Commit Graph

1153 Commits

Author SHA1 Message Date
ager@chromium.org
bfa2ef1f11 Fix receiver for calls to strict-mode and builtin functions that are
potentially shadowed by eval.

R=sgjesse@chromium.org
TEST=mjsunit/regress/regress-124.js

Review URL: http://codereview.chromium.org/7096004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-31 07:57:22 +00:00
ager@chromium.org
017935408d Reapply change to Pass undefined to JS builtins when called with
implicit receiver.

A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=fschneider@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7085034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-30 13:49:22 +00:00
ager@chromium.org
cc4a2d7e76 Fix a number of IC stubs to correctly set the call kind.
Make the call kind and call wrapper arguments explicit to force
developers to make a choice. This would have avoided the bug in the
first case.

R=fschneider@chromium.org
TEST=mjsunit/strict-mode-implicit-receiver.js

Review URL: http://codereview.chromium.org/7086029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-30 13:23:17 +00:00
fschneider@chromium.org
e0985887bf Simple support for const variables in Crankshaft.
The approach is to handle the common case in the optimizing
compiler and to bailout for the rare corner cases.

This is done by initializing all local const-variables with
the hole value and disallowing any use of the hole value statically.
Review URL: http://codereview.chromium.org/6026006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-30 11:31:41 +00:00
sgjesse@chromium.org
5cd77037aa ARM: Avoid using ldrd/strd with post increment
These instructions seems to cause problems in some situations. This reverts parts of r7873.

R=erik.corry@gmail.com

BUG=none
TEST=none

Review URL: http://codereview.chromium.org//6962010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8080 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-26 13:52:14 +00:00
danno@chromium.org
665219b8a7 Fix stray character in last build
TBR=kmillikin@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-26 12:16:13 +00:00
danno@chromium.org
c2394e0a71 Prevent deopt on double value assignment to typed arrays
Implement truncation of double and tagged values when assigning to an element of a typed arrays in order to avoid depots.

BUG=1313
TEST=test/mjsunit/external-array.js

Review URL: http://codereview.chromium.org/6961019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-26 12:07:22 +00:00
ager@chromium.org
c832c467a4 Revert "Pass undefined to JS builtins when called with implicit receiver."
Presubmit and failing test.

TBR=lrn@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7071009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-26 11:22:29 +00:00
ager@chromium.org
19b718fe73 Pass undefined to JS builtins when called with implicit receiver.
A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=lrn@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7068009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-26 11:07:48 +00:00
erik.corry@gmail.com
fbf76fc86a Fix GC-unsafe corner case in bit-not on ARM
Review URL: http://codereview.chromium.org/6987009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-25 10:35:00 +00:00
whesse@chromium.org
ce77e9499d Remove some dead code from full-codegen on all platforms.
BUG=
TEST=

Review URL: http://codereview.chromium.org/6966033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8047 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-24 15:11:48 +00:00
ager@chromium.org
6f775f2fb0 Fix calls of strict mode function with an implicit receiver.
Only IA32 version for now. I'll start porting.

Strict mode functions are to get 'undefined' as the receiver when
called with an implicit receiver. Modes are bad! It forces us to have
checks on all function calls.

This change attempts to limit the cost by passing information about
whether or not a call is with an implicit or explicit receiver in ecx
as part of the calling convention. The cost is setting ecx on all
calls and checking ecx on entry to strict mode functions.

Implicit/explicit receiver state has to be maintained by ICs. Various
stubs have to not clobber ecx or save and restore it.

CallFunction stub needs to check if the receiver is implicit when it
doesn't know from the context.

Review URL: http://codereview.chromium.org/7039036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-24 14:01:36 +00:00
whesse@chromium.org
583afefab5 Modify use of RelocInfo::CODE_TARGET_WITH_ID in full-codegen to make it the same on all platforms.
BUG=
TEST=

Review URL: http://codereview.chromium.org/7063021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-24 13:48:55 +00:00
fschneider@chromium.org
5552dbccdd Rename TypeRecording...Stub into ...Stub.
There is no need for this long name.
Review URL: http://codereview.chromium.org/7063017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-24 12:20:16 +00:00
karlklose@chromium.org
b082e6cc73 Remove stub call in non-VFP3 code path of external array load.
KeyedLoadStubCompiler::GenerateLoadExternalArray is tail-calling a stub, which it is not allowed to, because its major key is higher than InstanceOf. Instead of changing the major key I decided to provide an inline implementation.

TEST=test-api/ExternalArrays with --noenable-vfp3

R=danno@chromium.org

Review URL: http://codereview.chromium.org/7060007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 16:17:40 +00:00
danno@chromium.org
70d5e6d582 Add bit_field3 to Map objects
Reuse instance_descriptor field in the map to store additional flags when there are no descriptors. When descriptors get added to the map, move the flags to the DescriptorArray and access through indirection.

