable test that triggers known bug. 
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10910029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12418 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-31 12:02:02 +00:00
yangguo@chromium.org
5dd51bafef Cache results in SearchRegExpMultiple. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10837290

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-31 09:28:01 +00:00
verwaest@chromium.org
90db487390 Elements load depends on the type of the receiver. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10918005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12413 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-30 17:31:32 +00:00
rossberg@chromium.org
b0067e9cd5 Disable test that triggers known bug. 
R=verwaest@chromium.org
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10896005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 14:17:55 +00:00
rossberg@chromium.org
ccc827a6f8 Allocate block-scoped global bindings to global context. 
- The global object has a reference to the current global scope chain.
  Running a script adds to the chain if it contains global lexical declarations.
- Scripts are executed relative to a global, not a native context.
- Harmony let and const bindings are allocated to the innermost global context;
  var and function still live on the global object.
  (Lexical bindings are not reflected on the global object at all,
  but that will probably change later using accessors, as for modules.)
- Compilation of scripts now needs a (global) context (previously only eval did).
- The global scope chain represents one logical scope, so collision tests take
  the chain into account.

R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10872084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 11:25:08 +00:00
yangguo@chromium.org
7cbca775ee Reland regexp global optimizations. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10872010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 09:37:41 +00:00
ulan@chromium.org
7b1d13affc Revert r12342 "Flush monomorphic ICs on context disposal instead of context exit." because of canary channel crashes. 
BUG=144230
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10868068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-27 16:08:27 +00:00
danno@chromium.org
3544e2e875 Disable speculative LICM when it may lead to unnecessary deopts 
BUG=v8:2250
R=vegorov@chromium.org
TEST=tests/mjsunit/regress/regress-2250.js

Review URL: https://chromiumcodereview.appspot.com/10867033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 21:08:58 +00:00
vegorov@chromium.org
106a83252d Fix DoDeferredNumberTagU to keep the value in xmm1 instead of xmm0 on x64. 
xmm0 is not saved across runtime call on x64 because MacroAssembler::EnterExitFrameEpilogue preserves only allocatable XMM registers unlike on ia32 where it preserves all registers.

Cleanup handling of shifts: SHR can deoptimize only when its a shift by 0, all other shift never deoptimize.

Fix type inference for i-to-t change instruction. On X64 this ensures that write-barrier is generated correctly.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10868032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12373 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 16:14:01 +00:00
vegorov@chromium.org
f476d4d431 Allow uint32 value on optimized frames if they are consumed by safe operations. 
Safe operations are those that either do not observe unsignedness or have special support for uint32 values:

- all binary bitwise operations: they perform ToInt32 on inputs;
- >> and << shifts: they perform ToInt32 on left hand side and ToUint32 on right hand side;
- >>> shift: it performs ToUint32 on both inputs;
- stores to integer external arrays (not pixel, float or double ones): these stores are "bitwise";
- HChange: special support added for conversions of uint32 values to double and tagged values;
- HSimulate: special support added for deoptimization with uint32 values in registers and stack slots;
- HPhi: phis that have only safe uses and only uint32 operands are uint32 themselves.

BUG=v8:2097
TEST=test/mjsunit/compiler/uint32.js

Review URL: https://chromiumcodereview.appspot.com/10778029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-22 15:44:17 +00:00
ulan@chromium.org
efc26f9b2b Fix rounding in Uint8ClampedArray setter. 
According to Web IDL spec, we should round to
the nearest integer, choosing the even integer
if it lies halfway between two.

R=yangguo@chromium.org,kbr@chromium.org
BUG=v8:2294

Review URL: https://chromiumcodereview.appspot.com/10831409

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-22 14:27:11 +00:00
verwaest@chromium.org
5df5eea066 Check that index and length are Smi in bounds check. 
BUG=chromium:142218
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10829456

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-21 16:46:25 +00:00
yangguo@chromium.org
2b2f28cd2a Revert r12346 (Introduce InternalProperty type and expose internal properties for bound functions) 
Original CL: https://chromiumcodereview.appspot.com/10834376

BUG=

Review URL: https://chromiumcodereview.appspot.com/10834428

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-21 09:48:26 +00:00
peter.rybin@gmail.com
cfc4c37768 Introduce InternalProperty type and expose internal properties for bound functions 
Review URL: https://chromiumcodereview.appspot.com/10834376

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-20 21:49:19 +00:00
ulan@chromium.org
27fb8c2cf6 Flush monomorphic ICs on context disposal instead of context exit. 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836189

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-20 12:09:03 +00:00
yangguo@chromium.org
3a1c290b2c Add input check to %DebugSetScriptSource. 
R=verwaest@chromium.org
BUG=v8:2296

Review URL: https://chromiumcodereview.appspot.com/10837308

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 15:21:15 +00:00
svenpanne@chromium.org
b10d5d7f08 Deoptimization support for accessors. 
Highlights of this CL:

 * Introduced a new opcode in the deoptimizer for a setter stub frame.

 * Added a global setter stub for returning after deoptimizing a setter.

 * We do not need special deopt support for getters, although the getter stub creates an internal frame. The normal machinery works just right for this case, although we generate a stack that can never occur during normal fullcode execution. If this hurts us one day, we can parameterize and reuse the setter deopt machinery.

Review URL: https://chromiumcodereview.appspot.com/10855098

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 10:43:32 +00:00
svenpanne@chromium.org
f5f8ebd4ed Fix accessor lookup in crankshaft. 
Seeing monomorphic type feedback plus an AccessorPair does not necessarily imply
that the corresponding getter/setter is really there, so we have to check for
this explictly.

TEST=mjsunit/object-define-property

Review URL: https://chromiumcodereview.appspot.com/10825384

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-16 10:35:39 +00:00
mstarzinger@chromium.org
886c0fa4f7 Extend constructor inlining test case. 
This makes sure that deoptimization really happens in each hydrogen
context by not using binary operations but loads instead. This is
needed because we cannot clear BinaryOpICs explicitly.

R=svenpanne@chromium.org
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/10825382

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-16 09:13:25 +00:00
erik.corry@gmail.com
ee3a66b273 Fix bug in compare IC. BUG=2291 
Review URL: https://chromiumcodereview.appspot.com/10830334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-15 15:08:42 +00:00
svenpanne@chromium.org
1ee6c0e30b Improved constructor inlining unit tests. 
Currently we inline functions with different contexts only on ia32, so we have
to move the helper functions for the various contexts to the top level. Further
more, "new Object()" seems to prevent inlining, too, so we us a simple object
literal.

Although things get consistently inlined now, something strange seems to happen
in test/effect contexts: The DEOPT output seems to contain too few frames, and
we don't get any DEOPT ouput after the first time for those contexts. This has
to be investigated...

TBR=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836258

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-15 09:39:13 +00:00
yangguo@chromium.org
28c892938e Ensure capacity when adding parts in String.replace. 
R=ulan@chromium.org
BUG=v8:2289
TEST=regress-2289.js

Review URL: https://chromiumcodereview.appspot.com/10830304

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-14 11:33:12 +00:00
yangguo@chromium.org
d3733ce1e3 Prevent segfault on undefined inline runtime call. 
R=mstarzinger@chromium.org
BUG=v8:2286

Review URL: https://chromiumcodereview.appspot.com/10828282

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-14 10:06:34 +00:00
yangguo@chromium.org
3605fcbe63 Fix indexing bug in regexp, part 2. 
The previous fix initialized the start index incorrectly.

BUG=

Review URL: https://chromiumcodereview.appspot.com/10834291

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:53:40 +00:00
mstarzinger@chromium.org
e77f24f44e Remove prototype of global builtins object. 
R=yangguo@chromium.org
BUG=v8:2284
TEST=mjsunit/regress/regress-2284

Review URL: https://chromiumcodereview.appspot.com/10854116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:34:49 +00:00
yangguo@chromium.org
960b1af12f Fix wrong indexing in global regexp. 
R=ulan@chromium.org
BUG=142087

Review URL: https://chromiumcodereview.appspot.com/10824278

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:26:46 +00:00
yangguo@chromium.org
f30099dacf Check for function in %_CallFunction. 
R=mstarzinger@chromium.org
BUG=v8:2285

Review URL: https://chromiumcodereview.appspot.com/10854115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 12:11:26 +00:00
yangguo@chromium.org
bc9df090c7 Fix array-iteration test case. 
R=verwaest@chromium.org
BUG=v8:2282

Review URL: https://chromiumcodereview.appspot.com/10827295

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 08:32:17 +00:00
yangguo@chromium.org
cd5ee62692 Allow multiple lines of custom flags in javascript tests. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10855099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-10 12:26:33 +00:00
svenpanne@chromium.org
f9aea9fcef Inline simple setter calls. 
Currently only simple setter calls are handled (i.e. no calls in count
operations or compound assignments), and deoptimization in the setter is not
handled at all. Because of the latter, we temporarily hide this feature behind
the --inline-accessors flag, just like inlining getters.

We now use an enum everywhere we depend on the handling of a return value,
passing around several boolean would be more confusing.

Made VisitReturnStatement and the final parts of TryInline more similar, so
matching them visually is a bit easier now.

Simplified the signature of AddLeaveInlined, the target of the HGoto can simply
be retrieved from the function state.

Review URL: https://chromiumcodereview.appspot.com/10836133

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-10 09:05:42 +00:00
yangguo@chromium.org
5d35b1851b Fix parseInt's octal parsing behavior (ECMA-262 Annex E 15.1.2.2). 
R=svenpanne@chromium.org
BUG=v8:1645
TEST=test262, parse-int-float.js

Review URL: https://chromiumcodereview.appspot.com/10836151

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-08 07:44:17 +00:00
yangguo@chromium.org
e0954ca592 Take advantage of batched results when matching global regexp. 
BUG=
TEST=regexp-global.js

Review URL: https://chromiumcodereview.appspot.com/10831126

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-06 09:06:27 +00:00
svenpanne@chromium.org
83fc4205f6 Fixed compound/count operations with getter-only accessor properties. 
The underlying problem is that for compound/count operations we use the *load*
type feedback for storing, too. For normal properties this doesn't matter, but
for accessor properties we should better use the *store* type feedback, which
would be available, too. This consistent feedback usage could be guaranteed if
we removed the heavy copy-n-paste in the crankshaft code generation for
compound/count operations and assignments/property loads.

To be on the safe side, we postpone this refactoring and do a quick and easily
mergeable fix.

BUG=140083
TEST=mjsunit/regress/regress-crbug-140083.js

Review URL: https://chromiumcodereview.appspot.com/10828146

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-03 09:45:08 +00:00
ulan@chromium.org
c6d4094e44 Android: increase default test timeout and skip time sensitive mjsunit/regress/regress-1969. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-01 13:06:08 +00:00
erik.corry@gmail.com
b3e2440580 Speed up quicksort test to avoid timeouts on simulators. 
Review URL: https://chromiumcodereview.appspot.com/10830093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-31 13:36:24 +00:00
jkummerow@chromium.org
80c35c6522 Always set the callee's context when calling a function from optimized code. 
This is necessary even for recursive calls because we're sharing optimized code among closures, which could call each other and have distinct contexts.

BUG=138887
TEST=mjsunit/regress/regress-crbug-138887

Review URL: https://chromiumcodereview.appspot.com/10834031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12201 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-26 12:49:08 +00:00
mstarzinger@chromium.org
806fb8be96 Fix bootstrapping without snapshot and low GC interval. 
R=yangguo@chromium.org
BUG=v8:2249
TEST=mjsunit/regress/regress-2249 (snapshot=off)

Review URL: https://chromiumcodereview.appspot.com/10818005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 16:18:25 +00:00
danno@chromium.org
3667f92cbb Add dependency to HLoadKeyed* instructions to prevent invalid hoisting 
BUG=chromium:137768
TEST=test/mjsunit/regress/regress-137768.js

Review URL: https://chromiumcodereview.appspot.com/10802038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 13:59:24 +00:00
yangguo@chromium.org
0c23596d7d Interpret negative hexadecimal literals as NaN. 
R=rossberg@chromium.org
BUG=v8:2240
TEST=str-to-num.js

Review URL: https://chromiumcodereview.appspot.com/10818003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 10:33:41 +00:00
yangguo@chromium.org
50bf19a975 Fix corner case when transforming dictionary to fast elements. 
R=verwaest@chromium.org
BUG=v8:2249
TEST=regress-2249.js

Review URL: https://chromiumcodereview.appspot.com/10802051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 08:41:53 +00:00
danno@chromium.org
8c89cc4cab Optimize Smi keys for KeyedLoads 
Allows KeyeLoad/KeyedStore operations where the key is a Smi to fold the untagging of the key into the element offset calculation.

Review URL: https://chromiumcodereview.appspot.com/10735020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12156 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-20 11:00:33 +00:00
jkummerow@chromium.org
c09a137013 Android test runner: Update mjsunit status 
Review URL: https://chromiumcodereview.appspot.com/10810012
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12155 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-20 10:03:39 +00:00
sanjoy@chromium.org
693c7643d2 Optimize functions on a second thread. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10807024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12148 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-19 18:58:23 +00:00
jkummerow@chromium.org
6a60899022 Build V8 for Android IA 
Review URL: https://chromiumcodereview.appspot.com/10778033
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12122 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-18 11:43:44 +00:00
verwaest@chromium.org
90c7cb1397 When following an accessor transition for an already existing accessor, don't load the last added descriptor but the same descriptor as we already found previously. 
BUG=137689
TEST=test/mjsunit/regress/regress-crbug-137689.js

Review URL: https://chromiumcodereview.appspot.com/10808005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12115 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-18 09:20:57 +00:00
yangguo@chromium.org
022ba0588a Fix transcendental cache on ARM in optimized code. 
R=jkummerow@chromium.org
BUG=v8:2234
TEST=regress-2234.js

Review URL: https://chromiumcodereview.appspot.com/10695205

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-16 09:44:59 +00:00
svenpanne@chromium.org
43e87a65e1 Added Crankshaft support for setters. 
Refactored ComputeLoadStoreField a bit on the way to clarify a bit what it
actually does.

Review URL: https://chromiumcodereview.appspot.com/10692187

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-13 07:14:28 +00:00
svenpanne@chromium.org
b8a7abd1fc Perform HasFastProperties check on prototypes when computing call targets in Crankshaft, part 2. 
The previous fix was for "real" calls, this one is for getters. It is a bit
unfortunate that this has to be fixed twice: We should really break up
Call::ComputeTarget into a predicate and 1 or 2 getters, so code can be reused.

The regression test has been modified a bit to make things more uniform.

Review URL: https://chromiumcodereview.appspot.com/10702164

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-12 09:32:26 +00:00
jkummerow@chromium.org
2f43f5e9d7 MIPS: Rename "mips" arch to "mipsel" in the GYP build. 
In the traditional MIPS naming scheme, "mips" is used for
big-endian mips and "mipsel" is used for little-endian mips.
In V8 the "mips" build is little-endian, so the "mips" target is
renamed to "mipsel" to be compliant with the traditional MIPS
naming scheme.

This change is also required for supporting the Chromium project on MIPS.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10695114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12047 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-11 15:15:04 +00:00
jkummerow@chromium.org
0c4cc038e6 Add missing --allow-natives-syntax flag to test case 
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10698152

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-11 14:45:47 +00:00
jkummerow@chromium.org
432576b7c8 Perform HasFastProperties check on prototypes when computing call targets in Crankshaft. 
BUG=125148
TEST=mjsunit/regress/regress-crbug-125148

Review URL: https://chromiumcodereview.appspot.com/10735054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-11 14:27:53 +00:00
yangguo@chromium.org
2a819667c1 Do not use user-defined __lookupGetter__ when generating stack trace. 
BUG=v8:1591
TEST=regress-1591.js

Review URL: https://chromiumcodereview.appspot.com/10736030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-11 11:35:19 +00:00
mstarzinger@chromium.org
09bfdabd2a Fix inline constructors for Harmony Proxy prototypes. 
R=rossberg@chromium.org
BUG=v8:2225
TEST=mjsunit/regress/regress-2225

Review URL: https://chromiumcodereview.appspot.com/10736009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12028 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-10 11:28:33 +00:00
mmassi@chromium.org
c74871f37b Fixed array bounds check elimination (Chromium issue 132114). 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10698125

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-10 11:01:29 +00:00
verwaest@chromium.org
1007696cdb After transitioning to constant function, return the constant function as result of the assignment. 
BUG=v8:2226
TEST=test/mjsunit/regress/regress-2226.js

Review URL: https://chromiumcodereview.appspot.com/10700137

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-10 09:31:30 +00:00
rossberg@chromium.org
98db1a369d Implement proper module linking. 
Specifically:

- In parser, check that all exports are defined.
- Move JSModule allocation from parser to scope resolution.
- Move JSModule linking from full codegen to scope resolution.
- Implement module accessors for exported value members.
- Allocate module contexts statically along with JSModules
  (to allow static linking), but chain them when module literal is evaluated.
- Make module contexts' extension slot refer to resp. JSModule
  (makes modules' ScopeInfo accessible from context).
- Some other tweaks to context handling in general.
- Make any code containing module literals (and thus embedding
  static references to JSModules) non-cacheable.

This enables accessing module instance objects as expected.
Import declarations are a separate feature and do not work yet.

R=mstarzinger@chromium.org
BUG=v8:1569
TEST=

Review URL: https://chromiumcodereview.appspot.com/10690043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-09 08:59:03 +00:00
yangguo@chromium.org
3e3160b08c Correctly advance the scanner when scanning unicode regexp flag. 
R=rossberg@chromium.org
BUG=136084
TEST=regress-136084.js

Review URL: https://chromiumcodereview.appspot.com/10703106

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-06 14:04:15 +00:00
mstarzinger@chromium.org
026f179b34 Fix unhandlified code calling Harmony Proxy traps. 
R=rossberg@chromium.org
BUG=v8:2219
TEST=mjsunit/regress/regress-2219

Review URL: https://chromiumcodereview.appspot.com/10703103

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-06 11:34:22 +00:00
danno@chromium.org
f97df41fcf Fix timout of packed-elements.js on ARM 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10703093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-05 13:40:51 +00:00
svenpanne@chromium.org
ebff0eb7b3 Handle accessors on the prototype chain in StoreICs. 
Made stub compiler function signatures a bit more consistent on the way.

