Commit Graph

25312 Commits

Author SHA1 Message Date
brettw
cb2c22321f Use public_deps for v8_base in GN.
The previous code took advantage of the fact that a group's deps are implicitly public, but I'm trying to fix that. This also cleans up some duplicated code between component and non-component builds.

Review URL: https://codereview.chromium.org/1356723002

Cr-Commit-Position: refs/heads/master@{#30820}
2015-09-18 09:32:43 +00:00
jkummerow
491b9e29a0 [hydrogen] Add crash-hunting instrumentation to Hydrogen too
This extends instrumentation added in r30683 and r30768 to cover
the possibility that the root cause we're after is in optimized code.

This CL is intended to be reverted in a couple of days, but should
cause no harm while it's in the tree (we would crash anyway).

BUG=chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1348823003

Cr-Commit-Position: refs/heads/master@{#30819}
2015-09-18 09:15:46 +00:00
bmeurer
8016547c8e [stubs] Refactor StringCompareStub and use it for HStringCompareAndBranch.
The StringCompareStub used to take its parameters on the (JavaScript)
stack, which made it impossible to use in TurboFan. Actually
StringCompareStub was currently completely unused. This changes the
calling convention to something TurboFan compatible and introduces a
CallInterfaceDescriptor for StringCompareStub. It also changes
HStringCompareAndBranch to use the StringCompareStub instead of using
the full blown CompareICStub for a stupid string comparison.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1347913003

Cr-Commit-Position: refs/heads/master@{#30818}
2015-09-18 08:30:41 +00:00
machenbach
ba67a42629 [test] Allow passing extra flags to perf tryjobs.
NOTRY=true

Review URL: https://codereview.chromium.org/1342263003

Cr-Commit-Position: refs/heads/master@{#30817}
2015-09-18 08:06:31 +00:00
bmeurer
593c655a3c [runtime] Replace COMPARE/COMPARE_STRONG with proper Object::Compare.
This removes the weird COMPARE and COMPARE_STRONG JavaScript builtins
and replaces them with a proper C++ implementation in Object::Compare
and appropriate wrappers Object::LessThan, Object::GreaterThan, and
friends that are intended to be used by a true/false returning CompareIC
in the future, as well as the interpreter.  As a short-term solution we
provide %Compare and %Compare_Strong entry points for the current
CompareIC that return the appropriate integer values expected by
fullcodegen currently.

Now the Abstract Relational Comparison is also using the correct
ToPrimitive implementation, which properly supports @@toPrimitive.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1350113002

Cr-Commit-Position: refs/heads/master@{#30816}
2015-09-18 06:35:50 +00:00
v8-autoroll
dc39f3089e Update V8 DEPS.
Rolling v8/tools/clang to 0e7dbd100f91096de47919f394ac0b32dd7c21a2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1355633003

Cr-Commit-Position: refs/heads/master@{#30815}
2015-09-18 03:26:52 +00:00
aperez
3ece714df6 Use a kMaxSafeInteger instead of Number.MAX_SAFE_INTEGER
Defines and uses a kMaxSafeInteger macro (which expands to the constant
2^53-1) instead of accessing Number.MAX_SAFE_INTEGER. This saves loading
the attribute from the Number object, which is slightly faster. This also
makes it clearer from reading the code that tha value being compared is
constant.

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1353953002

Cr-Commit-Position: refs/heads/master@{#30814}
2015-09-18 00:00:00 +00:00
mbrandy
05c804fc1a PPC: [runtime] Initial step towards switching Execution::Call to callable.
Port d5bbd45f04

Original commit message:
    Currently Execution::Call (and friends) still duplicate a lot of the
    Call sequence logic that should be encapsulated in the Call and
    CallFunction builtins. So the plan now is to switch Execution::Call
    to accept any Callable and just pass that through to the Call builtin.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1347213003

Cr-Commit-Position: refs/heads/master@{#30813}
2015-09-17 20:40:04 +00:00
gdeepti
a633a38f08 [simdjs] Update spec version to 0.8.4
Merge ShiftRightArithmetic and ShiftRightLogical Functions.

