AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
17,852 Commits 1 Branch 0 Tags 839 MiB
d094d0fb44
Commit Graph

1095 Commits

Author SHA1 Message Date
bmeurer@chromium.org
9244429707 Fix invalid loop condition for Array.lastIndexOf(). 
BUG=380512
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/313073003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-04 08:21:39 +00:00
mvstanton@chromium.org
d19aaa2b1c Revert "Reland "Make 'name' property on functions configurable."" 
This reverts commit r21609 due to browser test failures.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/313583002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-03 11:52:07 +00:00
mvstanton@chromium.org
848a9af6b4 %ObjectFreeze needs to exclude non-fast-path objects. 
ClusterFuzz will call it with sloppy arguments and similar cases.

BUG=380049
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/315533002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21624 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-03 07:59:36 +00:00
mvstanton@chromium.org
adeaedf547 When flag --nouse-osr is set, don't allow osr from hidden runtime calls. 
BUG=379770
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/310773003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-03 07:45:40 +00:00
adamk@chromium.org
509a1a405c ES6: Add support for values/keys/entries for Map and Set 
This allows code like this:

  var map = new Map();
  map.set(1, 'One');
  ...
  var iter = map.values();
  var res;
  while (!(res = iter.next()).done) {
    print(res.value);
  }

BUG=v8:1793
LOG=Y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/259883002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-03 00:34:01 +00:00
mstarzinger@chromium.org
d6500b6cf7 Reland "Make 'name' property on functions configurable." 
R=rossberg@chromium.org
BUG=v8:3333
LOG=N

Review URL: https://codereview.chromium.org/303463006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21609 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-06-02 13:35:26 +00:00
bmeurer@chromium.org
5cd009a004 HRor and HSar can deoptimize. 
BUG=v8:3359
LOG=y
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/309483002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-30 16:12:25 +00:00
mvstanton@chromium.org
8c54a373dd Changing the attributes of a data property implemented with 
ExecutableAccessorInfo turns the property into a field. Better
to keep it as a callback, and correctly deal with the changed
property attributes.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/262053011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21558 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-28 09:58:27 +00:00
mstarzinger@chromium.org
6b33e50701 Revert "Make 'name' property on functions configurable." 
R=danno@google.com, danno@chromium.org

Review URL: https://codereview.chromium.org/297163009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21534 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-27 15:00:26 +00:00
yangguo@chromium.org
94b4aef7d6 Fix arm64 gc stress issue. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/306483002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-27 06:35:45 +00:00
mvstanton@chromium.org
d755611e93 Reland "Customized support for feedback on calls to Array." and follow-up fixes. 
Comparing one CallIC::State to another was not done correctly, leading to a failure to patch a CallIC when transitioning from monomorphic Array to megamorphic.

BUG=chromium:377198,chromium:377290
LOG=Y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/305493003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-26 13:59:24 +00:00
mstarzinger@chromium.org
82b3b2a367 Make 'name' property on functions configurable. 
R=rossberg@chromium.org
BUG=v8:3333
LOG=N

Review URL: https://codereview.chromium.org/296413003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-26 11:42:56 +00:00
yangguo@chromium.org
32f433c12e Fix leak in debug mirror cache. 
When fetching loaded scripts, mirror objects are created and cached.
If the cache is not cleared, it holds script objects alive.

This also fixes a minor issue with script unloading.

R=ulan@chromium.org
BUG=376534
LOG=N

Review URL: https://codereview.chromium.org/296953005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-26 07:05:56 +00:00
mstarzinger@chromium.org
cf448aa15f Fix representation inference for mutable double boxes. 
R=jarin@chromium.org
BUG=v8:3307
TEST=mjsunit/regress/regress-3307
LOG=N

Review URL: https://codereview.chromium.org/298723014

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-23 14:02:08 +00:00
jarin@chromium.org
3d0bf69cd8 Attempt no. 3 to fix Heap::IsHeapIterable and HeapIterator. 
Now we remember new space's top pointer after the last GC to find out if there was a new space allocation since the last GC.

