AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
10,338 Commits 1 Branch 0 Tags 839 MiB
c8636a2809
Commit Graph

1873 Commits

Author SHA1 Message Date
rossberg@chromium.org
af824eab8f When using an Object as a set in Object.getOwnPropertyNames, null out the proto 
Also apply the same fix elsewhere in v8natives.js

BUG=v8:2410

Review URL: https://codereview.chromium.org/11364237
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12982 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-16 09:32:39 +00:00
verwaest@chromium.org
a08194c83a Support all fast elements kinds in the major array operations. 
Currently missing support for unshift.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11377132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 12:19:14 +00:00
rossberg@chromium.org
4fb992a872 Object.observe: Handle oldValue for elements with accessors properly. 
Extended ElementAccessor interface to allow querying PropertyType and
AccessorPair. Also added respective functionality to JSObject.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358234

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12967 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 11:31:40 +00:00
rossberg@chromium.org
5e7b796479 Object.observe: Move notification of JSArray length changes to JSArray::SetElementsLength 
The previous implementation in Accessors::ArraySetLength failed when array length was set through StoreIC_ArrayLength. But that stub and the accessor both delegate to JSArray::SetElementsLength, so moving the code there allows notifications to be sent in both cases.

Review URL: https://codereview.chromium.org/11275292
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 16:51:21 +00:00
jkummerow@chromium.org
1c086d1202 Lattice-based representation inference, powered by left/right specific type feedback for BinaryOps and comparisons 
Review URL: https://chromiumcodereview.appspot.com/10837165

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 15:59:45 +00:00
ulan@chromium.org
74492ab2d4 Emit VMLA for multiply-add on ARM 
Review URL: https://chromiumcodereview.appspot.com/11293061
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12958 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 11:01:18 +00:00
yangguo@chromium.org
4783d3c31b Remove 'type' and 'arguments' properties from Error object. 
R=svenpanne@chromium.org
BUG=v8:2397

Review URL: https://chromiumcodereview.appspot.com/11358214

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 09:14:47 +00:00
peter.rybin@gmail.com
bb53dc6890 Issue 2368: LiveEdit crashes when new object/array literal is added 
Review URL: https://codereview.chromium.org/11191039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12952 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 19:13:27 +00:00
rossberg@chromium.org
36c3d01589 Object.unobserve(obj, callback) now throws a TypeError when callback is not a function. 
Review URL: https://codereview.chromium.org/11293248
Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12950 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 15:50:59 +00:00
yangguo@chromium.org
693ee09cf3 Correctly check for stack overflow even when interrupt is pending. 
BUG=v8:214

Review URL: https://chromiumcodereview.appspot.com/11362007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:56:25 +00:00
yangguo@chromium.org
4c27298d27 Collect stack trace on stack overflow. 
BUG=v8:2394

Review URL: https://chromiumcodereview.appspot.com/11275186

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:54:29 +00:00
yangguo@chromium.org
e3e899fe53 Correctly fix test expectations. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11369183

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:07:21 +00:00
yangguo@chromium.org
eea60ff76a Fix test expectations. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11361217

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12928 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 12:29:15 +00:00
yangguo@chromium.org
4cca6c6081 Make formatting error message side-effect-free. 
BUG=v8:2398

Review URL: https://chromiumcodereview.appspot.com/11359130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 10:33:20 +00:00
yangguo@chromium.org
ef1b3d3a76 Fix length check in JSON.stringify. 
R=verwaest@chromium.org
BUG=160010

Review URL: https://chromiumcodereview.appspot.com/11410031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 10:20:07 +00:00
rossberg@chromium.org
0e7306cc92 Implement Object.getNotifier() and remove Object.notify() 
Updated all tests to use getNotifier or actual object mutation instead of notify, and added tests for new behavior of getNotifier.

Review URL: https://codereview.chromium.org/11369154
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 16:14:42 +00:00
rossberg@chromium.org
af7bfe0e27 Minimal implementation and tests of observable array methods 
Bail out of any special-casing in array methods.
Further optimization is possible, but can be left for later.

Review URL: https://codereview.chromium.org/11369151
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 12:28:22 +00:00
rossberg@chromium.org
13f8fb47da Add more test coverage for setting Array.length 
Covers truncation of holey arrays and defineProperty('length').

Review URL: https://codereview.chromium.org/11369150
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 11:00:13 +00:00
rossberg@chromium.org
b72e5811e7 Object.observe: notify when element addition causes array growth 
Review URL: https://codereview.chromium.org/11369135
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 10:57:54 +00:00
mstarzinger@chromium.org
2d69a2b12e ES6: Add support for Set and Map clear method 
http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts, section
15.14.5.3 and 15.14.5.2

BUG=v8:2400

Review URL: https://codereview.chromium.org/11409002
Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 09:01:29 +00:00
yangguo@chromium.org
64da47559c Turn message property of the error object into a data property. 
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11368142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 08:22:02 +00:00
rossberg@chromium.org
2af4744889 Handle Object.observe notifications for setting Array.length 
Also handles notification of deleted properties when an array
is truncated by setting length.