Review URL: https://chromiumcodereview.appspot.com/10735003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11984 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-04 11:40:51 +00:00
rossberg@chromium.org
cc5a88812d Implement typedarray.set and arraybuffer.slice for d8. 
R=yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10694051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11983 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-03 13:44:36 +00:00
mstarzinger@chromium.org
7da6d2b023 Fix lazy compilation for strict eval scopes. 
This prevents lazy compilation of functions that have an outer context
containing a strict eval scope. Such a scope potentially contains
context allocated variables in an artificial function scope that is not
deserialized correctly.

R=ulan@chromium.org
BUG=chromium:135066
TEST=mjsunit/regress/regress-crbug-135066

Review URL: https://chromiumcodereview.appspot.com/10704058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-03 08:41:13 +00:00
ulan@chromium.org
c22c7054f2 Add Makefile targets for running tests on Android. 
This allows to run tests on the attached Android device using
> make android.check
> make android.debug.check
> make android.release.check
> ANDROID_V8=/data/local/v8 TESTJOBS=-j4 make android.release.check -j10

Tests and binaries are copied to device location specified by the ANDROID_V8
variable and then tests are executed using the 'adb shell' program.

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10696048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11975 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-03 07:45:58 +00:00
rossberg@chromium.org
1590a5d6b4 Added tests for calling typed array constructors as functions. 
R=danno@chromium.org
BUG=v8:1497
TEST=

Review URL: https://chromiumcodereview.appspot.com/10701055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-02 13:09:47 +00:00
danno@chromium.org
34d79888fb Add test case for typed arrays slicing 
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10698069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-02 10:45:00 +00:00
yangguo@chromium.org
f6230ab420 Extend test for external arrays. 
R=rossberg@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10697033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11953 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-29 15:06:36 +00:00
rossberg@chromium.org
680797234c Further extend TypedArray support in d8: 
- Add copy constructors.
- Add subarray methods.
- Make instanceof and constructor property work.
- Rename PixelArray to Uint8ClampedArray.

Also fix broken definition of assertInstanceof in MJSUnit test harness.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10558005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-28 16:29:53 +00:00
mstarzinger@chromium.org
a691c693fb Fix lazy parsing heuristics to respect outer scope. 
This makes sure that a function literal is only parsed lazily when the
outer scope actually allows lazy compilation. Otherwise compilation will
crash due to a missing function body.

R=ulan@chromium.org
BUG=chromium:135008
TEST=mjsunit/regress/regress-crbug-135008

Review URL: https://chromiumcodereview.appspot.com/10698032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-28 14:56:28 +00:00
mstarzinger@chromium.org
a90c023d5e Allow inlining of functions containing array literals. 
R=yangguo@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/10689005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11942 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-27 14:46:01 +00:00
mstarzinger@chromium.org
df35732ab2 Allow inlining of functions containing RegExp literals. 
R=yangguo@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/10703005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-27 11:49:37 +00:00
yangguo@chromium.org
8a61d3f2fd Port r11517 (not deopt Math.floor on negative input) to x64, sse2. 
BUG=v8:873
TEST=math-floor-negative.js

Review URL: https://chromiumcodereview.appspot.com/10636057

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-27 07:27:28 +00:00
yangguo@chromium.org
3a74218589 MIPS: Skip LiveEdit test on ARM. 
Port r11915 (4c749256)

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10661049
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-26 07:48:04 +00:00
mstarzinger@chromium.org
362381c68d Fix Harmony Maps and WeakMaps for undefined values. 
R=rossberg@chromium.org
BUG=chromium:132744
TEST=mjsunit/harmony/collections

Review URL: https://chromiumcodereview.appspot.com/10658014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-25 13:33:48 +00:00
yangguo@chromium.org
99a58e36ad Correctly throw reference error in strict mode with ICs disabled. 
R=jkummerow@chromium.org
BUG=v8:2119
TEST=regress/regress-2119.js

Review URL: https://chromiumcodereview.appspot.com/10659011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-25 13:28:11 +00:00
yangguo@chromium.org
32a6a29cc8 Skip LiveEdit test on ARM. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10665021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-25 08:18:09 +00:00
peter.rybin@gmail.com
83973a0a2e Correctly support several consecutive stack modifications. 
Review URL: https://chromiumcodereview.appspot.com/10637003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-22 20:50:03 +00:00
mstarzinger@chromium.org
84b866b2d9 Fix sharing of literal boilerplates for optimized code. 
This makes sure the literal boilerplates array is correctly shared
together with optimized code when caching of optimized code is enabled.
It also enabled said caching by default again.

R=ulan@chromium.org
BUG=v8:2193
TEST=mjsunit/regress/regress-2193

Review URL: https://chromiumcodereview.appspot.com/10649008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-22 13:55:15 +00:00
jkummerow@chromium.org
9ce4133017 Make near-jump check more strict in LoadNamedFieldPolymorphic on ia32/x64 
BUG=134055

TEST=mjsunit/regress/regress-crbug-134055

Review URL: https://chromiumcodereview.appspot.com/10630027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-22 13:38:39 +00:00
yangguo@chromium.org
e4f4aad2d1 x86/x64 port of Math.floor(x/y) to use integer division for specific divisor. 
Only handles when x is int32 and y is int32 constant.

BUG=v8:2038

Currently implemented by imul (not fpmul).
x86 and x64 algorithm differs a bit.
x86 implementation is kind of cumbersome, but I couldn't think of better ways.

Review URL: https://chromiumcodereview.appspot.com/10382033
Patch from Zheng Liu <zheng.z.liu@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-20 14:08:03 +00:00
erik.corry@gmail.com
423e5b8906 Make a test run faster that is timing out on the ARM simulator. 
Review URL: https://chromiumcodereview.appspot.com/10577032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-20 13:31:07 +00:00
erikcorry
f4f9e2c1e0 Quicksort: Choose pivot with recursive sort of pivot candidates on large arrays to avoid patholgical cases. 
Review URL: http://codereview.chromium.org/10532193

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-20 07:52:47 +00:00
mstarzinger@chromium.org
edc231e2a9 Fix return values for Harmony map and set operations. 
R=rossberg@chromium.org
BUG=chromium:132741,chromium:132742
TEST=mjsunit/harmony/collections

Review URL: https://chromiumcodereview.appspot.com/10573011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 15:23:03 +00:00
mstarzinger@chromium.org
a760b82cab Enable lazy compilation for non-trivial outer contexts. 
This changes the compiler to be more aggressive about lazy compilation
of closures with non-trivial outer context. Compilation can only be
triggered with a valid outer context now. One exception is the debugger,
which can request compilation of arbitrary shared code, but it ensures
to trigger compilation only at points where no context is needed.

This relands r11782, r11783, r11790 and a minor fix.

R=ulan@chromium.org
TEST=mjsunit/debug-script-breakpoints-nested

Review URL: https://chromiumcodereview.appspot.com/10543141

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 14:29:48 +00:00
rossberg@chromium.org
3e6b01df18 Fix crash bug in Hydrogen occurring with empty prototype chain. 
(Thanks for diagnosing this.)

R=vegorov@chromium.org
BUG=115100
TEST=

Review URL: https://chromiumcodereview.appspot.com/10576013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11861 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 13:44:07 +00:00
verwaest@chromium.org
30b335157f Fixing ClearNonLiveTransition bug in combination with AccessorPairs. 
BUG=133211
TEST=test/mjsunit/regress/regress-133211b.js

Review URL: https://chromiumcodereview.appspot.com/10575018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 13:16:39 +00:00
yangguo@chromium.org
0a60da717b Correctly resolve local var shadowing a context-allocated var in debugger. 
R=ulan@chromium.org
BUG=131994
TEST=regress/regress-131994.js

Review URL: https://chromiumcodereview.appspot.com/10585002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 11:25:49 +00:00
verwaest@chromium.org
8b7b7f466f Make sure we don't leak map transitions from AccessorPairs to the Javascript world. 
BUG=133211
TEST=test/mjsunit/regress/regress-133211.js

Review URL: https://chromiumcodereview.appspot.com/10559062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-19 10:58:15 +00:00
mstarzinger@chromium.org
928a1bff32 Fix handling of numbers in SameValue method. 
R=vegorov@chromium.org
BUG=v8:2186
TEST=mjsunit/regress/regress-2186

Review URL: https://chromiumcodereview.appspot.com/10532198

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-18 14:21:29 +00:00
yangguo@chromium.org
fa48ccde25 Print correct line number for Error thrown inside eval. 
R=rossberg@chromium.org
BUG=v8:1914
TEST=eval-stack-trace.js

Review URL: https://chromiumcodereview.appspot.com/10565002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-18 13:39:24 +00:00
erikcorry
45c4cd26be Avoid arbitrarily deep recursion in Array.sort. 
BUG=v8:2185
Review URL: http://codereview.chromium.org/10561017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-18 09:23:05 +00:00
peter.rybin@gmail.com
a2e9f7c46b Fix for Issue 915 
Review URL: https://chromiumcodereview.appspot.com/10332101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11837 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-16 21:40:35 +00:00
peter.rybin@gmail.com
bdfc48a3fd Support 'restart call frame' debug command 
Review URL: https://chromiumcodereview.appspot.com/10544151

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11836 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-15 16:52:03 +00:00
erik.corry@gmail.com
045b2fbf20 Revert part of 11727 as it sometimes tanked V8 benchmark (raytrace) performance 
for reasons that are not obvious.  Now we make objects into fast-case objects
when they are made prototypes for other objects, but we do not mark objects
that are already fast case with a bit that helps keep them in fast case.
Review URL: https://chromiumcodereview.appspot.com/10556004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-15 11:53:09 +00:00
fschneider@chromium.org
bb0a2ea766 Share optimized code for closures. 
Each SharedFunctionInfo gets an optimized code map to store
one optimized code object per context. When allocating a new
closure we consult this map and check if there is optimized code
that can be shared.

This patch is based on an original patch
by Anton Muhin (http://codereview.chromium.org/6793013/).

BUG=v8:2087, v8:2094
TEST=test/mjsunit/compiler/optimized-closures.js
Review URL: https://chromiumcodereview.appspot.com/10103035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-14 14:06:22 +00:00
yangguo@chromium.org
675d9b8a04 Add missing string length check in regexp engine. 
R=erik.corry@gmail.com
BUG=v8:2172
TEST=regress-2172.js

Review URL: https://chromiumcodereview.appspot.com/10536170

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-14 13:59:48 +00:00
mstarzinger@chromium.org
90c2448be6 Fix assertion for map code cache of shared maps. 
R=danno@chromium.org
TEST=mjsunit/compare-known-objects-slow

Review URL: https://chromiumcodereview.appspot.com/10548046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-14 13:54:23 +00:00
yangguo@chromium.org
fb81da2e5f ARM: Fix literal pool handling for breakpoints in debugger. 
BUG=2177
TEST=none

Review URL: https://chromiumcodereview.appspot.com/10449047
Patch from Martyn Capewell <m.m.capewell@googlemail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-14 11:16:47 +00:00
mstarzinger@chromium.org
74ab92e0ac Fix performance regression caused by r11202. 
R=erik.corry@gmail.com
BUG=v8:2156,v8:2034
TEST=mjsunit/regress/regress-2156,mjsunit/regress/regress-2034

Review URL: https://chromiumcodereview.appspot.com/10539131

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-13 11:58:18 +00:00
mstarzinger@chromium.org
9edaa1536b Revert r11782, r11783 and r11790 due to Webkit failures. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10536142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-13 11:26:34 +00:00
erikcorry
5eb4baed65 Fix r11780 to avoid bugs where near branches are used to labels that are out of range. 
Review URL: http://codereview.chromium.org/10542137

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-13 09:54:34 +00:00
ulan@chromium.org
f8b4574250 Return an error when parsing invalid dates where a number immediately follows a word. 
BUG=53209,126448
TEST=mjsunit/date-parse.js
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10541138

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-13 09:10:37 +00:00
mstarzinger@chromium.org
19ece2bec8 Enable lazy compilation for non-trivial outer contexts. 
This changes the compiler to be more aggressive about lazy compilation
of closures with non-trivial outer context. Compilation can only be
triggered with a valid outer context now. One exception is the debugger,
which can request compilation of arbitrary shared code, but it ensures
to trigger compilation only at points where no context is needed.

R=ulan@chromium.org
TEST=mjsunit/debug-script-breakpoints-nested

Review URL: https://chromiumcodereview.appspot.com/10538102

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-12 15:57:50 +00:00
erikcorry
0418b67142 Add negative lookups to polymorphic loads in Crankshaft. 
Review URL: http://codereview.chromium.org/10539110

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-12 15:44:12 +00:00
mstarzinger@chromium.org
a41d79a16d Temporarily disable debugger test on ARM. 
R=yangguo@chromium.org
BUG=v8:2177
TEST=mjsunit/debug-liveedit-breakpoints

Review URL: https://chromiumcodereview.appspot.com/10543112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-12 15:23:36 +00:00
danno@chromium.org
43a1f5e25d Eliminate redundant smi checks 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10543094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-12 12:16:19 +00:00
yangguo@chromium.org
09179b314a Reland r11753: Fix try..finally. 
R=ulan@chromium.org
BUG=129171
TEST=test-api/TryFinallyMessage, mjsunit/try-finally-continue.js

Review URL: https://chromiumcodereview.appspot.com/10540095

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-11 13:18:05 +00:00
jkummerow@chromium.org
5e60931332 Clean up some minor stuff in test expectation files 
Review URL: https://chromiumcodereview.appspot.com/10545082

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-11 12:24:00 +00:00
erikcorry
afc9b8e9a9 Fix optimization of Unicode regexp with ASCII subject to respect repeat counts. 
bug=131923
Review URL: http://codereview.chromium.org/10544093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-11 11:18:04 +00:00
danno@chromium.org
a1d9aca22f Fix EnsureCanContainElements to properly handle double values. 
R=jkummerow@chromium.org
BUG=v8:2170
TEST=test/mjsunit/regress/regress-2170.js

Review URL: https://chromiumcodereview.appspot.com/10542084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-11 08:41:48 +00:00
danno@chromium.org
4e525b85fc Optimistically assume that elements IC only transition once. 
Thanks to Zheng Liu for identifying this issue.

R=jkummerow@chromium.org
BUG=v8:2141
TEST=test/mjsunit/elements-kind.js

Review URL: https://chromiumcodereview.appspot.com/10532063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-08 13:06:24 +00:00
erik.corry@gmail.com
15ecbe0f93 More tests for r11732 syntax based fast-mode heuristics. 
Review URL: https://chromiumcodereview.appspot.com/10539046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-07 20:12:50 +00:00
erik.corry@gmail.com
657422c29a Use the syntax of a property addition as a hint for controlling the fast-mode vs. dictionary mode heursitics on objects. 
Review URL: https://chromiumcodereview.appspot.com/10537050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11732 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-07 12:08:07 +00:00
erik.corry@gmail.com
911d447b96 Keep track of which maps are associated with prototype objects so we can tune the fast-case vs. hash map heuristics accordingly. 
This is a reland of r11681 https://chromiumcodereview.appspot.com/10448011 , which was reverted because of layout test failures that were actually caused by the long-standing issue fixed in https://chromiumcodereview.appspot.com/10515006 (r11706).
Review URL: https://chromiumcodereview.appspot.com/10532021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-06 10:17:26 +00:00
rossberg@chromium.org
4ea1fc0d27 Remove one more case behind --es5_readonly flag. 
Plus add a couple of assertions.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10535011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-05 16:56:53 +00:00
rossberg@chromium.org
c13dd2ece6 Put inherited readonliness behind a flag, 
since it currently breaks WebKit bindings massively.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10535007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-05 12:39:07 +00:00
verwaest@chromium.org
a85f4e4226 ClearNonLiveTransitions has to hold on to non-map values. 
This ensures that we don't accidentally throw away getters and/or setters that are still needed. To make sure the bug gets triggered, we have to construct a situation where the map is on the live side of a live->non-live transition. This ensures that the map is passed to ClearNonLiveTransitions.

BUG=v8:2163
TEST=test/mjsunit/regress/regress-2163.js

Review URL: https://chromiumcodereview.appspot.com/10535004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-05 11:36:57 +00:00
erik.corry@gmail.com
0a856e0bd7 Fix bug in __proto__ assignment transition cache where we forget the next enumeration index resulting in wrong iteration order. 
Review URL: https://chromiumcodereview.appspot.com/10515006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-04 12:07:46 +00:00
yangguo@chromium.org
85e3fba8a3 Remove unnecessary code for non-zero-length global regexps. 
Also fixing a bug in the arm implementation.

BUG=
TEST=regexp-global.js

Review URL: https://chromiumcodereview.appspot.com/10383280

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-04 08:49:17 +00:00
rossberg@chromium.org
f6017d36f2 Clean up d8 ArrayBuffer implementation and fix bug in readbuffer: 
- Separate CreateExternalArrayBuffer function.
- Properly create buffers for arrays constructed with size argument only.
- Finalization of data array is tied to buffer object exclusively.
- Get rid of hidden buffer reference in array objects and size header in data.
- Use 'new' instead of 'malloc' in readbuffer.
- Test cases for additional array and buffer properties.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10459047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-01 11:46:05 +00:00
erik.corry@gmail.com
ae4fcd9702 Limit work done analyzing regexps with very large fanout. 
BUG=128821
Review URL: https://chromiumcodereview.appspot.com/10448117

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-01 11:28:52 +00:00
rossberg@chromium.org
e4c472a7af Implement correct checking for inherited readonliness on assignment. 
Removes 6 out of 8 of our remaining unintentional failures on test262.

Also fixes treatment of inherited setters added after the fact.

Specifically:

- In the runtime, when looking for setter callbacks in the prototype chain,
  also look for read-only properties. If one is found, reject (exception in
  strict mode). If a proxy is found, invoke proper trap.
  Note: this folds in the CanPut function from the spec and avoids an extra
  lookup over the prototype chain.

- In generated code for stores, insert a test for the maps from the prototype
  chain, but only up to the object where the property already exists (which
  may be the object itself).
  In Hydrogen, if the found property is read-only or not cacheable (e.g. a
  proxy), bail out; in a stub, generate an unconditional miss (to get an
  exception in strict mode).

