Commit Graph

4728 Commits

Author SHA1 Message Date
vegorov@chromium.org
bc77d4d60a Reland r18363.
Introduce API to temporarily interrupt long running JavaScript code.

It is different from termination API as interrupted JavaScript will continue to execute normally when registered InterruptCallback returns.

  /**
   * Request V8 to interrupt long running JavaScript code and invoke
   * the given |callback| passing the given |data| to it. After |callback|
   * returns control will be returned to the JavaScript code.
   * At any given moment V8 can remember only a single callback for the very
   * last interrupt request.
   * Can be called from another thread without acquiring a |Locker|.
   * Registered |callback| must not reenter interrupted Isolate.
   */
  void RequestInterrupt(InterruptCallback callback, void* data);

  /**
   * Clear interrupt request created by |RequestInterrupt|.
   * Can be called from another thread without acquiring a |Locker|.
   */
  void ClearInterrupt();

Fix Hydrogen SCE pass to avoid eliminating stack guards too aggressively. Only normal JavaScript functions are guaranteed to have stack guard in the prologue. If function is a builtin or has a custom call IC it will lack one.

Changes from r18363:

- includes r18364 to fix compilation errors: removes debugging only code;

- makes interrupiton related tests not threaded, because they rely on having exclusive access to the V8 instance and the fact that they can only interrupt themselves, if they are interrupted from the outside they break;

- changes HasStackCheck predicate used during SCE pass to avoid handles dereference to make SCE compatible with parallel recompilation.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/104823008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-19 16:45:58 +00:00
jkummerow@chromium.org
3c76ecd732 Fix switch statements with non-Smi integer labels and no type feedback
BUG=chromium:329709
LOG=Y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/98643010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-19 14:25:58 +00:00
vegorov@chromium.org
dd8a793962 Revert "Introduce API to temporarily interrupt long running JavaScript code."
This reverts commit r18363.

Revert "Fix compilation error introduced by r18363."

This reverts commit r18364.

Changes in SCE pass are incompatible with parallel compilation

TBR=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/101463003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 19:21:27 +00:00
vegorov@chromium.org
cd045f473e Fix compilation error introduced by r18363.
Remove debugging related code.

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/104793005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 19:01:02 +00:00
vegorov@chromium.org
64d2dfa232 Introduce API to temporarily interrupt long running JavaScript code.
It is different from termination API as interrupted JavaScript will continue to execute normally when registered InterruptCallback returns.

  /**
   * Request V8 to interrupt long running JavaScript code and invoke
   * the given |callback| passing the given |data| to it. After |callback|
   * returns control will be returned to the JavaScript code.
   * At any given moment V8 can remember only a single callback for the very
   * last interrupt request.
   * Can be called from another thread without acquiring a |Locker|.
   * Registered |callback| must not reenter interrupted Isolate.
   */
  void RequestInterrupt(InterruptCallback callback, void* data);

  /**
   * Clear interrupt request created by |RequestInterrupt|.
   * Can be called from another thread without acquiring a |Locker|.
   */
  void ClearInterrupt();

Fix Hydrogen SCE pass to avoid eliminating stack guards too aggressively. Only normal JavaScript functions are guaranteed to have stack guard in the prologue. If function is a builtin or has a custom call IC it will lack one.

BUG=
R=danno@chromium.org, dcarney@chromium.org

Review URL: https://codereview.chromium.org/102063004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 18:38:35 +00:00
verwaest@chromium.org
fb7218dc3d Enable optimization of functions with generic switches.
R=jkummerow@chromium.org, titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/110123002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 11:44:38 +00:00
svenpanne@chromium.org
389ee8d59b Removed internal uses of (almost) deprecated FunctionTemplate::New version.
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/108063003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 10:31:42 +00:00
yurys@chromium.org
bdb77d24a1 Fix Linux shared compilation after r18337
BUG=chromium:327298
LOG=N
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/118113002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 09:52:37 +00:00
yurys@chromium.org
19b6b7ada8 Delete several deprecated methods on v8::CpuProfiler
All methods for accessing collected profiles by index are deprecated. The indexed storage may well be implemented by the embedder should he need it. CpuProfiler's responsibility is just to create CpuProfile object that contains all collected data and whose lifetime can be managed by the embedder.

BUG=chromium:327298
LOG=Y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/117353002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 08:59:09 +00:00
yurys@chromium.org
8b542494c3 Add methods for finding object by its snapshot id and id for an object
Object<-->id mapping doesn't depend on a particular snapshot, actually same object may appear in several heap snapshots. The API for converting between id and heap object should be provided by HeapProfiler itself. There is already GetObjectId method which I extended with FindObjectById/ClearObjectIds. As the next step I'm going to deprecate and remove HeapGraphNode::GetHeapValue.

