Commit Graph

1973 Commits

Author SHA1 Message Date
yangguo
771b81f806 [debug] fix exception prediction for asm frames.
R=mstarzinger@chromium.org
BUG=chromium:633999

Review-Url: https://codereview.chromium.org/2215713002
Cr-Commit-Position: refs/heads/master@{#38358}
2016-08-05 07:14:21 +00:00
bmeurer
cad5b29610 [turbofan] Remove unnecessary prototype checks for element access.
We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709

Review-Url: https://codereview.chromium.org/2198833002
Cr-Commit-Position: refs/heads/master@{#38355}
2016-08-05 04:55:03 +00:00
adamk
e6d2c9b584 Properly pass InitializationFlag back from ScriptContextTable lookups
This was dropped accidentally in bb97d27ab.

R=verwaest@chromium.org
BUG=chromium:633884

Review-Url: https://codereview.chromium.org/2203213003
Cr-Commit-Position: refs/heads/master@{#38345}
2016-08-04 16:13:41 +00:00
mstarzinger
667d8ad099 [turbofan] Fix missing bailout for accessors in literals.
This adds the missing lazy bailout point when defining accessor pairs
within object literals via Runtime::kDefineAccessorPropertyUnchecked.
The runtime function in question can indeed trigger a lazy deopt due
to a DependentCode::kPrototypeCheckGroup dependency.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-633585
BUG=chromium:633585

Review-Url: https://codereview.chromium.org/2207413002
Cr-Commit-Position: refs/heads/master@{#38336}
2016-08-04 10:28:46 +00:00
jgruber
ea6b9609a6 Handle stack overflows in NoSideEffectToString
An infinite recursion can be triggered when NoSideEffectToString is
called on an error object with its name property set to itself.

BUG=633998

Review-Url: https://codereview.chromium.org/2206313002
Cr-Commit-Position: refs/heads/master@{#38325}
2016-08-04 07:45:11 +00:00
rmcilroy
aacbdacb89 [Crankshaft] Move don't crankshaft check before EnsureDeoptimizationSupport.
Avoids compiling baseline code when the function isn't able to be
optimized by crankshaft.

BUG=chromium:632289

Review-Url: https://codereview.chromium.org/2194453002
Cr-Commit-Position: refs/heads/master@{#38304}
2016-08-03 15:02:38 +00:00
jgruber
d48170dbf5 Move NoSideEffectToString to C++
BUG=

Review-Url: https://codereview.chromium.org/2206573002
Cr-Commit-Position: refs/heads/master@{#38289}
2016-08-03 12:22:23 +00:00
bmeurer
c9324fe6c5 [turbofan] Fix invalid representation selection for Phis/Selects.
We cannot just blindly make a representation selection for Phi or Select
based on the truncations, but we also need to consider the type of the
inputs (or actually of the Phi/Select node itself). We can only use
Word32 representation based on Word32 truncation if the inputs are
Number or Oddball, same for Float64.

R=epertoso@chromium.org
BUG=v8:5255

Review-Url: https://codereview.chromium.org/2206553002
Cr-Commit-Position: refs/heads/master@{#38241}
2016-08-02 12:11:09 +00:00
mstarzinger
962fd4ae4b [interpreter] Elide OSR polling from fake loops.
This makes sure we are not inserting {OsrPoll} instructions for any
statements that are not actually loops and have no back edges. Without
back edges the {BytecodeGraphBuilder} is unable to deduce loop ranges
and hence cannot construct a graph for OSR entry.

R=neis@chromium.org
TEST=mjsunit/regress/regress-5252
BUG=v8:5252

Review-Url: https://codereview.chromium.org/2200733002
Cr-Commit-Position: refs/heads/master@{#38233}
2016-08-02 09:16:59 +00:00
bmeurer
a758144329 [turbofan] Fix invalid comparison operator narrowing.
When we narrow a signed32 comparison to uint8 or uint16 representation,
we also need to change the condition to unsigned comparisons otherwise
the comparison will be done on int16/int8 which interprets the narrowed
bits wrong.

R=epertoso@chromium.org
BUG=v8:5254

Review-Url: https://codereview.chromium.org/2202803003
Cr-Commit-Position: refs/heads/master@{#38231}
2016-08-02 07:46:15 +00:00
jgruber
061d082dd3 Properly set function index in CallSite constructor
BUG=632965
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2199673002
Cr-Commit-Position: refs/heads/master@{#38208}
2016-08-01 12:59:57 +00:00
jgruber
1c7c0521f1 Set Error.stack property writable
Previously, the stack property was set up in JS as read-only; but since
it had a JS setter, writability was ignored and writing to stack was
possible.

This is no longer the case now that stack is either an actual data
property, or is associated with C++ accessors. Explicitly set the
property as writable to preserve old behavior.

BUG=5245
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2190313002
Cr-Commit-Position: refs/heads/master@{#38158}
2016-07-29 08:15:26 +00:00
ishell
fc66694de8 [fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a count operation with keyed load/store to a super.
BUG=chromium:631917

Review-Url: https://codereview.chromium.org/2191663004
Cr-Commit-Position: refs/heads/master@{#38139}
2016-07-28 14:31:07 +00:00
danno
7f1fa30e34 [stubs] Port CreateWeakCellStub to turbofan
In the process also inline the stub into the appropriate interpreter bytecode
handler and make sure that the context register is preserved in hand-written
assembly code that calls the stub and expects the context register to be
preserved.

