Commit Graph

267 Commits

Author SHA1 Message Date
kasperl@chromium.org
e5860bd6a8 Update V8 to version 3.0.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 09:11:56 +00:00
lrn@chromium.org
7be18f702b make DateParser::TimeComposer handle 1-2 digits millisecond values
see http://code.google.com/p/v8/issues/detail?id=944
This patch makes DateParser::TimeComposer process times that have
millisecond values with only 1 or 2 digits.

Without this patch, Date.parse("2010-11-25T22:02:30.5") returns
1290690150005 and
Date.parse("2010-11-25T22:02:30.5") == Date.parse("2010-11-25T22:02:30.005")
evaluates to true.

With this patch, Date.parse("2010-11-25T22:02:30.5") returns
1290690150500 instead, and
Date.parse("2010-11-25T22:02:30.5") == Date.parse("2010-11-25T22:02:30.005")
evaluates to false.

Review URL: http://codereview.chromium.org/5336005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-26 11:48:35 +00:00
sgjesse@chromium.org
010f35f478 Change the order of evaluation of sub-expressions for keyed call
The expression of the key is now evaluated before the arguments, so all expressions in a keyed call are evaluared from left to right.

BUG=http://code.google.com/p/v8/issues/detail?id=931
TEST=test/mjsunit/regress/regress-931.js
Review URL: http://codereview.chromium.org/5161002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-17 13:59:07 +00:00
lrn@chromium.org
0464b33625 Fix bug in parser that allows "(foo):42" as a labeled statement.
Fixes issue 918.

Review URL: http://codereview.chromium.org/5044003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-16 12:10:48 +00:00
vegorov@chromium.org
20d3aad5ae Add check for overflow after MUL operations in side-effect free int32 expressions.
BUG=http://code.google.com/p/v8/issues/detail?id=927
TEST=test/mjsunit/regress/regress-927.js

Review URL: http://codereview.chromium.org/4746001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-09 19:32:49 +00:00
vegorov@chromium.org
746d72420c Improve positions recording for calls.
Review URL: http://codereview.chromium.org/4469002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-11-04 15:12:03 +00:00
erik.corry@gmail.com
759a87b520 Fix new-space-too-small test crash on 64 bit VM.
Review URL: http://codereview.chromium.org/3778009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-15 10:45:18 +00:00
erik.corry@gmail.com
d22965c49d Fix creation of an exception to avoid rare GC corner case.
Review URL: http://codereview.chromium.org/3782009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-15 07:54:20 +00:00
lrn@chromium.org
6c0cde67bc Fix bug in cache handling of lastIndex on global regexps.
Review URL: http://codereview.chromium.org/3745005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-10-14 08:51:20 +00:00
vegorov@chromium.org
622351fedd Fix getOwnPropertyDescriptor() support for index properties.
Add support for index properties with getters, setters or indexed interceptors.

For indexed interceptor case only fix crashes, do not guarantee any semantic soundness. Separate issue opened for this http://code.google.com/p/v8/issues/detail?id=877

BUG=http://code.google.com/p/v8/issues/detail?id=874

Review URL: http://codereview.chromium.org/3462005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-23 11:25:01 +00:00
lrn@chromium.org
0dece535d9 RegExp: Fix caching to correctly set lastIndex.
BUG: 52801

Review URL: http://codereview.chromium.org/3389022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-22 11:22:57 +00:00
fschneider@chromium.org
e91a352d02 Fix a regression in character-at stub when doing a keyed load on a string.
Loading from out-of-range has to go to the runtime system to check if there
exists a property with that index in the prototype.

Review URL: http://codereview.chromium.org/3410011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-16 09:18:08 +00:00
lrn@chromium.org
ac2ae05f85 make Date.parse properly handle TZ offsets
This makes, e.g., Date.parse("2010-08-31T22:35:36-09:00") work as
expected. Without this change, the "-9:00" timezone-offset portion
causes V8 to fail to properly parse that string into a date.
BUG=http://code.google.com/p/v8/issues/detail?id=857
TEST=Try Date.parse("2010-08-31T22:35:36-09:00") and make sure
that it gets parsed without errors and does not return NaN.

Review URL: http://codereview.chromium.org/3318017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-10 07:00:28 +00:00
kaznacheev@chromium.org
73c02394bf Avoid pushing arguments twice in GenericBinaryOpStub.
Under some conditions (ADD, non-number arguments passed in registers)
GenerateRegisterArgumentsPush was called twice and the stack broke.

Review URL: http://codereview.chromium.org/3290012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-09-07 13:33:40 +00:00
vegorov@chromium.org
3d60cc34af Fix regress-851.js to use assertNull instead of assertFalse.
Review URL: http://codereview.chromium.org/3232002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-27 13:23:14 +00:00
vegorov@chromium.org
f059093562 Check result of JSObject::NormalizeElements() in JSObject::PreventExtensions().
Normalization requires allocation so Failure object can be returned.

BUG=http://code.google.com/p/v8/issues/detail?id=851
TEST=test/mjsunit/regress/regress-851.js

Review URL: http://codereview.chromium.org/3262001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-27 13:06:50 +00:00
ricow@chromium.org
7672338bc9 Fixes bug in Object.freeze and Object.seal causing them to misbehave when Array.prototype has changed.
Object.freeze and Object.seal uses GetOwnPropertyNames which
returns an array with local property names. This array will also have
the additional properties defined on Array.prototype or
Object.prototype.

Note that, the implementation of GetOwnPropertyNames (when used as
Object.getOwnPropertyNames) is correct, since the spec says to create
a new Array (which would also have these properties).