Review URL: http://codereview.chromium.org/7033024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 15:59:38 +00:00
whesse@chromium.org
d88dbf27f5 Avoid calling ToObject on JSFunction receiver arguments for Function.call and Function.apply.
BUG=
TEST=

Review URL: http://codereview.chromium.org/7062007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 15:17:10 +00:00
danno@chromium.org
b21987203e Ensure SMI check for receiver in external array store stub for ARM.
R=ager@chromium.org
BUG=none
TEST=test/mjsunit/external-array.js

Review URL: http://codereview.chromium.org/7058011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 15:04:32 +00:00
danno@chromium.org
780df33019 SMI checks for receiver in KeyedLoad/Store (done right this time)
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7059013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 13:42:33 +00:00
sgjesse@chromium.org
0e0b1b2da9 Optimise the deoptimisation check to improve performance on modern ARM cores.
BUG=none
TEST=none

Committed: http://code.google.com/p/v8/source/detail?r=7909

Reverted in r7916.

Review URL: http://codereview.chromium.org//7021007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7991 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 12:48:17 +00:00
danno@chromium.org
a86e0b7708 Add missing SMI checks to fix reliability bots
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/6974008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7989 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-23 11:40:36 +00:00
svenpanne@chromium.org
969a909e3a Refactoring only: Simplified LChunkBuilder:DoTest a bit, making it a simple if-then-else cascade.
Review URL: http://codereview.chromium.org/7055006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-20 11:49:52 +00:00
fschneider@chromium.org
f2cb08f1c2 Fix handling of -0 in the unary-op IC and avoid repeated patching/transitions.
When the stub return a heap number we do a state transition to
a version HEAP_NUMBER that can handle -0.

There is room for further improvement in the typefeedback for the
case of -0. This change however does not address this and only fixes
the acute issue.
Review URL: http://codereview.chromium.org/7037025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7944 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 17:32:36 +00:00
danno@chromium.org
123500999f Reland 7917:
Better support for 'polymorphic' JS and external arrays

Allow  keyed store/load stubs to switch between external array and fast JS arrays without forcing a state transition to the generic stub.

There CL consists of two pieces of functionality. First, code stubs for fast element arrays don't immediately transition to the MEGAMORPHIC state when there's a map mismatch. Second, two ICs are cached per map for fast elements, the MONOMORPHIC version, and a new MEGAMORPHIC version that handles two or more different maps and dispatches to shared stubs to perform the array operation.

Review URL: http://codereview.chromium.org/7036016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 13:17:29 +00:00
whesse@chromium.org
f40c463526 Fix bug 1396: Optimized calls to API functions assumed that the receiver was a JSObject, failed when compiling stub otherwise.
BUG=v8:1396
Review URL: http://codereview.chromium.org/7045002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 12:20:36 +00:00
svenpanne@chromium.org
f39b0dfccb Handle all kind of arguments in the ToBooleanStub. While this is not very thrilling in itself, it is one of several steps to add type recording to this stub. Removed a duplicate check for null in the ARM stub and made a tiny simplification, removing a sub instruction.
As a side note, this change has some positive impact on the performace, e.g. imaging-darkroom is 8.3% faster and ws-ieee754conv is even 19.9% faster. No idea why the speedup is so big in some cases, but never look a gift horse in the mouth... ;-)
Review URL: http://codereview.chromium.org/7042004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 10:40:01 +00:00
danno@chromium.org
83c84a43e8 Revert 7917
TBR=danno@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 18:47:10 +00:00
danno@chromium.org
5a9b2b3c5f Better support for 'polymorphic' JS and external arrays
Allow  keyed store/load stubs to switch between external array and fast JS arrays without forcing a state transition to the generic stub.

There CL consists of two pieces of functionality. First, code stubs for fast element arrays don't immediately transition to the MEGAMORPHIC state when there's a map mismatch. Second, two ICs are cached per map for fast elements, the MONOMORPHIC version, and a new MEGAMORPHIC version that handles two or more different maps. Currently, the only array types supported by the MEGAMORPHIC stub are fast elements for objects and JSArrays.

BUG=
TEST=

Review URL: http://codereview.chromium.org/6894003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 17:29:13 +00:00
sgjesse@chromium.org
46aeea9d3a Revert r7909
r7909: Optimise the deoptimisation check to improve performance on modern ARM cores.

Assert failure on mozilla/ecma/Date/15.9.3.8-2 and mozilla/ecma/Date/15.9.3.8-4.

R=ricow@chromium.org

Review URL: http://codereview.chromium.org//7037006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7916 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 12:43:14 +00:00
danno@chromium.org
ecc25bfb47 Add enumeration to specify if smi check needed
R==ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7039004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 12:05:06 +00:00
whesse@chromium.org
0eca2b4fc1 Fix error in postfix ++ in Crankshaft.
Add HForceRepresentation, to represent the implicit ToNumber applied to the input of a count operation.

