AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
12,563 Commits 1 Branch 0 Tags 839 MiB
c52b7bba05
Commit Graph

2223 Commits

Author SHA1 Message Date
yangguo@chromium.org
c52b7bba05 Fix regressions triggered by map invalidation during graph creation. 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/22807003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-12 14:10:25 +00:00
yangguo@chromium.org
c0d1ba2ede Do not materialize uninitialized const for debug evaluate. 
R=prybin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/22822002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16148 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-12 13:35:46 +00:00
machenbach@chromium.org
cfb7ef44ca Ignore an unsuitable test under deopt fuzz. 
That test relies on certain optimization/deoptimization points and is therefore not useful for the deopt fuzzer.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22475011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-12 08:59:42 +00:00
verwaest@chromium.org
ee53b0a5ed Make all load-named-fields depend on their map-check, unless explicitly ignored. 
BUG=
R=titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22555004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-09 18:40:10 +00:00
verwaest@chromium.org
3715358145 Replace LoadNamedFieldPolymorphic with explicit branches. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22213002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-09 14:04:47 +00:00
verwaest@chromium.org
19659646ca Fix smi-based math floor. 
BUG=chromium:270268
R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22623007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-09 11:21:03 +00:00
verwaest@chromium.org
e5afd32129 Fix Object.freeze, Object.observe wrt CountOperation and CompoundAssignment. 
BUG=2774,2779
R=adamk@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22562004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16111 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-07 18:45:41 +00:00
jkummerow@chromium.org
371ac893f9 Check for empty handle in JSON stringifier 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/22420004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-07 16:34:13 +00:00
prybin@chromium.org
29bb553b1d Fix step in positions (include various calls and exclude current pc point), add a test 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/22198002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16100 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-07 12:27:22 +00:00
mstarzinger@chromium.org
63defee477 First implementation of allocation elimination in Hydrogen. 
This change implements a simple data-flow analysis pass over captured
objects to the existing escape analysis. It tracks the state of values
in the Hydrogen graph through CapturedObject marker instructions that
are used to construct an appropriate translation for the deoptimizer to
be able to materialize these objects again.

This can be considered a combination of scalar replacement of loads and
stores on captured objects and sinking of unused allocations.

R=titzer@chromium.org
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/21055011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-07 11:24:14 +00:00
yangguo@chromium.org
ef8d394f12 Re-reland "Flush parallel recompilation queues on context dispose notification" 
BUG=
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22379002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-07 09:33:09 +00:00
ulan@chromium.org
3511f7a428 Fix Array index dehoisting. 
BUG=264203
TEST=test/mjsunit/regress/regress-264203
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22314012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 16:38:39 +00:00
rossberg@chromium.org
5e121882c6 Remove test that causes illegal access now 
TBR=mstarzinger@chromium.org
BUG=265369

Review URL: https://codereview.chromium.org/22428002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 14:34:25 +00:00
rossberg@chromium.org
f56ad9cab7 Turn assert into runtime assertion to make fuzzer happy 
R=mstarzinger@chromium.org
BUG=265369

Review URL: https://codereview.chromium.org/22284009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 14:19:13 +00:00
rossberg@chromium.org
92bd4d1f2d I found this working on 
https://codereview.chromium.org/19541010/

The main problem is that if you called Object.getNotifier(obj) on an object, %SetObserved(object) would never get called on it, and thus it would be unobservable (new test added for this).

Additionally, Runtime::SetObserved was asserting obj->IsJSObject() which would fail if called on a proxy.

It just happens that our existing test always called getNotifier() before Object.observe on proxies, and thus we never previously attempted to transition the map of a proxy.

Both issues are now fixed and properly tested.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/21891008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 13:49:10 +00:00
dslomov@chromium.org
45f4b685bf Update Array Iterator to use numeric indexes 
At the last face-to-face meeting it was decided that we should use
numeric indexes for the Array Iterator values.

https://github.com/rwldrn/tc39-notes/blob/master/es6/2013-07/july-24.md#514-keys-entries-return-numbers-for-array-index-properties

BUG=v8:2818
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/21180008

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 13:10:07 +00:00
jkummerow@chromium.org
232a2c0d88 Regression test for issue 2813 / r16008 
BUG=v8:2813
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/21806002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-02 12:17:19 +00:00
svenpanne@chromium.org
bf71023ba5 Replaced unary negation by multiplication with -1. 
This fixes a deopt loop in the Epic Citadel demo and removes some code. Apart from that, this change is performance-neutral.