BUG=chromium:324769
LOG=N
R=alph@chromium.org, hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/93843004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 08:17:03 +00:00
svenpanne@chromium.org
402139f686 Remove all stuff marked as V8_DEPRECATED.
R=jochen@chromium.org, mstarzinger@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/99193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-18 08:09:37 +00:00
yangguo@chromium.org
213b05b5b9 Fix off-by-one error in AstTyper, part 2.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/112933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 15:19:57 +00:00
jkummerow@chromium.org
48ff79a300 Fix polymorphic inlined calls with migrating prototypes
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/104793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 14:57:00 +00:00
yurys@chromium.org
19f29c380e Do not stop profiling if all finished profiles were deleted
Deleting finished profiles shouldn't interrupt profile recording.

BUG=chromium:327298
LOG=N
R=alph@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/103893003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 14:39:18 +00:00
verwaest@chromium.org
d5787278bc Fixed global object leak caused by overwriting the global receiver (the global proxy) in the global object with the global object itself.
This CL additionally removes the API function to reattach a global proxy to a
global object.

BUG=324812
LOG=y
R=dcarney@chromium.org, titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/101733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 13:51:48 +00:00
ulan@chromium.org
cc401095fb Initialize Date parse cache with SMI instead of double to workaround sharing mutable heap numbers in snapshot.
This is the only field in the snapshot that was tracked as double.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-280531.js
BUG=280531
LOG=Y

Review URL: https://chromiumcodereview.appspot.com/112003005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 13:11:44 +00:00
yangguo@chromium.org
5bc64b9fa5 Fix off-by-one error in AstTyper.
This causes the first parameter to be confused with the first
stack local when we collect type information.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/105943007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 11:34:09 +00:00
hpayer@chromium.org
75a84eca0b Added regression test for escape analysis.
BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/99133011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18290 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-10 15:54:20 +00:00
titzer@chromium.org
3de79abd85 Add a regression test for boolean concatenation in strings.
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/106743010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18287 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-10 14:05:25 +00:00
yangguo@chromium.org
d9e0763532 Track *all* external strings in the external string table.
Up till now, external strings may be tracked in the string table
(for internalized strings) or the external string table, depending
on in which order internalize and externalize happened.

The internalized string table should not have to deal with external
strings, all of which should be tracked by the external string table.

R=svenpanne@chromium.org
BUG=326489
LOG=N

Review URL: https://codereview.chromium.org/103663006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-10 12:11:45 +00:00
svenpanne@chromium.org
e1db6d86a9 Avoid FP exceptions when doing integer division.
BUG=v8:3039
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/104003004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-09 10:15:19 +00:00
yurys@chromium.org
cd5ea74700 Replace 'operator*' with explicit 'get' method on SmartPointer
Made operator* return reference to the raw type, not pointer. New method 'get()' should be used when raw pointer is needed.

Also removed useless inline modifier from the SmaprtPointer methods and added const modifier to the methods that don't change smart pointer.

Made ~SmartPointerBase protected to avoid accidental calls of the non-virtual base class's destructor.

drive-by: fixed use after free in src/factory.cc

BUG=None
LOG=N
R=alph@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/101763003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-09 07:41:20 +00:00
jkummerow@chromium.org
64e9cbc305 Fix compilation with clang
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/106863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-06 11:45:26 +00:00
mvstanton@chromium.org
b807f4f82f Bugfix: HCheckInstanceType::GetCheckMaskAndTag used an incorrect mask.
The mask to check for an internalized string was incorrectly formed. Hat
tip to Weiliang Lin for discovering the bug.

BUG=v8:3038
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/108033002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-06 09:43:07 +00:00
verwaest@chromium.org
8a4df124a4 Fix loop side-effects of deoptimizing loops with a nested live OSR loop.
R=titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/106723002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 18:31:06 +00:00
machenbach@chromium.org
d8a757c669 Add tests and extension verifying CHECK and ASSERT.
The new native functions can also be used in blink tests to ensure that V8 asserts are turned on where they should be.

BUG=
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/105953005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 17:26:22 +00:00
dcarney@chromium.org
69314e1f47 Fix parameter passing in callback store ics on arm
R=svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/93873007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 12:38:50 +00:00
yangguo@chromium.org
34f0b745b8 Reland "Implement hyperbolic math functions for ES6."
BUG=v8:2938
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/104173002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 12:36:42 +00:00
svenpanne@chromium.org
d6b75581f3 Remove internal uses of HandleScope::Close().
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/104183002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-04 10:09:08 +00:00
yangguo@chromium.org
3e689544af Revert "Implement hyperbolic math functions for ES6."
BUG=

Review URL: https://codereview.chromium.org/104003002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18248 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-04 08:53:17 +00:00
yangguo@chromium.org
d1e0c338f3 Implement hyperbolic math functions for ES6.
R=jarin@chromium.org
BUG=v8:2938
LOG=Y

Review URL: https://codereview.chromium.org/102023003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-04 08:32:18 +00:00
titzer@chromium.org
1d6710c933 Add some test cases with dead loops.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/98323004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 18:04:45 +00:00
verwaest@chromium.org
d4eaae37d1 Check whether the receiver to a keyed-call is actually a heapobject.
BUG=325225
LOG=n
R=dslomov@chromium.org