Unfortunately, this not completely safe - the debugger has a callback hook (that can call to JS) at the end of the GC epilogue that can in theory allocate and possibly make the heap non-iterable. We can only hope this does not happen.

BUG=373283
R=hpayer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/291193005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-22 11:13:37 +00:00
jarin@chromium.org
02f1a1b987 Revert "Fix Heap::IsHeapIterable." (again) 
This reverts commit r21397.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/299813002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-21 09:49:18 +00:00
jkummerow@chromium.org
58661c150f Fix ArrayShift hydrogen support 
BUG=chromium:374838
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/299713003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-21 08:51:29 +00:00
jarin@chromium.org
58a130da6e Reland "Fix Heap::IsHeapIterable." 
This relands r21388 (+ handlification of an offending function).

BUG=373283
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/294903003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-21 06:44:38 +00:00
jarin@chromium.org
014bf8b407 Revert "Fix Heap::IsHeapIterable." 
This reverts commit r21387.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/291193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-20 14:03:38 +00:00
jarin@chromium.org
dd4c82bbb3 Fix Heap::IsHeapIterable. 
We only consider heap iterable if the new space is empty (in addition to the exisiting old space check).

The change also moves the iterability forcing + allocation prevention gadgets to HeapIterator so that it is impossible to miss them when iterating the heap.

R=hpayer@chromium.org
BUG=373283
LOG=N

Review URL: https://codereview.chromium.org/285693006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-20 13:19:21 +00:00
jarin@chromium.org
c3cd2f0301 Fix %SetFlags("--stress-compaction") 
BUG=369943
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/261253006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-12 10:39:08 +00:00
jarin@chromium.org
cbf8c3f460 Make escape analysis preserve all representations required by HCompareNumericAndBranch. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/257803012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-12 08:43:18 +00:00
adamk@chromium.org
fb70df076b Object.observe: avoid accessing acceptList properties more than once 
BUG=v8:3315
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/270763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 18:22:28 +00:00
jarin@chromium.org
3976ebef93 Make new space iterable for --log-gc and --heap-stats options 
R=hpayer@chromium.org
BUG=370827
TEST=test/mjsunit/regress/regress-370827.js
LOG=N

Review URL: https://codereview.chromium.org/272503005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 09:23:10 +00:00
hpayer@chromium.org
de21c8a245 Simplify ConfigureHeap and change --max_new_space_size to --max_semi_space_size. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/271843005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21204 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 08:38:27 +00:00
ulan@chromium.org
8999a006be Fix index register assignment in LoadFieldByIndex for arm, arm64, and mips. 
This instruciton clobbers the index register.

BUG=368243
LOG=N
TEST=mjsunit/regress/regress-368243
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/269273003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21196 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-08 08:51:51 +00:00
rossberg@chromium.org
ae0a36ee32 Re^3-land "Ship promises and weak collections" 
R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/266243003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-06 14:48:34 +00:00
ishell@chromium.org
9be0c4d378 Fixed jump in non-SSE4.1 implementation of LMathFloor instruction on x64. 
BUG=chromium:370384
LOG=N
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/261853009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21171 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-06 14:20:46 +00:00
hpayer@chromium.org
dde49c9dc3 Set max new space size in tests to proper MB value. 
Revert "Limit old space size in test which require a large new space."

This reverts commit r21103.

Revert "Remove max space limits in tests."

This reverts commit r21104.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/263103006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-05 16:48:33 +00:00
ishell@chromium.org
b4c1eda032 Checks for empty array case added before casting elements to FixedDoubleArray. 
BUG=chromium:369450
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/264973008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21118 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-02 11:30:24 +00:00
svenpanne@chromium.org
7bfc426fc9 Object.defineProperty shouldn't be a hint that we're constructing a dictionary. 
BUG=362870
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/261583004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-02 06:02:00 +00:00
hpayer@chromium.org
56d0b9757e Remove max space limits in tests. 
BUG=

Review URL: https://codereview.chromium.org/263703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 19:32:47 +00:00
hpayer@chromium.org
3dd05f8fc7 Limit old space size in test which require a large new space. 
BUG=