BUG=608675

Review-Url: https://codereview.chromium.org/2188993003
Cr-Commit-Position: refs/heads/master@{#38132}
2016-07-28 11:49:00 +00:00
mlippautz
e97b8686f2 [heap] Don't consider mementos on pages below age mark
Objects that reside below the age mark could be on pages that have been moved
within new space. In this case mementos survived which can actually point to
already-collected allocation sites.

BUG=chromium:631050,chromium:581412
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2179033005
Cr-Commit-Position: refs/heads/master@{#38094}
2016-07-27 12:18:16 +00:00
yangguo
071b655fa9 [debugger] Scope iterator should not visit inner function literals.
R=marja@chromium.org
BUG=chromium:621361

Review-Url: https://codereview.chromium.org/2185913003
Cr-Commit-Position: refs/heads/master@{#38087}
2016-07-27 09:04:20 +00:00
mstarzinger
908f355ecc [interpreter] Enable OSR test that no longer fails.
R=mythria@chromium.org
TEST=mjsunit/regress/regress-2618
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2183463003
Cr-Commit-Position: refs/heads/master@{#38085}
2016-07-27 08:58:53 +00:00
bmeurer
32346aaea0 [turbofan] Fix overly aggressive dead code elimination.
When we eliminate nodes during truncation analysis that have no value
uses, we must make sure that we do not eliminate speculative number
operations that would have side effects depending on the inputs, i.e.
for example a SpeculativeNumberMultiply(x,y) does ToNumber(x) and
ToNumber(y) first, so if either x or y could throw an exception during
ToNumber conversion, we must not eliminate the multiplication, even if
it has no value uses (some later pass may kill the actual machine
multiplication, but the checks on the inputs have to remain still).
So we check whether both x and y are PlainPrimitive, i.e. neither
Receiver nor Symbol, which could raise exceptions for ToNumber, and
only in that case we propagate the "unusedness" of the node to its
inputs.

This also uncovered a bug with the type of Dead, which must be None,
as this represents an impossible value, so we had to fix that too.

Also the dead code removal will not work correctly for constants (i.e.
pure nodes with no value inputs), as those might be cached and hence
we might resurrect them for an unrelated node lowering during
SimplifiedLowering and only later kill the actual node (replacing its
uses with Dead), which would then also replace the new use with Dead.
So that was fixed as well. This shouldn't change anything for the
result, as unused constants automagically disappear from the graph later
on anyways.

R=yangguo@chromium.org
BUG=chromium:631318

Review-Url: https://codereview.chromium.org/2182003002
Cr-Commit-Position: refs/heads/master@{#38038}
2016-07-26 07:09:58 +00:00
neis
88a795d1c8 Remove the --ignition-generators flag.
This flag has been enabled by default for over a month now.

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2176143002
Cr-Commit-Position: refs/heads/master@{#38020}
2016-07-25 12:56:27 +00:00
mvstanton
480f155ed6 [Turbofan] IsUseLessGeneral shouldn't consider machine representation.
BUG=chromium:630952

Review-Url: https://codereview.chromium.org/2177193002
Cr-Commit-Position: refs/heads/master@{#38014}
2016-07-25 12:01:54 +00:00
bmeurer
5bed1516c8 [turbofan] Avoid introducing machine operators during typed lowering.
Introducing machine operators early causes trouble for the typing,
truncation analysis and representation selection, so we should rather
stick to simplified operators instead. Now there's only the for-in case
left, which is not clear how we can handle this in a better way.

Drive-by-fix: Also don't introduce Int32Constant and Word32Shl in
JSTypedLowering, but use NumberConstant and proper NumberShiftLeft
operators instead.

R=jarin@chromium.org
BUG=chromium:630951

Review-Url: https://codereview.chromium.org/2182453002
Cr-Commit-Position: refs/heads/master@{#38008}
2016-07-25 10:38:00 +00:00
yangguo
986814218b Native try-catch syntax parsing should not crash.
R=littledan@chromium.org
BUG=chromium:630559

Review-Url: https://codereview.chromium.org/2176613002
Cr-Commit-Position: refs/heads/master@{#37996}
2016-07-25 05:32:28 +00:00
bmeurer
e3e347b85c [turbofan] Remove overly restrictive DCHECK.
The dead code elimination in SimplifiedLowering can eliminate pure nodes
if they don't have value uses. But some of those can indeed have control
inputs, i.e. Phi nodes do of course have a control input.

R=jarin@chromium.org
BUG=chromium:630923

Review-Url: https://codereview.chromium.org/2177133002
Cr-Commit-Position: refs/heads/master@{#37995}
2016-07-25 05:22:19 +00:00
cbruni
7ede61ed1d [elements] Omit fast path in PrependElementIndices
In PrependElementIndicesImpl we sort a FixedArray of indices potentially
containing HeapNumbers. During the string conversion we might trigger a GC.
This in turn might try to read a slot where we previously had a HeapNumber
but the sort sneaked a SMI in there which is not a valid pointer.

BUG=chromium:630561

Review-Url: https://codereview.chromium.org/2173653003
Cr-Commit-Position: refs/heads/master@{#37993}
2016-07-23 12:16:14 +00:00
jgruber
89403e0316 Omit frames up to new target in Error constructor
BUG=v8:5216
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2175603003
Cr-Commit-Position: refs/heads/master@{#37978}
2016-07-22 11:45:50 +00:00
yangguo
6d0a420298 [debug] use catch prediction flag for promise rejections.
This is in preparation to implementing exception prediction for async
functions.  Each handler table entry can now predict "caught", "uncaught", or
"promise". The latter indicates that the exception will lead to a promise
rejection.