Review URL: https://chromiumcodereview.appspot.com/101863004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 17:59:31 +00:00
jochen@chromium.org
9d2344d1f4 Tests that make a stack allocated persistent weak and rely on gc need to force gc
Otherwise, if during a fuzzer test incremental marking is running, we'll
crash in the weak callback

BUG=none
TBR=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/101843002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18233 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 13:12:52 +00:00
jochen@chromium.org
8565d3e966 Remove deprecated Persistent::MakeWeak usage from V8
BUG=none
LOG=n
R=dcarney@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/101523002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 10:40:13 +00:00
yurys@chromium.org
054bdf7fc0 Remove HeapSnapshotsCollection class
The class added unecessary level of indirection to the heap profiler implementation. I merged some of its implementation into HeapProfiler and deleted the rest. This refactoring is also a prerequisite for keeping HeapObjectsMap alive even when all snapshots are deleted.

BUG=None
LOG=N
R=alph@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/101393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 09:48:30 +00:00
titzer@chromium.org
16c4c14fac Check elimination: Learn from if(CompareMap(x)) on true branch.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/99043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18210 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 18:34:33 +00:00
jochen@chromium.org
5d4c7562a1 Remove remaining HandleScope::Close usage
For some reason, this is only caught when compiling with chromium on
Mac.

BUG=none
R=verwaest@chromium.org, dslomov@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/99263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 18:12:01 +00:00
marja@chromium.org
54dfe36519 Fix: test-debug.cc: don't misuse C++.
The test in question (test-debug/LiveEditEnabled) is expected to fail, and it
failed, but because of the wrong reason (the test asserts that the default
isolate is not initialized, SetLiveEditEnabled initialized the default
isolate because it doesn't get one as param). Now it fails because of the right
reason.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/99043004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18203 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 15:41:57 +00:00
yurys@chromium.org
e87fe7b71f Simplify allocation tracker API
Deprecated separate methods for starting/stopping allocation tracking in favor of a bool param to Start/StopTrackingHeapObjects.

BUG=None
LOG=N
R=loislo@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18197 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 14:27:24 +00:00
bmeurer@chromium.org
aa83f2900a Fix invalid assertion with OSR in BuildBinaryOperation.
BUG=v8:3032
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/98623004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 13:12:07 +00:00
yangguo@chromium.org
3d062847a4 Make sin-cos test case compatible with --always-osr.
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/98893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18188 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 12:56:54 +00:00
mstarzinger@chromium.org
db915fe97e Handle captured objects in OptimizedFrame::Summarize.
R=yangguo@chromium.org
BUG=v8:3029
TEST=mjsunit/regress/regress-3029
LOG=N

Review URL: https://codereview.chromium.org/96773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18187 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 12:11:02 +00:00
bmeurer@chromium.org
6e373493aa Drop IsPregenerated() and allow_stub_calls flag.
This also removes the fixed register hack that was required to support RecordWriteStub in the snapshot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96853003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 20:49:15 +00:00
mvstanton@chromium.org
5ba1304d60 Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects.
BUG=299979
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/80623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 15:22:16 +00:00
yurys@chromium.org
5567426483 Do not put allocated block into HeapObjectsMap
Heap allocation reported to AllocationTracker may be later divided into several objects so it is incorrect to put the block as a new HeapObject into the map. We will match allocated block with actual HeapObjects later when iterating Heap (will be addressed in another patch). Since the objects are not assigned an id immediately after creation we need to call FindOrAddEntry when finding id for SharedFunctionInfo during stack crawling.

Removed hooks for tracking creation of AllocationMemento. AllocationMemento is not a HeapObject and should be considered as implementation overhead.

Renamed NewObjectEvent to AllocationEvent which is more precise in case of folded allocations and when a part of the new block becomes AllocationMemento.

BUG=None
LOG=N
R=loislo@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/95283003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 09:54:38 +00:00
yangguo@chromium.org
f235194518 Fix bug in inlining Function.apply.
R=jkummerow@chromium.org
BUG=323942
LOG=Y

Review URL: https://codereview.chromium.org/95123003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:30:17 +00:00
titzer@chromium.org
bbdd21ebb0 Fix load elimination: can only .Equals() GVN-able instructions.
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/95193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:27:42 +00:00
dslomov@chromium.org
7372596615 Ensure that length is Smi in TypedArrayFromArrayLike constructor.
R=jkummerow@chromium.org
BUG=324028
LOG=Y

Review URL: https://codereview.chromium.org/94473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:22:36 +00:00
mstarzinger@chromium.org
d53e38777f Fix missing bounds check in n-arguments Array constructor.
LOG=N
R=mvstanton@chromium.org
BUG=v8:3027
TEST=mjsunit/regress/regress-3027

Review URL: https://codereview.chromium.org/92103003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 09:29:57 +00:00