Review URL: http://codereview.chromium.org/3137041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-26 08:35:49 +00:00
erik.corry@gmail.com
e18d07b604 ARM: Ensure that we are not in a spilled scope when calling
Load() or constructing a reference.
Review URL: http://codereview.chromium.org/3125011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-16 11:43:30 +00:00
sgjesse@chromium.org
56e0221754 Handle accessors when generating Error.stack
BUG=http://code.google.com/p/v8/issues/detail?id=798
TEST=test/mjsunit/regress/regress-798.js
Review URL: http://codereview.chromium.org/3082012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-13 08:31:52 +00:00
sgjesse@chromium.org
8e0cd6db8a Handle overwriting valueOf on String objects correctly when adding
This adds a check to the fast case string add to ensure that the String object still have the default valueOf function. The default valueOf is sitting on a hidden prototype of String.prototype.

Before using the fast case valueOf the object is checked for a local valueOf property. For slow case objects this check always reports true (the dictionary is not probed, so valueOf might be there) and for fast case objects the descriptor array is checked for the valueOf symbol (just liniar scan). After that the prototype is checked for beeing the initial value of String.prototype. If this all pass (that is the default valueOf is still in place) this result is cached on the map making the check fast the next time.

This is only implemented in the optimizing compiler, as the two usages of %_IsStringWrapperSafeForDefaultValueOf is never hit by the full compiler.

I will port to x64 and ARM when this has been reviewed for ia32.

I will remove the performance counters prior to final commit.

BUG=http://code.google.com/p/v8/issues/detail?id=760
TEST=test/mjsunit/regress/regress-760-1.js
TEST=test/mjsunit/regress/regress-760-2.js

Review URL: http://codereview.chromium.org/3117006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-12 13:43:08 +00:00
erik.corry@gmail.com
bdfdf8bee9 Fix fuzzer-found error where left and right were the same register in bitops.
Review URL: http://codereview.chromium.org/3115004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-10 12:30:14 +00:00
ricow@chromium.org
44425bcc03 Change dos line endings to unix line endings in a number of mjsunit test files.
Review URL: http://codereview.chromium.org/3072031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5212 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-09 12:21:50 +00:00
vegorov@chromium.org
4a2f05ce35 Fix issue 806.
Ensure that we are not using r12 as a receiver in inlined NamedStore code.

Review URL: http://codereview.chromium.org/3081007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5162 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-02 09:14:44 +00:00
whesse@chromium.org
3607a9e78e Fix error in optimized x.apply(y, arguments) code generation on ARM. Fixes issue 784. Adds regression test.
Review URL: http://codereview.chromium.org/3048035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-28 12:50:27 +00:00
whesse@chromium.org
cb1eedd269 Fix error in x64 fast smi loops, change 4998.
Review URL: http://codereview.chromium.org/2925012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-14 13:22:47 +00:00
ricow@chromium.org
eff34b9952 Update JSON.stringify to floor the space parameter (fixes issue 753).
Review URL: http://codereview.chromium.org/2877004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-29 07:22:40 +00:00
ricow@chromium.org
faaf524445 Fixes bug in Array.prototype.lastIndexOf when called with null or undefined as fromIndex argument. (fixes issue 754).
Review URL: http://codereview.chromium.org/2840021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4950 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 09:28:38 +00:00
ager@chromium.org
b71fe5b61e Fix bug in JSON.stringify where Boolean objects are incorrectly
unwrapped.

This fixes issue 752.
Review URL: http://codereview.chromium.org/2845023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 07:45:52 +00:00
lrn@chromium.org
7b46a1f49d Fix bug in regexp exec with global regexps.
Review URL: http://codereview.chromium.org/2826020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-25 07:00:29 +00:00
ricow@chromium.org
be531accc0 Add regression test for the code flushing in issue 474 (which was
fixed in revision 4921).

This also enables codeflushing by default.

Review URL: http://codereview.chromium.org/2829020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-23 08:02:06 +00:00
ricow@chromium.org
de512af068 Add support for elements and array indices in Object.defineProperty
(fixes bug 619).

This also fixes a bug in GetOwnProperty in runtime.cc discovered by
the new test cases. That part of the code was not testable before
since we had no way of correctly defining properties on elements.

Review URL: http://codereview.chromium.org/2832001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-14 13:55:38 +00:00
vegorov@chromium.org
1d932dcc6e Add regression tests for issues 728, 732
TBR=lrn@chromium.org

Review URL: http://codereview.chromium.org/2698004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-07 10:54:42 +00:00
ricow@chromium.org
95939ada29 Fix issue 720 making Object.defineProperty handle existing writable flags correctly.
The existing version will overwrite the existing writable flag with
false even in the case where no new value is given and the existing
writable flag is true.

The reason for the issue is that there is no check to see if the
provided descriptor actually has a writable attribute. This causes us
to use the default value (false) even in the case where nothing was
provided. In addition, the existing tests makes wrong assumptions (that writable is always set to false if not provided) and has been changed to follow the specification.

Review URL: http://codereview.chromium.org/2271001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-26 08:31:57 +00:00
ricow@chromium.org
fb58bc06c6 Fixes issue 712 causing non-configurable accessors to be overwritable by using
Object.defineProperty with empty property descriptor.

The issue is fixed by implementing step 5 and 6 from DefineOwnProperty in the
specification (ES5 8.12.9).

This also fixes a bug in SameValue when used on boolean values (it
would priorly return a number - not a boolean).

Review URL: http://codereview.chromium.org/2131019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-25 06:25:27 +00:00
ricow@chromium.org
8d51195778 Fixed issue 619 allowing Object.create to be called with a function.
This change allows Object.create to take a function as input in the
proto argument. The spec says that Type(O) for the proto argument
should be true but our IS_OBJECT does not check for this. I will make a
IS_SPEC_OBJECT in macros.py and refactor v8natives in another CL.

Review URL: http://codereview.chromium.org/2051001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-09 08:43:59 +00:00
ricow@chromium.org
fb3e01a306 Correct issue 696 with Date.parse returning a value when called on a non date string.
The error was introduced in revision 4557 where support was added for
ES5 date time format strings. Because there was no check for a valid
year a random string starting with a non-digit character would be
parsed.