- Add test cases and adapt existing test expectations.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10388047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-06-01 10:51:36 +00:00
erik.corry@gmail.com
047a7cfee0 Avoid overdeep recursion in regexp where a guarded expression with a 
minimum repetition count is inside another quantifier.
Bug=129926
Review URL: https://chromiumcodereview.appspot.com/10451092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-31 11:59:04 +00:00
erik.corry@gmail.com
b7b43e9af9 Revert r11681 https://chromiumcodereview.appspot.com/10448011 
(Keep track of which maps are associated with prototype objects so we can tune the fast-case vs. hash map heuristics accordingly.).
Reverting because the dict-mode to fast case transformation loses the iteration order information.
Review URL: https://chromiumcodereview.appspot.com/10448097

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-31 09:27:39 +00:00
erik.corry@gmail.com
8cf2af4392 Keep track of which maps are associated with prototype objects 
so we can tune the fast-case vs. hash map heuristics accordingly.
Review URL: https://chromiumcodereview.appspot.com/10448011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-30 14:40:57 +00:00
rossberg@chromium.org
50fdcca1da Proxies: Fix receiver for setters inherited from proxies. 
R=mstarzinger@chromium.org
BUG=v8:1543
TEST=

Review URL: https://chromiumcodereview.appspot.com/10451064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-29 14:00:56 +00:00
rossberg@chromium.org
7a7ea0b547 Proxies: Fix ToStringArray function so that it does not reject some keys. 
R=mstarzinger@chromium.org
BUG=v8:1543
TEST=

Review URL: https://chromiumcodereview.appspot.com/10453053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11676 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-29 13:57:55 +00:00
svenpanne@chromium.org
39f88f1b26 Fixed JSObject::SetPropertyForResult (issue 2153) 
AccessorPairs containing only holes are maps were handled incorrectly.

BUG=v8:2153
TEST=mjsunit/regress/regress-2153.js

Review URL: https://chromiumcodereview.appspot.com/10453054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11672 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-29 12:42:22 +00:00
yangguo@chromium.org
e885a82c29 Fix test. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10442030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11662 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-25 11:03:28 +00:00
yangguo@chromium.org
24a1503d28 Fix creating substring in string.replace(<global regexp>, <function>). 
BUG=
TEST=regexp-global.js

Review URL: https://chromiumcodereview.appspot.com/10454032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11661 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-25 10:52:38 +00:00
yangguo@chromium.org
86c2a15691 messages.js: Get better function names in stack traces. 
CallSite.getFunctionName() is able to retrieve names for functions better than
getFunction().name.  Use it in CallSite.toString().

Code by marja@chromium.org.

BUG=NONE
TEST=stack-traces.js: Added testClassNames.

Review URL: https://chromiumcodereview.appspot.com/10384196

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-24 11:00:05 +00:00
svenpanne@chromium.org
ff216c9cea Re-land: Use map transitions when defining accessor properties. 
This is basically r11496, with the following changes:

 * Set back pointers in maps (cherry-picked from r11528)

 * Fixed size calculation in CopyInsert, as proposed by mstarzinger/rossberg

 * DefineFastAccessor uses GetCallbackObject instead of GetValue (for __proto__)

 * Put the code under a new flag, which is disabled by default

 * Cut down the corresponding regression test

 * Adapted bootup memory test, we actually only need a bit more memory on 64bit without snapshots, which can easily explained by more live maps lying around. Note that the snapshot variants are back to their previous limits.

Next steps: Investigate any performance degradationswith the flag enabled, and finally remove the flag when things are OK. Furthermore, GetCallbackObject should be merged into GetValue, the distinction is confusing and error-prone.

Review URL: https://chromiumcodereview.appspot.com/10445009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-24 10:40:24 +00:00
danno@chromium.org
17ec52b6cd Fix build and test failures from packed array optimizations. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10332317

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-23 21:15:14 +00:00
mstarzinger@chromium.org
7e613579be Fix RegExp.prototype.toString for incompatible receivers. 
BUG=v8:1981
TEST=mjsunit/regexp

Review URL: https://chromiumcodereview.appspot.com/10426005
Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-23 20:48:08 +00:00
danno@chromium.org
9910edbb9a Implement tracking and optimizations of packed arrays 
R=jkummerow@chromium.org
TEST=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10170030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11636 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-23 14:24:29 +00:00
yangguo@chromium.org
578fc3cc2d Implement loop for global regexps in regexp assembler. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10386090

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-22 14:05:44 +00:00
ulan@chromium.org
15b796bec8 Disable optimization for functions that have scopes that cannot be reconstructed from the context chain. 
BUG=v8:2071
TEST=mjsunit/regress/regress-2071.js

Review URL: https://chromiumcodereview.appspot.com/10388164

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-18 13:06:16 +00:00
yangguo@chromium.org
81720ffe84 Amend regression test. 
R=rossberg@chromium.org
BUG=128146
TEST=

Review URL: https://chromiumcodereview.appspot.com/10382196

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11580 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-16 12:26:11 +00:00
yangguo@chromium.org
62b35e2174 Add missing test for transcendental functions. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10389169

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-16 11:15:30 +00:00
yangguo@chromium.org
ec1fc618ff Revert r11496. 
CL being reverted: https://chromiumcodereview.appspot.com/10238005

BUG=128146
TEST=regress-128146

Review URL: https://chromiumcodereview.appspot.com/10386166

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11578 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-16 11:07:54 +00:00
danno@chromium.org
7966fb3d8c Always transition empty FAST_DOUBLE_ARRAYs on push 
R=mstarzinger@chromium.org
BUG=chromium:128018
TEST=test/mjsunit/regress/regress-128018.js

Review URL: https://chromiumcodereview.appspot.com/10387130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11570 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-15 16:17:53 +00:00
jkummerow@chromium.org
1819105559 Prepare for using GYP build on buildbots 
Review URL: https://chromiumcodereview.appspot.com/10383128

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11546 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-11 12:18:09 +00:00
danno@chromium.org
159ee25bbf Properly set ElementsKind of empty FAST_DOUBLE_ELEMENTS arrays when transitioning. 
R=jkummerow@chromium.org
BUG=chromium:117409
TEST=test/mjsunit/regress/regress-117409.js

Review URL: https://chromiumcodereview.appspot.com/10386045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-09 15:18:50 +00:00
rossberg@chromium.org
9f04d73350 Make Error.prototype.name writable again, as required by the spec and the web. 
Address http://code.google.com/p/chromium/issues/detail?id=69187 by instead
ignoring getters on ReferenceError.prototype.name in Error.prototype.toString.

And while we're at it, do the same for SyntaxError and TypeError, and the
properties "message", "type", and "arguments" on all of them, which
potentially have similar issues.

R=danno@chromium.org
BUG=69187
TEST=

Review URL: https://chromiumcodereview.appspot.com/10234004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-09 12:35:11 +00:00
erik.corry@gmail.com
681f2951c6 Regexp: Fix overflow in min-match-length calculation. Crbug=126412. 
Review URL: https://chromiumcodereview.appspot.com/10384053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-08 12:18:08 +00:00
erik.corry@gmail.com
80256c7452 Fix crash bug in VisitChoice (bug=126272). 
Review URL: https://chromiumcodereview.appspot.com/10332035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-07 13:23:56 +00:00
jkummerow@chromium.org
63263a9aa9 Fix unsigned-Smi check in MappedArgumentsLookup 
BUG=126414
TEST=mjsunit/regress/regress-crbug-126414

Review URL: https://chromiumcodereview.appspot.com/10375033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-07 10:05:39 +00:00
mstarzinger@chromium.org
11d24334fc Implement ClearFunctionTypeFeedback for test cases. 
R=danno@chromium.org
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/10332010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-04 09:16:38 +00:00
peter.rybin@gmail.com
885c142d24 Fix mjsunit.status for new liveedit test 
Review URL: https://chromiumcodereview.appspot.com/10353016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-03 18:53:40 +00:00
peter.rybin@gmail.com
1719a1499a Fix issue 825 (LiveEdit vs. function with no locals) in core and for ia32. 
Review URL: https://chromiumcodereview.appspot.com/10263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11502 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-03 17:31:34 +00:00
svenpanne@chromium.org
065cc14449 Use map transitions when defining accessor properties. 
AccessorPairs can now contain map transitions, which is similar to our current
handling of CONSTANT_FUNCTION/CONSTANT_TRANSITION, but generalized to a pair for
holding info about the getter and the setter. This way we can achieve map
sharing for objects with accessor properties, which is a prerequisite for making
them fast via inlining. We fall back to the previous way of handling accessor
properties when sharing is not possible or we don't handle a special case.

Note: When an exisiting accessor property is redefined we could in principle
move the AccessorPair out of the descriptor into the object itself (again just
like the way we do something similar for CONSTANT_FUNCTION/CONSTANT_TRANSITION),
but this would require a new property kind for holding a pair of values. Perhaps
we can implement this later, but for now this hopefully rare case is handled
like before, losing map sharing and potentially creating more maps than strictly
necessary.

Review URL: https://chromiumcodereview.appspot.com/10238005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-03 12:41:40 +00:00
yangguo@chromium.org
b42ab19d2e Modify two regression tests to actually fail when failing. 
BUG=
TEST=regress-1639, regress-1639-2

Review URL: https://chromiumcodereview.appspot.com/10315009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-03 11:52:56 +00:00
erik.corry@gmail.com
baf7ebd6da Fix assert triggered in fast/regex/pcre-test-4.html We were not filtering out 
all the nodes that had non-ASCII characters.  That has been fixed, but because
of the protection against over-deep recursion when filtering it is wrong to
assert that all nodes were filtered.  This change therefore also makes sure we
can cope with non-filtered nodes by adding back some code removed in
https://chromiumcodereview.appspot.com/10174017/
Review URL: https://chromiumcodereview.appspot.com/10358008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-03 08:22:12 +00:00
danno@chromium.org
908e77a53a Ensure reload of elements pointer in StoreFastDoubleElement stub. 
R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-125515.js
BUG=chromium:125515

Review URL: https://chromiumcodereview.appspot.com/10260014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-05-02 09:58:42 +00:00
jkummerow@chromium.org
f6dacfe83a Fixed corner cases in truncation behavior when storing to TypedArrays. 
Also simplified ia32 KeyedStoreStubCompiler::GenerateStoreExternalArray a bit.

BUG=v8:2110
TEST=mjsunit/regress/regress-2110

Review URL: https://chromiumcodereview.appspot.com/10260011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-30 15:17:59 +00:00
mstarzinger@chromium.org
b54ca31fb2 Fix LFastLiteral to check boilerplate elements kind. 
Adds a missing check that the elements kind of the boilerplate object
still has the expected elements kind, unoptimized code can transition
the boilerplate. Corner cases might cause the optimized code to be
reentered again.

R=danno@chromium.org
TEST=mjsunit/regress/regress-fast-literal-transition

Review URL: https://chromiumcodereview.appspot.com/10254006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-30 14:59:13 +00:00
peter.rybin@gmail.com
569eba39f5 Issue 2081: Expose function's (closure's) inner context in debugger. 
This is against the correct branch (bleeding_edge).

Review URL: https://chromiumcodereview.appspot.com/10171003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-26 20:16:53 +00:00
erik.corry@gmail.com
292e007cf3 Remove more assumptions from debug tests. Even though a function 
is optimized, does not mean all frames on the stack are optimized.
Also, when we ask for the list of scripts we may get more or less
depending on GC timing.  Also fixed a presubmit error and made
%GetOptimizationStatus a little more honest.
Review URL: https://chromiumcodereview.appspot.com/10234007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-26 13:44:18 +00:00
erik.corry@gmail.com
ad4f2b996b Remove unwarranted assumptions about inlining from a debugger test. 
Review URL: https://chromiumcodereview.appspot.com/10239003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11449 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-26 11:58:34 +00:00
erik.corry@gmail.com
d511b69e86 Regexp: Remove nodes from the regexp that cannot match because 
they contain non-ASCII characters and the input string is ASCII.
Remove unused Clone() method.
Review URL: https://chromiumcodereview.appspot.com/10174017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11445 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-26 09:11:19 +00:00
mmassi@chromium.org
93113da5a2 Eliminate redundant array bound checks (checks already performed earlier in the DT). 
As a special case, for checks on index expressions with the form (expr + constant) if a smaller constant is checked later in the DT also eliminate the check.
Finally, if a larger constant is checked later in the same BB do the more general check (larger constant) earlier instead of the less general one.
This will not cause useless deoptimizations because, since we are in the same BB, all the checks would have been executed anyway.
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10032029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11437 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-25 14:32:27 +00:00
mstarzinger@chromium.org
21fc0fef6a Fix deopted construct stub frame to contain code object. 
R=danno@chromium.org
BUG=chromium:124594
TEST=mjsunit/regress/regress-124594

Review URL: https://chromiumcodereview.appspot.com/10155024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-25 13:22:04 +00:00
erik.corry@gmail.com
f6f954484c Make --stress-compaction more stressful. 
Review URL: https://chromiumcodereview.appspot.com/10141007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-25 11:35:32 +00:00
fschneider@chromium.org
6e713a269d Optimise Math.floor(x/y) to use integer division for specific divisor. 
Landing for Rodolph Perfetta <rodolph.perfetta@gmail.com>. 

Original CL: http://codereview.chromium.org/9638018/
Review URL: https://chromiumcodereview.appspot.com/10197010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-24 15:59:07 +00:00
erik.corry@gmail.com
c436c70f8b Fix some bugs in accessing details of the lastest regexp 
match.  Sometimes were were not updating it when we should
and sometimes we were leaving the lastMatchInfoOverride in
place when we should be using the updated regular last match
info.  Small optimization for zero length match in
String.prototype.replace.
Review URL: https://chromiumcodereview.appspot.com/10184004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-23 18:56:07 +00:00
mstarzinger@chromium.org
e3be59512a Fix source property of empty RegExp objects. 
R=rossberg@chromium.org
BUG=v8:1982
TEST=test262/15.10.4.1-5

Review URL: https://chromiumcodereview.appspot.com/10134010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-23 13:59:43 +00:00
yangguo@chromium.org
717dbba694 Disabling stepping into callback function of String.replace. 
This is being done due to performance concerns.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10134006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-20 15:20:52 +00:00
rossberg@chromium.org
c8aea7a184 Put new global var semantics behind a flag until WebKit tests are cleaned up. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10163003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-20 13:35:09 +00:00
yangguo@chromium.org
f516037a6f Enable stepping into callback passed to builtins (e.g. Array.forEach). 
BUG=109564
TEST=

Review URL: https://chromiumcodereview.appspot.com/10078014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-20 11:06:12 +00:00
svenpanne@chromium.org
cac8bbff6e Replaced the --limit-inling flag by three separate flags and bumped hard limits. 
This change makes experiments with inlining limits much easier. Note that the
default values for the limits keep their old values for now. Renamed things a
bit for more consistency.

Review URL: https://chromiumcodereview.appspot.com/10162001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-20 10:42:12 +00:00
fschneider@chromium.org
0556f87851 Optimize ~~(expr) in optimized code. 
~~ is commonly used to truncate a value to int32 (ToInt32).

This change avoid actually emitting the bitwise operations, and
just truncates the subexpression of ~~.

BUG=v8:2037
TEST=test/mjsunit/compiler/optimize-bitnot.js
Review URL: https://chromiumcodereview.appspot.com/10123007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11390 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-19 13:24:15 +00:00
mstarzinger@chromium.org
57739100f3 Fix missing GVN flag for new-space promotion. 
R=vegorov@chromium.org
BUG=chromium:123919
TEST=mjsunit/regress/regress-123919

Review URL: https://chromiumcodereview.appspot.com/10119016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-19 07:49:11 +00:00
mstarzinger@chromium.org
47d07b8a7b Fix fast array literals to ignore prototype chain. 
This makes sure that boilerplate objects for array literals with
non-constant elements (which will contain the hole at non-constant
positions) will not cause prototype chain lookups when generating
optimized code.

R=erik.corry@gmail.com
BUG=chromium:123512
TEST=mjsunit/regress/regress-123512

Review URL: https://chromiumcodereview.appspot.com/10105025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-17 11:12:37 +00:00
mstarzinger@chromium.org
f7cd1e41f8 Fix illegal escape-sequences to throw syntax errors. 
R=erik.corry@gmail.com
TEST=test262/S7.8.4_A6.*,test262/S7.8.4_A7.*

Review URL: https://chromiumcodereview.appspot.com/9490006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-16 15:54:02 +00:00
rossberg@chromium.org
ab26fb6b21 Implement rudimentary module linking. 
Constructs the (generally cyclic) graph of module instance objects
and populates their exports. Any exports other than nested modules
are currently set to 'undefined' (but already present as properties).

Details:
- Added new type JSModule for instance objects: a JSObject carrying a context.
- Statically allocate instance objects for all module literals (in parser 8-}).
- Extend interfaces to record and unify concrete instance objects,
  and to support iteration over members.
- Introduce new runtime function for pushing module contexts.
- Generate code for allocating, initializing, and setting module contexts,
  and for populating instance objects from module literals.
  Currently, all non-module exports are still initialized with 'undefined'.
- Module aliases are resolved statically, so no special code is required.
- Make sure that code containing module constructs is never optimized
  (macrofy AST node construction flag setting while we're at it).
- Add test case checking linkage.

Baseline: http://codereview.chromium.org/9722043/

R=svenpanne@chromium.org,mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9844002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11336 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-16 14:43:27 +00:00
rossberg@chromium.org
62945585fd Implement ES5 erratum: global declarations shadow inherited properties. 
I also discovered that our treatment of const declarations is inconsistent
when inside a global eval under 'with' (i.e., when created by
DeclareContextSlots). That is,

  var x;
  eval("const x = 9")

and

  var x;
  eval("with({}) const x = 9")

differ (the former assigns 9, the latter throws). This appears to be an
oversight from earlier changes to our const semantics (the latter shouldn't
throw either). Fixing this is a separate issue, though (and one that doesn't
seem quite worthwhile).

R=mstarzinger@chromium.org
BUG=v8:1991,80591
TEST=

Review URL: https://chromiumcodereview.appspot.com/10067010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-16 13:20:50 +00:00
erik.corry@gmail.com
b32ff09a49 Regexp.rightContext was still not quite right. Fixed and 
added more tests.
Review URL: https://chromiumcodereview.appspot.com/10008104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-13 11:03:22 +00:00
vegorov@chromium.org
69952d78af Untabify test/mjsunit/regress/regress-119609.js. 
TBR=kmillikin@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10067017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-12 20:29:48 +00:00
vegorov@chromium.org
ec4c772746 Return LOOKUP variable instead of CONTEXT for non-context allocated outer scope parameters. 
R=kmillikin@chromium.org
BUG=chromium:119609
TEST=test/mjsunit/regress/regress-119609.js

Review URL: https://chromiumcodereview.appspot.com/10010046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-12 19:32:29 +00:00
jkummerow@chromium.org
14e181709b Fix regular and ElementsKind transitions interfering with each other 
R=danno@chromium.org
BUG=122271
TEST=mjsunit/regress/regress-crbug-122271

Review URL: https://chromiumcodereview.appspot.com/10038010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-12 12:30:32 +00:00
erikcorry
32f16418ea Regexp: Fix rightContext in the lastMatchInfoOverride 
case.
Review URL: http://codereview.chromium.org/10068010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-12 12:13:18 +00:00
vegorov@chromium.org
983d521fe9 Reland arguments access support for inlined functions (r11109,r11118). 
When pushing arguments use correct initial values instead of fetching them from the environment which can be modified.