BUG=v8:4124
LOG=Y

Review URL: https://codereview.chromium.org/1351663002

Cr-Commit-Position: refs/heads/master@{#30812}
2015-09-17 17:55:03 +00:00
rmcilroy
2088752c70 [arm64]: Fix bug introduced accidentally in r30710
Uncomment the if (!serializer_enabled()) check which I accidentially left
commented out after debugging during the CLs development.

BUG=chromium:532969
R=bmeurer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1351943002

Cr-Commit-Position: refs/heads/master@{#30811}
2015-09-17 17:24:22 +00:00
mbrandy
92eed98b14 PPC: [runtime] Replace the EQUALS builtin with proper Object::Equals.
Port 54bab695f5

Original commit message:
    Move the implementation of the Abstract Equality Comparison to the
    runtime and thereby remove the EQUALS dispatcher builtin. Also remove
    the various runtime entry points that were only used to support the
    EQUALS builtin.

    Now the Abstract Equality Comparison is also using the correct
    ToPrimitive implementation, which properly supports @@toPrimitive.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1357493002

Cr-Commit-Position: refs/heads/master@{#30810}
2015-09-17 17:16:52 +00:00
mbrandy
b82efa8290 PPC: [builtins] Unify the String constructor.
Port a3d6f6cce3

Original commit message:
    Implement the String constructor completely as native builtin,
    avoiding the need to do gymnastics in JavaScript builtin to
    properly detect the no argument case (which is different from
    the undefined argument case) and also allowing to just
    tailcall through to ToString or SymbolDescriptiveString for
    the common case. Also the JavaScript builtin was misleading
    since the case for construct call was unused, but could be
    triggered in a wrong way once we support tail calls from
    constructor functions.

    This refactoring allows us to properly implement subclassing
    for String builtins, once we have the correct initial_map on
    derived classes (it's merely a matter of using NewTarget
    instead of the target register now).

    This introduces a new %SymbolDescriptiveString runtime
    entry, which is also used by Symbol.toString() now.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1354663002

Cr-Commit-Position: refs/heads/master@{#30809}
2015-09-17 17:14:16 +00:00
bmeurer
d5bbd45f04 [runtime] Initial step towards switching Execution::Call to callable.
Currently Execution::Call (and friends) still duplicate a lot of the
Call sequence logic that should be encapsulated in the Call and
CallFunction builtins. So the plan now is to switch Execution::Call
to accept any Callable and just pass that through to the Call builtin.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4413
LOG=n

Committed: https://crrev.com/359645f48156e15f235e9a9ede7910e0bcd9ae45
Cr-Commit-Position: refs/heads/master@{#30791}

Review URL: https://codereview.chromium.org/1353723002

Cr-Commit-Position: refs/heads/master@{#30808}
2015-09-17 17:11:54 +00:00
mbrandy
632c367998 PPC: Remove --pretenure-call-new
Port b5588f48fd

Original commit message:
    There isn't a plan to turn it on soon, so we'll take it out in favor of cleaner code.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1347253003

Cr-Commit-Position: refs/heads/master@{#30807}
2015-09-17 17:04:12 +00:00
mbrandy
c1be709866 PPC: Vector ICs: Hook up vectors in platform builtins to their SharedFunctionInfos.
Port 905e008c52

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4423
LOG=N

Review URL: https://codereview.chromium.org/1350923003

Cr-Commit-Position: refs/heads/master@{#30806}
2015-09-17 17:03:04 +00:00
tandrii
1777763fdf Whitespace change.
R=machenbach@chromium.org,jochen@chromium.org
NOTRY=True
BUG=

Review URL: https://codereview.chromium.org/1357453002

Cr-Commit-Position: refs/heads/master@{#30805}
2015-09-17 14:59:41 +00:00
ben
bfce677866 Pretenure builtin typed arrays.
Typed arrays from the snapshot start out in the young space but they
all seem to end up in the old space sooner or later anyway.  Let's
expedite that by allocating them in the old space right away.