This change disallows ES5 formatted dates where there is no date
fraction (i.e., with only a timestamp). Since none of the other
browsers support Date.parse on only timestamps I have disabled this
totally instead of just correcting the parser.


Review URL: http://codereview.chromium.org/2017005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4613 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-07 11:53:20 +00:00
ricow@chromium.org
f066a9af40 Added regression test for crbug 40931 http://crbug.com/40931
Review URL: http://codereview.chromium.org/1756013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-26 13:26:11 +00:00
ager@chromium.org
c0f1f18f80 Fix bug in KeyedLoadIC generic stub where signed instead of unsigned
comparison was used.

Review URL: http://codereview.chromium.org/1769005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-23 12:57:41 +00:00
ager@chromium.org
c678e44805 Add missing smi check in IC for nonexistent properties.
Add regression test.

BUG=v8:681
Review URL: http://codereview.chromium.org/1673005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4446 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-20 10:20:39 +00:00
ager@chromium.org
afc15bb48f Reapply load ICs for nonexistent properties.
We need to be careful to check global property cells for the property
encountered during lookup.  Therefore, the ICs have to be specific to
the name of the property if global objects are involved.  In
principle, this means that we could get a large number of monomorphic
ICs for the same map if there is a global object in the prototype
chain.  However, since this is only done for normal load ICs and not
for keyed load ICs I do not expect this to be a problem.  I will
experiment with it once this goes in.

BUG=675
Review URL: http://codereview.chromium.org/1559033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-15 11:25:41 +00:00
sgjesse@chromium.org
6a63910650 Re-apply "Inline floating point compare"
This re-applies r4220 and r4233, which was reverted in r4254 due to a bug. This bug has now been fixed, with the only change being line 2884 changed from

  __ SmiTag(left_side->reg());

to

  __ SmiTag(operand->reg());

Added a regression test.

BUG=http://crbug.com/39160
TEST=test/mjsunit/regress/regress-crbug-39160.js

Review URL: http://codereview.chromium.org/1251009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-25 12:04:34 +00:00
sgjesse@chromium.org
1963ffba99 Don't generate inline constructors if this.__proto__ is assigned.
BUG=http://code.google.com/p/v8/issues/detail?id=646
TEST=test/mjsunit/regress/regress-646.js
Review URL: http://codereview.chromium.org/1023008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-17 13:23:53 +00:00
fschneider@chromium.org
d0908674fa Fix bug in assigned variables analysis.
Property stores were not visited correctly by the visitor.
I fixed this issue by visiting property stores by visiting 
receiver and key directly (and not calling visit on the lhs property
 ast node)

Review URL: http://codereview.chromium.org/903003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-12 13:12:08 +00:00
fschneider@chromium.org
d896e4f6f2 Fix treatment of const variables in assigned variable analysis.
Const variables are not considered as trivial sub-expressions since
we have the check for the hole value as a side-effect.

Review URL: http://codereview.chromium.org/849003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4112 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-12 10:20:31 +00:00
sgjesse@chromium.org
b0c9738f77 Fix code cache lookup for keyed IC's
For keyed IC's the name is not necessarily a string.

BUG=http://crbug.com/37853
TEST=test/mjsunit/regress/regress-crbug-37853.js
Review URL: http://codereview.chromium.org/872001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-11 08:52:31 +00:00
sgjesse@chromium.org
800b6df2a6 Correct handling of adding a string and a smal integer
The fast case of looking up the string convertion of the smi did not handle the case where left/reghe operands could be in eax/edx instead of edx/eax which is the default.

Also got rid of creating an internal frame for calling string and instead patched the argument on the stack and performed a tail call.

BUG=http://code.google.com/p/v8/issues/detail?id=636
TEST=test/mjsunit/regress/regress-636.js
Review URL: http://codereview.chromium.org/720001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-09 09:40:35 +00:00
sgjesse@chromium.org
df4471c8f3 Fix stack tweaking in array allocation
When Array(0) or new Array(0) is handled by the generated code it is handled
by the same code as Array() and new Array(). For this to work the stack is
tweaked to remove the argument of value 0. However the argc was still passed
as 1 if a call to the runtime system was made.

When the stack is tweaked argc is also changed to 0.

BUG=634
TEST=test/mjsunittest/mjsunit/regress/regress-634.js
Review URL: http://codereview.chromium.org/668155

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-05 13:43:53 +00:00
kmillikin@chromium.org
3c0d77f32e Fix stack corruption when calling non-function.
Fix for issue 603.

Revision r3484 removed the property name from the call stack for
call ICs.  When a non-function was called via a call IC and
Function.prototype.call, an extra value was left on the stack that the
caller could not know to clean up.

Fix is to change the JS builtin used for calling non-functions.  It
now gets the callee as receiver, rather than iterating stack frames
and finding it on the expression stack of its JS caller.

Review URL: http://codereview.chromium.org/604064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-17 08:26:50 +00:00
antonm@chromium.org
087fedeae8 Normalize the object before updating getter/setter info.
BUG=612

Review URL: http://codereview.chromium.org/608014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-17 06:53:19 +00:00
sgjesse@chromium.org
10910394e6 Handle insertion order for simple constructors
When functions only have simple assignments of the form this.x = ... the object is created in generated code without actually calling the constructor. In this case the initial map for the function already contains the properties assigned in the constructor. The field descriptors in this initial map now has an enumeration index assigned to make property enumeration order the insertion order. The insertion order here is the order of the this.x assignments in the code.

BUG=http://crbug.com/3867
TEST=test/mjsunit/regress/regress-crbug-3867.js

Review URL: http://codereview.chromium.org/566016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-02 13:33:29 +00:00
whesse@chromium.org
04e9399694 Fix V8 issue 580: Arithmetic on some integer constants gives wrong anwers.
Review URL: http://codereview.chromium.org/545134

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-01-20 17:01:34 +00:00
mikhail.naganov@gmail.com
23fe22e7c8 Fix build problems.
Review URL: http://codereview.chromium.org/543087

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-01-15 20:15:47 +00:00
mikhail.naganov@gmail.com
a3c0f20035 Submit Object.getOwnPropertyNames patch by Pavel Feldman. See http://codereview.chromium.org/549050.
Add copyright to regression test to fix build broken by r3619.