R=fschneider@chromium.org
TEST=test/mjsunit/compiler/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/10033028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11274 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-11 13:40:55 +00:00
erikcorry
f90e665e9a Ensure that a call to String.prototype.match with a 
global regexp after a call to String.prototype.replace
with a function argument sets the last match info
correctly.  Bug=2058
Review URL: http://codereview.chromium.org/10029009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-10 10:42:25 +00:00
danno@chromium.org
ed5d288ac1 Adjust stack limit again to avoid overflow on 64 bit windows 
Also add additional stack check.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10006010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11238 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-05 14:01:39 +00:00
ulan@chromium.org
3861063018 Check for NaN in inlined versions of Math.min, Math.max. 
R=danno@chromium.org
BUG=V8:2056
TEST=mjsunit/regress/regress-2056.js

Review URL: https://chromiumcodereview.appspot.com/10006008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-05 13:24:52 +00:00
danno@chromium.org
3c6f5774d2 Fix stack overflows on Windows x64. 
R=mstarzinger@chromium.org
TEST=win 64 not red anymore

Review URL: https://chromiumcodereview.appspot.com/10008005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-05 12:32:35 +00:00
danno@chromium.org
7bd1274baa Rollback 11231: Add regression test case for issue 2025. 
TBR=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10006006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-05 08:35:32 +00:00
danno@chromium.org
db34072379 Add regression test case for issue 2025. 
R=ulan@chromium.org
BUG=v8:2056
TEST=test/mjsunit/regress/regress-2056.js

Review URL: https://chromiumcodereview.appspot.com/10006004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-05 08:08:05 +00:00
mstarzinger@chromium.org
47aa3254c2 Fix rewriter to not treat throw as an expression. 
Now we can correctly optimize top level code that contains a throw (or
return) as it's last statement.

R=ulan@chromium.org
BUG=v8:2054
TEST=mjsunit/regress/regress-2054

Review URL: https://chromiumcodereview.appspot.com/9969146

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-04 13:41:05 +00:00
mstarzinger@chromium.org
7b59b1d5ac Fix array boilerplate object transitioning. 
Array literal boilerplate objects can be transitioned while existing
un-transitioned clones are still being populated. This adds a check that
prevents us from performing the same transition twice.

R=danno@chromium.org
BUG=v8:2055
TEST=mjsunit/regress/regress-2055

Review URL: https://chromiumcodereview.appspot.com/9950095

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-03 16:54:28 +00:00
danno@chromium.org
8dc9bc962f Don't crash on stack overflow entering the debugger. 
R=ager@chromium.org, sgjesse@chromium.org
BUG=chromium:119429
TEST= test/mjsunit/regress/regress-119429.js

Review URL: https://chromiumcodereview.appspot.com/9965101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-03 13:45:56 +00:00
danno@chromium.org
d9437722da Properly support shrinking arrays in CopyDictionaryToObjectElements. 
R=mstarzinger@chromium.org
BUG=chromium:121407
TEST=test/mjsunit/regress/regress-121407.js

Review URL: https://chromiumcodereview.appspot.com/9968056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-03 08:13:59 +00:00
mstarzinger@chromium.org
5798bc27aa Fix hidden properties to ignore [[Extensible]]. 
The [[Extensible]] property prevented the very first hidden property
from being added. If any hidden property was added to the object before
preventing extension, adding subsequent hidden properties would have
succeed however.

R=svenpanne@chromium.org
BUG=v8:2034
TEST=mjsunit/regress/regress-2034

Review URL: https://chromiumcodereview.appspot.com/9844025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-04-02 08:26:30 +00:00
vegorov@chromium.org
8360ec877e Ensure that arguments object is materialized when deoptimizing from inlined function. 
Lithium translation rebuilds hydrogen environments from scratch so we have to ensure that arguments object is correctly bound on function entry otherwise deoptimization will not materialize it.

This fix was implemented as part of r11109 and then reverted.

R=danno@chromium.org
BUG=v8:2045
TEST=test/mjsunit/regress/regress-2045.js

Review URL: https://chromiumcodereview.appspot.com/9963008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-30 13:22:39 +00:00
erik.corry@gmail.com
356cf1ed0a RegExp: Add support for table-based character class 
code generation.  This is performance neutral for
all our tests, but a factor 6 faster for the Unicode
based regexp in the new test (and much more compact
code).
Review URL: https://chromiumcodereview.appspot.com/9854020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-30 07:43:48 +00:00
mstarzinger@chromium.org
552393c383 Add missing regression test for r11173. 
R=svenpanne@chromium.org
BUG=chromium:12009
TEST=mjsunit/regress/regress-120099

Review URL: https://chromiumcodereview.appspot.com/9873027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-28 15:17:14 +00:00
mstarzinger@chromium.org
057371da13 Fix polymorphic load on named fields. 
This fixes polymorphic loads to correctly compare in-object offsets
instead of indices, because indices might coincide even though the
actual slot is different because of different instance sizes.

R=danno@chromium.org
BUG=v8:2030
TEST=mjsunit/regress/regress-2030,mjsunit/mirror-array

Review URL: https://chromiumcodereview.appspot.com/9864028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-27 10:42:38 +00:00
erik.corry@gmail.com
6cb333cadf Fix broken test. 
Review URL: https://chromiumcodereview.appspot.com/9865019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-27 09:10:58 +00:00
erik.corry@gmail.com
bfb1e9e702 Fix edge case for case independent regexp character classes. 
http://code.google.com/p/v8/issues/detail?id=2032
Review URL: https://chromiumcodereview.appspot.com/9860029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-27 08:42:37 +00:00
ulan@chromium.org
a47d1c0714 Fix the return type of the date set methods. 
Date set methods (setMinutes, setHours, etc.) should return the time value as a number instead of JSDate.

R=jkummerow@chromium.org
TEST=test/mjsunit/regress/regress-2027.js

Review URL: https://chromiumcodereview.appspot.com/9809010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-26 10:13:03 +00:00
jkummerow@chromium.org
4e405b6945 Fix missing write barrier in CopyObjectToObjectElements. 
Passing the write barrier mode as a parameter does not make sense, as the elements kind specific copiers know best whether a write barrier is needed or not.

BUG=119926
TEST=mjsunit/regress/regress-crbug-119926
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9808111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11134 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-25 15:16:06 +00:00
danno@chromium.org
8833c99552 Check double array bounds in HasElementImpl. 
R=jkummerow@chromium.org
BUG=chromium:119925
TEST=test/mjsunit/regress/regress-119925.js

Review URL: https://chromiumcodereview.appspot.com/9808110

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-25 14:21:51 +00:00
vegorov@chromium.org
3ccc885c78 Revert arguments access support for inlined functions (r11109,r11118). 
We are inserting HPushArgument instructions after HEnterInlined based on the environment at the point of the first arguments access. Which might create use before def if there are redundant phis in the environment. 
Review URL: https://chromiumcodereview.appspot.com/9837041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-23 15:39:34 +00:00
rossberg@chromium.org
00346bd1da Fix use of proxies as f.prototype properties. 
R=mstarzinger@chromium.org
BUG=v8:2021
TEST=

Review URL: https://chromiumcodereview.appspot.com/9837008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-23 10:25:14 +00:00
vegorov@chromium.org
b7dca5d5a7 Support arguments object access from inlined functions. 
R=fschneider@chromium.org
TEST=test/mjsunit/compiler/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9837002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-22 13:53:28 +00:00
vegorov@chromium.org
790219ec55 Use correct arguments adaptation environment when inlining function containing arguments. 
R=mstarzinger@google.com
BUG=V8:2014
TEST=test/mjsunit/compile/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9750007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-20 18:15:31 +00:00
yangguo@chromium.org
184b7a8915 Experimental profiler: split RegExp.test() for better optimization. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9701064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-15 17:21:42 +00:00
pfeldman@chromium.org
26aaa3b005 Debugger: naive implementation of "step into Function.prototype.bind". 
Review URL: https://chromiumcodereview.appspot.com/9705018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-15 14:17:22 +00:00
mstarzinger@chromium.org
79a98de9f7 Fix declarations escaping global strict eval. 
According to ES5 10.4.2(3), eval calls of strict code always require
their own lexical and variable environment. For now we just add a new
scope when we parse the strict mode directive. The clean solution would
be to always have this sope present (even for global eval calls) and
adapt variable binding to cope with that.

R=rossberg@chromium.org
BUG=v8:1624
TEST=mjsunit/regress/regress-1624,test262/S10.4.2.1_A1

Review URL: https://chromiumcodereview.appspot.com/9703021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-15 13:02:21 +00:00
pfeldman@chromium.org
100bc51eae Debugger: add ability to set script source from within OnBeforeCompile. 
Review URL: https://chromiumcodereview.appspot.com/9677043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-15 11:51:26 +00:00
danno@chromium.org
beb012be45 Don't use an explicit s0 in ClampDoubleToUint8. 
R=fschneider@chromium.org
BUG=v8:2004
TEST=test/mjsunit/pixel-array-rounding.js

Review URL: https://chromiumcodereview.appspot.com/9702027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-15 09:52:48 +00:00
mstarzinger@chromium.org
2c7f0edd48 Fix wrapping of receiver for non-strict callbacks. 
R=rossberg@chromium.org
BUG=v8:1973
TEST=mjsunit/regress/regress-1973

Review URL: https://chromiumcodereview.appspot.com/9705020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-14 17:42:19 +00:00
rossberg@chromium.org
46001aa54c Function declarations shall not overwrite read-only global properties. 
R=mstarzinger@chromium.org
BUG=115452
TEST=mjsunit/regress/regress-115452

Review URL: https://chromiumcodereview.appspot.com/9696035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-14 13:51:00 +00:00
vegorov@chromium.org
262c8bddd5 Always create HArgumentsObject on function entry. 
We do not know if we are going to need it and creating it lazyly might cause us to insert it at the block that does not dominate all uses.

R=mstarzinger@chromium.org
TEST=mjsunit/compiler/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9692046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-13 14:45:03 +00:00
kmillikin@chromium.org
7d6fd56fd5 Ensure there is a smi check of the receiver for global load and call ICs. 
There was a comment that, for such ICs specialized to the global object,
they were always contextual loads.  This is very brittle.  It is a
micro-optimization that relies too much on the way that things happen to
work today.

Instead, never omit the smi check because it's safer.

R=vegorov@chromium.org
BUG=117794
TEST=regress-117794.js

Review URL: https://chromiumcodereview.appspot.com/9691038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-13 11:39:30 +00:00
yangguo@chromium.org
7659beafb1 Ensure consistency of Math.sqrt on Intel platforms. 
BUG=
TEST=regress-sqrt.js

Review URL: https://chromiumcodereview.appspot.com/9690010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-12 14:56:04 +00:00
vegorov@chromium.org
da03f56b1f Inline functions that use arguments object in f.apply(o, arguments) pattern. 
Support arguments materialization after deoptimization in all frames (not only in topmost one).

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9643001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-12 12:49:41 +00:00
ulan@chromium.org
cb2f2a2391 Fix compile errors on Windows introduced by r10983. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9652030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-09 13:01:32 +00:00
ulan@chromium.org
1767fef60b Implement date library functions in C++. 
Developed together with Andreas Rossberg based on:
  https://chromiumcodereview.appspot.com/9117034/
  https://chromiumcodereview.appspot.com/9307083/

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9572008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10983 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-09 12:07:29 +00:00
rossberg@chromium.org
8604da7f06 New class for Date objects: caches individual date components. 
First step, cache slots not used yet.

R=ulan@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9117034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-09 11:11:55 +00:00
rossberg@chromium.org
dbb95bc5f0 Fix minifier to distinguish regexps from divisions (to some extent). 
Rrraaa, I have to say, doing program rewriting via regexp rules is an inherently broken idea...

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9644001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-08 16:38:44 +00:00
rossberg@chromium.org
448b620dad Basic interface inference for modules. 
All module expressions, and all variables that might refer to modules,
are assigned interfaces (module types) that are resolved using
unification. This is necessary to deal with the highly recursive
nature of ES6 modules, which does not allow any kind of bottom-up
strategy for resolving module names and paths.

Error messages are rudimental right now. Probably need to track
more information to make them nicer.

R=svenpanne@chromium.org
BUG=v8:1569
TEST=

Review URL: https://chromiumcodereview.appspot.com/9615009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-08 13:03:07 +00:00
mstarzinger@chromium.org
1d89a176ec Implement Object.is and Number.is[Finite,NaN] functions. 
R=rossberg@chromium.org
TEST=mjsunit/object-is,mjsunit/number-is

Review URL: https://chromiumcodereview.appspot.com/9630009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-08 12:49:24 +00:00
yangguo@chromium.org
13689a4f13 Set debug break slot at init of loop variable in a for loop. 
BUG=102153
TEST=regress-102153.js

Review URL: https://chromiumcodereview.appspot.com/9625011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-08 10:21:43 +00:00
svenpanne@chromium.org
1729e3c0dd Make the runtime entry for setting/changing accessors "atomic". 
Previously, there were 1 or 2 calls to the runtime when accessors were changed
or set. This doesn't really work well with property attributes, leading to some
hacks and complicates things even further when trying to share maps in presence
of accessors. Therefore, the runtime entry now takes the full triple (getter,
setter, attributes), where the getter and/or the setter can be null in case they
shouldn't be changed.

For now, we do basically the same on the native side as we did before on the
JavaScript side, but this will change in future CLs, the current CL is already
large enough.

Note that object literals with a getter and a setter for the same property still
do 2 calls, but this is a little bit more tricky to fix and will be handled in a
separate CL.

Review URL: https://chromiumcodereview.appspot.com/9616016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-07 13:24:44 +00:00
yangguo@chromium.org
67540abe08 Fix compile with debuggersupport=off. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9546051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-07 10:57:36 +00:00
svenpanne@chromium.org
64340007e0 Never let the hole escape... 
Review URL: https://chromiumcodereview.appspot.com/9605042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-07 10:03:32 +00:00
mstarzinger@chromium.org
8c2708de6d Fix Error.prototype.toString to throw TypeError. 
R=rossberg@chromium.org
BUG=v8:1980
TEST=mjsunit/function-call,mjsunit/regress/regress-1980

Review URL: https://chromiumcodereview.appspot.com/9568005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-05 13:57:48 +00:00
mstarzinger@chromium.org
240e818f0c Fix inlining of strict mode constructors. 
Inlined strict mode functions (that are not called as methods) will get
their receiver reset to undefined. This should not happen when inlining
constructors.

This change also simplifies the test suite to reuse the same closures
into which constructors get inlined and use gc() to force V8 to forget
collected type feedback.

R=vegorov@chromium.org
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/9597017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-05 12:46:50 +00:00
yangguo@chromium.org
f2699b66cf Revert r10908 due to flakiness and crashes. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9580007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-02 15:00:52 +00:00
yangguo@chromium.org
12f2099993 Ensure consistent result of transcendental functions. 
BUG=
TEST=regress-transcendental.js

Review URL: https://chromiumcodereview.appspot.com/9572009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-02 14:33:15 +00:00
danno@chromium.org
57a0c6c6e3 Inline ordered relational compares of mixed double/undefined values. 
Allow Crankshaft to inline ordered relational comparisons (<, >, <=, >=) that have undefined arguments in addition to double value arguments (rather than calling the generic Compare stub).

R=fschneider@chromium.org
TEST=test/mjsunit/comparison-ops-and-undefined.js

Review URL: https://chromiumcodereview.appspot.com/9584006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-02 13:40:14 +00:00
fschneider@chromium.org
1e40f7ac2c Fix a register assignment bug in typed array stores without SSE3 available. 
The old code used a separate HToInt32 instruction which had a wrong register
constraint for the input register which caused wrong result when the stored value
is used after a typed array store. (UseRegister instead of UseTempRegister) when no
SSE3 is available.

This change fixes it by replacing HToInt32 with the corresponding HChange
instruction which has correct register contraints.

TEST=mjsunit/compiler/regress-toint32.js
Review URL: https://chromiumcodereview.appspot.com/9565007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-01 12:45:46 +00:00
mstarzinger@chromium.org
fd5640cf7a Implement inlined object allocation in Crankshaft. 
Generates inlined code for object allocation specific to the initial map
of the given constructor function. Also forces completion of inobject
slack tracking while crankshafting to finalize instance size of these
objects.

R=vegorov@chromium.org
TEST=mjsunit/compiler/alloc-object

Review URL: https://chromiumcodereview.appspot.com/9370019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-03-01 11:10:28 +00:00
rossberg@chromium.org
b89c0a962c AST extensions and parsing for import & export declarations. 
R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9496003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-29 12:12:52 +00:00
mstarzinger@chromium.org
fb8eb04bfd Implement inlining of constructor calls. 
R=vegorov@chromium.org,kmillikin@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9304001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-28 09:05:55 +00:00
vegorov@chromium.org
9b55ebaa3a When compiling for-in pass correct context value to the increment instruction. 
Additionally force increment instruction to use int32 representation.

R=fschneider@google.com
BUG=http://crbug.com/115646
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9463052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-27 14:37:27 +00:00
yangguo@chromium.org
32e2b0319e Update break points set with partial file name after compile. 
BUG=v8:1853

Review URL: https://chromiumcodereview.appspot.com/9460059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-27 11:52:08 +00:00
rossberg@chromium.org
becd8dd11c Make 'module' a context-sensitive keyword. 
Baseline: http://codereview.chromium.org/9401008/

R=lrn@chromium.org,mstarzinger@chromium.org
BUG=v8:1957
TEST=mjsunit/harmony/module-parsing

Review URL: https://chromiumcodereview.appspot.com/9422001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-24 15:53:09 +00:00
mstarzinger@chromium.org
36a91e30f7 Fix redefining of attributes on aliased arguments. 
This allows elements of the non-strict arguments object to be redefined
with custom attributes and still maintain an alias into the context.
Such a slow alias is maintained by placing a special marker into the
dictionary backing store of the arguments object.