To mark the relevant try-catch blocks, we add a new native syntax.
try { } %catch (e) { } indicates a TryCatchStatement with the "promise"
prediction.

The previous implementation of using the function to tell the relevant
try-catch apart from inner try-catch blocks will not work for async functions
since these can have inner try-catch blocks inside the same function.

BUG=v8:5167

Review-Url: https://codereview.chromium.org/2161263003
Cr-Commit-Position: refs/heads/master@{#37966}
2016-07-22 06:04:54 +00:00
ivica.bogosavljevic
eaa86cbf06 MIPS: Fix infinite loop in Math.pow(2,-2147483648)
BUG=v8:5213

Review-Url: https://codereview.chromium.org/2163963003
Cr-Commit-Position: refs/heads/master@{#37955}
2016-07-21 19:38:01 +00:00
yangguo
07a0f9ebff [debugger] be more lenient about argument type in %DebugGetProperty.
R=mstarzinger@chromium.org
BUG=chromium:629996

Review-Url: https://codereview.chromium.org/2166123003
Cr-Commit-Position: refs/heads/master@{#37942}
2016-07-21 11:29:24 +00:00
jacob.bramley
e83739c0ae [arm] Fix infinite loop in Math.pow(2,2147483648).
BUG=v8:5214

Review-Url: https://codereview.chromium.org/2166743003
Cr-Commit-Position: refs/heads/master@{#37933}
2016-07-21 09:30:32 +00:00
bmeurer
f793cb1fc3 [runtime] %TransitionElementsKind works for any kind of JSObject.
The optimizing compilers actually invoke %TransitionElementsKind for
any kind of JSObject, the only relevant thing is the elements kind.
The runtime function was however checking for JSArray unnecessarily.
This only worked by coincindence in Crankshaft because the stub would
normally not call into the runtime fallback.

R=jarin@chromium.org
BUG=chromium:629823

Review-Url: https://codereview.chromium.org/2166963004
Cr-Commit-Position: refs/heads/master@{#37919}
2016-07-21 07:23:58 +00:00
jgruber
9211dee01a Move Error methods to C++
This ports a large portion of Error methods to C++,
including the constructor, stack setter and getter,
and Error.prototype.toString.

BUG=

Committed: https://crrev.com/5742da056a290caa13a0b8717ddb1e43424e0d31
Review-Url: https://codereview.chromium.org/2142933003
Cr-Original-Commit-Position: refs/heads/master@{#37870}
Cr-Commit-Position: refs/heads/master@{#37908}
2016-07-20 13:05:47 +00:00
jgruber
8c163cfe45 Revert of Move Error methods to C++ (patchset #11 id:200001 of https://codereview.chromium.org/2142933003/ )
Reason for revert:
Clusterfuzz failures: https://bugs.chromium.org/p/chromium/issues/detail?id=629749

Original issue's description:
> Move Error methods to C++
>
> This ports a large portion of Error methods to C++,
> including the constructor, stack setter and getter,
> and Error.prototype.toString.
>
> BUG=
>
> Committed: https://crrev.com/5742da056a290caa13a0b8717ddb1e43424e0d31
> Cr-Commit-Position: refs/heads/master@{#37870}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2159223004
Cr-Commit-Position: refs/heads/master@{#37881}
2016-07-20 06:45:49 +00:00
jgruber
5742da056a Move Error methods to C++
This ports a large portion of Error methods to C++,
including the constructor, stack setter and getter,
and Error.prototype.toString.

BUG=

Review-Url: https://codereview.chromium.org/2142933003
Cr-Commit-Position: refs/heads/master@{#37870}
2016-07-19 13:51:07 +00:00
yangguo
4de5e1456e [debug] add test case for scope iterator using correct language mode.
TBR=mstarzinger@chromium.org
BUG=v8:5207

Review-Url: https://codereview.chromium.org/2154393003
Cr-Commit-Position: refs/heads/master@{#37860}
2016-07-19 11:07:03 +00:00
bmeurer
e0b8707c78 [turbofan] Fix typing rule for number addition.
R=jarin@chromium.org
BUG=chromium:629435

Review-Url: https://codereview.chromium.org/2161013002
Cr-Commit-Position: refs/heads/master@{#37859}
2016-07-19 10:08:13 +00:00
bmeurer
15f99cd5b5 [turbofan] Properly handle bit->float64 representation changes.
BUG=chromium:629062
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2155323003
Cr-Commit-Position: refs/heads/master@{#37853}
2016-07-19 08:29:52 +00:00
bmeurer
173313e297 [crankshaft] Guard against side effects in Array.prototype.shift lowering.
We need to pay attention to potential side effects from parameter
evaluation when inlining the fast case Array.prototype.shift.

R=yangguo@chromium.org
BUG=chromium:614644

Review-Url: https://codereview.chromium.org/2161943002
Cr-Commit-Position: refs/heads/master@{#37850}
2016-07-19 06:43:04 +00:00
yangguo
a51f429772 [regexp] Fix case-insensitive matching for one-byte subjects.
The bug occurs because we do not canonicalize character class ranges
before adding case equivalents. While adding case equivalents, we abort
early for one-byte subject strings, assuming that the ranges are sorted.
Which they are not.