TBR=sgjesse@chromium.org

Review URL: http://codereview.chromium.org/542092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3620 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-01-15 15:34:32 +00:00
sgjesse@chromium.org
562f90d375 Ensure correct boxing of values when calling functions on them
When a function is called with a value type as the receiver this is now boxed as an object.

This is a low-impact solution where the receiver is only boxed when required. For IC calls to the V8 builtins values are not boxed and as most of the functions on String.prototype, Number.prototype and Boolean.prototype are sitting there most IC calls on values will not need any boxing of the receiver.

For calls which are not IC calls but calls through the CallFunctionStub a flag is used to determine whether the receiver might be a value and only when that is the case will the receiver be boxed.

No changtes to Function.call and Function.apply - they already boxed values. According to the ES5 spec the receiver should not be boxed for these functions, but current browsers have not adopted that change yet.

BUG=223
TEST=test/mjsunit/value-wrapper.js
TEST=test/mjsunit/regress/regress-crbug-3184.js
Review URL: http://codereview.chromium.org/542087

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-01-15 13:42:32 +00:00
sgjesse@chromium.org
44b7c59eb5 Extend the maximum size map space
On 32-bit the maps are now aligned on a 32-byte boundary in order to encode more maps during compacting GC. The actual size of a map on 32-bit is 28 bytes making this change waste 4 bytes per map.

On 64-bit the encoding for compacting GC is now using more than 32-bits and the maps here are still pointer size aligned. The actual size of a map on 64-bit is 48 bytes and this change does not intruduce any waste.

My choice of 16 bits for kMapPageIndexBits for 64-bit should give the same maximum number of pages (8K) for map space. As maps on 64-bit are larger than on 32-bit the total number of maps on 64-bit will be smaller than on 32-bit. We could consider raising this to 17 or 18.

I moved the kPageSizeBits to globals.h as the calculation of the encoding really depended on this.

There are still an #ifdef/#endif in objects.h and this constant could be moved to globaks.h as well, but I kept it together with the related constants.

All the tests run in debug mode with additional options --gc-global --always-compact as well (except for a few tests on which also fails before this change when run with --gc-global --always-compact).

BUG=http://code.google.com/p/v8/issues/detail?id=524
BUG=http://crbug.com/29428
TEST=test/mjsunit/regress/regress-524.js

Review URL: http://codereview.chromium.org/504026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-12-17 08:53:18 +00:00
lrn@chromium.org
5bbb1d7bd6 Fix for issue 545: don't reuse this VariableProxy.
Review URL: http://codereview.chromium.org/464069


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-12-08 09:43:51 +00:00
kmillikin@chromium.org
0bf2822266 The toplevel code generator assumed that declarations did not shadow
parameters.  This could case the initial value to be lost or worse, a
crash.

Fix by handling the case of a declaration shadowing both
stack-allocated parameters and those in the arguments object.

This is related to V8 issue 540.
http://code.google.com/p/v8/issues/detail?id=540

BUG=29565
Review URL: http://codereview.chromium.org/469006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3429 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-12-07 13:31:47 +00:00
kmillikin@chromium.org
7266bd0b9a Fix issue 540 by handling the case that a declaration is in the
arguments object.

See http://code.google.com/p/v8/issues/detail?id=540
Review URL: http://codereview.chromium.org/460070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3421 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-12-04 11:59:09 +00:00
erik.corry@gmail.com
a0e12a3124 Fix toLocaleString-related breakage on buildbot.
TBR=ager
Review URL: http://codereview.chromium.org/449055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-12-01 14:19:23 +00:00
fschneider@chromium.org
1c90793581 Fix bug in the fast compiler's object literal code
Fixes issue 526:

BUG=http://code.google.com/p/v8/issues/detail?id=526

The object literals code in the fast compiler returned an incorrect result 
when getter or setters are defined together with computed properties.

Added a regression test that captures the most reduced version of this
problem. 

Also added a test for object literals with getters/setters and 
prototype properties.


Review URL: http://codereview.chromium.org/444001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-26 21:13:20 +00:00
ager@chromium.org
3cf9ce4736 Fix crash in string replace with regexp. If the suffix of the subject
string is larger than 2047 chars we will encode the slice as two Smis
instead of one.  The calculation of the max size of the string builder
did not take this into account.

BUG=http://code.google.com/p/v8/issues/detail?id=515
Review URL: http://codereview.chromium.org/402056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-18 18:48:04 +00:00
erik.corry@gmail.com
cc3896dfac Fix bug 503: undefined <= undefined should return false on ARM.
Review URL: http://codereview.chromium.org/399001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-16 14:12:27 +00:00
fschneider@chromium.org
2e3e770ab9 Add a regression test that exposes a stack corruption problem.
See http://code.google.com/p/chromium/issues/detail?id=27227

Review URL: http://codereview.chromium.org/385092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3303 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-13 13:58:48 +00:00
christian.plesner.hansen@gmail.com
5d4d5944dd Remove special-case for arguments.toString to match ES5
Patch by Jan de Mooij <jandemooij@gmail.com>
Review: http://codereview.chromium.org/273073

Review URL: http://codereview.chromium.org/389008


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-11 11:28:37 +00:00
ager@chromium.org
2252cc1bc9 Fix inline constructor code bailout.
Remove variable that is currently unused.

BUG=http://code.google.com/p/v8/issues/detail?id=502
Review URL: http://codereview.chromium.org/392001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-11 09:00:09 +00:00
erik.corry@gmail.com
57c919e414 Fix bug 486, Cyrillic character ranges in case independent regexps.
http://code.google.com/p/v8/issues/detail?id=486
Review URL: http://codereview.chromium.org/361033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-06 11:15:20 +00:00
ager@chromium.org
f39fbb206e Fix case where we treat an unaliased call to eval as an aliased call
to eval.