R=rossberg@chromium.org
BUG=v8:1772
TEST=test262,mjsunit/object-define-property

Review URL: https://chromiumcodereview.appspot.com/9460004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-24 14:34:01 +00:00
mstarzinger@chromium.org
9f83b4ee36 Fix Object.getOwnPropertyDescriptor in string elements. 
This fixes Object.getOwnPropertyDescriptor to report string character
elements as enumerable in accordance with the spec.

BUG=v8:862
TEST=mjsunit/get-own-property-descriptor

Review URL: https://chromiumcodereview.appspot.com/9447053
Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10822 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-24 11:58:09 +00:00
yangguo@chromium.org
baabb87dae Fix HConstant's hash function for smis on x64. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9466003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-24 10:59:12 +00:00
yangguo@chromium.org
8affd2bead Skip regress-1969 in x64. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9455015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-23 14:50:08 +00:00
mstarzinger@chromium.org
30dcdb6a36 Revert r10811 because of test flakiness. 
TBR=vegorov@chromium.org
BUG=v8:1322

Review URL: https://chromiumcodereview.appspot.com/9453012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-23 14:12:44 +00:00
yangguo@chromium.org
671084074d Lazy removal of dead HValues in GVN from use lists. 
BUG=v8:1969
TEST=regress/regress-1969

Review URL: https://chromiumcodereview.appspot.com/9455011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-23 13:59:35 +00:00
mstarzinger@chromium.org
c1b97fe842 Allow inlining of functions containing function literals. 
R=fschneider@chromium.org,vegorov@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/9453007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-23 12:24:03 +00:00
vegorov@chromium.org
5bb6a8399d Support OSR in for-in loops. 
Modify PreProcessOsrEntry to work with OSR entries that have non-empty expression stack.

Modify graph builder to take for-in state from environment instead of directly referencing emitted instructions.

Extend %OptimizeFunctionOnNextCall with an argument to force OSR to make writing OSR tests easier: %OptimizeFunctionOnNextCall(f, "osr").

R=fschneider@chromium.org
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9431030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-22 16:45:35 +00:00
vegorov@chromium.org
6703dddac4 Support fast case for-in in Crankshaft. 
Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.

HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).

New hydrogen instructions:

- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;

Changed hydrogen instructions:

- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9425045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-22 12:47:42 +00:00
rossberg@chromium.org
e414be5fc6 After assignment return right hand side value instead of undefined 
when Object.isExtensible(o) === false

Added corresponding tests

ES5 description: http://es5.github.com/#x11.13.1

Related issue: http://code.google.com/p/v8/issues/detail?id=1901

Contributed by ioseb.dzmanashvili@gmail.com

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9429002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-21 14:09:45 +00:00
vegorov@chromium.org
f5c8ac9839 On ia32 LFunctionLiteral instruction should get context from esi register instead of stack slot. 
This makes LFunctionLiteral safe even when it is used from inside inlined function.

All other architectures were implementing LFunctionLiteral correctly.

R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-inlining-function-literal-context.js

Review URL: https://chromiumcodereview.appspot.com/9425061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-21 12:10:04 +00:00
mstarzinger@chromium.org
417a01accf Fix RegExp white-space character class to match BOMs. 
R=rossberg@chromium.org
TEST=test262/S15.10.2.12_A?_T1,mjsunit/regexp

Review URL: https://chromiumcodereview.appspot.com/9426032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-20 17:50:53 +00:00
rossberg@chromium.org
958b3bf470 Parsing of basic module declarations (no imports/exports yet). 
Module definitions are not compiled or otherwise executed yet.
Toplevel module identifiers are bound but never initialized.

R=kmillikin@chromium.org,mstarzinger@google.com
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9401008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-20 14:02:59 +00:00
rossberg@chromium.org
1336b913d0 Make built-ins strict mode conforming, and support a --use-strict flag. 
* Turned all uses of 'const' into 'var'.
* Turned all uses of local 'function' into 'var'.
* Added a couple of missing toplevel 'var' declarations.

One consequence is that the properties on the builtin object  are no longer
non-writable, and I had to adapt one test. Is that a problem?

Unfortunately, we cannot actually switch the library scripts to strict mode
by default, because that makes observable things like poisoned .caller properties
for library functions.

Also removed dead flag code in Compiler::Compile.

R=yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9415010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-20 13:48:24 +00:00
yangguo@chromium.org
30bcc481e1 Enable inlining for Math.min/max in more cases. 
Review URL: https://chromiumcodereview.appspot.com/9372021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-20 13:21:15 +00:00
mstarzinger@chromium.org
e423637898 Fix sequence of element access in array builtins. 
R=rossberg@chromium.org
BUG=v8:1790
TEST=mjsunit/regress/regress-1790,test262/15.4.4.22-9-9

Review URL: https://chromiumcodereview.appspot.com/9419044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-17 10:06:26 +00:00
mstarzinger@chromium.org
1dd2b094a5 Implement fast literal support in Crankshaft. 
This extends the current support for nested object literals we already
have in Crankshaft, to also support nested array literals and mixed
nested literals containing arrays and objects. All three types are
generated by the unified HFastLiteral instruction.

All previous upper bounds on nested literal graphs remain unchanged,
keeping the size of generated code in check.

The main intention is to boost performance of two-dimensional array
literals containing constant elements (aka. matrices).

R=danno@chromium.org
TEST=mjsunit/compiler/literals-optimized

Review URL: https://chromiumcodereview.appspot.com/9403018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 17:32:30 +00:00
mstarzinger@chromium.org
15c368ce4c Revert r10721 because of test flakiness. 
TBR=fschneider@chromium.org
BUG=v8:1322

Review URL: https://chromiumcodereview.appspot.com/9417013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 17:13:37 +00:00
danno@chromium.org
a07e129e9a Relax TransitionElementsKind DependsOn/Changes dependencies. 
Ensure that GVN eliminates all transitions that are dominated by an equivalent transition, even if there is a DependsOn-changing instruction in between.

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9365057

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 15:37:52 +00:00
mstarzinger@chromium.org
acb83c06f4 Allow inlining of functions containing function literals. 
R=fschneider@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/9419005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 14:01:41 +00:00
yangguo@chromium.org
cc2780403a Ensure using byte registers for byte instructions on ia32 and x64. 
BUG=v8:1945
TEST=regress-1945.js

Review URL: https://chromiumcodereview.appspot.com/9418005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 12:48:02 +00:00
danno@chromium.org
bd79e299e5 Uniformly handle 'undefined' store to Float64Array and Float32Array. 
Previous behavior diverged in ICs and Crankshaft. When storing to a Float32Array or Float64Array, the ICs treated undefined as zero while Crankshaft treated it as NaN. Now both ICs and Crankshaft treat it as NaN, which is consistent with the WebGL & ECMAScript spec.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9402008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-16 07:58:07 +00:00
yangguo@chromium.org
01e46b955f Initialize internal arrays with the correct map. 
BUG=v8:1878
TEST=regress-1878.js

Review URL: https://chromiumcodereview.appspot.com/9402009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-15 13:45:42 +00:00
danno@chromium.org
71cd77e22c Fix crashing bugs in store-and-grow IC for double values. 
R=jkummerow@chromium.org
BUG=chromium:113924
TEST=test/mjsunit/regress/regress-113924.js

Review URL: https://chromiumcodereview.appspot.com/9365055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-14 15:09:49 +00:00
jkummerow@chromium.org
4233bf8348 Initial support for count-based profiling 
(behind FLAG_count_based_interrupts; only on ia32)

Review URL: https://chromiumcodereview.appspot.com/9373028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-14 14:00:31 +00:00
rossberg@chromium.org
559f5eecad Don't treat function parameters as let-bound variables in Harmony mode. 
R=ulan@chromium.org
BUG=v8:1942
TEST=

Review URL: https://chromiumcodereview.appspot.com/9365054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-14 13:47:54 +00:00
mstarzinger@chromium.org
0db91d40e9 Allow inlining of functions containing object literals. 
R=fschneider@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/9388007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-14 08:57:10 +00:00
yangguo@chromium.org
fff8eba038 Fix test expectations for the tickprocessor. 
Review URL: https://chromiumcodereview.appspot.com/9388003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-13 10:24:55 +00:00
danno@chromium.org
f0c4b87f34 Implement KeyedStoreICs to grow arrays on out-of-bound stores. 
Supports growing non-COW JSArray by a single element if the backing store has room, and initial allocation of a backing store for the store to index zero of an empty array  to kPreallocatedArrayElements elements (e.g. the [] array literal).

Review URL: https://chromiumcodereview.appspot.com/9310117

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-10 12:36:05 +00:00
danno@chromium.org
9cc595a295 Add asserts to try to flush out test flakiness. 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9358033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-09 17:29:26 +00:00
danno@chromium.org
256975f314 Ensure expected behavior for transition hosting tests by flushing ICs 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9373027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-09 14:55:32 +00:00
mstarzinger@chromium.org
19a62a22fc Fix d8-os unit test to be skipped for isolates. 
This test sets the umask on a per-process basis and hence cannot be
used in multi-threaded runs.

R=yangguo@chromium.org
TEST=mjsunit/d8-os

Review URL: https://chromiumcodereview.appspot.com/9372018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-09 09:52:38 +00:00
danno@chromium.org
d949c64688 Improve GVN handling of ElementTransitions. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9141016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-09 08:58:19 +00:00
fschneider@chromium.org
b8b50400d2 Inline builtin Math functions functions in more cases. 
Until now we only could inline as specialized HIR instructions when called
as a method (e.g. Math.abs)

It is very common practice to abbreviate calls to those functions by defining
a global or local variable like:

var a = Math.abs;
var x = a(123);

This change allows inlining them when called as a function (global or local).
Review URL: https://chromiumcodereview.appspot.com/9365013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10640 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-08 12:08:46 +00:00
mstarzinger@chromium.org
8e1399c761 Fix d8-os unit test to work with isolates. 
We cannot use chdir to set the working directory on a per-isolate basis,
hence we need to specify absolute directories instead for this test to
work properly on multi-threaded runs.

R=yangguo@chromium.org
TEST=mjsunit/d8-os

Review URL: https://chromiumcodereview.appspot.com/9348051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-08 10:59:19 +00:00
mstarzinger@chromium.org
f034a3f0ea Enable membrane example for proxies again. 
R=rossberg@chromium.org
BUG=v8:1845
TEST=mjsunit/harmony/proxies-example-membrane

Review URL: https://chromiumcodereview.appspot.com/9365011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-08 10:14:18 +00:00
yangguo@chromium.org
3e58827710 Fix elements transition bug related to array.concat. 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9358018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-08 09:50:13 +00:00
lrn@chromium.org
f0a87d7c34 Fix handling of 'c: if (0) break c; else ()' where a parser optimization 
leaves a trailing ";" after removing the break.

Review URL: https://chromiumcodereview.appspot.com/9159043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-08 08:40:11 +00:00
fschneider@chromium.org
cb5164c0b0 Speed up two unit tests to avoid timeouts and make tests finish faster. 
Review URL: https://chromiumcodereview.appspot.com/9309118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10609 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-06 11:40:24 +00:00
ulan@chromium.org
8093e397e4 Do not ignore an empty context with extension when creating a scope object. 
Runtime_DebugEvaluate creates an empty context which is not correctly handled in FullCodeGenerator::ContextSlotOperandCheckExtensions because the corresponding scope indicates that it has no context.

BUG=crbug.com/107996
TEST=test/mjsunit/regress/regress-crbug-107996.js

Review URL: https://chromiumcodereview.appspot.com/9310027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10582 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-02-02 09:35:12 +00:00
mstarzinger@chromium.org
5dc4859fa4 Fix test case to correctly check expected result. 
R=vegorov@chromium.org
TEST=mjsunit/regress/regress-1229

Review URL: https://chromiumcodereview.appspot.com/9303032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-31 12:31:24 +00:00
danno@chromium.org
57525ef893 Store transitioned JSArray maps in global context 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9073007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-26 21:47:57 +00:00
vegorov@chromium.org
67d72eab45 When preparing heap for breakpoints make sure not to flush away non-optimized code for inlined functions. 
Debug::PrepareForBreakPoints was not fully populating active_functions list.

R=erik.corry@gmail.com
TEST=test/mjsunit/regress/regress-debug-code-recompilation.js

Review URL: https://chromiumcodereview.appspot.com/9290013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-25 15:11:59 +00:00
vegorov@chromium.org
189aee91de Untabify test/mjsunit/debug-evaluate-locals-optimized-double.js. 
TBR=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9284016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-24 08:48:33 +00:00
vegorov@chromium.org
04289e8d17 Support inlining at call-sites with mismatched number of arguments. 
Review URL: https://chromiumcodereview.appspot.com/9265004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10483 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-24 08:43:12 +00:00
rossberg@chromium.org
c61665604b Fix handling of function proxies in higher-order array and string methods, 
which use yet another way to determine strict vs non-strict function receivers.

R=kmillikin@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9270004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-20 13:59:37 +00:00
vegorov@chromium.org
704c92ce95 Ensure that LRandom restores rsi after call to the C function on x64. 
R=ulan@chromium.org
BUG=http://crbug.com/110509
TEST=test/mjsunit/regress/regress-110509.js

Review URL: https://chromiumcodereview.appspot.com/9265003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-19 08:43:34 +00:00
yangguo@chromium.org
6d0d6a5695 Recursion limit for one-char string replace and retire String::kMinNonFlatLength. 
TEST=mjsunit/string-replace-one-char.js

Review URL: https://chromiumcodereview.appspot.com/9231017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-17 14:29:17 +00:00
yangguo@chromium.org
ddc0144490 Fixing issue 1898 (using HChange outside the insert-representation-changes phase). 
BUG=v8:1898
TEST=mjsunit/regress/regress-1898.js

Review URL: http://codereview.chromium.org/9190047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-13 07:48:44 +00:00
yangguo@chromium.org
339c9c12e7 Inlining Math.min and Math.max in crankshaft. 
BUG=v8:1325
TEST=

Review URL: http://codereview.chromium.org/9147034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10391 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-11 15:43:33 +00:00
danno@chromium.org
a42da8e38d Correct nits in d8 ArrayBuffer() implementation 
TBR=jkummerow@chromium.org
BUG=none
TEST=external-array.js

Review URL: http://codereview.chromium.org/9185006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10390 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-11 15:10:56 +00:00
danno@chromium.org
6ce13906dc Add primitive WebGL ArrayBuffer() support to d8 
R=jkummerow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/9114050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10389 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-11 14:42:58 +00:00
vegorov@chromium.org
c4d3a110a2 Adjust position recorded for call expressions. 
For calls of the form ident(...) record position of the identifier as the position of the call. For other calls record positions of the opening parenthesis.

This guarantees that for expressions of the form function(){}() call position will not intersect with positions recorded for function literal which is used by the debugger for scope chain resolution.

R=kmillikin@chromium.org
BUG=http://crbug.com/109195
TEST=test/mjsunit/regress/regress-109195.js

Review URL: http://codereview.chromium.org/9125001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-06 10:26:17 +00:00
mstarzinger@chromium.org
e79274abe6 Fix handling of bogus receivers for Harmony collections. 
R=rossberg@chromium.org
BUG=v8:1884
TEST=mjsunit/harmony/collections

Review URL: http://codereview.chromium.org/9074003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-05 12:55:06 +00:00
erik.corry@gmail.com
81a0271004 Randomize the seed used for string hashing. This helps guard against 
CPU-eating DOS attacks against node.js servers.  Based on code from
Bert Belder.  This version only solves the issue for those that compile
V8 themselves or those that do not use snapshots.  A snapshot-based
precompiled V8 will still have predictable string hash codes.
Review URL: http://codereview.chromium.org/9086006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-01-04 15:12:15 +00:00
danno@chromium.org
f648626eb9 Reland 10309: Ensure large Smi-only arrays don't transition to FAST_DOUBLE_ARRAY 
TBR=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9051014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-30 14:28:14 +00:00
danno@chromium.org
5d85a04472 Rollback 10309 
TBR=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8968042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-30 13:42:21 +00:00
danno@chromium.org
dff0e36d2d Ensure large Smi-only arrays don't transition to FAST_DOUBLE_ARRAY 
BUG=v8:1849
TEST=test/mjsunit/regress/regress-1849.js

Review URL: http://codereview.chromium.org/8968028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-30 12:54:23 +00:00
danno@chromium.org
aa38094bf0 Ensure that InternalArrays remain InternalArrays regardless of how they are constructed. 
R=whesse@chromium.org
BUG=v8:1878
TEST=test/mjsunit/regress/regress-1878.js

Review URL: http://codereview.chromium.org/9016041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-27 15:12:12 +00:00
vegorov@chromium.org
3947056c03 Avoid embedding new space objects into code objects in the lithium gap resolver. 
R=danno@chromium.org
BUG=http://crbug.com/108296
TEST=test/mjsunit/regress/regress-108296.js

Review URL: http://codereview.chromium.org/8960004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-23 10:39:01 +00:00
mstarzinger@chromium.org
04f0e33229 Fix handling of foreign callbacks in DefineOwnProperty. 
We use foreign callbacks to make some properties shadow internal values
but still behave as data properties from within JavaScript. This means
when a value is passed to Object.defineProperty() on such a property,
it should update the internal value instead of redefinind the property
and destroying the shadowing.

R=rossberg@chromium.org
BUG=v8:1530
TEST=mjsunit/regress/regress-1530,test262/S15.3.3.1_A4

Review URL: http://codereview.chromium.org/8996008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-20 08:49:51 +00:00
jkummerow@chromium.org
0438c76185 Fix outdated test expectations for array literal crankshafting 
TEST=nosnap builder green

Review URL: http://codereview.chromium.org/8915006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-14 13:32:34 +00:00
jkummerow@chromium.org
106973c3d2 Create missing boilerplate for array literals instead of deoptimizing 
BUG=107370
TEST=new additions to mjsunit/array-literal-transitions

Review URL: http://codereview.chromium.org/8914006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-14 13:01:27 +00:00
yangguo@chromium.org
4cd99d7cb9 Handle external strings in generated code when concatenating short strings. 
TEST=string-external-cached.js

Review URL: http://codereview.chromium.org/8931025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-14 10:32:22 +00:00
fschneider@chromium.org
cf8e2b01e4 Landing forgotten mjsunit test file from previous CL. 
Patch by Fedor Indutny <fedor.indutny@gmail.com>.