Review URL: https://codereview.chromium.org/11338048
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 16:12:12 +00:00
rossberg@chromium.org
8eb704257f Object.observe: Fixed missing case for turning off ICs. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11358122

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 13:15:54 +00:00
rossberg@chromium.org
fbc6e0d883 Object.observe: generate change records for indexed properties. 
Details:
- Extend ElementAccessors with GetAttributes method.
- Add HasLocalElement, Get[Local]ElementAttribute methods to JSReceiver/JSObject.
- Otherwise, mirror implementation for named properties.

Cannot correctly handle the cases yet where an accessor is redefined or deleted.

Also fixed handling of object info table.

(Based on CL https://codereview.chromium.org/11362115/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11365111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 12:58:08 +00:00
mstarzinger@chromium.org
a31889e2de Fix slack tracking when instance prototype changes. 
This fixes a corner case when the instance prototype of a function is
changed while inobject slack tracking is still in progress. This caused
the intial map to be unrelated for functions with the same shared info
and hence the shared construct stub is no longer generic enough to work
for all those functions.

R=danno@chromium.org
BUG=chromium:157019
TEST=mjsunit/regress/regress-crbug-157019

Review URL: https://codereview.chromium.org/11293059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 11:56:44 +00:00
rossberg@chromium.org
e059e64c98 Object.observe: include oldValue in change records, 
plus more accurate distinction of different change types.

Required handlifying more code.

Also fixed a handlification bug in JSProxy::GetElementAttributeWithHandler.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11362115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-07 14:14:50 +00:00
yangguo@chromium.org
ecb6126e45 Remove check for recursion depth for JSON.stringify. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11368119

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-07 12:12:52 +00:00
mstarzinger@chromium.org
e405ff84b4 ES6: Adding support for size to Set and Map 
Section 15.14.5.10 and 15.16.5.7 in the October 26, 2012 ES6 draft,
http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts

This adds a getter for "size" to Set.prototype and Map.prototype which reflects
the number of elements in the Set and Map respectively.

BUG=v8:2395

Review URL: https://codereview.chromium.org/11360089
Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 18:14:45 +00:00
rossberg@chromium.org
b80cbd7922 Object.observe: generate change records for named properties. 
In more detail:
- Set observation bit for observed objects (and make NormalizedMapCache respect it).
- Mutation of observed objects is always delegated from ICs to runtime.
- Introduce JS runtime function for notifying generated changes.
- Invoke this function in the appropriate places (including some local refactoring).
- Inclusion of oldValue field is not yet implemented, nor element properties.

Also, shortened flag to --harmony-observation.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11347037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 12:32:36 +00:00
ulan@chromium.org
f106c9c9f7 Add rotate-right instruction to hydrogen and use it instead of bitwise operations 
of the form ((x >>> i) | (x << (32 - i))).

This CL is based on https://chromiumcodereview.appspot.com/10984057/
by Jay Conrod <dconrod@codeaurora.org>.

R=danno@chromium.org,mstarzinger@chromium.org,dconrod@codeaurora.org

Review URL: https://chromiumcodereview.appspot.com/11033005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 13:28:10 +00:00
yangguo@chromium.org
e452c10702 Add fast path for FastProperty objects in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11363078

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 12:59:35 +00:00
yangguo@chromium.org
e26012e771 Fix JSON.stringify wrt harmony proxies. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11312063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 10:53:56 +00:00
svenpanne@chromium.org
9de1d40d28 Improve handling of property loads on the proto chain. 
Previously Crankshaft emitted a generic load for these, now we emit a load of a
named field, guarded by a proto chain check.

LCheckPrototypeMaps now returns the holder, which is for free, because it
already had to check its map as the last step, anyway. This is in sync with what
StubCompiler::CheckPrototype does.

Review URL: https://codereview.chromium.org/11338030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 08:53:54 +00:00
yangguo@chromium.org
e8d91b424c Handle edge cases in basic JSON.stringify. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11315009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-02 14:46:57 +00:00
verwaest@chromium.org
14abf05bd5 Ensure reducing the length of an array doesn't make it go holey. 
Also only transition and/or change anything to the backing store if we are
actually going to delete anything.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11358011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-02 10:24:56 +00:00
yangguo@chromium.org
fe7ec01096 Fix handling arrays with holes in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11273112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-30 15:29:34 +00:00
yangguo@chromium.org
8ed2e560ea Treat leading zeros in JSON.parse correctly. 
R=verwaest@chromium.org
BUG=158185

Review URL: https://chromiumcodereview.appspot.com/11273075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-29 12:01:29 +00:00
mstarzinger@chromium.org
e363cd3425 Fix ugly typo in GenerateNewNonStrictFast. 
R=svenpanne@chromium.org
BUG=chromium:157520
TEST=mjsunit/regress/regress-crbug-157520