R=marja@chromium.org
BUG=v8:5199

Review-Url: https://codereview.chromium.org/2159683002
Cr-Commit-Position: refs/heads/master@{#37833}
2016-07-18 12:03:37 +00:00
mstarzinger
a95cdbb4b4 [turbofan] Fix deopt point for [[ToObject]] lazy bailout.
This fixes the deoptimization information for the lazy bailout point
after a [[ToObject]] operation inserted for with statements. The result
value was pushed on the operand stack but erroneously ignored and left
on the operand stack by the FullCodeGenerator.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-5205
BUG=v8:5205

Review-Url: https://codereview.chromium.org/2158443002
Cr-Commit-Position: refs/heads/master@{#37818}
2016-07-18 08:08:47 +00:00
ishell
5d66a7f76b [fullcode] Restore context after calling ToNumber builtin.
BUG=chromium:628573

Review-Url: https://codereview.chromium.org/2153783002
Cr-Commit-Position: refs/heads/master@{#37796}
2016-07-15 13:18:57 +00:00
neis
1c1bdfe17e [test] Extend a test of destructuring.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2147733003
Cr-Commit-Position: refs/heads/master@{#37773}
2016-07-14 16:11:41 +00:00
mstarzinger
95ba1af314 [i18n] Make regression test work without i18n.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2144263002
Cr-Commit-Position: refs/heads/master@{#37759}
2016-07-14 12:32:45 +00:00
bmeurer
6530a16eb5 [stubs] Properly handle length overflow in StringAddStub.
Using the Hydrogen code stub bailout mechanism is not correct for the
string length overflow check in the StringAddStub. Instead make sure we
just throw the proper exception.

R=mstarzinger@chromium.org
BUG=chromium:627934

Review-Url: https://codereview.chromium.org/2146353002
Cr-Commit-Position: refs/heads/master@{#37758}
2016-07-14 11:47:42 +00:00
mstarzinger
8226c88b52 [i18n] Ensure [[ToString]] conversion of time zone names.
This adds a missing conversion of time zone names to string primitives
before case conversion and regular expression matching are applied.

This is in sync with ECMA-402, section 12.1.1.1, step 16(a).

R=jochen@chromium.org
TEST=mjsunit/regress/regress-crbug-627935
BUG=chromium:627935

Review-Url: https://codereview.chromium.org/2143003005
Cr-Commit-Position: refs/heads/master@{#37757}
2016-07-14 11:31:29 +00:00
jpp
aa91225289 V8. ASM-2-WASM. Migrates asm-wasm-builder to the new asm-typer.
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/*
LOG=N

Review-Url: https://codereview.chromium.org/2134333003
Cr-Commit-Position: refs/heads/master@{#37729}
2016-07-13 19:40:10 +00:00
mstarzinger
a2f1519f68 [turbofan] Fix deopt point for [[ToName]] lazy bailout.
This fixes the deoptimization information for the lazy bailout point
after a [[ToName]] operation inserted for object literals and class
literals. The result value was erroneously ignored.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-627828
BUG=chromium:627828

Review-Url: https://codereview.chromium.org/2149493003
Cr-Commit-Position: refs/heads/master@{#37719}
2016-07-13 15:18:10 +00:00
mythria
fd420203ec [Interpreter] Collect type feedback for calls in the bytecode handler
Collect type feedback in the call bytecode handler. The current
implementation only collects feedback for JS function objects. The other
objects and Array functions do not collect any feedback. They will be
marked Megamorphic.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2122183002
Cr-Commit-Position: refs/heads/master@{#37700}
2016-07-13 08:00:23 +00:00
aseemgarg
cd95c600be [wasm] allow array access with unsigned indices
BUG=618608
R=bradnelson@chromium.org
TEST=regress-618608.js

Review-Url: https://codereview.chromium.org/2138243002
Cr-Commit-Position: refs/heads/master@{#37693}
2016-07-12 21:56:38 +00:00
cbruni
d234118e29 Revert of making heap verification more aggressive (patchset #7 id:120001 of https://codereview.chromium.org/2126613002/ )
Reason for revert:
failing gc stress tests: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/7223/steps/Mjsunit/logs/stdio

Original issue's description:
> [runtime] making heap verification more aggressive
>
> - check that packed elements do not contain the_hole (with fix)
> - verify argument objects with elements kind
> - use JSObjectVerifiy in all JSObject "subclasses"
> - change initialization order for ArrayLiteralBoilerplate to simplify verification
>
> BUG=v8:5188
>
> Committed: https://crrev.com/599aa2e106ca8ab79f5cc489d1b93b6a26b19714
> Cr-Commit-Position: refs/heads/master@{#37680}

TBR=ishell@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5188

Review-Url: https://codereview.chromium.org/2140163002
Cr-Commit-Position: refs/heads/master@{#37682}
2016-07-12 14:07:17 +00:00
cbruni
599aa2e106 [runtime] making heap verification more aggressive
- check that packed elements do not contain the_hole (with fix)
- verify argument objects with elements kind
- use JSObjectVerifiy in all JSObject "subclasses"
- change initialization order for ArrayLiteralBoilerplate to simplify verification

BUG=v8:5188

Review-Url: https://codereview.chromium.org/2126613002
Cr-Commit-Position: refs/heads/master@{#37680}
2016-07-12 13:32:03 +00:00
yangguo
bbb2159d4c [regexp] Fix regexp source escaping with preceding backslashes.
R=franzih@chromium.org
BUG=chromium:515897

Review-Url: https://codereview.chromium.org/2137033002
Cr-Commit-Position: refs/heads/master@{#37664}
2016-07-12 05:36:17 +00:00
aseemgarg
8474f24450 [wasm] throw in case of assignment to module parameters
BUG=613928
R=bradnelson@chromium.org
TEST=regress-613928.js