Review URL: https://codereview.chromium.org/265673003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21103 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 18:57:25 +00:00
mvstanton@chromium.org
5e2ee2bac2 A new test needs to exit early on non-internationalization builds. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/265513003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 09:04:17 +00:00
mstarzinger@chromium.org
129c58c47d Fix some more missing ToObject on Array.prototype. 
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/254103002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 08:52:00 +00:00
mvstanton@chromium.org
0c3e70a3b6 Bugfix: internationalization routines fail on monkeypatching. 
Calls to Object.defineProperty() and Object.apply() are not safe.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/253903003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 07:36:12 +00:00
yangguo@chromium.org
1a9649ae13 Error stack getter should not overwrite itself with a data property. 
R=ulan@chromium.org
BUG=v8:3294
LOG=Y

Review URL: https://codereview.chromium.org/258933007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21016 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-28 12:14:36 +00:00
jarin@chromium.org
ff884e06ae Fix materialization of accessor frames with captured receivers 
I have fixed skipping of the receiver object to materialize captured
objects. This is done with a new DoTranslateSkip method.

We should consider unifying DoTranslateSkip, DoTranslateObject and
DoTranslateCommand as they do the almost the same thing - they only
differ in where they store the result.

The change also turns bunch of ASSERTs into CHECKs.

R=mstarzinger@chromium.org
BUG=359441
TEST=test/mjsunit/regress/regress-359441.js
LOG=N

Review URL: https://codereview.chromium.org/225283006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 12:58:15 +00:00
jarin@chromium.org
d557425a0c Preserve Smi representation of non-escaping fields. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/251493004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20971 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 11:29:02 +00:00
verwaest@chromium.org
d2179f2062 Don't adopt the AST id from previous if id is none, since previous may have mismatching expected stack height. 
Additionally, harden merging of simulates after instructions with side effects and ensure there's a simulate before HEnterInlined.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/252583004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20967 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 09:52:11 +00:00
hpayer@chromium.org
20107bf2d8 Remove lazy sweeping. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/254603002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 09:50:42 +00:00
verwaest@chromium.org
a55821eef2 Mark the simulate before EnterInlined with BailoutId::None(), and set ReturnId on EnterInlined. When merging simulates into the simulate before enter-inlined, adopt the last AST id that gets merged into it. 
BUG=v8:3282
LOG=n
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/257583004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 15:20:53 +00:00
bmeurer@chromium.org
052f9e9b6d Make DescriptorArray::IsMoreGeneralThan() and DescriptorArray::Merge() compatible again. 
BUG=365172
LOG=y
TEST=mjsunit/regress/regress-365172-[1-3]
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/255513005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 08:07:14 +00:00
jarin@chromium.org
8c57b45042 Fix C++ type of Factory::NewFixedDoubleArray. 
The change fixes the C++ type of Factory::NewFixedDoubleArray to
reflect the empty array case, where we return an empty
FixedArray (rather than FixedDoubleArray).

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/249593002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 05:29:00 +00:00
wingo@igalia.com
2194f3f858 Move bug 3280 regression test to mjsunit/harmony 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/248483004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20913 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-23 15:01:30 +00:00
mstarzinger@chromium.org
66ec299808 Fix ToObject and Object.isSealed in four Array builtins. 
R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-builtinbust-6

Review URL: https://codereview.chromium.org/240223006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-23 12:48:32 +00:00
jarin@chromium.org
783eb25a8c Avoid setting transitions in-place for cached maps when observed 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/246523004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-23 09:21:24 +00:00
adamk@chromium.org
71750f7be8 Fix issue with Map/SetIterator and types 
BUG=v8:3281
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/246993003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 18:14:46 +00:00
wingo@igalia.com
a2ac40aca7 Context-allocate all parameters in generators 
Generator function scopes have forced context allocation.  Ensure that
all variables in such scopes get context allocation -- even unused
variables.

This fixes an assertion when reifying generator scopes in the debugger.