Review URL: https://codereview.chromium.org/11300008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-26 10:55:25 +00:00
yangguo@chromium.org
f6ed7f5e23 Relax test expectations for json-recursive.js 
R=mvstanton@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11311002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-26 07:52:18 +00:00
rossberg@chromium.org
ae93cf665d Initial JS stub implementation of Object.observe. Adds support for .object/.unobserve/.notify/.deliverChangeRecords. No delivery mechanism is implemented for end-of-microtask. 
Review URL: https://codereview.chromium.org/11225058
Patch from Rafael Weinstein <rafaelw@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 14:56:44 +00:00
yangguo@chromium.org
e91473f057 Relax test expectations to appease mac build. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11272029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:39:41 +00:00
yangguo@chromium.org
58c82e93b3 Catch stack overflow in JSON.parse. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11275039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:36:40 +00:00
yangguo@chromium.org
e40b33d39e Correctly check for stack limit in JSON.stringify. 
Changes include:
 - inline functions in a way as not to waste stack space.
 - reset StackReserveSize to the value prior to r12808.
 - check stack overflow dynamically.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11271021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 12:18:24 +00:00
yangguo@chromium.org
b2d41f8fe8 Fix stack overflow in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11265011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-24 15:49:59 +00:00
yangguo@chromium.org
e50ee08ad6 Reland JSON.stringify reimplementation. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11189112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 14:22:58 +00:00
jkummerow@chromium.org
5ea870f855 tools/run-tests.py: A few timeout-related fixes 
Review URL: https://codereview.chromium.org/11230029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 14:13:01 +00:00
yangguo@chromium.org
e41250a390 Revert r12760 (JSON.stringify). 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11225026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 11:11:22 +00:00
yangguo@chromium.org
8148f972e8 Stress GC less by allocating exponentially growing string chunks in JSON.stringify. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11232002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 12:39:43 +00:00
yangguo@chromium.org
f910052543 Always invoke the default Array.sort functions from builtin functions, part 2. 
R=vegorov@chromium.org
BUG=v8:2372

Review URL: https://chromiumcodereview.appspot.com/11175007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 12:30:18 +00:00
ulan@chromium.org
06a9f51ccb Adjust Android test expectations. 
Disable long running tests:
- test-threads/ThreadJoinSelf in release and debug modes.
- regress/regress-1122 in debug mode.

Disable failing test:
- preparser/strict-octal-regexp (v8 issue 2265).

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11185073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 09:28:23 +00:00
verwaest@chromium.org
fa53250dd2 Fixed json regression 
BUG=v8:2374

Review URL: https://chromiumcodereview.appspot.com/11186059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 08:23:45 +00:00
verwaest@chromium.org
7bc94a92c5 Fixed error introduced in r12761. 
BUG=2373

Review URL: https://chromiumcodereview.appspot.com/11198068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 18:43:19 +00:00
yangguo@chromium.org
7a653c1675 Reimplement a simpler version of JSON.stringify. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11186025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 14:42:26 +00:00
yangguo@chromium.org
a7f3edb818 Make sure the fast case of ScanJsonString bails out to the slow case correctly. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11185050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 13:15:05 +00:00
fschneider@chromium.org
971e834a8d Always invoke the default Array.sort functions from builtin functions. 
TEST=mjsunit/regress/regress-builtin-array-op.js
BUG=v8:2372
Review URL: https://chromiumcodereview.appspot.com/10559005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-18 11:18:08 +00:00
mstarzinger@chromium.org
02490829dd Fix bug in deletion of indexed properties 
The delete operator always return true in case of indexed property. It
should return false if an indexed property can't be deleted (eg.
DontDelete attribute is set or a string object is the holder).

Contributed by Peter Varga <pvarga@inf.u-szeged.hu>

BUG=none
TEST=mjsunit/delete-non-configurable

Review URL: https://codereview.chromium.org/11094021
Patch from Peter Varga <pvarga@inf.u-szeged.hu>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12736 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-15 15:23:22 +00:00
verwaest@chromium.org
7c28995e5d Invalidate the enum cache when converting a transition across which the descriptors are shared. 
Review URL: https://chromiumcodereview.appspot.com/11145017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-15 08:38:51 +00:00
ulan@chromium.org
c969afe137 Reland r12342: Flush monomorphic ICs on context disposal instead of context exit. 
The crashes that caused r12342 to be reverted are fixed in r12563.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11092081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-12 13:49:12 +00:00
verwaest@chromium.org
b75705f07b Don't clear EnumLength but rather copy the enum cache. Added regression test for crashes from chromecrash. 
Review URL: https://chromiumcodereview.appspot.com/11103036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 15:33:34 +00:00
rossberg@chromium.org
348736efaa Find a stack limit for the test that works on both Win32 and Linux64. 
R=mstarzinger@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11086073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 13:10:24 +00:00
rossberg@chromium.org
ddbd426821 Increase stack size for test to work on x64. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11098070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 12:11:46 +00:00
rossberg@chromium.org
00132da734 Bump variable limit further to 2^17. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/11099063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 11:40:10 +00:00
verwaest@chromium.org
dde1cdfb8e Fix transition conversion from CONSTANT_FUNCTION to FIELD. 
Review URL: https://chromiumcodereview.appspot.com/11094044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 12:31:50 +00:00
verwaest@chromium.org
55e924c595 Fix CNLT regression. 
This happens when a map A with no descriptors in fast_holey_elements
mode first gets some properties, making it share descriptor arrays with
a map B to which it transitions. Then map A transitions elements kind to
dictionary_elements in map C. C stores the empty_descriptor_array in its
own transition array. When adding a property to C, C transitions to D
and shares the descriptors. If D dies, a CNLT clears the transition
array of C, making the descriptor array of A (and thus also of B) shine
through. If a property is now added to an object in state C, it'll inherit
all the properties of A (and B). If those properties had high field indices,
we do not have a large enough backing store for the single newly added
property, and we'll write out of bounds.