Review-Url: https://codereview.chromium.org/2123283007
Cr-Commit-Position: refs/heads/master@{#37653}
2016-07-11 17:41:30 +00:00
ishell
b030a6f59d [runtime] Follow-up fix for "Better encapsulation of dictionary objects handling in lookup iterator."
BUG=chromium:626715

Review-Url: https://codereview.chromium.org/2135253002
Cr-Commit-Position: refs/heads/master@{#37651}
2016-07-11 15:51:58 +00:00
caitp
08d0012dda [keys] propagate PropertyFilter to proxy targets in KeyAccumulator
BUG=v8:5174, v8:1543
R=cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2129193003
Cr-Commit-Position: refs/heads/master@{#37634}
2016-07-11 10:39:35 +00:00
jgruber
be5808bff8 Correctly format builtin constructors in stack traces
CallSite::IsConstructor() was unable to recognize builtin construct stubs
(NumberConstructor_ConstructStub and StringConstructor_ConstructStub) as
constructors, and thus these frames were not formatted correctly in stack
traces.

Fix this by explicitly marking their Code objects as construct stubs and
passing along a special receiver value when we encounter such cases in
CaptureSimpleStackTrace.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2125163004
Cr-Commit-Position: refs/heads/master@{#37631}
2016-07-11 10:05:03 +00:00
jgruber
d49d3864d7 [builtins] Construct builtin frame in String/Number ctors
BUG=v8:5173
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2118283003
Cr-Commit-Position: refs/heads/master@{#37598}
2016-07-08 06:38:19 +00:00
jkummerow
b36237b8a3 [ForIn] Fix HasEnumerableProperty for Proxies with null prototype
BUG=v8:5181

Review-Url: https://codereview.chromium.org/2129563002
Cr-Commit-Position: refs/heads/master@{#37577}
2016-07-07 10:12:06 +00:00
neis
4a4f7175df [parser] Fix bug in destructuring binding for catch.
For variables introduced as part of a catch pattern, we used to set their
"initializer position" to the beginning of the pattern.  This lead to
full-codegen eliminating crucial hole checks when reading such variables
inside the pattern itself.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5178

Review-Url: https://codereview.chromium.org/2123953002
Cr-Commit-Position: refs/heads/master@{#37569}
2016-07-07 07:31:16 +00:00
mlippautz
9f7fd3a554 [heap] Remove test running OOM on some bots
While the test was useful to reproduce the issue locally it creates a lot of
heap pressure and causes all sorts of troubles (OOM, slowness) on the bots, so
let's drop it.

R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2127803002
Cr-Commit-Position: refs/heads/master@{#37551}
2016-07-06 13:09:03 +00:00
mstarzinger
c4781e344c [runtime] Deprecate RUNTIME_ASSERT from debugger methods.
This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2053573004
Cr-Commit-Position: refs/heads/master@{#37545}
2016-07-06 09:06:58 +00:00
neis
45a8167477 [debugger] Don't leak holes from generator arguments.
This is a quick fix for the hole leaking from generators via the debugger's frame
inspection feature: when collecting the arguments, convert each hole to undefined.
In the long term, we probably want to remember and restore the actual arguments
rather than pushing these dummy arguments on each resume.

BUG=v8:5164

Review-Url: https://codereview.chromium.org/2122923003
Cr-Commit-Position: refs/heads/master@{#37544}
2016-07-06 08:11:29 +00:00
mlippautz
da3745d8d9 Reland "[heap] Track length for array buffers to avoid free-ing dependency"
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

This reverts commit 1791d7bb9a.

Review-Url: https://codereview.chromium.org/2127643002
Cr-Commit-Position: refs/heads/master@{#37537}
2016-07-05 16:32:17 +00:00
machenbach
1791d7bb9a Revert of [heap] Track length for array buffers to avoid free-ing dependency (patchset #2 id:20001 of https://codereview.chromium.org/2122603004/ )
Reason for revert:
[Sheriff] This makes mjsunit/regress/regress-625752 extremely slow on all gc stress bots and leads to timeouts with custom snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6602

Original issue's description:
> [heap] Track length for array buffers to avoid free-ing dependency
>
> The dependency would only happen if we have a smi overflow for the length and
> have create a heap number. In this case the heap number would've to survive
> until the array buffer is collected.
>
> To avoid this dependency we track the length (as we previously used to).
>
> BUG=chromium:625748,chromium:625752
> LOG=N
> TEST=test/mjsunit/regress/regress-625752.js
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/ddc75cc1356a58b6cfd63f9da0586e1150496b3d
> Cr-Commit-Position: refs/heads/master@{#37530}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:625748,chromium:625752

Review-Url: https://codereview.chromium.org/2127483003
Cr-Commit-Position: refs/heads/master@{#37533}
2016-07-05 14:43:24 +00:00
mlippautz
ddc75cc135 [heap] Track length for array buffers to avoid free-ing dependency
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625748,chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2122603004
Cr-Commit-Position: refs/heads/master@{#37530}
2016-07-05 13:15:22 +00:00
jgruber
971468031a Use toString tag to format receiver in stack traces
This concerns formatting of calls to, e.g., Math.acos in stack traces,
in which the receiver is an object with an attached toString tag. If
such a tag exists, use it to format the receiver typename to ensure that
the stack trace includes 'Math.acos' instead of 'Object.acos'.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110683007
Cr-Commit-Position: refs/heads/master@{#37513}
2016-07-05 07:42:53 +00:00
jgruber
f59a23356b [builtins] Add receiver to builtin exit frames
Stack trace generation requires access to the receiver; and while the
receiver is already on the stack, we cannot determine its position
during stack trace generation (it's stored in argv[0], and argc is only
stored in a callee-saved register).