BUG=http://code.google.com/p/v8/issues/detail?id=496
Review URL: http://codereview.chromium.org/366027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-05 11:19:37 +00:00
sgjesse@chromium.org
77a71c90c7 Fix issue 491: constantpool dump violates ARM debugger assertion for return point
The generation of the return sequence is now protected from having the constant pool emitted inside of it in both compilers.

BUG=http://code.google.com/p/v8/issues/detail?id=491
TEST=test/mjsunit/regress/regress-491.js
Review URL: http://codereview.chromium.org/362003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-04 14:45:50 +00:00
sgjesse@chromium.org
54ec6c031a Fix xssue 492: ARM debug crash: mozilla/ecma/FunctionObjects/15.3.1.1-3
When the number of parameters times 4 (kPointerSize) to a function cannot be encoded in 12 bits the return sequence gets one more instruction. Changed the assertion to check for this case.

BUG=http://code.google.com/p/v8/issues/detail?id=492
TEST=test/mjsunit/regress/regress-492.js
Review URL: http://codereview.chromium.org/354028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-04 10:04:22 +00:00
sgjesse@chromium.org
b4c11d0816 Don't use string slices when processing RexExp replace (re-apply r3153)
Re-apply r3153 with a fix for issue 490. Except for the change in line 1756 and the added test this change is identical to http://codereview.chromium.org/342015.

BUG=490
TEST=test/mjsunit/regress/regress-490.js
Review URL: http://codereview.chromium.org/341064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3197 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-11-02 12:21:43 +00:00
lrn@chromium.org
0aecc29024 Issue 485: Fix leak of builtins object through call and apply functions.
Review URL: http://codereview.chromium.org/345007


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-28 13:51:30 +00:00
sgjesse@chromium.org
7a509f2101 Fix issue with running some constructors having only this.x = ... assignments.
If we had compiled the comment instead of the code it would have worked.

BUG=483
TEST=mjsunit/regress/regress-483.js
Review URL: http://codereview.chromium.org/332007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-23 12:18:47 +00:00
sgjesse@chromium.org
a637f45385 Fix issue 475
The check for arguments in registers in one of the three versions of GenericBinaryOpStub::GenerateCall was plain wrong.

BUG=475
TEST=mjsunit/regress/regress-475.js
Review URL: http://codereview.chromium.org/307002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3092 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-20 12:13:31 +00:00
peter.rybin@gmail.com
3b955790a0 Redo "running" field in debug-delay.js and support "suspend" command
It also fixes "backtrace" command so that it didn't give away random stack if we are running

Review URL: http://codereview.chromium.org/242034


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-15 20:06:08 +00:00
lrn@chromium.org
aed6a37c10 X64: Convert smis to holding 32 bits of payload.
Review URL: http://codereview.chromium.org/196139


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-08 12:36:12 +00:00
ager@chromium.org
e9acdc7a00 Follow the spec in disallowing function declarations without a name. We
used to allow these for compatibility, but both Safari and Firefox now
disallow them.
Review URL: http://codereview.chromium.org/242124

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-10-02 12:47:15 +00:00
kasperl@chromium.org
6621a43833 Add regression test case for http://crbug.com/18639 which
was fixed in r2642.
Review URL: http://codereview.chromium.org/192037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-09-08 07:22:35 +00:00
whesse@chromium.org
3703231636 Add safe handling of NaN to Posix platform-dependent time functions.
Review URL: http://codereview.chromium.org/160580

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-04 09:41:18 +00:00
whesse@chromium.org
18c6337a2c Fix an error in a keyed lookup stub - HeapNumbers treated as strings.
Review URL: http://codereview.chromium.org/155924

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-23 13:01:17 +00:00
kmillikin@chromium.org
1ca19c383d Fix ARM compiler crash in short-circuited boolean expressions.
We did not handle the case where the left-hand-side expression was
fully compiled to control flow.  There were also some assertions for
unary and binary expressions that crashed debug builds when the
expression was fully compiled to control flow.

Regression test added.

Review URL: http://codereview.chromium.org/160006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-23 11:40:14 +00:00
kmillikin@chromium.org
6443cb99f7 Fix issue 345 by avoiding duplicates in the list of escaping labels
from a try...catch...finally statement.

Review URL: http://codereview.chromium.org/149670

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-15 08:57:25 +00:00
lrn@chromium.org
e3bb851efb X64: Fix bug in left-shift.
Also changed a few other places that looked suspicious in the same way.
Added more info to failing test case and rewrote incorrect uses of mjsunit "fail" function.

Review URL: http://codereview.chromium.org/155279


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-09 08:00:12 +00:00
kasperl@chromium.org
b0f411c298 Fix issue 397 and issue 399.
Review URL: http://codereview.chromium.org/149247

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2372 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-07 11:57:09 +00:00
kasperl@chromium.org
f0053e89aa Add regression test case for issue 396.
Review URL: http://codereview.chromium.org/150215

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-02 09:08:15 +00:00
sgjesse@chromium.org
25405ddd9c Handle JavaScript accessors on the global object.
With the new representation of the global object adding JavaScript accessors for a property after global inline caches was created for that property did not work property as the inline caches did not take the JavaScript accessor information (fixed array with two elements) that could be present in a global object property cell into account.

This is now fixed by changing the map for a global object when a JavaScript accessor is defined on it.