BUG=chromium:151749

Review URL: https://chromiumcodereview.appspot.com/11017054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 12:29:44 +00:00
svenpanne@chromium.org
5d11c5ee69 Fixed Accessors::FunctionGetPrototype's proto chain traversal. 
Actually it didn't traverse that far... ;-) Did some cleanup on the way.

R=rossberg@chromium.org
BUG=chrome:143967
TEST=regress/regress-143967.js

Review URL: https://codereview.chromium.org/11087004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-08 12:58:46 +00:00
rossberg@chromium.org
329cf12363 Make sure that names of temporaries do not clash with real variables. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11035054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 12:47:34 +00:00
rossberg@chromium.org
b07f38a46b Reject local module declarations. 
R=mstarzinger@chromium.org
BUG=150628

Review URL: https://codereview.chromium.org/11033025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 09:14:08 +00:00
rossberg@chromium.org
3f7b5c338a Reject uses of lexical for-loop variable on the RHS. 
R=mstarzinger@chromium.org
BUG=v8:2322

Review URL: https://codereview.chromium.org/11031045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-05 09:07:53 +00:00
verwaest@chromium.org
efe955587e Allow optimistically hoisting elements transitions over accesses. 
Review URL: https://chromiumcodereview.appspot.com/10972011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-01 16:22:43 +00:00
mmassi@chromium.org
8fbfad63cd Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339). 
BUG=v8:2339

Review URL: https://chromiumcodereview.appspot.com/10963032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-26 09:57:30 +00:00
erik.corry@gmail.com
72e9f1bea1 x64 and ARM: Fix issue 2346 (order of operations in keyed store 
on arrays) and turn get-own-property-descriptor.js test into
a regression test.
Review URL: https://chromiumcodereview.appspot.com/10985017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12604 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-25 13:35:42 +00:00
rossberg@chromium.org
20b1c426cf Bump number of allowed variables per scope to 65535, to address GWT. 
R=jkummerow@chromium.org
BUG=151625

Review URL: https://codereview.chromium.org/10965063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12600 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 16:22:17 +00:00
jkummerow@chromium.org
43f038d4cd Split test/mjsunit/debug-stepout-scope into smaller chunks 
Review URL: https://codereview.chromium.org/10969061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 11:18:29 +00:00
jkummerow@chromium.org
8a3ec89824 Delete test/mjsunit/regress-1969. 
It was flaky, and its usefulness was doubtful.

Review URL: https://codereview.chromium.org/10961075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:48:14 +00:00
jkummerow@chromium.org
cc6fe90b2b Remove trailing whitespace 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/10969064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:44:04 +00:00
jkummerow@chromium.org
1e1470fca0 Speed up test/mjsunit/compiler/regress-or 
Review URL: https://codereview.chromium.org/10969063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12593 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:08:01 +00:00
jkummerow@chromium.org
6dc2af06dc Speed up test/mjsunit/compiler/regress-gvn 
Review URL: https://codereview.chromium.org/10956059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:07:09 +00:00
jkummerow@chromium.org
d600358e6d Split test/mjsunit/numops-fuzz into smaller chunks 
Review URL: https://codereview.chromium.org/10961065

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12591 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:06:06 +00:00
jkummerow@chromium.org
fbf5965db4 Split test/mjsunit/mul-exhaustive into smaller chunks 
Review URL: https://codereview.chromium.org/10958064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:04:58 +00:00
jkummerow@chromium.org
a2fc134169 Split test/mjsunit/fuzz-natives into smaller chunks 
Review URL: https://codereview.chromium.org/10970058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:03:49 +00:00
jkummerow@chromium.org
1bfbfc34ad Split test/mjsunit/math-floor into smaller chunks 
Review URL: https://codereview.chromium.org/10967064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:02:44 +00:00
jkummerow@chromium.org
bafa150f99 Speed up test/mjsunit/greedy.js 
Review URL: https://codereview.chromium.org/10969062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:01:35 +00:00
jkummerow@chromium.org
d88069821c Speed up test/mjsunit/debug-multiple-breakpoints 
Review URL: https://codereview.chromium.org/10961064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 10:00:25 +00:00
jkummerow@chromium.org
6a617a7b23 Speed up test/mjsunit/d8-os by reducing sleep times 
Review URL: https://codereview.chromium.org/10973003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:57:16 +00:00
jkummerow@chromium.org
cf0cae7eb1 Speed up test/mjsunit/regress/regress-crbug-119926 
Review URL: https://codereview.chromium.org/10958063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:56:11 +00:00
jkummerow@chromium.org
975d6e2170 First commit of new tools/run-tests.py 
Review URL: https://codereview.chromium.org/10919265