Original code review: http://codereview.chromium.org/8857001/
Review URL: http://codereview.chromium.org/8935006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-13 17:13:47 +00:00
jkummerow@chromium.org
91efb313eb Fix crash in d8 when external array ctor hits stack overflow 
BUG=100859
TEST=mjsunit/regress/regress-crbug-100859

Review URL: http://codereview.chromium.org/8898021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-13 13:51:58 +00:00
yangguo@chromium.org
94f9aa3a0d Avoid using an invalid working directory in mjsunit/d8-os. 
This test deleted its working directory and then tried to run several
shell commands which caused a failure on nfs.

Changes:
-TEST_DIR is only removed at the very end of the test
-the working directory is changed to /tmp at the beginning so that
 every iteration (when running with --stress-opt) has a valid working directory

BUG=
TEST=

Review URL: http://codereview.chromium.org/8936004
Patch from Daniel Kalmar <kalmard@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10240 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-13 12:57:33 +00:00
yangguo@chromium.org
a7f0c72e2d Fixing bug introduced in r10210 that crashes v8 raytrace benchmark. 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8889047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10226 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-09 12:11:56 +00:00
yangguo@chromium.org
ce86c1bfb1 Avoid bailing out to runtime for short substrings. 
This significantly improves the speed for creating short substrings (less than 13 characters) from slices, flat cons strings and external strings.

TEST=string-external-cached.js, string-slices.js

Review URL: http://codereview.chromium.org/8889012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-09 10:04:58 +00:00
keuchel@chromium.org
f1649cf39c Hydrogen support for context allocated harmony bindings. 
This CL adds support for loading from and storing to context slots
belonging to harmony let or const bound variables. Checks for the
hole value are performed and the function is deoptimized if they fail.
The full-codegen generated code will take care of properly throwing
a reference error in these cases.

TEST=mjsunit/harmony/block-let-crankshaft.js

Review URL: http://codereview.chromium.org/8820015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10220 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-09 09:50:30 +00:00
danno@chromium.org
ef54f5690f Support Smi->Double->HeapObject transitions in constructed Arrays. 
Also several bugs with Smi/double elements handling and make Ensure* routines more flexible.

BUG=none
TEST=test/mjsunit/array-construct-transition.js

Review URL: http://codereview.chromium.org/8820014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10218 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-09 08:50:19 +00:00
vegorov@chromium.org
a457040ca6 Ensure that non-optimized code objects are not flushed for inlined functions. 
Collector was flushing them if optimized code was reachable only through the stack (not through the JSFunction object) which happens when you have a pending lazy deoptimization.

Also prevent v8::Script::New from leaking internal objects allocated by the compiler into outer HandleScope.

R=kmillikin@chromium.org
BUG=http://crbug.com/97116
TEST=test/mjsunit/regress/regress-97116.js

Review URL: http://codereview.chromium.org/8888011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-08 16:07:07 +00:00
fschneider@chromium.org
c1662a199b Fix a bug with register use in optimized Math.round. 
We're not allowed to modify the input register and have to
use a temporary instead, otherwise the result of expressions
containing Math.round can be wrong.

BUG=106351
TEST=test/mjsunit/compiler/regress-106351.js
Review URL: http://codereview.chromium.org/8833007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-07 10:13:46 +00:00
danno@chromium.org
b5b91b5add Fix nosnap build test failures. 
TBR=jkummerow@chromium.org
BUG=none
TEST=less waterfall redness

Review URL: http://codereview.chromium.org/8828004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10184 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 22:27:15 +00:00
yangguo@chromium.org
e9688608cd Fix presubmit. 
Review URL: http://codereview.chromium.org/8821016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10178 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 13:30:22 +00:00
yangguo@chromium.org
72827079ac Fixing mozilla test failures regarding Math.pow. 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8820011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 13:14:46 +00:00
keuchel@chromium.org
8b34f4630b Hydrogen support for stack local harmony bindings in function scope. 
This is the first CL in a series that add support for the harmony scoping
features to crankshaft. This CL specifically adds support for stack
allocated 'let' and 'const' declared variables in function scopes.

TEST=mjsunit/harmony/block-let-crankshaft.js

Review URL: http://codereview.chromium.org/8806012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10171 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 09:41:06 +00:00
yangguo@chromium.org
8e6655c676 Stop skipping regress-397.js 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8804013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 09:20:55 +00:00
yangguo@chromium.org
fe2049fcb8 Fixing fix for MathPowHalf on ARM. 
Review URL: http://codereview.chromium.org/8817012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 09:20:00 +00:00
yangguo@chromium.org
b37ee7bcce Fixing MathPowHalf on ARM. 
BUG=v8:397
TEST=regress-397.js

Review URL: http://codereview.chromium.org/8800009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-06 08:28:12 +00:00
keuchel@chromium.org
08b4262512 Statically check for assignments to const in harmony mode. 
The ES.next draft rev 4 in section 11.13 reads:
It is a Syntax Error if the AssignmentExpression is contained in extended code
and the LeftHandSideExpression is an Identifier that does not statically resolve
to a declarative environment record binding or if the resolved binding is an
immutable binding.

This CL adds corresponding static checks for the immutable binding case.

TEST=mjsunit/harmony/block-const-assign

Review URL: http://codereview.chromium.org/8688007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10156 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-05 14:43:28 +00:00
mstarzinger@chromium.org
993d650f15 MIPS: updated test .status files based mostly on the ARM version. 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8572032
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10155 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-05 11:44:17 +00:00
yangguo@chromium.org
c0e7884752 Temporarily disable regress-397 until fix has been ported to all platforms. 
Review URL: http://codereview.chromium.org/8775051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-02 13:42:51 +00:00
yangguo@chromium.org
929c619101 Quickfix for DoMathPowHalf. 
TEST=regress-397.js

Review URL: http://codereview.chromium.org/8769037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-02 13:16:49 +00:00
danno@chromium.org
25e3d2706d Optimize Crankshaft array literal initialization from boilerplate. 
BUG=none
TEST=test/mjsunit/array-literal-transitions.js

Review URL: http://codereview.chromium.org/8747009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-02 12:42:35 +00:00
yangguo@chromium.org
d5fdb76028 Implement Math.pow using FPU instructions and inline it in crankshaft (ia32). 
Review URL: http://codereview.chromium.org/8749002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-12-02 08:06:37 +00:00
sgjesse@chromium.org
5ccdb3b692 Fix handling of recompiling code for optimized and inlined functions 
The debugger preparation did not take optimized functions - including
inlined function into account. This caused the full-code used for
deoptimization to be the "lazy compile" builtin which did not work and
caused V8 to crash.

R=yangguo@chromium.org

BUG=chromium:105375, v8:1782
TEST=test/mjsunit/debug-break-inline.js

Review URL: http://codereview.chromium.org//8728031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-30 11:48:35 +00:00
keuchel@chromium.org
b3a2e242db Reapply "Fix the ScopeIterator reimplementation". 
This reapplies a fixed version of r10076 that also works on arm. Patch set one is r10076 reapplied and patch set 2 contains the new fix.

Review URL: http://codereview.chromium.org/8725001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10080 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-29 08:43:14 +00:00
keuchel@chromium.org
e26093f3d8 Make let/const outside of the extended mode early errors (under harmony flag). 
The ES.next drafts require that source code that matches the productions for
let and const bindings outside the extended mode trigger early syntax
errors. This CL adapts the parser / preparser accordingly under the harmony
scoping flag.

Summary:
* Harmony scoping flag not set: Old semantics allowing const in classic mode
with function level scope. Const binding in strict mode and let bindings in
classic and strict mode trigger early syntax errors.
* Harmony scoping is set: Use new harmony const and let in
extended mode and old const in classic mode. This is to preserve
compatibility with current web pages that already use
non-standard implementations of const. An early syntax error is
thrown on const in strict mode and on let in classic and strict
mode.

This depends on:
http://codereview.chromium.org/8562002/

TEST=mjsunit/harmony/block-early-errors.js

Review URL: http://codereview.chromium.org/8564001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10079 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-29 06:38:04 +00:00
keuchel@chromium.org
9664e48e14 Revert r10076 due to arm build failures. 
Review URL: http://codereview.chromium.org/8716005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-28 14:01:13 +00:00
keuchel@chromium.org
8866d63cc9 The ScopeIterator uses recorded scope position - as detailed in scopes.h - and 
source code positions it gets from the program counter to recreate the scope
chain by reparsing the function or program.

This CL includes the following changes
* Adds source code positions for the assignment added by the rewriter.
* Run the preparser over global code first.
* Use the ScopeType from the ScopeInfo to determine if the code being debugged
  is eval, function or global code instead of looking up the '.result' symbol.

TEST=mjsunit/debug-stepout-scope.js

Review URL: http://codereview.chromium.org/8590027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-28 12:47:39 +00:00
lrn@chromium.org
c7fccff9af Clean up JavaScript files to better follow coding standard. 
Multiline conditionals must use braces.
Semicolons are not optional.

Review URL: http://codereview.chromium.org/8701006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-28 12:11:00 +00:00
mstarzinger@chromium.org
ad356bd5ad Skip test for known failure tracked by issue 1845. 
R=keuchel@chromium.org
BUG=v8:1845
TEST=mjsunit/harmony/proxies-example-membrane

Review URL: http://codereview.chromium.org/8698017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-28 11:58:53 +00:00
yangguo@chromium.org
d542a2fb75 Add external strings support to regexp in generated code. 
TEST=test/mjsunit/string-external-cached.js

Review URL: http://codereview.chromium.org/8680010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-25 14:04:47 +00:00
lrn@chromium.org
ebccde15bc Don't preparse large files to find boundaries of lazy functions. 
Instead use the preparser inline to parse only the lazy function
bodies.

This is still disabled for small files.
More measurements are needed to determine if lazy-compiling small
sources is worth it.

Review URL: http://codereview.chromium.org/8662037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-25 09:36:31 +00:00
keuchel@chromium.org
1e9a7267ab Introduce extended mode. 
This CL introduces a third mode next to the non-strict
(henceforth called 'classic mode') and 'strict mode'
which is called 'extended mode' as in the current
ES.next specification drafts. The extended mode is based on
the 'strict mode' and adds new functionality to it. This
means that most of the semantics of these two modes
coincide.

The 'extended mode' is entered instead of the 'strict mode'
during parsing when using the 'strict mode' directive
"use strict" and when the the harmony-scoping flag is
active. This should be changed once it is fully specified how the 'extended mode' is entered.

This change introduces a new 3 valued enum LanguageMode
(see globals.h) corresponding to the modes which is mostly
used by the frontend code. This includes the following
components:
* (Pre)Parser
* Compiler
* SharedFunctionInfo, Scope and ScopeInfo
* runtime functions: StoreContextSlot,
  ResolvePossiblyDirectEval, InitializeVarGlobal,
  DeclareGlobals

The old enum StrictModeFlag is still used in the backend
when the distinction between the 'strict mode' and the 'extended mode' does not matter. This includes:
* SetProperty runtime function, Delete builtin
* StoreIC and KeyedStoreIC
* StubCache

Review URL: http://codereview.chromium.org/8417035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10062 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-24 15:17:04 +00:00
yangguo@chromium.org
2055f4195e Recommit introducing short external strings. 
Review URL: http://codereview.chromium.org/8677006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-23 13:08:28 +00:00
yangguo@chromium.org
922aee5a02 Rolling back r10049 due to webkit failures. 
Review URL: http://codereview.chromium.org/8681007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-23 10:41:12 +00:00
yangguo@chromium.org
21edc7c30b Introduce short external strings without pointer cache. 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8635011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10049 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-23 09:58:58 +00:00
yangguo@chromium.org
5a82d78948 Add pointer cache field to external string for access in generated code. 
TEST=test/mjsunit/string-externalize.js

Review URL: http://codereview.chromium.org/8513010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-17 17:05:12 +00:00
fschneider@chromium.org
8fbf1d5017 Landing: [hydrogen] optimize switch with string clauses. Patch by Fedor Indutny <fedor.indutny@gmail.com>. 
Original code review: http://codereview.chromium.org/8373029/
Review URL: http://codereview.chromium.org/8589019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10019 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-17 13:57:55 +00:00
fschneider@chromium.org
8480569467 Fix lazy deoptimization at HInvokeFunction and enable target-recording call-function stub. 
Changes the way we do lazy deoptimization:

1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.

     CALL
     GAP
     LAZY-BAILOUT ==> lazy-deopt-call

2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.

   STACK-CHECK
   GAP ==> lazy-deopt-call

The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.

Additional changes:
 * RegExpLiteral marked it as having side-effects so that it 
   gets an explicitlazy-bailout instruction (instead of
   treating it specially like stack-checks)
 * Enable target recording CallFunctionStub to achieve
   more inlining on optimized code.

BUG=v8:1789
TEST=jslint and uglify run without crashing, mjsunit/compiler/regress-lazy-deopt.js
Review URL: http://codereview.chromium.org/8492004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-16 08:44:30 +00:00
mstarzinger@chromium.org
330cd2205c Remove hidden prototype for builtin functions. 
This is a deliberate non-conformity introduced more than 2 years ago to
be compatible with JSC. The current state is that all other browsers
perform ES5 conform in that regard.

R=erik.corry@gmail.com
BUG=chromium:1717,chromium:39662
TEST=test262/15.2.3.6-4-6??,mjsunit/undeletable-functions

Review URL: http://codereview.chromium.org/8566009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-15 09:44:57 +00:00
fschneider@chromium.org
c48f928480 Speedup unit test to avoid timeout on slow ARM simulator. 
This test depends on OSR being triggered. That's why I can't
use %OptimizeFunctionOnNextCall.
Review URL: http://codereview.chromium.org/8555004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-14 12:33:44 +00:00
rossberg@chromium.org
a9c1b834f8 A more holistic test case for proxies. 
Depends on http://codereview.chromium.org/8318014/

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8392038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-10 16:24:43 +00:00
rossberg@chromium.org
830763bda4 Fixing test cases for correct assertSame. 
Leaving out derived construct trap for now, which I'm working on separately.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8506020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9960 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-10 15:48:07 +00:00
rossberg@chromium.org
8caa6eb732 Fix instanceof a function proxy. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8520001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9954 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-10 13:39:22 +00:00
yangguo@chromium.org
6157562994 Simplify StringCharCodeAt in non-crankshaft codegen. 
TEST=test/mjsunit/string-slices.js

Review URL: http://codereview.chromium.org/8510005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-09 14:32:51 +00:00
yangguo@chromium.org
53c6077cee Fixing issue 103259. 
BUG=103259
TEST=regress-103259.js

Review URL: http://codereview.chromium.org/8498011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-08 14:59:40 +00:00
rossberg@chromium.org
f936aac43e Make _CallFunction proxy-aware. 
Change calling convention for CallFunction stub.
Some fixes regarding strict mode call traps.

R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8318014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9916 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-08 14:39:37 +00:00
keuchel@chromium.org
72dba271eb Reapply r9870 "Remove some initialization checks based on source positions.". 
This reverts r9896 "Revert r9870 due to browser-test failures." See below for
the diff from the previous version for the ia32 platform. The code for other
platforms has been changed accordingly.

TEST=mjsunit/compiler/lazy-const-lookup.js

diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index 2cbf518..1990f2f 100644
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -1258,13 +1258,17 @@ void FullCodeGenerator::EmitVariableLoad(VariableProxy* proxy) {
         // binding is initialized:
         //   function() { f(); let x = 1; function f() { x = 2; } }
         //
-        // Check that we always have valid source position.
-        ASSERT(var->initializer_position() != RelocInfo::kNoPosition);
-        ASSERT(proxy->position() != RelocInfo::kNoPosition);
-        bool skip_init_check =
-            var->mode() != CONST &&
-            var->scope()->DeclarationScope() == scope()->DeclarationScope() &&
-            var->initializer_position() < proxy->position();
+        bool skip_init_check;
+        if (var->scope()->DeclarationScope() != scope()->DeclarationScope()) {
+          skip_init_check = false;
+        } else {
+          // Check that we always have valid source position.
+          ASSERT(var->initializer_position() != RelocInfo::kNoPosition);
+          ASSERT(proxy->position() != RelocInfo::kNoPosition);
+          skip_init_check = var->mode() != CONST &&
+              var->initializer_position() < proxy->position();
+        }
+
         if (!skip_init_check) {
           // Let and const need a read barrier.
           Label done;

Review URL: http://codereview.chromium.org/8479034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-08 13:28:53 +00:00
fschneider@chromium.org
4627023b38 Revert r9901 to make tree green again. 
There was a test failure on x64 mozilla tests.

TBR=ricow@chromium.org
Review URL: http://codereview.chromium.org/8495011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-08 09:56:09 +00:00
fschneider@chromium.org
cac3008437 [hydrogen] optimize switch with string clauses 
Hydrogen should optimize not only SMI clauses, but clauses with string literals
too.

Patch from fedor.indutny <fedor.indutny@gmail.com>.

R=vegorov@chromium.org
BUG=
TEST=
Review URL: http://codereview.chromium.org/8373029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-08 09:08:33 +00:00
jkummerow@chromium.org
9625d5d4a0 Fix Array.{splice,slice} to set proper ElementsKind of result 
TEST=mjsunit/elements-kind.js

Review URL: http://codereview.chromium.org/8430036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-04 12:47:58 +00:00
jkummerow@chromium.org
f2787a42b0 Fix JSObject::EnsureCanContainElements to correctly iterate over Arguments 
TEST=mjsunit/elements-kind.js

Review URL: http://codereview.chromium.org/8437094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-04 12:31:44 +00:00
jkummerow@chromium.org
8450c60d47 Fix Runtime_ArrayConcat to handle FAST_DOUBLE_ELEMENTS 
TEST=mjsunit/elements-kind.js; stanford-crypto-sha256-iterative in debug mode

Review URL: http://codereview.chromium.org/8334028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-04 12:19:35 +00:00
mstarzinger@chromium.org
0bbfb46aa6 Fix Harmony sets and maps to allow undefined as keys. 
This uses a global sentinel as a replacement for undefined keys, which
are not supported internally but required for Harmony sets and maps.

R=rossberg@chromium.org
BUG=v8:1622
TEST=mjsunit/harmony/collections

Review URL: http://codereview.chromium.org/8439069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-03 14:33:58 +00:00
mstarzinger@chromium.org
79cadcc947 Fix Harmony sets and maps to allow null as key. 
This changes the internal convention for marking deleted entries in hash
tables from null_value to the_hole_value, which is consistent with other
usages of the_hole.