R=yangguo@chromium.org
LOG=Y
BUG=v8:3280

Review URL: https://codereview.chromium.org/246733003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 11:34:16 +00:00
bmeurer@chromium.org
63a477b29b Clear invalid field maps in PropertyAccessInfo. 
BUG=363956
TEST=mjsunit/regress/regress-363956
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/239623005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 09:48:32 +00:00
mstarzinger@chromium.org
e51d6462a7 Fix bogus call to Object.hasOwnProperty in Array builtin. 
R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-builtinbust-5

Review URL: https://codereview.chromium.org/239033002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-15 12:52:41 +00:00
mstarzinger@chromium.org
39137c81e6 Fix bogus Object.isSealed check in some Array builtins. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/237253002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-15 08:25:42 +00:00
ulan@chromium.org
8b445aaa5f Fix result of LCodeGen::DoWrapReceiver for strict functions and builtins. 
BUG=362128
LOG=Y
TEST=mjsunit/regress/regress-362128
R=jacob.bramley@arm.com

Review URL: https://codereview.chromium.org/226363007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-14 11:58:18 +00:00
mstarzinger@chromium.org
b280ad6c44 Try to switch Array builtins into strict mode. 
R=rossberg@chromium.org
TEST=mjsunit,test262,webkit

Review URL: https://codereview.chromium.org/233083003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-14 11:24:40 +00:00
ulan@chromium.org
4268ce0abd Check stack limit in ArgumentAdaptorTrampoline. 
BUG=353058
LOG=N
TEST=mjsunit/regress/regress-353058
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/215853005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 13:39:19 +00:00
ulan@chromium.org
49d951d043 Do not call user defined getter of Error.stackTraceLimit. 
Handlify GetNormalizedProperty.

BUG=360733
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/233243005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 13:16:36 +00:00
jarin@chromium.org
166ec11e43 Avoid type assertion on object comparison in Hydrogen - the comparison is unreachable because of previous checks. 
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/232053004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 06:45:24 +00:00
jarin@chromium.org
fd988331ea There is no definition for HArgumentsObject, so LDummyUse confuses the register allocator. I have recently made similar fix for HCapturedObject (see https://codereview.chromium.org/222283002/). 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/226613007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 06:29:51 +00:00
svenpanne@chromium.org
5bddec047d Do not use ranges after range analysis. 
Due to the SSA vs. SSI difference, we are only allowed to use the
flags computed during range analysis, not the ranges themselves. For
the case at hand, there is no such flag, so the condition is simply
remvoed.

BUG=361608
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/232553004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-10 09:40:17 +00:00
jarin@chromium.org
008a70c47b Revert "Make new space iterable when transitioning double array to objects" 
This reverts r20603.

BUG=

Review URL: https://codereview.chromium.org/230863003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 13:39:03 +00:00
jarin@chromium.org
57d70c149c Avoid hydrogen compare-objects-equal assertions in dead code 
ClusterFuzz test is triggering assertions for dead code. This fix issues
HDeoptimize instruction when it finds out that the compare instruction
is dead (because of previous checks).

R=yangguo@chromium.org
BUG=359491
LOG=N

Review URL: https://codereview.chromium.org/228883005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20620 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 13:08:28 +00:00
yangguo@chromium.org
4df132a878 Fix argument expectation Runtime_StringParseInt. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/230693002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 12:33:51 +00:00
jarin@chromium.org
69d5b3c155 Make new space iterable when transitioning double array to objects 
R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/228643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20603 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 09:50:08 +00:00
mstarzinger@chromium.org
e3aec7a587 Fix return value of push() and unshift() on Array.prototype. 
R=ulan@chromium.org
TEST=mjsunit/regress/regress-builtinbust-3

Review URL: https://codereview.chromium.org/230453002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 09:14:56 +00:00
jarin@chromium.org
05670b63bf Add stack overflow check for inlined property getter 
We should check for overflow for each inlined property getter;
otherwise, we can get an overflow from inlining property getter while
still having pending overflow exception from some previous inlined
getter (in the same polymorphic access).