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 09:38:46 +00:00
verwaest@chromium.org
083ee63a83 Fix CNLT for enum indices. 
Review URL: https://chromiumcodereview.appspot.com/10958015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 15:18:00 +00:00
verwaest@chromium.org
ea31f868e8 Deopt on storing undefined into double elements. 
Review URL: https://chromiumcodereview.appspot.com/10963010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12568 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 13:41:00 +00:00
ulan@chromium.org
a0dfdfc273 Revert r12530 "Tentatively reenable previous failing test." 
BUG=v8:2341
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10964015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 11:28:33 +00:00
jkummerow@chromium.org
a8e502fe60 Fix LBoundsCheck on x64 to handle (stack slot + constant) correctly 
BUG=150729

Review URL: https://codereview.chromium.org/10959009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:56:24 +00:00
jkummerow@chromium.org
83da019a46 Move regress-2286.js where it belongs 
Review URL: https://codereview.chromium.org/10957013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-20 09:55:19 +00:00
mmassi@chromium.org
9dc822ca13 Fixed minus zero test (fixes v8:2133). 
BUG=v8:2133

Review URL: https://chromiumcodereview.appspot.com/10937013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 12:48:49 +00:00
mstarzinger@chromium.org
c012afb6d4 Fix setting array length to zero for slow elements. 
R=verwaest@chromium.org
BUG=chromium:146910
TEST=mjsunit/regress/regress-crbug-146910

Review URL: https://codereview.chromium.org/10937026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 11:52:33 +00:00
mstarzinger@chromium.org
f0dcaf9a19 Fix lost arguments dropping in HLeaveInlined. 
This fixes HleaveInlined to correctly drop pushed arguments on all code
paths and addresses a corner case where the arguments stack height
mismatched at an OSR entry point.

R=jkummerow@chromium.org
BUG=chromium:150545
TEST=mjsunit/regress/regress-crbug-150545

Review URL: https://codereview.chromium.org/10938016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 08:13:46 +00:00
yangguo@chromium.org
783d10197a Tentatively reenable previous failing test. 
R=mstarzinger@chromium.org
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10907254

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 14:19:11 +00:00
yangguo@chromium.org
73462594ea Change regress-2318 to trigger more quickly and reliably. 
BUG=v8:2336

Review URL: https://chromiumcodereview.appspot.com/10913294

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 13:21:59 +00:00
erik.corry@gmail.com
bafcfe5427 Fix misplaced assert in heap.cc. 
Bug=2336
Review URL: https://chromiumcodereview.appspot.com/10911334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-17 11:38:24 +00:00
yangguo@chromium.org
cb72bf5735 Fix debugger's eval when close to stack overflow. 
R=verwaest@chromium.org
BUG=v8:2318

Review URL: https://chromiumcodereview.appspot.com/10914290

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:40:32 +00:00
verwaest@chromium.org
ad4746c8a3 CNLT with descriptors but no valid enum fields has to clear the EnumCache. 
Review URL: https://chromiumcodereview.appspot.com/10928204

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 13:15:43 +00:00
mstarzinger@chromium.org
77a7d9f539 Fix caching of optimized code for OSR. 
This makes sure we do not share optimized code across closures that were
optimized using OSR (for a particular OSR entry AST id) even if caching
of optimized code kicks in.

R=danno@chromium.org
BUG=v8:2326
TEST=mjsunit/regress/regress-2326

Review URL: https://codereview.chromium.org/10933088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 10:41:31 +00:00
verwaest@chromium.org
1d1adaf9d3 Ensure correct enumeration indices in the dict 
BUG=chromium:148376

Review URL: https://chromiumcodereview.appspot.com/10908216

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-13 08:52:55 +00:00
mmassi@chromium.org
22aed1cddd Fixed bounds check removal by restricting it to int32 indexes (and reenabled both ABCR and index dehoisting). 
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10905232

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 17:00:25 +00:00
yangguo@chromium.org
67d0506622 Correctly initialize regexp global cache. 
R=ulan@chromium.org
BUG=148378

Review URL: https://chromiumcodereview.appspot.com/10905239

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 15:26:43 +00:00
mstarzinger@chromium.org
f37f504de5 Fix arguments object materialization during deopt. 
This fixes materialization of arguments objects for strict mode functions during
deoptimization. We materialize arguments from the stack area where optimized
code pushes the arguments when entering the inlined environment. For adapted
invocations we use the arguments adaptor frame for materialization.