This patch grants access to the receiver by pushing argc onto builtin
exit frames as an extra argument. Compared to simply pushing the
receiver, this requires an additional dereference during stack trace
generation, but one fewer during builtin calls.

BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106883003
Cr-Commit-Position: refs/heads/master@{#37500}
2016-07-04 12:46:47 +00:00
ishell
43aee0331d [fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a keyed store to a super.
BUG=chromium:625590

Review-Url: https://codereview.chromium.org/2120963002
Cr-Commit-Position: refs/heads/master@{#37497}
2016-07-04 11:42:39 +00:00
ishell
acd674db10 [crankshaft] Use canonical nan_value or minus_zero_value objects instead of constant heap numbers with NaN or -0.0 values.
BUG=chromium:625547

Review-Url: https://codereview.chromium.org/2115413002
Cr-Commit-Position: refs/heads/master@{#37495}
2016-07-04 09:59:26 +00:00
littledan
0ff7b4830c Implement immutable prototype chains
This patch implements "immutable prototype exotic objects" from the ECMAScript
spec, which are objects whose __proto__ cannot be changed, but are not otherwise
frozen. They are introduced in order to prevent a Proxy from being introduced
to the prototype chain of the global object.

The API is extended by a SetImmutablePrototype() call in ObjectTemplate, which
can be used to vend new immutable prototype objects. Additionally, Object.prototype
is an immutable prototype object.

In the implementation, a new bit is added to Maps to say whether the prototype is
immutable, which is read by SetPrototype. Map transitions to the immutable prototype
state are not saved in the transition tree because the main use case is just for
the prototype chain of the global object, which there will be only one of per
Context, so no need to take up the extra word for a pointer in each full transition
tree.

BUG=v8:5149

Review-Url: https://codereview.chromium.org/2108203002
Cr-Commit-Position: refs/heads/master@{#37482}
2016-07-01 19:20:11 +00:00
mstarzinger
a757a62bf5 [turbofan] Broaden checkpoint elimination on returns.
This makes the elimination of checkpoints flowing effect-wise into nodes
having the {Return} operator more permissive. We can cut out checkpoints
even when they are not wholly owned by the return. This also alleviates
a problem where TCO no longer applies.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624747
BUG=chromium:624747

Review-Url: https://codereview.chromium.org/2118793002
Cr-Commit-Position: refs/heads/master@{#37480}
2016-07-01 13:53:45 +00:00
bmeurer
9c281f2407 [turbofan] Properly lower NumberSinh, NumberCosh and NumberTanh.
R=jarin@chromium.org
BUG=chromium:625121

Review-Url: https://codereview.chromium.org/2116533004
Cr-Commit-Position: refs/heads/master@{#37479}
2016-07-01 12:53:04 +00:00
mstarzinger
920bc17c97 [turbofan] Fix eager bailout point after comma expression.
This ensures no eager bailout point is emitted after a comma expression
in test context where the right-hand side omitted an eager bailout point
as well. This is to stay in sync with full-codegen.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624919
BUG=chromium:624919

Review-Url: https://codereview.chromium.org/2113893004
Cr-Commit-Position: refs/heads/master@{#37475}
2016-07-01 09:51:50 +00:00
verwaest
c17b44bd3a Fix double canonicalization
This turns the blacklist back into a white-list adding all binary operations as allowed operations. The one known fix is that it forces canonicalization of the double-hole as double constant.

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2106393002
Cr-Commit-Position: refs/heads/master@{#37452}
2016-06-30 15:18:16 +00:00
jgruber
5febc27b5d [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel;tryserver.v8:v8_linux_nosnap_dbg

Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
Review-Url: https://codereview.chromium.org/2090723005
Cr-Original-Commit-Position: refs/heads/master@{#37384}
Cr-Commit-Position: refs/heads/master@{#37416}
2016-06-30 06:58:23 +00:00
adamk
7166503f6e Do all parsing for try/catch destructuring inside the appropriate scopes
Previously, any expressions inside destructuring patterns in a catch
would be parsed in the surrounding scope, instead of in the catch's
scope. This change fixes that by entering not only the catch scope,
but also the block scope inside it.

R=neis@chromium.org
BUG=v8:5106, v8:5112

Review-Url: https://codereview.chromium.org/2110193002
Cr-Commit-Position: refs/heads/master@{#37415}
2016-06-30 06:52:13 +00:00
bmeurer
5927deaaf1 Revert of [builtins] New frame type for exits to C++ builtins (patchset #5 id:80001 of https://codereview.chromium.org/2090723005/ )
Reason for revert:
Looks like this breaks on nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/7626

Original issue's description:
> [builtins] New frame type for exits to C++ builtins
>
> Prior to this commit, calls to C++ builtins created standard exit
> frames, which are skipped when constructing JS stack traces. In order to
> show these calls on traces, we introduce a new builtin exit frame type.
>
> Builtin exit frames contain target and new.target on the stack and are
> not skipped during stack trace construction.
>
> BUG=v8:4815
> R=bmeurer@chromium.org, yangguo@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
> Cr-Commit-Position: refs/heads/master@{#37384}

TBR=yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106113002
Cr-Commit-Position: refs/heads/master@{#37394}
2016-06-29 12:39:36 +00:00
jgruber
3c60c6b105 [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090723005
Cr-Commit-Position: refs/heads/master@{#37384}
2016-06-29 11:10:27 +00:00
hpayer
46a365faae [heap] Reland uncommit unused large object page memory.
BUG=

Review-Url: https://codereview.chromium.org/2109943003
Cr-Commit-Position: refs/heads/master@{#37376}
2016-06-29 09:38:45 +00:00
neis
40641fbc03 [regexp] Fix writing of lastIndex in JSRegExp::Initialize.
The lastIndex property must be written with the semantics of a strict [[Set]],
so an exception must be thrown when the attributes don't allow writing.  We used
to ignore the attributes.