R=verwaest@chromium.org
TEST=test/mjsunit/regress/regress-inline-getter-near-stack-limit.js

Review URL: https://codereview.chromium.org/220813003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 07:35:12 +00:00
bmeurer@chromium.org
48e0d81205 Fix invalid local property lookup for transitions. 
BUG=361025
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/224903023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20570 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-08 09:36:04 +00:00
jarin@chromium.org
c19764595f Dead code elimination of inlined arguments objects causes wrong deopt info to be generated - instead of materializing the arguments, we get 'undefined'. 
Golem says the change is perf-neutral.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/208683006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-07 08:42:34 +00:00
svenpanne@chromium.org
814be9b1b6 Yet another regression test for range analysis. 
BUG=v8:3204
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/224723016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-07 08:04:25 +00:00
mvstanton@chromium.org
eaacd968f1 Fix for v8:3255 Grow KeyedStoreIC doesn't respect String value wrappers 
BUG=v8:3255
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/226053002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-07 07:52:24 +00:00
hpayer@chromium.org
5230d8d330 Make sure value is a heap number when reusing the double box in BinaryOpICStub. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/216823005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-04 08:46:49 +00:00
mstarzinger@chromium.org
775d9b022f Use premordial Object.isSealed/isFrozen in builtins. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/223473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 12:23:35 +00:00
jarin@chromium.org
fe37026116 When freezing global object, go through the property cell 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/223613002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20469 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 10:43:56 +00:00
jarin@chromium.org
42d2d3cb9d Do not generate LDummyUse instruction for HCapturedObject 
LDummyUse confuses the register allocator (since there is no definition
for the use).

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/222283002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 07:35:13 +00:00
jarin@chromium.org
0b53ed2d2b Check in Lithium that allocation size in Smi range. 
This is to avoid triggering an assertion from Smi::FromInt. The
generated code is unreachable, so it is not a real bug.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/221743005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 07:04:46 +00:00
jkummerow@chromium.org
511edabed2 Fix HGraphBuilder::BuildAddStringLengths 
length == String::kMaxLength is fine and should not bail out.

BUG=chromium:357052
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/222113002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20433 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-02 12:24:42 +00:00
dslomov@chromium.org
19c354b7b0 Support typed arrays in IsMoreGeneralElementsKindTransition. 
R=verwaest@chromium.org
BUG=357054
LOG=Y

Review URL: https://codereview.chromium.org/220403004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20410 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 16:41:35 +00:00
yangguo@chromium.org
64901004be Smi immediates are not supported on x64. Do not use it. 
R=jkummerow@chromium.org
BUG=358059
LOG=N

Review URL: https://codereview.chromium.org/217083003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 15:32:06 +00:00
mvstanton@chromium.org
d93c906acc Monomorphic prototype failures should be reserved for already-seen keys. 
We incorrectly mark a KeyedStoreIC miss as a monomorphic prototype
failure even though it's the first time a particular (string) key has
been seen.

BUG=358088
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/219313002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 14:16:54 +00:00
yangguo@chromium.org
10abff3498 Remove internalized cons string types. 
Currently, internalizing a cons string could result in either an
in-place converted internalized cons string or a newly created
internalized sequential string, depending on allocation success.

The former could end up being embedded into an IC, which is not
supported.

R=mstarzinger@chromium.org
BUG=357103
LOG=N

Review URL: https://codereview.chromium.org/218993011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 11:30:31 +00:00
jarin@chromium.org
5607582f3b We should perform the illegal redeclaration check earlier so that we do not confuse the AST typer with missing type feedback nodes. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/218493007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 16:45:46 +00:00
rossberg@chromium.org
282a7ca14e Fix Type::Intersect to skip uninhabited bitsets 
R=verwaest@chromium.org, bmeurer@chromium.org
BUG=chromium:357330
LOG=Y

Review URL: https://codereview.chromium.org/219333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 15:53:21 +00:00
dslomov@chromium.org
b3148d921e Fix PrepareKeyedOperand on arm. 
When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