R=svenpanne@chromium.org
BUG=v8:2261
TEST=mjsunit/regress/regress-2261,mjsunit/compiler/inline-arguments

Review URL: https://chromiumcodereview.appspot.com/10908194

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 12:28:42 +00:00
ulan@chromium.org
a9162af1af Fix delta computation in DoDeferredInstanceOfKnownGlobal() for ARM. 
BUG=v8:2314

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10908195

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-11 11:36:48 +00:00
peter.rybin@gmail.com
bda5ce9cd6 Introduce InternalProperty type and expose internal properties for bound functions 
Committed: https://code.google.com/p/v8/source/detail?r=12346

Review URL: https://chromiumcodereview.appspot.com/10834376

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 23:17:04 +00:00
mstarzinger@chromium.org
f6cd2403e3 Fix deoptimizer for shared optimized code. 
The deoptimizer searched the stack for activations of the same function to
determine whether to trigger lazy deopting. Since we share optimized code we
actually need to search for activations of the same code (but potentially
different functions).

R=jkummerow@chromium.org
BUG=chromium:147475
TEST=mjsunit/regress/regress-crbug-147475

Review URL: https://chromiumcodereview.appspot.com/10917162

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 11:05:17 +00:00
yangguo@chromium.org
1a0c14f12c Add checks to runtime functions. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10915062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 08:35:26 +00:00
svenpanne@chromium.org
7af6883098 Fixed deoptimization of inlined getters. 
It is necessary to explicitly handle the internal frame lying between the caller
of the getter and the getter itself in the deoptimizer: When the getter is
inlined, leaving the internal frame restores the correct context.

BUG=http://crbug/134609
TEST=mjsunit/regress/regress-crbug-134609

Review URL: https://chromiumcodereview.appspot.com/10910110

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-07 09:01:54 +00:00
erik.corry@gmail.com
9ff7ec1c4a Fix binding in new Function(). 
Review URL: https://chromiumcodereview.appspot.com/10916114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-05 11:45:58 +00:00
erik.corry@gmail.com
e5df02834b Fix some corner cases in skipping native methods using caller. 
Review URL: https://chromiumcodereview.appspot.com/10911063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-05 08:19:49 +00:00
verwaest@chromium.org
0c24942be7 Fixed test expectation. 
Review URL: https://chromiumcodereview.appspot.com/10913062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12435 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:54:36 +00:00
verwaest@chromium.org
a8638c1570 Support register as right operand in min/max support. 
R=jkummerow@chromium.org
BUG=chromium:145961
TEST=mjsunit/regress/regress-crbug-145961.js

Review URL: https://chromiumcodereview.appspot.com/10914072

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-04 09:35:43 +00:00
yangguo@chromium.org
ddfae013a6 Disable test that triggers known bug. 
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10910029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12418 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-31 12:02:02 +00:00
yangguo@chromium.org
5dd51bafef Cache results in SearchRegExpMultiple. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10837290

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-31 09:28:01 +00:00
verwaest@chromium.org
90db487390 Elements load depends on the type of the receiver. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10918005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12413 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-30 17:31:32 +00:00
rossberg@chromium.org
b0067e9cd5 Disable test that triggers known bug. 
R=verwaest@chromium.org
BUG=v8:2261

Review URL: https://chromiumcodereview.appspot.com/10896005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 14:17:55 +00:00
rossberg@chromium.org
ccc827a6f8 Allocate block-scoped global bindings to global context. 
- The global object has a reference to the current global scope chain.
  Running a script adds to the chain if it contains global lexical declarations.
- Scripts are executed relative to a global, not a native context.
- Harmony let and const bindings are allocated to the innermost global context;
  var and function still live on the global object.
  (Lexical bindings are not reflected on the global object at all,
  but that will probably change later using accessors, as for modules.)
- Compilation of scripts now needs a (global) context (previously only eval did).
- The global scope chain represents one logical scope, so collision tests take
  the chain into account.

R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10872084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 11:25:08 +00:00
yangguo@chromium.org
7cbca775ee Reland regexp global optimizations. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10872010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 09:37:41 +00:00
ulan@chromium.org
7b1d13affc Revert r12342 "Flush monomorphic ICs on context disposal instead of context exit." because of canary channel crashes. 
BUG=144230
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10868068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-27 16:08:27 +00:00
danno@chromium.org
3544e2e875 Disable speculative LICM when it may lead to unnecessary deopts 
BUG=v8:2250
R=vegorov@chromium.org
TEST=tests/mjsunit/regress/regress-2250.js

Review URL: https://chromiumcodereview.appspot.com/10867033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 21:08:58 +00:00
vegorov@chromium.org
106a83252d Fix DoDeferredNumberTagU to keep the value in xmm1 instead of xmm0 on x64. 
xmm0 is not saved across runtime call on x64 because MacroAssembler::EnterExitFrameEpilogue preserves only allocatable XMM registers unlike on ia32 where it preserves all registers.