Review URL: https://codereview.chromium.org/1347263003

Cr-Commit-Position: refs/heads/master@{#30804}
2015-09-17 14:47:56 +00:00
mlippautz
61fef76894 [heap] Fix waiting for parallel tasks
R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1356663002

Cr-Commit-Position: refs/heads/master@{#30803}
2015-09-17 14:43:27 +00:00
ishell
d7b78abc2e Fix for deopt fuzzer which was broken by https://codereview.chromium.org/1352803002
Review URL: https://codereview.chromium.org/1347073004

Cr-Commit-Position: refs/heads/master@{#30802}
2015-09-17 14:05:43 +00:00
machenbach
d7c8b9bac6 [test] Switch perf try wrapper to buildbucket.
NOTRY=true

Review URL: https://codereview.chromium.org/1351093002

Cr-Commit-Position: refs/heads/master@{#30801}
2015-09-17 13:41:42 +00:00
hpayer
3eda099c1b [heap] Scalable slots buffer for parallel compaction.
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1341973003

Cr-Commit-Position: refs/heads/master@{#30800}
2015-09-17 13:38:29 +00:00
ishell
3d964e0b83 Disable tests that are known to be non-deterministic in --verify-predictable mode.
Review URL: https://codereview.chromium.org/1352803002

Cr-Commit-Position: refs/heads/master@{#30799}
2015-09-17 13:02:10 +00:00
jkummerow
9516dccd41 Reland "[test] Fix cctest path separators on Windows"
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Original review: https://codereview.chromium.org/1348653003/

This reverts commit 5f44a91059.

NOTRY=true

Review URL: https://codereview.chromium.org/1356613002

Cr-Commit-Position: refs/heads/master@{#30798}
2015-09-17 13:01:12 +00:00
cbruni
007eac94a1 Improve JSReceiver::GetKeys Speed
The core bottleneck lies in N-square cost of array union. Depending on the size
of the arrays involved it makes sense to rely on a hash-set/table for the lookup.

LOG=N
BUG=v8:2904

Review URL: https://codereview.chromium.org/1316213008

Cr-Commit-Position: refs/heads/master@{#30797}
2015-09-17 12:52:51 +00:00
mlippautz
7af79ae67a Reland "[heap] Introduce parallel compaction algorithm."
This reverts commit 7a0a0b8b85.

- The number of parallel tasks is still 1, i.e., we only compact on the main
  thread.
- Remove emergency memory (PagedSpace, and CodeRange)
- Introduce partial compaction of pages.
- Logic for multiple tasks is in place.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1356533002

Cr-Commit-Position: refs/heads/master@{#30796}
2015-09-17 12:23:55 +00:00
jkummerow
5f44a91059 Revert of [test] Fix cctest path separators on Windows (patchset #2 id:20001 of https://codereview.chromium.org/1348653003/ )
Reason for revert:
mozilla tests are failing on Windows

Original issue's description:
> [test] Fix cctest path separators on Windows
>
> Now run-tests.py understands "suite/foo/bar" with forward slashes for
> command-line test selection on all test suites on all platforms.
>
> Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
> that behavior is sacrificed here in favor of unification. For the cctest
> suite, OTOH, it wasn't possible on Windows to select specific tests at all.
>
> Committed: https://crrev.com/b36cfdb39ae648b49a1396c4f669df9b1f57996c
> Cr-Commit-Position: refs/heads/master@{#30794}

TBR=machenbach@google.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1349163002

Cr-Commit-Position: refs/heads/master@{#30795}
2015-09-17 12:00:23 +00:00
jkummerow
b36cfdb39a [test] Fix cctest path separators on Windows
Now run-tests.py understands "suite/foo/bar" with forward slashes for
command-line test selection on all test suites on all platforms.