When we do something similar for BIT_NOT, the whole UnaryOp stuff can go away.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/21782002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-02 11:56:35 +00:00
mstarzinger@chromium.org
c87abd1117 Add new Harmony methods to Array.prototype object. 
Array.prototype.find
Array.prototype.findIndex

http://people.mozilla.org/~jorendorff/es6-draft.html

BUG=v8:2776,v8:2777
TEST=mjsunit/harmony/array-find,mjsunit/harmony/array-findindex
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21079003

Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-02 10:57:48 +00:00
jkummerow@chromium.org
a47705644e Avoid redundant smi check for Math.abs 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/21180004

Patch from Weiliang Lin <weiliang.lin2@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16021 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-02 08:59:02 +00:00
hpayer@chromium.org
286fc963b2 Disable test in object observe because of bug 2774. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/21495004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-02 06:40:50 +00:00
dslomov@chromium.org
f62ffeef31 Calling Map etc without new should throw TypeError 
Even though we do not yet allow Map, Set, WeakMap and WeakSet to be
subclassed we need to ensure that we do not allow them to be [[Call]]ed
to allow them to be subclassed in the future.

BUG=v8:2819
R=dslomov@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21400002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-01 09:18:28 +00:00
verwaest@chromium.org
2af164f4d9 Mark maps as unstable if their instances potentially transition away. 
Use this as a prerequisite for adding code dependencies.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21095005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 16:33:58 +00:00
mstarzinger@chromium.org
0627d433b0 Add new Harmony methods to String.prototype object. 
String.prototype.repeat
String.prototype.startsWith
String.prototype.endsWith
String.prototype.contains

http://people.mozilla.org/~jorendorff/es6-draft.html

BUG=v8:2796,v8:2797,v8:2798,v8:2799
TEST=mjsunit/string-repeat,mjsunit/string-startswith,mjsunit/string-endswith,mjsunit/string-contains
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21014007

Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15960 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 16:33:08 +00:00
titzer@chromium.org
45d4afbde5 Fix many tests that try to force an OSR by checking OptimizationStatus() to instead check OptimizationCount(). 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21221003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 09:28:55 +00:00
machenbach@chromium.org
7696139437 Run some skipped tests again after resolved issue. 
BUG=2795
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/21220002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 08:52:26 +00:00
mstarzinger@chromium.org
3202e1d795 Re-revert "Flush parallel recompilation queues on context dispose notification" (r15883). 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/21156009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 08:35:48 +00:00
titzer@chromium.org
37ee4a0369 Fix IsDeletable() for HStringAdd, HStringCharCodeAt, HStringCharFromCode. 
BUG=
R=mstarzinger@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/20241005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:35:43 +00:00
mvstanton@chromium.org
43e35a87e2 Fix: Need to remove function type feedback between stress stages in 
release build

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/20987005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 12:22:34 +00:00
mvstanton@chromium.org
e9cc78af7e Fix for V8 issue 2795: Check fails with deopt for mjsunit/array-store-and-grow 
(https://code.google.com/p/v8/issues/detail?id=2795)

The reason is when allocating and building arrays in hydrogen we need to ensure
we do any int32-to-smi conversions BEFORE the allocation. These conversions can
at least theoretically deoptimize. If this happens before all the fields of the
newly allocated object are filled in, we will have a corrupted heap.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/20726002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 11:50:39 +00:00
bmeurer@chromium.org
709012021a The compiled_transitions flag was enabled for quite some time now and seems to work out quite well, so time has come to remove the obsolete code paths and remove the unused methods. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/18034024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 09:12:16 +00:00
jkummerow@chromium.org
3619dcf868 Add regression test for recently fixed bug 
BUG=chromium:258519
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/20732002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 14:58:30 +00:00
machenbach@chromium.org
53c95353c9 Disable mjsunit test when parallel recompilation is not available. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20573003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 12:34:46 +00:00
verwaest@chromium.org
565699669e Fix Smi-based MathMinMax on x64, and reenable smi mode. 
BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/20706002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 12:06:22 +00:00
yangguo@chromium.org
372763897d Lazy call to custom stack trace formatting using Error.prepareStackTrace. 
This enables custom stack trace formatting for stack overflow.
A consequence is that stack trace formatting is now easily observable,
but we already established that the default stack trace formatting can
be observed anyways. It is only triggered by the .stack getter, and
it has to be explicitly called, (e.g. not implicitly after GC).