BUG=394
TEST=test\mjsunit\regress\regress-394.js
Review URL: http://codereview.chromium.org/150162

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-01 11:20:33 +00:00
kasperl@chromium.org
3ae01ab8ef Fix issue 392 by disabling the TakeValue optimization for
access to the arguments object.
Review URL: http://codereview.chromium.org/150016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-29 06:20:52 +00:00
lrn@chromium.org
2dd9717c4b Fix bug in static type inference for loops.
Review URL: http://codereview.chromium.org/140058


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-22 12:36:01 +00:00
whesse@chromium.org
74ddab9d94 Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitions.
Review URL: http://codereview.chromium.org/141031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-22 07:41:15 +00:00
erik.corry@gmail.com
e2a01ed4fb Fix regexp bug reported by Ian where [6-9] would match any digit.
Review URL: http://codereview.chromium.org/140021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2226 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-20 17:57:09 +00:00
lrn@chromium.org
945245393c Fix for issue 351 - lastIndexOf.
Review URL: http://codereview.chromium.org/113838


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-05-26 15:42:06 +00:00
lrn@chromium.org
2ff3901cf7 Fix for issue 349: Make initial boundary check for BM text search.
There was a case where the BMH algorithm bailed out exactly at the end of the string, and the BM algorithm that takes over wasn't expecting this.

Review URL: http://codereview.chromium.org/113575


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-05-19 09:01:03 +00:00
whesse@chromium.org
1ae8a7da3d Fix bug 344: always keep attributes of existing properties.
Review URL: http://codereview.chromium.org/113197

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-05-13 10:46:28 +00:00
kmillikin@chromium.org
18f69a7171 Fix for issue 341. In the stub for instanceof, we could try to read
an object's map before we were sure it was a heap object.
Review URL: http://codereview.chromium.org/115236

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-05-12 11:40:14 +00:00
lrn@chromium.org
889eac7f13 Fix Issue 326. Handle sorting of non-array objects correctly.
Change handling of sorting to be the same for all JS-arrays.
Collect undefined values as well while removing holes.

Review URL: http://codereview.chromium.org/92123


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-27 11:16:59 +00:00
kmillikin@chromium.org
cb9d66638b Fix regression test by wrapping expression in a thunk^H^H^H^H^Hstring.
Review URL: http://codereview.chromium.org/95001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-22 17:44:28 +00:00
kmillikin@chromium.org
b39f4383dc When merging a frame to an expected on at block entry, the static type
of elements is set to a safe lower bound.  Move the setting of the
static type out of VirtualFrame::MergeTo (which is not necessarily run
for all frames) and into VirtualFrame::PrepareMergeTo (which is).
Review URL: http://codereview.chromium.org/92009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1767 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-22 13:19:38 +00:00
lrn@chromium.org
bfb33b1e2f Fix for Issue 317 - bug in string.replace(string, "$foo").
Fix for Issue 317. Replace string with something containing dollar now works.

Review URL: http://codereview.chromium.org/94002


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-22 11:43:05 +00:00
kmillikin@chromium.org
22896c8304 Change the function name collector to tolerate expressions that contain
multiple anonymous function literals as subexpressions.

Choose the rightmost one the one to attach a name to.
Review URL: http://codereview.chromium.org/67165

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-15 13:14:23 +00:00
sgjesse@chromium.org
a74fcf458c Fixed the step in handling for function.apply.
The generic step-in mechanism floods the function called with break points to ensure a break is hit when entering the function. This generic mechanism was also used for function.apply. The code for function.apply contains a keyed load IC which was patched when stepping into function.apply. However function.apply enteres an internal frame not a JavaScript frame. This caused the logic for returning from the break in function.apply to fail as it forced a jump to the IC on the top JavaScript frame. The top JavaScript frame was the frame for the function calling function.apply not the frame for the apply function. Now returning from the break point in the keyed load IC in the apply code caused a jump to the code for the call IC for the function calling function.apply in the first place. Not a pretty sight.

Step-in now handles function.apply as a separate case where the actual JavaScript function called through apply is flodded with breakpoints instead of the function.apply function.

BUG=269
BUG=8210@chromium.org
Review URL: http://codereview.chromium.org/63055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-04-07 09:54:53 +00:00
kmillikin@chromium.org
c80b013999 Fix issue 294 by ensuring that we don't lose the copy flag on memory
frame elements when allocating them to a register as a result of
popping one of their copies.
Review URL: http://codereview.chromium.org/57053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-31 14:01:25 +00:00
kmillikin@chromium.org
1ba34bf86b Fix issue 286. Ensure frame elements are invalidated by
InvalidateFrameSlotAt.

Review URL: http://codereview.chromium.org/53008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-24 12:42:28 +00:00
kmillikin@chromium.org
5e2f3adfd0 Fix issue 284.
The problem was continuing out of the body of a for/in (where we do
register allocation) to the loop update (where we do not).  Variables
allocated to registers where not preserved.

Review URL: http://codereview.chromium.org/53002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-24 08:29:24 +00:00
olehougaard
a8c50151fc Reapply revisions 1432, 1433, 1469 and 1472 while fixing issue 279.
Review URL: http://codereview.chromium.org/48006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-23 07:27:47 +00:00
ager@chromium.org
2fcad0aec1 Revert change 1509 that flush ICs when adding setters on an object or
when setting a __proto__ to an object that holds a setter.

This seems to cause a major page load regression, so we need to tune
the clearing.
Review URL: http://codereview.chromium.org/50011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-19 15:06:00 +00:00
kasperl@chromium.org
0a09a08ec8 Add copyright notice to new test case.
Review URL: http://codereview.chromium.org/42216

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1514 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-15 22:44:23 +00:00
erik.corry@gmail.com
99063fe0f8 Fix GC related crash bug in search-replace.
Review URL: http://codereview.chromium.org/42214

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-15 22:28:26 +00:00
erik.corry@gmail.com
3aa57f7f65 Revert 1432, 1433, 1469 and 1472 due to a bug with literal objects.
Review URL: http://codereview.chromium.org/46088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-15 16:18:20 +00:00
christian.plesner.hansen@gmail.com
8dffcb9efa Flush ICs when adding setters to an object or setting a __proto__ to
an object that holds a setter.  If there are no store ics then no
flushing is done.  The implementation has been tweaked so that no ICs
are cleared during normal context creation.
This may cost us some performance but I'm submitting it as it is and
if there are problems we can either decide to be smarter about when,
what and/or how we clear, or back this change out altogether.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-13 13:43:07 +00:00
kmillikin@chromium.org
0e60cf38dc Fix issue 265 by handling extra statement state on the frame based on
the expectation at the break, continue, and return labels (including
shadowed ones) instead of based on the AST nodes.