R=littledan@chromium.org, yangguo@chromium.org
BUG=v8:5138

Review-Url: https://codereview.chromium.org/2109593002
Cr-Commit-Position: refs/heads/master@{#37369}
2016-06-29 08:48:03 +00:00
aseemgarg
fa5cb207a1 [wasm] fix loops and if-else to take int type instead of signed
BUG=617526
R=bradnelson@chromium.org
TEST=regress-617526.js

Review-Url: https://codereview.chromium.org/2101923003
Cr-Commit-Position: refs/heads/master@{#37354}
2016-06-29 00:40:32 +00:00
bradnelson
e42983d147 [wasm] Making compare and conditionals more correct.
Comparisons were allowing asm 'int' values in places
that require strict 'signed' or 'unsigned' but not both.

Fixes crash when these make it to asm-wasm.

BUG=599413
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2106683003
Cr-Commit-Position: refs/heads/master@{#37353}
2016-06-28 23:50:14 +00:00
bradnelson
c5856779eb [wasm] Forbid sign mismatch in asm typer.
asm.js forbids mixing signed and unsigned % or /.
We had been allowing these.

Fixes crash.

BUG=618602
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2107683002
Cr-Commit-Position: refs/heads/master@{#37350}
2016-06-28 21:01:36 +00:00
bradnelson
58920e04bc [wasm] Require wasm explicit asm instantiation to be of a function.
We were not checking that the string passed to instantiateFromAsm
contains a function declaration (any declaration was allowed).

Fixes crash.

BUG=620649
BUG=v8:4203
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2109533002
Cr-Commit-Position: refs/heads/master@{#37349}
2016-06-28 20:58:28 +00:00
hpayer
f99f633309 Revert of [heap] Reland uncommit unused large object page memory. (patchset #1 id:1 of https://codereview.chromium.org/2101383002/ )
Reason for revert:
Crashes unbox-double-arrays

Original issue's description:
> [heap] Reland uncommit unused large object page memory.
>
> BUG=
>
> Committed: https://crrev.com/dd0ee5fd11653ba41a292641ccd66ae7cc5a8398
> Cr-Commit-Position: refs/heads/master@{#37341}

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2106933003
Cr-Commit-Position: refs/heads/master@{#37347}
2016-06-28 20:22:35 +00:00
hpayer
dd0ee5fd11 [heap] Reland uncommit unused large object page memory.
BUG=

Review-Url: https://codereview.chromium.org/2101383002
Cr-Commit-Position: refs/heads/master@{#37341}
2016-06-28 17:41:30 +00:00
nikolaos
61c137c811 Fix bug with re-scoping arrow function parameter initializers
When re-scoping arrow function parameter initializers, temporaries
should be moved from the closure of the old scope to the closure of
the new scope, if necessary.

R=adamk@chromium.org, rossberg@chromium.org
BUG=chromium:622663
LOG=N

Review-Url: https://codereview.chromium.org/2083083007
Cr-Commit-Position: refs/heads/master@{#37335}
2016-06-28 15:10:17 +00:00
mstarzinger
4af80298b6 [turbofan] Fix missing lazy deopt in object literals.
This adds a missing lazy bailout point when defining data properties
with computed property names in object literals. The runtime call to
Runtime::kDefineDataPropertyInLiteral can trigger deopts. The necessary
bailout ID already exists and is now properly used.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-621816
BUG=chromium:621816

Review-Url: https://codereview.chromium.org/2099133003
Cr-Commit-Position: refs/heads/master@{#37294}
2016-06-27 13:56:00 +00:00
adamk
c7eb436d09 Remove all harmony runtime flags which shipped in M51
Flags removed (all begin with "harmony-"):
  function-name
  instanceof
  iterator-close
  unicode-regexps
  regexp-exec
  regexp-subclass
  species

BUG=v8:3566, v8:3648, v8:3699, v8:4093, v8:4447, v8:4602

Review-Url: https://codereview.chromium.org/2096933002
Cr-Commit-Position: refs/heads/master@{#37235}
2016-06-24 01:13:10 +00:00
adamk
f795a79010 Rewrite scopes in computed properties in destructured parameters
While we properly handled scopes of initializers in destructured parameters,
we never did the right thing for computed properties. This patch fixes that
by factoring out PatternRewriter's scope rewriting logic and calls it
for the computed property case.

BUG=chromium:620119

Review-Url: https://codereview.chromium.org/2084103002
Cr-Commit-Position: refs/heads/master@{#37228}
2016-06-23 20:47:18 +00:00
adamk
7b011fc9db Array splice should only normalize deleted_elements if it's an array
Also slightly expand regression test to end with a return instead of
an exception.