Cleanup handling of shifts: SHR can deoptimize only when its a shift by 0, all other shift never deoptimize.

Fix type inference for i-to-t change instruction. On X64 this ensures that write-barrier is generated correctly.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10868032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12373 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 16:14:01 +00:00
vegorov@chromium.org
f476d4d431 Allow uint32 value on optimized frames if they are consumed by safe operations. 
Safe operations are those that either do not observe unsignedness or have special support for uint32 values:

- all binary bitwise operations: they perform ToInt32 on inputs;
- >> and << shifts: they perform ToInt32 on left hand side and ToUint32 on right hand side;
- >>> shift: it performs ToUint32 on both inputs;
- stores to integer external arrays (not pixel, float or double ones): these stores are "bitwise";
- HChange: special support added for conversions of uint32 values to double and tagged values;
- HSimulate: special support added for deoptimization with uint32 values in registers and stack slots;
- HPhi: phis that have only safe uses and only uint32 operands are uint32 themselves.

BUG=v8:2097
TEST=test/mjsunit/compiler/uint32.js

Review URL: https://chromiumcodereview.appspot.com/10778029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-22 15:44:17 +00:00
ulan@chromium.org
efc26f9b2b Fix rounding in Uint8ClampedArray setter. 
According to Web IDL spec, we should round to
the nearest integer, choosing the even integer
if it lies halfway between two.

R=yangguo@chromium.org,kbr@chromium.org
BUG=v8:2294

Review URL: https://chromiumcodereview.appspot.com/10831409

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-22 14:27:11 +00:00
verwaest@chromium.org
5df5eea066 Check that index and length are Smi in bounds check. 
BUG=chromium:142218
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10829456

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-21 16:46:25 +00:00
yangguo@chromium.org
2b2f28cd2a Revert r12346 (Introduce InternalProperty type and expose internal properties for bound functions) 
Original CL: https://chromiumcodereview.appspot.com/10834376

BUG=

Review URL: https://chromiumcodereview.appspot.com/10834428

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-21 09:48:26 +00:00
peter.rybin@gmail.com
cfc4c37768 Introduce InternalProperty type and expose internal properties for bound functions 
Review URL: https://chromiumcodereview.appspot.com/10834376

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-20 21:49:19 +00:00
ulan@chromium.org
27fb8c2cf6 Flush monomorphic ICs on context disposal instead of context exit. 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836189

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-20 12:09:03 +00:00
yangguo@chromium.org
3a1c290b2c Add input check to %DebugSetScriptSource. 
R=verwaest@chromium.org
BUG=v8:2296

Review URL: https://chromiumcodereview.appspot.com/10837308

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 15:21:15 +00:00
svenpanne@chromium.org
b10d5d7f08 Deoptimization support for accessors. 
Highlights of this CL:

 * Introduced a new opcode in the deoptimizer for a setter stub frame.

 * Added a global setter stub for returning after deoptimizing a setter.

 * We do not need special deopt support for getters, although the getter stub creates an internal frame. The normal machinery works just right for this case, although we generate a stack that can never occur during normal fullcode execution. If this hurts us one day, we can parameterize and reuse the setter deopt machinery.

Review URL: https://chromiumcodereview.appspot.com/10855098

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 10:43:32 +00:00
svenpanne@chromium.org
f5f8ebd4ed Fix accessor lookup in crankshaft. 
Seeing monomorphic type feedback plus an AccessorPair does not necessarily imply
that the corresponding getter/setter is really there, so we have to check for
this explictly.

TEST=mjsunit/object-define-property

Review URL: https://chromiumcodereview.appspot.com/10825384

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-16 10:35:39 +00:00
mstarzinger@chromium.org
886c0fa4f7 Extend constructor inlining test case. 
This makes sure that deoptimization really happens in each hydrogen
context by not using binary operations but loads instead. This is
needed because we cannot clear BinaryOpICs explicitly.

R=svenpanne@chromium.org
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/10825382

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-16 09:13:25 +00:00
erik.corry@gmail.com
ee3a66b273 Fix bug in compare IC. BUG=2291 
Review URL: https://chromiumcodereview.appspot.com/10830334

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-15 15:08:42 +00:00
svenpanne@chromium.org
1ee6c0e30b Improved constructor inlining unit tests. 
Currently we inline functions with different contexts only on ia32, so we have
to move the helper functions for the various contexts to the top level. Further
more, "new Object()" seems to prevent inlining, too, so we us a simple object
literal.

Although things get consistently inlined now, something strange seems to happen
in test/effect contexts: The DEOPT output seems to contain too few frames, and
we don't get any DEOPT ouput after the first time for those contexts. This has
to be investigated...