See http://code.google.com/p/v8/issues/detail?id=265

Review URL: http://codereview.chromium.org/42017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-11 06:17:19 +00:00
lrn@chromium.org
34db0ff86c Issue 267: Calls to arguments in eval-tainted function scope uses global object as receiver.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-10 12:28:34 +00:00
christian.plesner.hansen@gmail.com
782b53799d Implemented invalid UTF8 detection in decodeURI. That is, detection
of invalid utf8 not invalid utf8-detection.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-10 09:08:05 +00:00
ager@chromium.org
bab4b3b2e0 Simplify the map collection regression test. This test is the minimal
example that would trigger the bug.
Review URL: http://codereview.chromium.org/43004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-10 07:23:22 +00:00
ager@chromium.org
38548e3da6 Make map collection test run faster in an attempt to make it pass on
buildbot (not timeout).

This consistently fails with the old build.

TBR=whesse
Review URL: http://codereview.chromium.org/40302

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-09 18:00:39 +00:00
whesse@chromium.org
7977c6c680 Fix garbage collection of unused maps. Null descriptors, created
by map collection, are now handled correctly everywhere.  The 
map-collect flag is now true by default.
Review URL: http://codereview.chromium.org/40218

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-09 16:24:46 +00:00
kmillikin@chromium.org
34af9f2ecf Work around issue 260 for now by disabling duplication of the loop
condition for while and for loops.

http://code.google.com/p/v8/issues/detail?id=260

Review URL: http://codereview.chromium.org/40294

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-09 14:12:20 +00:00
kmillikin@chromium.org
ece2c03160 Fix issue 263:
http://code.google.com/p/v8/issues/detail?id=263

Sharing the code to unlink the exception handler for a try/finally
causes us to try to merge virtual frames with different heights (due
to statements that keep state on the stack) at the entry to the unlink
code.

Avoid this by unlinking the handler separately for each exit from the
try block.
Review URL: http://codereview.chromium.org/39331

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1449 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-09 10:51:57 +00:00
kmillikin@chromium.org
182c3ebb2d Reapply r1434 and port to ARM.
Review URL: http://codereview.chromium.org/40220

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-06 14:18:03 +00:00
christian.plesner.hansen@gmail.com
2a2c9381ea Reverted r1434
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1437 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-06 11:59:53 +00:00
kmillikin@chromium.org
b638d5c613 Fix issue 259.
http://code.google.com/p/v8/issues/detail?id=259

Due to constant folding of loop conditions, it is possible to have a
try/finally with no exits from the try block (eg, an infinite loop in
the try block).  In that case the code to unlink the try handler is
dead and should not be emitted.

Review URL: http://codereview.chromium.org/39251

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-06 10:18:33 +00:00
lrn@chromium.org
21fb24e0b2 Issue 254 - now correctly updates lastIndexof when using the test method.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1418 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-04 12:29:37 +00:00
olehougaard
7bd50d046d Fixed issue 253. No longer assuming that the target of a property lookup is a JSObject.
Review URL: http://codereview.chromium.org/39126

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-04 11:57:24 +00:00
lrn@chromium.org
4852bef23d Issue 246 - wait until regexp is parsed to detect whether it's simple.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1412 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-03-04 09:52:01 +00:00
lrn@chromium.org
80bb2cc546 Missing handle check. Triggers bug if the runtime stack overflows and it is detected by a global regexp.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-13 09:40:15 +00:00
lrn@chromium.org
0b1f3f2134 Issue 231 - Irregexp backtracking stack pointer could become corrupted.
http://code.google.com/p/v8/issues/detail?id=231


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-12 13:07:58 +00:00
lrn@chromium.org
396fa22799 Regular Expression literal flags may contain unicode escapes. If these escape any of the
valid flags, "gim", they should work.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1253 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-12 09:09:28 +00:00
lrn@chromium.org
c621bbbe45 Issue 227 Fixed. Properly handles non-ASCII characters in quick-check on ASCII strings.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1248 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-11 11:54:30 +00:00
lrn@chromium.org
b0e3ee6274 Fix bug 225 in regexp replace with function.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-05 13:24:13 +00:00
sgjesse@chromium.org
d131ecf3dd Changed the debugger API to allow only one debug event listener to be registered. The public API now only has SetDebugEventListener instead of AddDebugEventListener and RemoveDebugEventListener.
Moved the registrered debug event listener from the context to a global handle in the Debugger class. Storing it in the context did not make much sense.

Changed a lot of tests to handle the API change.

BUG=1242707
Review URL: http://codereview.chromium.org/19753

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1212 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-03 07:59:12 +00:00
ager@chromium.org
c33e51681f Fix issue 221:
http://code.google.com/p/v8/issues/detail?id=221

The attempt to resolve 'eval' went into an infinite loop.  Also, we
need to throw a reference error in case 'eval' cannot be resolved.
Review URL: http://codereview.chromium.org/19536

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-02 13:18:20 +00:00
kmillikin@chromium.org
46023fb742 Fix for off-by-one when initializing a constant or function
declaration that was not a slot.
Review URL: http://codereview.chromium.org/19745

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1203 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-02-02 12:05:13 +00:00
lrn@chromium.org
0730ada63e Allow duplicate flags in regexps to match other browsers.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1193 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-30 12:36:40 +00:00
lrn@chromium.org
2de5de495f Irregexp: Backtrack past look-aheads works correctly.
Allows backtracking to clear registers instead of pushing and popping
them to restore state.
Redo of 1135 with bug fixed.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1156 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-26 14:38:17 +00:00
ager@chromium.org
524e34b8f8 Fix issue 192 by propagating out exceptions from object literal
boilerplate creation.