Previously, file-based suites like mjsunit also accepted "mjsunit/foo\bar";
that behavior is sacrificed here in favor of unification. For the cctest
suite, OTOH, it wasn't possible on Windows to select specific tests at all.

Review URL: https://codereview.chromium.org/1348653003

Cr-Commit-Position: refs/heads/master@{#30794}
2015-09-17 11:24:09 +00:00
machenbach
a535ed4bce Revert of [runtime] Initial step towards switching Execution::Call to callable. (patchset #1 id:1 of https://codereview.chromium.org/1353723002/ )
Reason for revert:
[Sheriff] Causes a dcheck failure in layout tests (and some test changes in release):
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/1442/layout-test-results/virtual/android/fullscreen/api/element-request-fullscreen-top-stderr.txt
from
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/1442

Original issue's description:
> [runtime] Initial step towards switching Execution::Call to callable.
>
> Currently Execution::Call (and friends) still duplicate a lot of the
> Call sequence logic that should be encapsulated in the Call and
> CallFunction builtins. So the plan now is to switch Execution::Call
> to accept any Callable and just pass that through to the Call builtin.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
> R=jarin@chromium.org
> BUG=v8:4413
> LOG=n
>
> Committed: https://crrev.com/359645f48156e15f235e9a9ede7910e0bcd9ae45
> Cr-Commit-Position: refs/heads/master@{#30791}

TBR=jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4413

Review URL: https://codereview.chromium.org/1346763005

Cr-Commit-Position: refs/heads/master@{#30793}
2015-09-17 10:11:49 +00:00
conradw
b185ed4061 Fix temp_zone scoping when parsing inner function literals
BUG=v8:4392
LOG=Y

Review URL: https://codereview.chromium.org/1354523003

Cr-Commit-Position: refs/heads/master@{#30792}
2015-09-17 09:38:33 +00:00
bmeurer
359645f481 [runtime] Initial step towards switching Execution::Call to callable.
Currently Execution::Call (and friends) still duplicate a lot of the
Call sequence logic that should be encapsulated in the Call and
CallFunction builtins. So the plan now is to switch Execution::Call
to accept any Callable and just pass that through to the Call builtin.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1353723002

Cr-Commit-Position: refs/heads/master@{#30791}
2015-09-17 09:05:46 +00:00
neis
1328715977 Intersection of certain constants with bitsets was wrongly non-empty.
R=jarin
BUG=

Review URL: https://codereview.chromium.org/1343933002

Cr-Commit-Position: refs/heads/master@{#30790}
2015-09-17 08:52:10 +00:00
hpayer
1eeb41692a [heap] Inline record slot methods.
BUG=chromium:532784
LOG=n

Review URL: https://codereview.chromium.org/1347363002

Cr-Commit-Position: refs/heads/master@{#30789}
2015-09-17 08:44:24 +00:00
mlippautz
7a0a0b8b85 Revert of [heap] Introduce parallel compaction algorithm. (patchset #9 id:160001 of https://codereview.chromium.org/1343333002/ )
Reason for revert:
Check failed: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Win64/builds/5535/steps/Check%20%28flakes%29/logs/IndependentWeakHandle

Original issue's description:
> [heap] Introduce parallel compaction algorithm.
>
> - The number of parallel tasks is still 1, i.e., we only compact on the main
>   thread.
> - Remove emergency memory (PagedSpace, and CodeRange)
> - Introduce partial compaction of pages.
> - Logic for multiple tasks is in place.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/61ea4f55616d3f7bc2ce049a678f16f7475e03e0
> Cr-Commit-Position: refs/heads/master@{#30787}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1347873003

Cr-Commit-Position: refs/heads/master@{#30788}
2015-09-17 07:58:35 +00:00
mlippautz
61ea4f5561 [heap] Introduce parallel compaction algorithm.
- The number of parallel tasks is still 1, i.e., we only compact on the main
  thread.
- Remove emergency memory (PagedSpace, and CodeRange)
- Introduce partial compaction of pages.
- Logic for multiple tasks is in place.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1343333002

