ricow@chromium.org
cd6bd8c4fa
Revert 6220 (generic descriptor support in Object.defineOwnProperty)
...
This change caused a webkit failure in http/tests/security/xss-DENIED-defineProperty.html.
I will look into this and reapply when I find a solution.
Review URL: http://codereview.chromium.org/6134005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-10 07:20:54 +00:00
ricow@chromium.org
22d1249b68
Disable flaky test on x64 when running with --crankshaft.
...
mjsunit/compiler/simple-osr is flaky.
Disabling for now until we get osr in place on the x64 port.
Bug 1026 created to track this:
http://code.google.com/p/v8/issues/detail?id=1026
Review URL: http://codereview.chromium.org/6176001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 13:53:20 +00:00
whesse@chromium.org
50eaaf4be4
Speed up a regression test regress-3249650.js so it does not timeout.
...
Review URL: http://codereview.chromium.org/6175001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 13:52:36 +00:00
lrn@chromium.org
90fd0ee897
Change interpretation of malformed \c? escapes in RegExp to match JSC.
...
Review URL: http://codereview.chromium.org/6171001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 12:35:42 +00:00
sgjesse@chromium.org
cce04b9071
Added a few new debugger tests.
...
Patch by Mark Lam from Hewlett-Packard Development Company, LP
Review URL: http://codereview.chromium.org/6035016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 11:59:41 +00:00
ricow@chromium.org
08cd803827
Landing for Peter Hallam
...
First cut at bug 992
Fixes JS portion of DefineOwnProperty when there is
an existing property and the new descriptor is generic.
Makes code follow spec steps more closely.
Fixes typo for check for unchanged enumerable in step 6.
Adds regression test.
Codereview url: http://codereview.chromium.org/6035014/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6220 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 11:49:09 +00:00
whesse@chromium.org
f39ff5c679
X64 Crankshaft: Implement some methods in LInstruction, update mjsunit test expectations.
...
Review URL: http://codereview.chromium.org/6118002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-07 09:47:16 +00:00
lrn@chromium.org
a50e69bda5
Avoid calling inherited setters when creating object literals and their boilerplates.
...
Fix issue 1015.
Review URL: http://codereview.chromium.org/6118001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-06 14:00:50 +00:00
sgjesse@chromium.org
9bc3a16af0
Fix bug in instanceof stub
...
If the instanceof stub was requested to deliver true/false objects as the result instead of 0/1 then 0/1 was actually returned if the builtin INSTANCE_OF ended up being called. This is now fixed.
BUG=v8:1020
TEST=test/mjsunit/regress/regress-1020.js
Review URL: http://codereview.chromium.org/6014013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-05 14:19:12 +00:00
ricow@chromium.org
aa396c5779
Allow getters and setters on JSArray elements.
...
This fixes bug 900
Review URL: http://codereview.chromium.org/5959009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 13:59:34 +00:00
lrn@chromium.org
d8fb09a030
Fix tab in javascript file.
...
Review URL: http://codereview.chromium.org/6004009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6156 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 13:14:39 +00:00
lrn@chromium.org
e7ecb74b8a
Don't let JSON parsed objects hit inherited setters.
...
Review URL: http://codereview.chromium.org/6101001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 12:19:55 +00:00
lrn@chromium.org
59aea66dfa
Fix bug that happens when the first non-ASCII character of a literal is at a power-of-two position.
...
Review URL: http://codereview.chromium.org/6044009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 11:25:59 +00:00
lrn@chromium.org
5741575327
Tweak quicksort loop to reduce number of compares slightly.
...
Review URL: http://codereview.chromium.org/6039002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-20 14:57:51 +00:00
antonm@chromium.org
ae476ecd6c
Teach C++ ArraySlice builtin to deal with arguments object.
...
Array.prototype.slice.call(arguments, ...) idiom is pretty common (up to 97% of invocations
in GMail), so we'd better handle it efficiently too.
Review URL: http://codereview.chromium.org/6034003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-20 14:41:41 +00:00
ager@chromium.org
06ac3b18a0
When setting property on a context extension object do not inherit the
...
attributes from an existing property on a prototype object.
Review URL: http://codereview.chromium.org/5995002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-17 13:04:53 +00:00
ricow@chromium.org
717153274f
Reduce number of iterations in new regression test, this times out on arm and the regression is hit with an order of magnitude less iterations.
...
Review URL: http://codereview.chromium.org/5963001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-17 07:23:06 +00:00
fschneider@chromium.org
73737fcdb6
Fix bugs in the range analysis for integers.
...
The overflow conditions were not correctly detected for
certain add, sub and mul instructions.
I replaced the previous code by using 64-bit arithmetic
to correctly identify overflows for *, + and -.