R=mstarzinger@chromium.org
BUG=v8:2559

Review URL: https://codereview.chromium.org/20692002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-26 11:28:08 +00:00
jkummerow@chromium.org
32e2e37230 Fix JSArray-specific length lookup in polymorphic array handling 
BUG=chromium:263276
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/20295005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 15:04:21 +00:00
yangguo@chromium.org
14e205e9cf Reland "Flush parallel recompilation queues on context dispose notification." 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19500022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-25 15:01:23 +00:00
dslomov@chromium.org
a418b36b75 Make DataView setters throw when only offset is provided. 
Also fix typo in error message id.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/20030004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 17:35:15 +00:00
yangguo@chromium.org
eaedafad4b Restore test and behavior prior to deferred stack trace formatting. 
R=mstarzinger@chromium.org
TEST=stack-traces-overflow.js

Review URL: https://codereview.chromium.org/19805003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 12:16:02 +00:00
machenbach@chromium.org
a0734ba3af Add deopt fuzzer tool. 
Can be run as a stand-alone script like run-tests.

Executes first all tests of a given test suite to collect the maximum number of possible deopt points. Runs then a fuzzing phase with artificial deoptimizations triggered during testing.

Works for now with mjsunit and ia32 only.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19931005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 12:04:29 +00:00
hpayer@chromium.org
6c83b7d6c1 Support double allocations when folding allocation. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19956002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 19:27:00 +00:00
verwaest@chromium.org
7e08f81e6d Also eliminate map checks with transitions. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19888006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15821 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 10:01:06 +00:00
verwaest@chromium.org
babce318d1 Eliminate map checks of constant values. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19954005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 09:18:42 +00:00
mstarzinger@chromium.org
232c55854f Add test case for issue 2793 about experimental natives. 
R=yangguo@chromium.org
BUG=v8:2793

Review URL: https://codereview.chromium.org/19948002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 18:18:55 +00:00
ulan@chromium.org
b2dd5c67f7 ARM: Ensure space for lazy deoptimization before calling IC. 
If IC triggers deoptimization, then subsequent patching might get invalid
target address that was overwritten.

R=verwaest@chromium.org
BUG=247688
TEST=mjsunit/regress/regress-247688.js

Review URL: https://chromiumcodereview.appspot.com/19972002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 17:21:41 +00:00
yangguo@chromium.org
cd41cb9b6d Turn on parallel recompilation for tests that assert optimization status. 
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/19807002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 09:16:33 +00:00
mstarzinger@chromium.org
ce81b0d3a8 ES6: Implement WeakSet 
WeakSets work similar to ordinary Sets but the value (which must be an
object) is held weakly.

This is available under --harmony-collections

BUG=v8:2785
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19678023

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 08:32:24 +00:00
rossberg@chromium.org
ac2b8c04f3 Proxies: Make 'with' work, plus minor other fixes 
Also fixes internal exception handling in several places of the runtime.

R=yangguo@chromium.org
BUG=v8:1543

Review URL: https://codereview.chromium.org/19384004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 14:07:23 +00:00
ulan@chromium.org
88a4b0d6ca Fix deopt in store with effect context. 
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19693004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 13:45:26 +00:00
rossberg@chromium.org
83d9e6e7ee Add support for explicit octal and binary integer literals 
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-7.8.3

ES6 extends the numeric literals to support explicit support
for binary and octal literals using the following syntax:

  0b10101
  0o777

This is currently behind the flag, --harmony-numeric-literals

BUG=2783
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/19300002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 09:57:35 +00:00