R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2090193002
Cr-Commit-Position: refs/heads/master@{#37223}
2016-06-23 17:23:20 +00:00
ishell
a81c66546e [mips] Fix using signaling NaN for holes in fixed double arrays.
BUG=chromium:620650

Review-Url: https://codereview.chromium.org/2086343002
Cr-Commit-Position: refs/heads/master@{#37207}
2016-06-23 08:27:54 +00:00
littledan
2601900dda Reland of write scopes of non-simple default arguments (patchset #1 id:1 of https://codereview.chromium.org/2081323006/ )
Reason for revert:
Infra issue appears to be over

TBR=adamk@chromium.org

Original issue's description:
> Revert of Rewrite scopes of non-simple default arguments (patchset #5 id:80001 of https://codereview.chromium.org/2077283004/ )
>
> Reason for revert:
> Seems to close tree (but it could be an infra issue)
>
> Original issue's description:
> > Rewrite scopes of non-simple default arguments
> >
> > Default parameters have additional declaration block scopes inserted
> > around them when something in the function scope calls eval. This
> > patch sets the parent scope of the expressions introduced due to
> > those defaults to the new block scope.
> >
> > R=adamk
> > BUG=chromium:616386
> >
> > Committed: https://crrev.com/0e14baf712955a1993f742647bb2adc293702b80
> > Cr-Commit-Position: refs/heads/master@{#37198}
>
> TBR=adamk@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:616386
>
> Committed: https://crrev.com/dd50262933d2ac087da32be887a7c18385fd998e
> Cr-Commit-Position: refs/heads/master@{#37201}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2086353003
Cr-Commit-Position: refs/heads/master@{#37202}
2016-06-22 21:09:57 +00:00
littledan
dd50262933 Revert of Rewrite scopes of non-simple default arguments (patchset #5 id:80001 of https://codereview.chromium.org/2077283004/ )
Reason for revert:
Seems to close tree (but it could be an infra issue)

Original issue's description:
> Rewrite scopes of non-simple default arguments
>
> Default parameters have additional declaration block scopes inserted
> around them when something in the function scope calls eval. This
> patch sets the parent scope of the expressions introduced due to
> those defaults to the new block scope.
>
> R=adamk
> BUG=chromium:616386
>
> Committed: https://crrev.com/0e14baf712955a1993f742647bb2adc293702b80
> Cr-Commit-Position: refs/heads/master@{#37198}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2081323006
Cr-Commit-Position: refs/heads/master@{#37201}
2016-06-22 19:58:10 +00:00
littledan
0e14baf712 Rewrite scopes of non-simple default arguments
Default parameters have additional declaration block scopes inserted
around them when something in the function scope calls eval. This
patch sets the parent scope of the expressions introduced due to
those defaults to the new block scope.

R=adamk
BUG=chromium:616386

Review-Url: https://codereview.chromium.org/2077283004
Cr-Commit-Position: refs/heads/master@{#37198}
2016-06-22 18:22:18 +00:00
mlippautz
7a88ff3cc0 [heap] Filter out stale left-trimmed handles for scavenges
The missing part from
  https://codereview.chromium.org/2078403002/

R=jochen@chromium.org
BUG=chromium:621869
LOG=N

Review-Url: https://codereview.chromium.org/2077353004
Cr-Commit-Position: refs/heads/master@{#37184}
2016-06-22 12:22:46 +00:00
mlippautz
21b55c4aa5 [heap] Fix check in AdvancePage
Failing to do the right check in AdvancePage results in a crash in a CHECK later
in EnsureCurrentCapacity.

BUG=chromium:620750,chromium:622115
LOG=N
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2090013002
Cr-Commit-Position: refs/heads/master@{#37171}
2016-06-22 09:10:09 +00:00
yangguo
5eaf4ac48f [debugger] add test case for scope materialization and rest params.
R=jgruber@chromium.org
BUG=v8:4703

Review-Url: https://codereview.chromium.org/2088703002
Cr-Commit-Position: refs/heads/master@{#37169}
2016-06-22 08:35:28 +00:00
jwolfe
d8147eb98c Reland: change most cases of variable redeclaration from TypeError to SyntaxError.
Reland of https://codereview.chromium.org/2048703002/

Code like `let a; eval("var a;");` should throw a SyntaxError, not a TypeError
(this caused a test262 failure.). However, the code `eval("function NaN() {}");`
should actually throw a TypeError. This patch changes most cases of
redeclaration errors from TypeError to SyntaxError. See the test
mjsunit/regress/redeclaration-error-types for a thorough analysis with spec
references.

The relevant sections of the spec are ES#sec-globaldeclarationinstantiation and
ES#sec-evaldeclarationinstantiation

BUG=v8:4955
LOG=y
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
R=adamk

Review-Url: https://codereview.chromium.org/2086063002
Cr-Commit-Position: refs/heads/master@{#37156}
2016-06-21 20:19:59 +00:00
bmeurer
5e0cd389bf [turbofan] MemoryOptimizer cannot deal with dead nodes in use lists.
We need to trim the graph before we execute the MemoryOptimizer, because
that just walks the effect chain from Start to End and cannot deal with
dead nodes in the use lists.

R=jarin@chromium.org
BUG=chromium:614292

Review-Url: https://codereview.chromium.org/2080703003
Cr-Commit-Position: refs/heads/master@{#37133}
2016-06-21 10:40:44 +00:00
bmeurer
7877ddecdb [builtins] Make sure the Math functions and constants agree.
While the EcmaScript specification doesn't define precise values for the
Math constants or the Math functions, we should at least ensure that the
values of the constants and the functions agree, i.e. Math.E should be
exactly the same value as Math.exp(1).

Also make sure that Math.exp(1) returns the expected value; we should
revisit the fdlibm algorithm and figure out why it's wrong in the last
bit.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=chromium:626111,v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2079233005
Cr-Commit-Position: refs/heads/master@{#37128}
2016-06-21 07:02:16 +00:00