Review URL: http://codereview.chromium.org/5860009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 18:01:36 +00:00
ager@chromium.org
6e30a77ab5
A number of instructions use GVN but do not provide a comparison
...
function for the data. This leads to wrong results where operations
are wrongly assumed to have the same value as a previous (different)
operation.
Provide the data comparison functions.
BUG=995
Review URL: http://codereview.chromium.org/5898003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 15:40:02 +00:00
ager@chromium.org
1b67320800
Perform more aggressive time to NaN conversions. Our internal date
...
methods rely on the time values passed in being within a certain range
- not significantly larger than the the ECMA 262 specified time
range. When creating a time, always make it NaN if there is no way
that it can be within range even after UTC conversion.
Review URL: http://codereview.chromium.org/5905003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6048 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 13:02:09 +00:00
lrn@chromium.org
b20f0968fa
Change DefaultString and DefaultNumber to match the spec required behavior.
...
Previously it did two reads of the .toString and .valueOf properties where
only one was allowed.
Review URL: http://codereview.chromium.org/5950001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6047 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 12:49:55 +00:00
ricow@chromium.org
357afa385b
Change Object.defineProperty to accept undefined as getters and setters and to correctly accept overriding an accessor with a data property.
...
In the past we only accepted functions as argument for setting an
accessor. Since one should be able to set an accessor to undefined
this had to be changed to take either.
In addition, we did not lookup properties in the prototype chain,
causing us to call the setter of an existing accessor up the prototype
chain when trying to replace an existing accessor (that was not local)
with a data property.
Review URL: http://codereview.chromium.org/5861006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 12:21:08 +00:00
peter.rybin@gmail.com
e9c989b8fa
Fix evaluate with context debug protocol
...
Review URL: http://codereview.chromium.org/5866002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 19:55:51 +00:00
vegorov@chromium.org
ed59e77256
Fix several register allocation issues revealed by fuzzer:
...
- LIsObject had incorrect contraint for value input;
- Temporaries had incorrect lifetime intervals;
- Live ranges for live_out values was not covering the whole block.
Review URL: http://codereview.chromium.org/5899002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 18:13:02 +00:00
kmillikin@chromium.org
ace6290452
Fix issue 974.
...
When entering a finally block in unoptimized code, we unconditionally
save the accumulator register in the stack in case it holds a return
value or an exception. In the case of a break, continue, or falling
off the end of the try or catch block, this value is unpredictable and
not necessarily safe for GC.
Review URL: http://codereview.chromium.org/5883003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 16:14:29 +00:00
vegorov@chromium.org
655b30858d
Fix issue 982.
...
When splitting at the beginning of a use interval assign coinciding position to the split child instead of leaving it to parent.
BUG=v8:982
Review URL: http://codereview.chromium.org/5898001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 14:35:46 +00:00
karlklose@chromium.org
88dfadd090
Fix presubmit error.
...
Review URL: http://codereview.chromium.org/5891001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 11:43:35 +00:00
karlklose@chromium.org
5f962f2eb2
Add array bound checks to code generated for SwapElements. This fixes a bug that lead to a segfault when an array was modified while it was sorted.
...
Review URL: http://codereview.chromium.org/5686006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 09:52:58 +00:00
lrn@chromium.org
f118f44130
Fix regression in JSON serialization of RegExps.
...
Tweaks to the serialization.
Review URL: http://codereview.chromium.org/5676005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6018 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 09:31:05 +00:00
ager@chromium.org
5dc1d7a126
Update test expectations for ARM crankshaft build.
...
Review URL: http://codereview.chromium.org/5813002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6014 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-15 07:46:22 +00:00
ricow@chromium.org
cd2f41f7dd
Don't run mjsunit/compiler/regress-funcaller in debug mode.
...
This test takes 12+ minutes to run on the windows slaves. In addition,
the regression is hit in release mode on the code prior to the fix for
this.
Review URL: http://codereview.chromium.org/5701006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-14 13:15:28 +00:00
ricow@chromium.org
60f07139aa
Disable mjsunit/regress/regress-create-exception in debug mode.
...
This test takes a very long time to run in debug mode. This test alone
is causing 10+ minutes of cycle time on the windows debug bots (and the
same in CPU runtime on all slaves!).
Review URL: http://codereview.chromium.org/5748006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-14 08:55:57 +00:00
ricow@chromium.org
f89d4f39e6
mjsunit/regress/regress-3247124 takes a long time to run, and the original regression is hit
...
with two orders of magnitude less iterations.
Review URL: http://codereview.chromium.org/5822001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-14 08:29:33 +00:00
ricow@chromium.org
3b1152aed4
Change the number of iterations in mjsunit/regress-962
...