R=rossberg@chromium.org,kmillikin@chromium.org
BUG=v8:1622
TEST=mjsunit/harmony/collections

Review URL: http://codereview.chromium.org/8343056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9871 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-11-03 14:17:05 +00:00
danno@chromium.org
0766a138a6 Add and use ElementsKind side effect 
Also partition side effects into observable and not observable, with only observable requiring Simulates and non-observable changes able to participate in GVN and code hoisting.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8380017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-31 14:15:10 +00:00
mstarzinger@chromium.org
358d7c2078 Adapt date test to be timezone independant. 
R=yangguo@chromium.org
BUG=v8:1792
TEST=mjsunit/date

Review URL: http://codereview.chromium.org/8423004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-31 11:15:23 +00:00
lrn@chromium.org
30465596e6 Make eval consider anything on the form eval(args...) a potential direct cal 
Previously we omitted all cases where the global eval property was shadowed,
even if by a variable holding the same value. ES5 requires us to treat these
as direct calls.

We still throw if calling indirect eval with a detached global object.

BUG=v8:994
TEST=mjsunit/eval.js

Review URL: http://codereview.chromium.org/8343054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-31 09:38:52 +00:00
danno@chromium.org
6d7d6d4e4e Force transition to FAST_ELEMENTS on out-of-bounds KeyedLoads. 
Proactively ensure that that objects don't get FAST_DOUBLE_ELEMENTS to reduce the number of double boxing operations when generated code calls the runtime frequently to satisfy KeyedLoad requests.

Review URL: http://codereview.chromium.org/8416014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-28 10:35:38 +00:00
mstarzinger@chromium.org
6d950a748f Fix assertSame for unit testing harness. 
Using isNaN() here is bogus because it performs an implicit toNumber()
conversion, hence something like assertSame(undefined, {}) would not
throw an exception. These are not the NaNs you are looking for.

R=rossberg@chromium.org
TEST=mjsunit

Review URL: http://codereview.chromium.org/8400056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-28 09:09:51 +00:00
mstarzinger@chromium.org
cd9bc6c3a6 Fix error handling in Date.prototype.toISOString. 
This fixes Date.prototyoe.toISOString to throw a RangeError exception
for invalid time values. It also includes a fix to removes the arbitrary
(and completely bogus) range limit on the date value during construction
of a Date object. Note that we still have bogus range limits on the year
and month values.

R=lrn@chromium.org
BUG=v8:1792
TEST=mjsunit/date,test262/15.9.5.43-0-*

Review URL: http://codereview.chromium.org/8392036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-28 08:45:04 +00:00
fschneider@chromium.org
a5b40e27b8 Revert r9805. 
It did not fix the original problem, but instead introduced new ones.

R=vegorov@chromium.org
Review URL: http://codereview.chromium.org/8404037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-27 12:12:53 +00:00
ricow@chromium.org
d9597f0086 Skip live edit debug tests, these are flaky because in the case of osr we will get wrong frame heights. 
Review URL: http://codereview.chromium.org/8401029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-27 07:10:25 +00:00
lrn@chromium.org
a9edfefa58 Remove special-casing of calls to RegExp test and exec methods with no argument. 
Matches new JSC behavior. Fix issue 75740.

BUG=75740
TEST=mjsunit/regexp-static

Review URL: http://codereview.chromium.org/6677020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9804 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-26 12:51:07 +00:00
mstarzinger@chromium.org
5a33ffd7e8 Fix Error.prototype.toString to be ES5 conform. 
R=lrn@chromium.org
TEST=test262/15.11.4.4-8-1,mjsunit/error-tostring

Review URL: http://codereview.chromium.org/8341021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-26 10:41:52 +00:00
fschneider@chromium.org
2d4bb1803d Fix bug in inlining call-as-function when inlining multiple levels deep. 
This change fixes a off-by-one level error when dropping the
function from the environment. The function of the outermost
environment was not dropped.

BUG=v8:1785
TEST=test/mjsunit/compiler/regress-inline-callfunctionstub.js
Review URL: http://codereview.chromium.org/8341019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-26 10:31:06 +00:00
rossberg@chromium.org
f7d56eb602 Handle proxies in KeyedStoreIC::Store, instead of just ignoring them. 
R=mstarzinger@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/8391005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-26 09:31:40 +00:00
fschneider@chromium.org
f8f8c672b6 Temporarily skip failing test to make sure builders cycle green. 
R=mstarzinger@chromium.org
Review URL: http://codereview.chromium.org/8393005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9779 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-25 16:11:53 +00:00
vegorov@chromium.org
f8c2d3847f Take loop side-effects into account when collecting side-effects on the path between two blocks. 
R=fschneider@chromium.org
BUG=100409
TEST=test/mjsunit/regress/regress-100409.js

Review URL: http://codereview.chromium.org/8395002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-25 15:39:55 +00:00
mstarzinger@chromium.org
622d35dc0e Implement Harmony sets and maps. 
This implementation extends the internal ObjectHashTable to be able to
hold arbitrary objects (e.g. Smis, Strings, ...) as keys by applying
specialized hashing functions to primitive types. Equality of keys is
defined using the internal SameValue function.

R=rossberg@chromium.org
BUG=v8:1622
TEST=mjsunit/harmony/collections

Review URL: http://codereview.chromium.org/8372027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-25 14:14:56 +00:00
keuchel@chromium.org
e8bccc2cb0 Block scoped const variables. 
This implements block scoped 'const' declared variables in harmony mode. They
have a temporal dead zone semantics similar to 'let' bindings, i.e. accessing
uninitialized 'const' bindings in throws a ReferenceError.

As for 'let' bindings, the semantics of 'const' bindings in global scope is not
correctly implemented yet. Furthermore assignments to 'const's are silently
ignored. Another CL will introduce treatment of those assignments as early
errors.

Review URL: http://codereview.chromium.org/7992005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-25 08:33:08 +00:00
rossberg@chromium.org
46dde044de Adapt to latest spec changes for Proxy.create[Function]. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8271005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-24 16:25:30 +00:00
rossberg@chromium.org
70dc2fe968 Implement for-in loop for proxies. 
Fix related corner case for Object.keys.
Remove obsolete GET_KEYS builtin.

R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8256015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-24 15:56:18 +00:00
yangguo@chromium.org
f92da58e13 Handle COW-arrays correctly when converting smi->double fast elements. 
TEST=mjsunit/elements-transition.js

Review URL: http://codereview.chromium.org/8383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-24 15:06:20 +00:00
fschneider@chromium.org
53e7502fa0 Fix bug in environment simulation after inlined call-as-function. 
This change is based on my previous change enabling inlining calls-as-function
fixing the bugs related to deoptimization.

The function value on top of the environment was dropped too late in the old code.
As a result we could get a wrong value on top after deoptimization.

This change includes r9619. It was reverted because of test failures that are fixed
with this patch.
Review URL: http://codereview.chromium.org/8360001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-24 13:53:08 +00:00
keuchel@chromium.org
c6464d500b Replace boolean indications of strict mode by an enum value. 
Review URL: http://codereview.chromium.org/8344082

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-24 07:47:22 +00:00
keuchel@chromium.org
666c4be29f Reapply r9673 "Scope tree serialization and ScopeIterator cleanup." 
This also includes the two fixes from r9674 and r9675. Here's the diff
to the previous CL.

 --- a/src/runtime.cc
 +++ b/src/runtime.cc
 @@ -11133,17 +11133,26 @@ class ScopeIterator {
        context_(Context::cast(frame->context())),
        nested_scope_chain_(4) {

 +    // Catch the case when the debugger stops in an internal function.
 +    Handle<SharedFunctionInfo> shared_info(function_->shared());
 +    if (shared_info->script() == isolate->heap()->undefined_value()) {
 +      if (shared_info->scope_info()->HasContext()) Next();
 +      return;
 +    }
 +
      // Check whether we are in global code or function code. If there is a stack
      // slot for .result then this function has been created for evaluating
      // global code and it is not a real function.
      // Checking for the existence of .result seems fragile, but the scope info
      // saved with the code object does not otherwise have that information.
 -    int index = function_->shared()->scope_info()->
 +    int index = shared_info->scope_info()->
          StackSlotIndex(isolate_->heap()->result_symbol());

      // Reparse the code and analyze the scopes.
      ZoneScope zone_scope(isolate, DELETE_ON_EXIT);
 -    Handle<SharedFunctionInfo> shared_info(function_->shared());
      Handle<Script> script(Script::cast(shared_info->script()));
      Scope* scope;
      if (index >= 0) {

Review URL: http://codereview.chromium.org/8344046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-21 10:26:59 +00:00
lrn@chromium.org
a47caee095 Make builtin functions be skipped in stack traces. 
Does include exposed builtin functions ("native functions").

Review URL: http://codereview.chromium.org/8345039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-20 12:31:33 +00:00
mstarzinger@chromium.org
67c9a03922 Fix handling Function.apply for non-array arguments. 
R=rossberg@chromium.org
TEST=mjsunit/apply,test262

Review URL: http://codereview.chromium.org/8342034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 13:56:18 +00:00
sgjesse@chromium.org
663bc0fb78 Temporarily skip asserts in test mjsunit/debug-step-3.js until issue is resolved 
R=kmillikin@chromium.org

BUG=v8:1782
TEST=mjsunit/debug-step-3.js

Review URL: http://codereview.chromium.org//8356001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 13:47:53 +00:00
jkummerow@chromium.org
439e4600df Adjust elements-kind.js expectation when --smi-only-arrays is off 
TEST=mjsunit/elements-kind passes both with and without --smi-only-arrays flag

Review URL: http://codereview.chromium.org/8356002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 12:44:50 +00:00
yangguo@chromium.org
372c16161c Optimize fast element conversion in arm using batch store/loads. 
Review URL: http://codereview.chromium.org/8353002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 12:15:15 +00:00
keuchel@chromium.org
17cc6d313f Revert 9673, 9674 and 9675 because of failing webkit tests. 
This reverts commits
r9673: "Scope tree serialization and ScopeIterator cleanup."
r9674: "Use OS::SNPrintF instead of snprintf."
r9675: "Use int instead of size_t, StrLength instead of strlen."

Review URL: http://codereview.chromium.org/8353003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 12:15:02 +00:00
jkummerow@chromium.org
3a9d6c04ba Introduce HTransitionElementsKind instruction. 
TEST=mjsunit/elements-kind

Review URL: http://codereview.chromium.org/8305001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 12:10:18 +00:00
danno@chromium.org
e5f23399b4 Support array literals with FAST_DOUBLE_ELEMENTS ElementsKind. 
BUG=none
TEST=test/mjsunit/array-literal.js

Review URL: http://codereview.chromium.org/8258015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 11:36:55 +00:00
svenpanne@chromium.org
d0fe04447e Fixed evaluation order issue in defineProperties. 
This is not covered by test262 yet, but it really makes sense and matches Firefox's behaviour.

TEST=mjsunit/define-properties.js
Review URL: http://codereview.chromium.org/8349031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 09:52:08 +00:00
mstarzinger@chromium.org
b3eba9e764 Fix handling of non-object receivers for array builtins. 
R=svenpanne@chromium.org
BUG=chromium:100702
TEST=mjsunit/regress/regress-100702

Review URL: http://codereview.chromium.org/8347034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 09:24:37 +00:00
yangguo@chromium.org
8472de004b Porting r9605 to arm (elements kind conversion in generated code). 
Review URL: http://codereview.chromium.org/8329022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 09:04:35 +00:00
svenpanne@chromium.org
140ae348d2 Recognize special comparisons via pattern matching on the hydrogen graph, 2nd attempt. 
This time, we initially leave the HTypeof instruction in the Hydrogen graph,
even for the special cases. We later try to remove this instruction (and any
HConstant) in the canonicalization pass, if possible. Always removing the
HTypeof during the initial graph construction is wrong if e.g. it is used in an
HSimulate.

The removals can be generalized a bit, but this will happen in a separate CL.

TEST=mjsunit/optimized-typeof.js
Review URL: http://codereview.chromium.org/8334021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-19 07:35:30 +00:00
sgjesse@chromium.org
a58c963c67 Reapply "Support for precise stepping in functions compiled before debugging was started (step 2)" 
This is reapplying r9501 with this single change which seemed to be causing most (all) of the failures for r9501.

--- a/src/debug.cc
+++ b/src/debug.cc
@@ -2230,6 +2230,7 @@ Debugger::Debugger(Isolate* isolate)
       compiling_natives_(false),
       is_loading_debugger_(false),
       never_unload_debugger_(false),
+      force_debugger_active_(true),
       message_handler_(NULL),
       debugger_unload_pending_(false),
       host_dispatch_handler_(NULL),

R=kmillikin@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//8337009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-18 13:40:33 +00:00
lrn@chromium.org
cefbb1e7f8 Make bound functions have poisoned .caller and .arguments. 
Also makes func.caller return null if the caller is a bound function,
matching JSC.
Fix bug preventing poisoned setters from triggering.

TEST=mjsunit/function-bind, mjsunit/strict-mode

Review URL: http://codereview.chromium.org/8333019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-18 12:26:53 +00:00
keuchel@chromium.org
4e5643a648 Scope tree serialization and ScopeIterator cleanup. 
The intention is to store enough scope information for the debugger to
handle stack allocation of block scoped variables introduced by
http://codereview.chromium.org/7860045/ .

This CL is based on
http://codereview.chromium.org/7904008/ .

Review URL: http://codereview.chromium.org/7979001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-18 08:46:46 +00:00
yangguo@chromium.org
d7f3985e33 Rolling back r9662. 
Review URL: http://codereview.chromium.org/8321001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 13:39:56 +00:00
yangguo@chromium.org
d2434953e2 Changes around ascii-check for strings wrt external strings. 
Review URL: http://codereview.chromium.org/8312015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9662 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 12:49:34 +00:00
lrn@chromium.org
5152d2e0da Reimplement Function.prototype.bind. 
Make instanceof work correctly.

BUG=v8:893

Review URL: http://codereview.chromium.org/8199004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 12:44:16 +00:00
keuchel@chromium.org
6f4e70a1dc Let bound iteration variables in for-loops 
TEST=mjsunit/harmony/block-for.js

Review URL: http://codereview.chromium.org/7837028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 12:19:06 +00:00
keuchel@chromium.org
f93c69308f Disallow function declarations in statement positions in harmony mode. 
Review URL: http://codereview.chromium.org/8306025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 11:59:08 +00:00
yangguo@chromium.org
92fdeff125 Porting r9605 to x64 (elements kind conversion in generated code). 
Review URL: http://codereview.chromium.org/8271007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 10:44:47 +00:00
lrn@chromium.org
50ef25e0f3 Remove redundant allow-natives flag from CompilationInfo. 
Just use script being native and FLAG_allow_natives_syntax directly.

Review URL: http://codereview.chromium.org/8314018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9643 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 09:02:26 +00:00
mstarzinger@chromium.org
ac712f13c3 Fix evaluation order of GT and LTE operators. 
According to the ES5 spec all ">" and "<=" expressions should be be
evaluated left-to-right. This obsoletes old hacks for reversing the
order to be ES3 compliant.

R=lrn@chromium.org
BUG=v8:1752

Review URL: http://codereview.chromium.org/8275035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9641 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-17 07:43:40 +00:00
rossberg@chromium.org
4753976194 Fix handling of this in direct calls to function proxies. 
Fix & tweak some proxy-related error messages.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/8229008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-13 15:55:57 +00:00
yangguo@chromium.org
00a5287d2f Fixing test failures in arm and x64 due to missing implementation introduced in r9605. 
Review URL: http://codereview.chromium.org/8261007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-13 12:03:33 +00:00
yangguo@chromium.org
fae807b3bb Elements kind conversion in generated code (ia32). 
BUG=
TEST=

Review URL: http://codereview.chromium.org/8241003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9605 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-13 10:53:31 +00:00
rossberg@chromium.org
1abf3ed0a4 Introduce collective --harmony flag. 
Shorten --harmony-block-scoping to --harmony-scoping.

R=keuchel@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8226017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-12 12:23:06 +00:00
jkummerow@chromium.org
ddacdf847b Make elements_kind map transition test conditional on smi element support 
TEST=mjsunit/element-kind passes even without --smi-only-arrays

Review URL: http://codereview.chromium.org/8230008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9578 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-11 10:02:42 +00:00
jkummerow@chromium.org
184fdcf28b Track elements_kind transitions in KeyedStoreICs. 
Review URL: http://codereview.chromium.org/8166017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9577 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-11 09:33:00 +00:00
yangguo@chromium.org
3249530ef0 Fixing issue 1757 (string slices of external strings). 
BUG=v8:1757
TEST=regress-1757.js

Review URL: http://codereview.chromium.org/8217011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-10 16:09:03 +00:00
kmillikin@chromium.org
fa18fdb206 Add a regression test for an already fixed issue. 
Add a regression test for Chromium issue 99167.

R=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8222002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-10 10:46:27 +00:00
rossberg@chromium.org
357b45dea5 Tests for evil side-effects during 'internal methods'. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8200002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9558 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-10 09:59:03 +00:00
rossberg@chromium.org
8898b97dc4 Separate tests specific to function proxies in a separate file. 
R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8218003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-10 08:58:44 +00:00
keuchel@chromium.org
80048c14b1 Fix load of potentially eval-shadowed let bindings. 
BUG=
TEST=test/mjsunit/harmony/block-let-semantics.js

Review URL: http://codereview.chromium.org/8118032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-06 15:24:20 +00:00
rossberg@chromium.org
ebf6cb7150 Use correct trap for lookup in prototype proxy. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8133023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-06 08:42:10 +00:00
lrn@chromium.org
9f73eed45f Fix issue 1361 - Implement ES5 Array.prototype.toString. 
BUG=v8:1361
TEST=mjsunit/array-tostring

Review URL: http://codereview.chromium.org/8124025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-05 07:08:23 +00:00
mstarzinger@chromium.org
c034518442 Fix preparation for sorting of external arrays. 
R=rossberg@chromium.org
BUG=98773
TEST=mjsunit/regress/regress-98773

Review URL: http://codereview.chromium.org/8122020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 13:49:50 +00:00
lrn@chromium.org
4750f0c3cd Fix issue 1415 - allow surrogate pair codes in decodeURIComponent. 
Also some cleanup of uri.js.

BUG=v8:1415
TEST=mjsunit/regress/regress-1415

Review URL: http://codereview.chromium.org/8118004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-04 07:15:07 +00:00
lrn@chromium.org
4b385d7e8e Fix bug in x64 RegExp detecting start of string. 
Also add missing MIPS case in regexp tracer.

Fixes issues v8:1748 and v8:1746

BUG=v8:1748, v8:1746
TEST=mjsunit/regress/regress-1748.js

Review URL: http://codereview.chromium.org/8116001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-03 10:31:01 +00:00
lrn@chromium.org
165e105ec9 Check enumerability of array indices correctly in propertyIsEnumerable. 
Fix issue 1692.