TBR=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836258

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-15 09:39:13 +00:00
yangguo@chromium.org
28c892938e Ensure capacity when adding parts in String.replace. 
R=ulan@chromium.org
BUG=v8:2289
TEST=regress-2289.js

Review URL: https://chromiumcodereview.appspot.com/10830304

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-14 11:33:12 +00:00
yangguo@chromium.org
d3733ce1e3 Prevent segfault on undefined inline runtime call. 
R=mstarzinger@chromium.org
BUG=v8:2286

Review URL: https://chromiumcodereview.appspot.com/10828282

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-14 10:06:34 +00:00
yangguo@chromium.org
3605fcbe63 Fix indexing bug in regexp, part 2. 
The previous fix initialized the start index incorrectly.

BUG=

Review URL: https://chromiumcodereview.appspot.com/10834291

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:53:40 +00:00
mstarzinger@chromium.org
e77f24f44e Remove prototype of global builtins object. 
R=yangguo@chromium.org
BUG=v8:2284
TEST=mjsunit/regress/regress-2284

Review URL: https://chromiumcodereview.appspot.com/10854116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:34:49 +00:00
yangguo@chromium.org
960b1af12f Fix wrong indexing in global regexp. 
R=ulan@chromium.org
BUG=142087

Review URL: https://chromiumcodereview.appspot.com/10824278

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 15:26:46 +00:00
yangguo@chromium.org
f30099dacf Check for function in %_CallFunction. 
R=mstarzinger@chromium.org
BUG=v8:2285

Review URL: https://chromiumcodereview.appspot.com/10854115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 12:11:26 +00:00
yangguo@chromium.org
bc9df090c7 Fix array-iteration test case. 
R=verwaest@chromium.org
BUG=v8:2282

Review URL: https://chromiumcodereview.appspot.com/10827295

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 08:32:17 +00:00
yangguo@chromium.org
cd5ee62692 Allow multiple lines of custom flags in javascript tests. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10855099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-10 12:26:33 +00:00
svenpanne@chromium.org
f9aea9fcef Inline simple setter calls. 
Currently only simple setter calls are handled (i.e. no calls in count
operations or compound assignments), and deoptimization in the setter is not
handled at all. Because of the latter, we temporarily hide this feature behind
the --inline-accessors flag, just like inlining getters.

We now use an enum everywhere we depend on the handling of a return value,
passing around several boolean would be more confusing.

Made VisitReturnStatement and the final parts of TryInline more similar, so
matching them visually is a bit easier now.

Simplified the signature of AddLeaveInlined, the target of the HGoto can simply
be retrieved from the function state.

Review URL: https://chromiumcodereview.appspot.com/10836133

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-10 09:05:42 +00:00
yangguo@chromium.org
5d35b1851b Fix parseInt's octal parsing behavior (ECMA-262 Annex E 15.1.2.2). 
R=svenpanne@chromium.org
BUG=v8:1645
TEST=test262, parse-int-float.js

Review URL: https://chromiumcodereview.appspot.com/10836151

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-08 07:44:17 +00:00
yangguo@chromium.org
e0954ca592 Take advantage of batched results when matching global regexp. 
BUG=
TEST=regexp-global.js

Review URL: https://chromiumcodereview.appspot.com/10831126

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-06 09:06:27 +00:00
svenpanne@chromium.org
83fc4205f6 Fixed compound/count operations with getter-only accessor properties. 
The underlying problem is that for compound/count operations we use the *load*
type feedback for storing, too. For normal properties this doesn't matter, but
for accessor properties we should better use the *store* type feedback, which
would be available, too. This consistent feedback usage could be guaranteed if
we removed the heavy copy-n-paste in the crankshaft code generation for
compound/count operations and assignments/property loads.

To be on the safe side, we postpone this refactoring and do a quick and easily
mergeable fix.

BUG=140083
TEST=mjsunit/regress/regress-crbug-140083.js

Review URL: https://chromiumcodereview.appspot.com/10828146

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-03 09:45:08 +00:00
ulan@chromium.org
c6d4094e44 Android: increase default test timeout and skip time sensitive mjsunit/regress/regress-1969. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10836049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-01 13:06:08 +00:00
erik.corry@gmail.com
b3e2440580 Speed up quicksort test to avoid timeouts on simulators. 
Review URL: https://chromiumcodereview.appspot.com/10830093

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-31 13:36:24 +00:00
jkummerow@chromium.org
80c35c6522 Always set the callee's context when calling a function from optimized code. 
This is necessary even for recursive calls because we're sharing optimized code among closures, which could call each other and have distinct contexts.

BUG=138887
TEST=mjsunit/regress/regress-crbug-138887

Review URL: https://chromiumcodereview.appspot.com/10834031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12201 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-26 12:49:08 +00:00
mstarzinger@chromium.org
806fb8be96 Fix bootstrapping without snapshot and low GC interval. 
R=yangguo@chromium.org
BUG=v8:2249
TEST=mjsunit/regress/regress-2249 (snapshot=off)

Review URL: https://chromiumcodereview.appspot.com/10818005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-07-23 16:18:25 +00:00