This test causes the arm simulator to timeout, and the test reveals
the original problem with three orders of magnitude less iterations.
Review URL: http://codereview.chromium.org/5678007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-14 07:57:14 +00:00
peter.rybin@gmail.com
8c3e13cad8
Introduce additional context to evaluate operations
...
Review URL: http://codereview.chromium.org/5733001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5997 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-14 00:07:44 +00:00
kmillikin@chromium.org
b1c71408d7
Rename regression test and reenable disabled test.
...
The regression test for v8 issue 969 was committed with the wrong file
name. Also reenable a test that was disabled due to that issue.
Review URL: http://codereview.chromium.org/5707008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5992 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 16:52:04 +00:00
kmillikin@chromium.org
49f4c39d6d
Deoptimize to the proper target after assignment side effects.
...
This fixes V8 issue 989.
Before, assignments used the AST ID of the assignment expression to
mark the side effect of the store, which became a target for
deoptimization bailout for code after the assignment. In effect
contexts this environment included the value of the assignment, which
was unexpected by the unoptimized code.
Now we introduce a new assignment ID for AST node types that include
an assignment (Assignment, CountOperation, and ForInStatement) and use
it for the side effect of the store.
Review URL: http://codereview.chromium.org/5682010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5990 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 16:29:47 +00:00
ricow@chromium.org
ad0401174a
Temporarily disable mjsunit/array-splice (issue 969)
...
Disabling this to get the waterfall green, Kevin knows what the issue
is and is working on a fix.
Review URL: http://codereview.chromium.org/5752005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 12:10:41 +00:00
lrn@chromium.org
94bb378ee5
Make RegExp character class match JSC.
...
See http://trac.webkit.org/changeset/73594
Review URL: http://codereview.chromium.org/5723002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-13 08:33:32 +00:00
vegorov@chromium.org
65f98b1e7a
Fix issue 962.
...
SplitBetween (formely known as Split with 3 arguments) should select split position from [start, end] instead of [start, end[. This should also improve allocation quality (remove certain redundant move patterns).
Also some minor renaming and refactoring to make register allocator code more readable.
BUG=v8:962
TEST=test/mjsunit/regress/regress-962.js
Review URL: http://codereview.chromium.org/5720001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-10 14:25:10 +00:00
ager@chromium.org
eb8e1d9d0e
Change test script to make it easy to run crankshaft tests on ARM and
...
x64 where crankshaft is not the default. Add ability to add custom
expectations for running in this special crankshaft mode.
The expectations are not updated in this change. There are a couple of
bugs that I would like to fix before doing that. Otherwise the lists
will be very long. :)
Review URL: http://codereview.chromium.org/5787001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-10 12:05:28 +00:00
lrn@chromium.org
c0df3f0a23
Fix issue 965.
...
Review URL: http://codereview.chromium.org/5773002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5960 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-10 11:27:15 +00:00
lrn@chromium.org
6691d531ab
Revert 5911 (RegExp fail on invalid range syntax).
...
Review URL: http://codereview.chromium.org/5703001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5953 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-09 12:07:52 +00:00
mikhail.naganov@gmail.com
670aea0218
Remove log compression support.
...
This is no longer used in Chromium, and only pollutes code.
BUG=859
Review URL: http://codereview.chromium.org/5575006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 13:24:22 +00:00
kmillikin@chromium.org
e0d3f6afdf
Be more careful about exiting inlined functions in a test context.
...
When falling off the end of a function inlined in a test context, we cannot
constant fold the test of undefined away. The graph builder assumes that
control flow always reaches both branches of a test.
Instead, explicitly test and branch on "undefined". Introduce a pair of
empty blocks to hold the necessary LeaveInlined instructions.
Review URL: http://codereview.chromium.org/5566005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 12:07:40 +00:00
kasperl@chromium.org
90b3370374
Update V8 to version 3.0 (re-land r5920).
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:31:57 +00:00
kasperl@chromium.org
51b494d096
Revert r5920. Will re-land shortly.
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 11:01:02 +00:00
kasperl@chromium.org
e5860bd6a8
Update V8 to version 3.0.
...
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-07 09:11:56 +00:00
sandholm@chromium.org
209eb1c219
Improved JSON stringify.
...
Review URL: http://codereview.chromium.org/5578004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-06 15:41:07 +00:00
lrn@chromium.org
be20c55b3e
Change RegExp syntax to fail on invalid ranges like [\d-x], [x-\d] and [\d-\d].
...
The previous behavior was to treat the "-" as verbatim if the range was invalid.
This change matches the JSC changeset http://trac.webkit.org/changeset/72813/
Review URL: http://codereview.chromium.org/5464001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-02 08:02:37 +00:00