BUG=v8:1692
TEST=mjsunit/regress/regress-1692

Review URL: http://codereview.chromium.org/8113001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-03 09:15:58 +00:00
sgjesse@chromium.org
08a85de703 Revert "Support for precise stepping in functions compiled before debugging was started (step 2)" 
TBR=kmillikin@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//8101011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9502 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-01 08:47:12 +00:00
sgjesse@chromium.org
b2ebc91f5c Reapply "Support for precise stepping in functions compiled before debugging was started (step 2)" 
This is to get a clean run in the buildbot.

TBR=kmillikin@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//8098020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-10-01 05:39:14 +00:00
sgjesse@chromium.org
083275715a Revert "Support for precise stepping in functions compiled before debugging was started (step 2)" 
This reverts commits r9499, r9497 and r9489.

Then changed caused a number of failures.

TBR=kmillikin@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//8086020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-30 13:27:38 +00:00
sgjesse@chromium.org
de7b222e36 Support for precise stepping in functions compiled before debugging was started (step 2) 
This change will ensure that full code with debug break slots is compiled and activated for all functions which already have activation frames.

This additional handling is only for functions which have activations on the stack, and that activation is of the full code compiled without debug break slots. In that case the full code is recompiled with debug break slots. It is ensured that the full code is compiled generating the exact same instructions - except for the additional debug break slots - as before. The return address on the stack is then patched to continue execution in the new code.

Also fixed SortedListBSearch to actually use the passed comparision function.

R=svenpanne@chromium.org, kmillikin@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org//8050010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-30 08:39:56 +00:00
yangguo@chromium.org
008f7ab302 Enable --smi-only-arrays flag in test case for no-snapshot build. 
TEST=element-kind.js

Review URL: http://codereview.chromium.org/8077008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-29 14:00:53 +00:00
vegorov@chromium.org
1a0423b54f Fix leakage of virtual address space on Linux platform. 
Ensure that unmap return values are checked in debug mode.

R=erik.corry@gmail.com
BUG=v8:1701

Review URL: http://codereview.chromium.org/8060052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-29 12:23:05 +00:00
erik.corry@gmail.com
4d062f6ea5 Disable array-join test. We know it is flaky and it is 
making it hard to see other failures on the build bot.
Review URL: http://codereview.chromium.org/8036018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-28 13:29:00 +00:00
jkummerow@chromium.org
0455aadbeb Add Crankshaft support for smi-only elements 
Review URL: http://codereview.chromium.org/8002019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 12:09:04 +00:00
vegorov@chromium.org
6dee868e03 Enable compaction, disable code-compaction. 
Enable array-join test again.

R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8043022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9425 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 11:46:16 +00:00
lrn@chromium.org
b9d39c48b8 Make the RegExp.prototype object be a RegExp object. 
BUG=v8:1217
TEST=mjsunit/regress/regress-1217

Review URL: http://codereview.chromium.org/8041015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9419 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-26 08:42:01 +00:00
yangguo@chromium.org
65b1ea22fe Porting r9392 to x64 (smi-only arrays). 
Review URL: http://codereview.chromium.org/7992003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-23 14:19:04 +00:00
rossberg@chromium.org
3df2602037 Handle function proxies as getters/setters. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7849021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 17:12:41 +00:00
ricow@chromium.org
e4c90dc958 GC Cleanup + Set max old generation size to 700MB on ia32 and max executable size to 128 MB (on ia32) 
Review URL: http://codereview.chromium.org/7993003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 17:10:40 +00:00
vegorov@chromium.org
bfd048173f Notify collector about lazily deoptimized code objects. 
All slots that were recorded on these objects during incremental marking should be ignored as they are no longer valid.

To filter such invalidated slots out during slots buffers iteration we set all markbits under the invalidated code object to 1 after the code space was swept and before slots buffers are processed.

R=erik.corry@gmail.com
BUG=v8:1713
TEST=test/mjsunit/regress/regress-1713.js

Review URL: http://codereview.chromium.org/7983045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 16:01:35 +00:00
yangguo@chromium.org
7ab81a14fa Reverting r9399. 
Review URL: http://codereview.chromium.org/7989007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 15:55:44 +00:00
yangguo@chromium.org
0c6863a1ef Set RegExp's prototype to RegExp as specified by ES5. 
BUG=v8:1217
TEST=regress-1217.js

Review URL: http://codereview.chromium.org/7995005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 15:11:12 +00:00
rossberg@chromium.org
d938560d59 Implement identity hashes for proxies. 
R=mstarzinger@chromium.org
BUG=v8:1543,v8:1565
TEST=

Review URL: http://codereview.chromium.org/7754015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 13:54:53 +00:00
mstarzinger@chromium.org
873e4980db Fix transferal of marking bits on array trimming. 
R=vegorov@chromium.org
BUG=v8:1708
TEST=mjsunit/regress/regress-1708

Review URL: http://codereview.chromium.org/7979038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 13:03:22 +00:00
danno@chromium.org
f48c9f6557 Basic support for tracking smi-only arrays on ia32. 
Activated by the flag --smi-only-arrays

Currently not crankshaft support, using flag on non-ia32 platforms will lead to write barrier misses and crashes.

BUG=none
TEST=elements_kind.js

Review URL: http://codereview.chromium.org/7901016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 11:30:04 +00:00
rossberg@chromium.org
e04d0b23a8 Make integer indexed properties ("elements") work for proxies. 
Rehome some Object/JSReceiver/JSObject methods.

R=ricow@chromium.org,kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7795055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 10:45:37 +00:00
yangguo@chromium.org
b7cac76bae Fixed string.split: always convert non-regexp separator to string. 
BUG=v8:1711
TEST=mjsunit/regress/regress-1711.js

Review URL: http://codereview.chromium.org/7976046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9371 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-22 08:18:58 +00:00
rossberg@chromium.org
6c8472bd3a Fix and test use of property descriptor objects. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7828080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 12:45:51 +00:00
keuchel@chromium.org
41eb990afe Fix pre-parsing function declarations. 
The preparser has been out of sync with the parser. As a reminder, we have the
following grammer for harmony mode

 Block ::
   { SourceElement* }
 SourceElement ::
   Statement
   FunctionDeclaration
   LetDeclaration

instead of

 Block ::
   { Statement* }
 SourceElement ::
   Statement
   FunctionDeclaration

The extension to allow FunctionDeclarations in statement positions in
non-strict code is still active.

Review URL: http://codereview.chromium.org/7983006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 12:27:07 +00:00
rossberg@chromium.org
647ad8f500 Fix GC hazard. 
R=jkummerow@chromium.org
BUG=v8:1698
TEST=

Review URL: http://codereview.chromium.org/7977021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 09:58:40 +00:00
erik.corry@gmail.com
14087f430d Disable some tests while we hunt for the reasons behind them. 
Review URL: http://codereview.chromium.org/7978022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-21 07:25:33 +00:00
mstarzinger@chromium.org
3fabe323f2 Add kHeaderSize constant to SeqString. 
This prevents potential misuse of SeqString::kHeaderSize as in the
case of live byte counting in incremental marking stub. All stubs
picked up the undefined size constant SeqString::kHeaderSize, thus
the computed size of all strings was off by two pointers slots.

R=lrn@chromium.org
BUG=v8:1672
TEST=mjsunit/object-seal.js,...

Review URL: http://codereview.chromium.org/7971009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9349 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 16:33:03 +00:00
lrn@chromium.org
610281f4ee Fix calculation of live-bytes in pages. 
The "live bytes" count is *really* a "marked black" count - i.e., the count of bytes *known* to be live.

Fix aggravating bug on X64 where assembler code used a value that was off
by a factor of 2^31.

Ensure that sweeping clears live-bytes. Added other missing increments.

Added print statements to trace live-byte modifications, under a flag.

Still a few cases of undercounting left.

(New issue to merge from GC branch to bleeding_edge)

Review URL: http://codereview.chromium.org/7970009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 11:20:00 +00:00
fschneider@chromium.org
76c869434d Fix a bug with uninitialized const variables in the optimizing compiler. 
We have to check for uninitialized uses before phi-elimination. Otherwise we
may miss such a use and result in using the hole value instead. This
causes a NULL-dereference or assertion failure.

BUG=96989
TEST=mjsunit/compiler/regress-96989.js
Review URL: http://codereview.chromium.org/7974009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 10:26:01 +00:00
yangguo@chromium.org
fdffe67205 Initialize pre-allocated fields of JSObject with undefined. 
BUG=94873

Review URL: http://codereview.chromium.org/7929001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 10:06:23 +00:00
fschneider@chromium.org
403a022272 Skip crashing Harmony proxies unit test until underlying issue is fixed. 
BUG=v8:1698
Review URL: http://codereview.chromium.org/7974006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-20 07:00:59 +00:00
vegorov@chromium.org
ac36cb4504 Merge experimental/gc branch to the bleeding_edge. 
Review URL: http://codereview.chromium.org/7945009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-19 18:36:47 +00:00
rossberg@chromium.org
42f0a73a96 Make proxies work as prototypes. 
Fix a couple of other proxy bugs along the way.
Refactor trap invocation in native code.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7799026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-16 13:38:30 +00:00
rossberg@chromium.org
07469fa5ae Make function proxies work as constructors. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7628021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-16 12:26:29 +00:00
yangguo@chromium.org
3439ab60f7 Correcting a bogus assert outdated since r9295. 
Review URL: http://codereview.chromium.org/7909002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 12:47:06 +00:00
jkummerow@chromium.org
fcc2e65aad Change global const handling to silently ignore redeclarations 
and make window.{Infinity,NaN,undefined} read-only as per ES5

BUG=89490
TEST=mjsunit/const-redecl.js, mjsunit/undeletable-functions.js, es5conform, sputnik

Review URL: http://codereview.chromium.org/7811015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 12:00:30 +00:00
yangguo@chromium.org
327eb48ce6 Enable slices of external strings (in the tentative implementation). 
TEST=cctest test-strings/SliceFromExternal, mjsunit/string-slices.js

Review URL: http://codereview.chromium.org/7832002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 11:10:01 +00:00
fschneider@chromium.org
9e4663a8d9 Enable inlining of functions that reference context slots. 
Review URL: http://codereview.chromium.org/7887038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 10:57:47 +00:00
yangguo@chromium.org
48b5328bde Fixing issue 1639, debugger stops stepping outside evaluate. 
BUG=v8:1639

Review URL: http://codereview.chromium.org/7889039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9287 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-15 07:23:31 +00:00
keuchel@chromium.org
96de832c89 Mark variables as being accessed from any inner scope, not only function scopes 
BUG=96523
TEST=mjsunit/regress/regress-96523.js

Review URL: http://codereview.chromium.org/7890031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9281 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-14 13:51:29 +00:00
keuchel@chromium.org
a392f5bf70 Fix scope iteration when debugging global code. 
TEST=mjsunit/debug-scopes.js

Review URL: http://codereview.chromium.org/7890007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-14 11:20:31 +00:00
kmillikin@chromium.org
63bec78428 Revert "MIPS: port Remove in-loop tracking for call ICs." 
Committed incorrectly.

TBR=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7890026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-14 08:08:16 +00:00
kmillikin@chromium.org
f9e2922b12 MIPS: port Remove in-loop tracking for call ICs. 
port r9260 (af9cfd83).

Original commit message:
We passed this flag around in a lot of places and had differenc call
ICs based on it, but never did any real specialization based on its
value.

BUG=
TEST=

Review URL: http://codereview.chromium.org/7886028
Patch from Paul Lind <plind44@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-14 08:04:47 +00:00
rossberg@chromium.org
40880d3206 Fixed spurious character in test case, plus presubmit issues. 
Also addressed Slava's complaint about the personalized comment.

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7886032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-14 07:30:51 +00:00
rossberg@chromium.org
28f7136ced Fix for .bind regression. 
R=jkummerow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7892013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 17:14:39 +00:00
yangguo@chromium.org
321bfc549f Fixing r9265: moving test case into correct location. 
Review URL: http://codereview.chromium.org/7889008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 16:11:05 +00:00
yangguo@chromium.org
fc2c22dd2b Adding test case for issue 1639, fixed by r9264. 
BUG=v8:1639

Review URL: http://codereview.chromium.org/7889006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 15:08:36 +00:00
rossberg@chromium.org
ff5c242a47 Test (and fix) all exception paths that can occur with proxies. 
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 13:07:20 +00:00
rossberg@chromium.org
e645597aa7 Implement function proxies (except for their use as constructors). 
Introduce new %Apply native.

Extend Execution::Call to optionally handle receiver rewriting (needed for %Apply).

Fix Function.prototype.bind for functions that have .apply modified.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 11:42:57 +00:00
mstarzinger@chromium.org
aae949ba10 Fix parent of the WeakMap prototype. 
R=rossberg@chromium.org
BUG=v8:1565
TEST=mjsunit/harmony/weakmaps

Review URL: http://codereview.chromium.org/7890003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 09:45:10 +00:00
sgjesse@chromium.org
81df4a42e4 Support for precise stepping in functions compiled before debugging was started (step 1) 
This change will ensure that all non-optimized code will be compiled
with debug break slots when debugging is initiated. This is handled by
scanning the heap for non-optimized functions without debug break slots and setting their code to be lazy recomplied. When the lazy recompilation happens the code will ge generated with debug break slots (if debugging is still active at that point in time).

R=svenpanne@chromium.org
Currently this is only implemented for functions which do not have activations on the stack.

BUG=
TEST=

Review URL: http://codereview.chromium.org//7839030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-13 08:31:21 +00:00
jkummerow@chromium.org
3ec371690c d8 external array c'tors: allow parameters that can be converted to numbers 
BUG=v8:1681
TEST=d8 accepts: var a = new Int32Array("2");

Review URL: http://codereview.chromium.org/7867036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-12 12:42:05 +00:00
mikhail.naganov@gmail.com
57b9e9d968 Revert accidental r9229 and r9230 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-12 10:50:40 +00:00
mikhail.naganov@gmail.com
03d325da08 add test 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-12 10:42:25 +00:00
danno@chromium.org
df860eda5c Don't allow seal or element property re-definition on external arrays. 
R=ricow@chromium.org
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js

Review URL: http://codereview.chromium.org/7858031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-09 14:30:00 +00:00
yangguo@chromium.org
f877f7bda2 Fixing presubmit error. 
Review URL: http://codereview.chromium.org/7839031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-07 16:15:48 +00:00
lrn@chromium.org
2c8680cc46 Avoid size increase of snapshot. 
The prototype of builtin functions is already unwritable, so we don't
have to make it so (the default map for functions changes after builtins
are initialized).

We no longer need to make the prototype non-extensible, since all properties
that are ever read by the bultins code has been added and frozen already.
Adding properties to the prototype, or changing its __proto__, cannot affect
code.

Removing these two pieces of initialization code reduces the snapshot size
by a few Kb.

Review URL: http://codereview.chromium.org/7839028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-07 11:56:06 +00:00
kmillikin@chromium.org
94777e213d Remove variable rewrites and the unneccesary Slot class. 
R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7824038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9162 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-07 11:02:31 +00:00
kmillikin@chromium.org
8b165d414f Fix a bug in abrupt exit from with or catch inside finally. 
When with or catch is nested inside finally, we were not properly restoring
the context in the stack for the finally code.  Also, as a small
optimization, restore it from the handler block instead of iteratively
unwinding contexts.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7837023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-07 09:21:44 +00:00
keuchel@chromium.org
85a5b6d3c4 Getting rid of ExitContextStatement for scoped blocks. 
Review URL: http://codereview.chromium.org/7835027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 22:00:59 +00:00
keuchel@chromium.org
edd893a159 Simplfy handling of exits from scoped blocks. 
BUG=
TEST=mjsunit/harmony/block-leave.js

Review URL: http://codereview.chromium.org/7792100

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9157 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 21:48:32 +00:00
keuchel@chromium.org
0820205316 Avoid dynamic lookup when initializing let declared variables. 
'Let's inside a 'with' would initialize the variable
using the StoreContextSlot runtime function which
would fail because it checks that the variable does
not hold the hole value.

Review URL: http://codereview.chromium.org/7792098

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9156 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 21:22:35 +00:00
yangguo@chromium.org
8b82ad274f Put test directories of d8-os tests into /tmp/. 
Review URL: http://codereview.chromium.org/7835040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 14:48:08 +00:00
jkummerow@chromium.org
09c66d20ce Fix possible crash in FixedDoubleArray::Initialize() 
(this only affected ia32).

BUG=95113
TEST=mjsunit/regress/regress-95113.js passes without crashing.

Review URL: http://codereview.chromium.org/7833040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 14:07:54 +00:00
vegorov@chromium.org
d451878c91 Fix bug in Page::GetRegionMaskForSpan. 
When checking for a wrap take into account offset of the start address in the region.

BUG=http://crbug.com/94425
TEST=test/mjsunit/regress/regress-94425.js
Review URL: http://codereview.chromium.org/7779037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 11:24:48 +00:00
ricow@chromium.org
0fbf8c8854 Add regression test for issue 1215, expand regression test for issue 1447. 
Both these issues has now been closed since they are working on bleeding edge.
Review URL: http://codereview.chromium.org/7739024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 07:43:51 +00:00
lrn@chromium.org
ffffa716c5 Lock the prototype of internal classes. 
Prototypes and their properties and methods are locked down to prevent fiddling with their operation, even if the build-in object leaks.

Made some built-in functions only work during bootstrapping.

Review URL: http://codereview.chromium.org/7799027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9122 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-05 07:30:35 +00:00
keuchel@chromium.org
ccd2cd8f64 Prune empty block scopes from scope tree 
BUG=
TEST=

Review URL: http://codereview.chromium.org/7825006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-02 12:43:28 +00:00
lrn@chromium.org
b7eb138eab The spec (15.1.2.2 parseInt (string , radix)) says ToString should be called before ToInt32. 
http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf

In the current implementation, the order is reversed. So this webkit test (https://bugs.webkit.org/show_bug.cgi?id=65366) fails on Chromium.

BUG=1649
TEST=parse-int-float.js

Review URL: http://codereview.chromium.org/7740080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-02 11:38:40 +00:00
keuchel@chromium.org
d434d3158c Detect conflicting variable bindings in harmony mode. 
BUG=
TEST=mjsunit/harmony/block-conflicts.js

Review URL: http://codereview.chromium.org/7756014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9102 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-01 12:31:18 +00:00