Cr-Commit-Position: refs/heads/master@{#30787}
2015-09-17 07:36:09 +00:00
bmeurer
7be2555151 Revert "[profiler] Make no frame region detection code more robust", "Fix ASAN after r30777" and "Fix MSAN warning after r30777 (try 2)"
This reverts commits 12c7bc9a22,
cb0b359225, and
a6e00c6a9f, because they introduced weird
flaky crashes in random places now at least in the arm simulator, where
it see that quite often now on different change sets, i.e. see

http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm_rel/builds/8138/steps/Check%20%28flakes%29/logs/LoadICFastApi_DirectC..

and

https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20mipsel%20-%20sim/builds/2566/steps/Check%20%28flakes%29/logs/LoadICFastApi_DirectC..

for example.

TBR=alph@chromium.org
BUG=chromium:529931
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
LOG=N

Review URL: https://codereview.chromium.org/1354573002

Cr-Commit-Position: refs/heads/master@{#30786}
2015-09-17 06:31:30 +00:00
alph
a6e00c6a9f Fix MSAN warning after r30777 (try 2)
TBR=bmeurer,yurys
NOTRY=true

Review URL: https://codereview.chromium.org/1348493003

Cr-Commit-Position: refs/heads/master@{#30785}
2015-09-17 05:41:25 +00:00
mtrofin
af1508c64f [tubofan] Greedy: groupper -> grouper.
Small spelling fix.

Review URL: https://codereview.chromium.org/1352673002

Cr-Commit-Position: refs/heads/master@{#30784}
2015-09-17 03:55:15 +00:00
mtrofin
1145090ad5 [turbofan] Greedy: faster compile time.
Avoiding unnecessarily traversing conflicts when doing weight
comparisons. This reduced compile time regressions from a few
multiples to under 10% - at least for zlib.

Review URL: https://codereview.chromium.org/1346263004

Cr-Commit-Position: refs/heads/master@{#30783}
2015-09-17 03:54:03 +00:00
v8-autoroll
7a88581351 Update V8 DEPS.
Rolling v8/tools/clang to eea56c7ed84778edadbcd43f06793b0311a56b28

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1350993003

Cr-Commit-Position: refs/heads/master@{#30782}
2015-09-17 03:26:35 +00:00
chunyang.dai
ecc6e6c52c X87: Reland VectorICs: ia32 store ics need a virtual register.
port 1e00bb57a2 (r30737).

original commit message:

    (reason for revert/reland: patch incorrectly left --vector-stores flag
     on, helpfully revealing some gcstress issues to look at, but they
     don't need to block this CL).

    Some pretty hacky code was used to carry out the tail-call
    handler dispatch on ia32 vector stores due to a lack
    of free registers. It really tanks performance. A better
    approach is to use a virtual register on the isolate.

BUG=

Review URL: https://codereview.chromium.org/1344383002

Cr-Commit-Position: refs/heads/master@{#30781}
2015-09-17 01:25:36 +00:00
chunyang.dai
e97b1938dd X87: [runtime] Replace the EQUALS builtin with proper Object::Equals.
port 54bab695f5 (r30747).

original commit message:

    Move the implementation of the Abstract Equality Comparison to the
    runtime and thereby remove the EQUALS dispatcher builtin. Also remove
    the various runtime entry points that were only used to support the
    EQUALS builtin.

    Now the Abstract Equality Comparison is also using the correct
    ToPrimitive implementation, which properly supports @@toPrimitive.