BUG=v8:1389

TEST=

Review URL: http://codereview.chromium.org/7033008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7913 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 11:41:59 +00:00
fschneider@chromium.org
7d446f7f4c Fix bug restoring of JS entry sp so to fix profiler-related valgrind issues.
The profiler did not correctly identify when there was a JS frame
on the stack after an exception was thrown.

I also refactored the code to use PopTryHandler macro-instructions on all platforms

BUG=73722
TEST=No more valgrind errors related to v8::internal::StackFrameIterator.
Review URL: http://codereview.chromium.org/7019010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 11:11:12 +00:00
sgjesse@chromium.org
9bddc8e0d8 Optimise the deoptimisation check to improve performance on modern ARM cores.
BUG=none
TEST=none

Review URL: http://codereview.chromium.org//7021007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 10:52:51 +00:00
danno@chromium.org
7185ec6ca8 Remaining (forgotten) feedback for pixel array deopt fix
TBR=kmillikin@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7019008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 07:22:01 +00:00
danno@chromium.org
daa1be1226 Support conversion of clamped double values for pixel arrays in Crankshaft.
BUG=1313
TEST=test/mjsunit/external-array.js

Review URL: http://codereview.chromium.org/7014033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-16 14:10:56 +00:00
vegorov@chromium.org
850b106400 Extend GCMole with poor man's data flow analysis to catch dead raw pointer vars.
Fix various places in the code found by improved GCMole.

Review URL: http://codereview.chromium.org/6973063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7895 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-16 09:06:16 +00:00
ricow@chromium.org
964dbff40d Only send null or undefined as receiver for es5 natives, not generally
for builtin functions.
Review URL: http://codereview.chromium.org/7012012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7879 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-13 07:26:44 +00:00
karlklose@chromium.org
b606195012 ARM: Fix disasm for strh, vabs, vneg. Add load/store tests.
Patch from ARM Ltd.

BUG=none
TEST=added to test/cctest/test-disasm-arm.cc

Original review at http://codereview.chromium.org/7013024/.

Review URL: http://codereview.chromium.org/7013027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-12 14:44:49 +00:00
sgjesse@chromium.org
b9c771c106 ARM: Reduce amount of code generated for context save on deopt.
BUG=none
TEST=none

Review URL: http://codereview.chromium.org//6930038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-12 13:33:14 +00:00
vitalyr@chromium.org
03c00ee6a6 Support symbol comparison in crankshaft.
Review URL: http://codereview.chromium.org/7000021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 12:50:04 +00:00
whesse@chromium.org
b77f131914 Don't emit code for HContext values with no uses.
BUG=
TEST=

Review URL: http://codereview.chromium.org/6982023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 12:11:23 +00:00
vitalyr@chromium.org
4cc800b3cf Support %_IsUndetectableObject in crankshaft.
Review URL: http://codereview.chromium.org/6995046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 11:53:43 +00:00
fschneider@chromium.org
6db15ae34b Remove peephole optimiziations from IA32 and ARM assembler.
They are not used with Crankshaft anymore.
Review URL: http://codereview.chromium.org/7003025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 11:29:53 +00:00
whesse@chromium.org
bf06fbdbf1 Recommit "First step in letting Crankshaft inline functions with a different context.""
This reverts r7810, thus recommitting 7807.

BUG=
TEST=

Review URL: http://codereview.chromium.org/6963009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 11:03:12 +00:00
erik.corry@gmail.com
291781ed3c Limit the generation of regexp code with large inlined constants.
Review URL: http://codereview.chromium.org/6997015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-11 06:39:27 +00:00
jkummerow@chromium.org
944a388412 Avoid using a register for constant external array indices.
This CL is based on and obsoletes CL 6879037.

TEST=mjsunit/external-array.js

Review URL: http://codereview.chromium.org/6902112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-10 15:25:17 +00:00
vitalyr@chromium.org
c10267f1fa Refactor HCheckInstanceType to allow mask/tag tests.
This allows us to get rid of totally fake LAST_STRING_TYPE and makes
it possible to test for symbols.

I considered splitting HCheckInstanceType into two instructions, but
it seems nice to be able to hide the instance type implementation
details from the hydrogen level.

Review URL: http://codereview.chromium.org/6964011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-10 14:17:23 +00:00
vegorov@chromium.org
d9c80d4771 Propagate a Failure from GenerateDictionaryNegativeLookup instead of causing GC.
Review URL: http://codereview.chromium.org/6973001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-09 16:15:18 +00:00
fschneider@chromium.org
45d07bcd32 Simple elimination of redundant array-hole checks.
If the result of an fast elements load is converted to an untagged
representation we can omit the hole check if the value is not used
anywhere else except for HChange instructions converting it to
an untagged representation since those will deoptimize for the hole
value anyway.
Review URL: http://codereview.chromium.org/6964012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-09 15:21:40 +00:00
vitalyr@chromium.org
07ed2f1263 Compare IC: add SYMBOLS state.
Review URL: http://codereview.chromium.org/6960011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-09 13:30:04 +00:00