Removed declaration of unused and unimplemented function.
Review URL: http://codereview.chromium.org/18749

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-26 13:10:26 +00:00
erik.corry@gmail.com
108fe9dbcc complete revert by removing empty files
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-23 15:50:33 +00:00
erik.corry@gmail.com
f6c3ef2d2a Reverting r1136 due to crashes
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-23 14:33:19 +00:00
lrn@chromium.org
18c2d3ef4e Clears captures of look-aheads on backtrack.
Reduces number of pushes when flushing a trace. Some are converted to clears
in the undo-code instead, and some just ignored if they have no value worth restoring.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-23 13:34:51 +00:00
ager@chromium.org
39842baecf Do not violate the assumption that fast-case arrays have Smi length
when transforming from slow to fast-case array elements.

This fixes issue 201:
  
   http://code.google.com/p/v8/issues/detail?id=201
   
Review URL: http://codereview.chromium.org/18711

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-23 13:08:29 +00:00
ager@chromium.org
8a731355be Make sure that eval and try-catch introduced context extension objects
act as if they have no properties in their prototype chains.

This fixes V8 issue 193:

  http://code.google.com/p/v8/issues/detail?id=193.
Review URL: http://codereview.chromium.org/18709

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-23 12:16:03 +00:00
ager@chromium.org
c23dbc1928 Fix handling of const initialization. We did not handle the fact that
a const variable can be deleted between its declaration and its
initialization.

This fixes issue 189:

  http://code.google.com/p/v8/issues/detail?id=189

Review URL: http://codereview.chromium.org/18660

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1127 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-22 13:53:06 +00:00
sgjesse@chromium.org
c2c780bfc4 Added handles to the mirror objects. When a mirror for an object is created
it is assigned a numeric handle. Handles are used to make a 1:1
correspondence between objects and mirrors. Currently the mirrors are
cached in a JavaScript array and when creating a mirror this cache is
checked to see if a mirror already exists for the object. This cache is
cleared when leaving the debugger.

Changed the serialization format to take advantage of these handles. When
an object is serialized referenced objects are represented just by their
handle id serialized as '{ref:<handle>}'. During serialization the
referenced handles are collected and the serializer can provide a
serialization of all the referenced objects.

Removed the special handling of array properties. Indexed properties and
the length property are now rendered as named properties in the
serialization.

Removed the special serialization handling of RegExp properties. The
properties 'source', 'global', 'ignoreCase' and 'multiline' are serialized
with the rest of the properties.

Changed a lot of tests to handle the changed format.
Review URL: http://codereview.chromium.org/18092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-16 09:54:46 +00:00
ager@chromium.org
47d1298236 Change the handling of catch blocks to use context extension objects
instead of normal JSObjects.

This ensures that __proto__ and accessors on the Object prototype do
not interfere with catch scopes.  Also, it fixes the bug that catch
variables were not DontDelete (issue 74).

Next step is to create special lookup routines for context extension
objects and remove the special handling of context extension objects
from the general javascript object lookup routines.
Review URL: http://codereview.chromium.org/18143

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-16 09:42:08 +00:00
sgjesse@chromium.org
dc2a0ec3e9 Reverted r1078 as it was committed by accident without review.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1079 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-15 12:29:05 +00:00
sgjesse@chromium.org
6bc1d40a57 Added handles to the mirror objects. When a mirror for an object is created it is assigned a numeric handle. Handles are used to make a 1:1 correspondence between objects and mirrors. Currently the mirrors are cached in a JavaScript array and when creating a mirror this cache is checked to see if a mirror already exists for the object. This cache is cleared when leaving the debugger.
Changed the serialization format to take advantage of these handles. When an object is serialized referenced objects are represented just by their handle id serialized as '{ref:<handle>}'. During serialization the referenced handles are collected and the serializer can provide a serialization of all the referenced objects.

Removed the special handling of array properties. Indexed properties and the length property are now rendered as named properties in the serialization.

Removed the special serialization handling of RegExp properties. The properties 'source', 'global', 'ignoreCase' and 'multiline' are serialized with the rest of the properties.

Changed a lot of tests to handle the changed format.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-15 12:10:34 +00:00
ager@chromium.org
384b0a5408 Fix issue 191:
http://code.google.com/p/v8/issues/detail?id=191

Accessor setters should not be called for eval-introduced context
extension objects.

This change fixes the issue, but I think it is time to separate out
the lookup routines for eval-introduced context extension objects.
There is no reason to use the general lookup routines for this.  I'll
do that in a separate changelist.
Review URL: http://codereview.chromium.org/18090

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-15 11:31:08 +00:00
ager@chromium.org
d4dae20a12 Fix issue 186:
http://code.google.com/p/v8/issues/detail?id=186

Create a new instance type for context extension objects.  Use it to
not use the __proto__ accessor for context extension objects.
Review URL: http://codereview.chromium.org/18044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-14 12:13:26 +00:00
christian.plesner.hansen@gmail.com
d6e6508bd7 Added clearing of captures before entering the body of a loop. This
also revealed a bug or two that had to be fixed.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-14 11:32:23 +00:00
iposva@chromium.org
f3da5ff626 Fix for issue 171:
- Make sure to not destroy the instance type by slightly rearranging the code.
- Added regression test.

Review URL: http://codereview.chromium.org/16594

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-07 23:26:31 +00:00
olehougaard
726aa859c6 Fix for issue 91 (http://code.google.com/p/v8/issues/detail?id=91)
Review URL: http://codereview.chromium.org/17232

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-01-07 09:58:58 +00:00
christian.plesner.hansen@gmail.com
b57b4a15cd Merge regexp2000 back into bleeding_edge
Review URL: http://codereview.chromium.org/12427

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-25 11:07:48 +00:00
lrn@chromium.org
4e3bbd8247 If a HeapNumber is the incoming value, it must be converted to Smi before
checking. This is not done in a fast way.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-03 13:33:13 +00:00