BUG=

Review URL: https://codereview.chromium.org/1349623002

Cr-Commit-Position: refs/heads/master@{#30780}
2015-09-17 01:21:53 +00:00
alph
cb0b359225 Fix ASAN after r30777
TBR=bmeurer,yurys
NOTRY=true

Review URL: https://codereview.chromium.org/1349953002

Cr-Commit-Position: refs/heads/master@{#30779}
2015-09-17 00:56:46 +00:00
ofrobots
007baaedd3 improve allocation accounting for incremental mark
Add an assertion that allocated_bytes >= 0 in IncrementalMark::Step and then
make it pass. We were not being diligent in maintaining top_on_previous_step_
and as a result inaccurate, and even negative values of allocated_bytes were
being reported to Step.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1274453002

Cr-Commit-Position: refs/heads/master@{#30778}
2015-09-17 00:55:37 +00:00
alph
12c7bc9a22 [profiler] Make no frame region detection code more robust
Upon collection of the stack trace if the current PC falls into
the frame building code, the top frame might be in a non-consistent
state. That leads to some of the frames could be missing from the
stack trace.

The patch makes it check instructions under current PC and if they
look like the frame setup/destroy code, it skips the entire sample.

Support for x86/x64

BUG=chromium:529931
LOG=N

Review URL: https://codereview.chromium.org/1341413002

Cr-Commit-Position: refs/heads/master@{#30777}
2015-09-17 00:12:23 +00:00
mtrofin
bd8c6ab042 [turbofan] Greedy: small fix in groupping algo.
This is a performance bug, not a functional bug: we were
losing grouping opportunities.

BUG=

Review URL: https://codereview.chromium.org/1342243003

Cr-Commit-Position: refs/heads/master@{#30776}
2015-09-16 21:43:34 +00:00
caitpotter88
15e7897bec [cleanup] refactor ParsePropertyDefinition for clarity
Some cleanup of ParsePropertyDefinition --- Replaces certain hacks with
more structured, clean code, and adds additional comments to aid in
comprehension of this tricky area of the ambiguous recursive descent
parser.

BUG=v8:3583
LOG=N
R=adamk, aperez, wingo, rossberg

Review URL: https://codereview.chromium.org/1348773004

Cr-Commit-Position: refs/heads/master@{#30775}
2015-09-16 21:27:39 +00:00
adamk
21bd456453 Disallow Object.observe calls on access-checked objects
We already disallowed observing the global proxy; now we also
disallow any observation of access-checked objects (regardless
of whether the access check would succeed or fail, since there's
not a good way to tell the embedder what kind of access is being
requested).

Also disallow Object.getNotifier for the same reasons.

BUG=chromium:531891
LOG=y

Review URL: https://codereview.chromium.org/1346813002

Cr-Commit-Position: refs/heads/master@{#30774}
2015-09-16 21:19:35 +00:00
domenic
d346834fdc Implement V8 extras utils object
This adds a utils object meant specifically for V8 extras, presenting a limited
API surface for doing things that would otherwise require %-functions.

BUG=v8:4276
LOG=Y
R=jochen@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1343113003

Cr-Commit-Position: refs/heads/master@{#30773}
2015-09-16 21:00:58 +00:00
aperez
d4e1299f16 ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32
Defines a new --harmony-tolength flag, and a ToLengthFlagged() runtime function,
that is used where ES6 requires ToLength(), but a pre-ES6 conversion existed
before. When the flag is disabled, the function uses TO_UINT32(), which is
the pre-ES6 behaviour. When the flag enabled, the ES6-compliant ToLength()
conversion is used.

Based on a patch initially from Diego Pino <dpino@igalia.com>

BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1309243003

Cr-Commit-Position: refs/heads/master@{#30772}
2015-09-16 18:01:52 +00:00
fedor
0d017282d3 [objects] do not visit ArrayBuffer's backing store
ArrayBuffer's backing store is a pointer to external heap, and can't be
treated as a heap object. Doing so will result in crashes, when the
backing store is unaligned.

See: https://github.com/nodejs/node/issues/2791

BUG=chromium:530531
R=mlippautz@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1327403002

Cr-Commit-Position: refs/heads/master@{#30771}
2015-09-16 17:27:59 +00:00