R=verwaest@chromium.org
BUG=358057
LOG=Y

Review URL: https://codereview.chromium.org/219473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 15:14:28 +00:00
jarin@chromium.org
d02e1f2c25 Fix left trimming check for large objects 
BUG=358090
TEST=test/mjsunit/regress/regress-358090.js
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/213833008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 15:01:46 +00:00
verwaest@chromium.org
019e27d8db Reland and fix "Fix LoadFieldByIndex to take mutable heap-numbers into account."" 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 14:21:04 +00:00
yangguo@chromium.org
c0fa861726 Do not check for interrupt when allocating stack locals. 
R=dcarney@chromium.org
BUG=357137
LOG=N

Review URL: https://codereview.chromium.org/219373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20357 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 14:14:54 +00:00
jochen@chromium.org
163044e7ba Revert 20348 - "Fix LoadFieldByIndex to take mutable heap-numbers into account." 
Reason for revert: crashes benchmarks/sunspider/string-fasta on ia32.debug

This also reverts r20350 and r20352

> Fix LoadFieldByIndex to take mutable heap-numbers into account.
>
> BUG=
> R=ishell@chromium.org
>
> Review URL: https://codereview.chromium.org/213213002

BUG=none
LOG=n
TBR=verwaest@chromium.org

Revert "Use sarq on x64"

This reverts commit e2a8ef9321345c6bc091054443bf2b9535ff6b1c.

Revert "Don't | int and bool"

This reverts commit c90d713d3a8ceba4fec41933a63beb6e50a3d7c0.

Review URL: https://codereview.chromium.org/219393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 13:23:32 +00:00
jochen@chromium.org
b7039334ae Revert 20313 - "Ship promises and weak collections" 
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://code.google.com/p/v8/source/detail?r=20211
>
> Review URL: https://codereview.chromium.org/206163004

R=rossberg@chromium.org
TBR=rossberg@chromium.org
LOG=y
BUG=n

Review URL: https://codereview.chromium.org/219303002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 12:40:32 +00:00
verwaest@chromium.org
55a6318560 Fix LoadFieldByIndex to take mutable heap-numbers into account. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/213213002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 11:59:29 +00:00
jarin@chromium.org
d65fe51ca0 Add missing lazy deopt point for the TransitionElementsKind instruction. 
R=mvstanton@chromium.org, yangguo@chromium.org
BUG=357105
TEST=test/mjsunit/regress/regress-357105.js
LOG=N

Review URL: https://codereview.chromium.org/216963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 11:58:53 +00:00
jarin@chromium.org
9e655afdb4 Reland "Fix property enum cache creation to include only own properties" 
Reland r20308 (reverted by r20310).

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/216383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-28 06:59:20 +00:00
adamk@chromium.org
c2bbd9f9e2 Don't pass the hole to SetElement when creating Array.observe change records 
Also added comments to remind us why we were using the hole here in the first
place (it's used for the case where Object.observe, rather than Array.observe,
has been called on Array that's undergoing truncation).

BUG=356589
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/213823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20316 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 18:29:07 +00:00
rossberg@chromium.org
826cf64fd3 Ship promises and weak collections 
R=mstarzinger@chromium.org
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=20211

Review URL: https://codereview.chromium.org/206163004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 16:42:34 +00:00
jarin@chromium.org
af74f1206e Revert "Fix property enum cache creation to include only own properties" 
This reverts commit 4cf47a20b4846cf050ea4844433e9c57654da34e.

BUG=

Review URL: https://codereview.chromium.org/214893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 16:18:42 +00:00
jarin@chromium.org
4608bdeccc With this fix, we only create the enum cache for own property descriptors (originally we cached all descriptors in the map). The problem was that the size of all descriptors could be trimmed during GC triggered by allocating the storage for the cache, so we could have ended up with a wrong storage size. 
This is really Toon's fix, I have only created a small repro case.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/212673011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 15:33:06 +00:00
dslomov@chromium.org
4cdfb46a6d Fix JSObject::SetElement for fixed typed array elements. 
R=ulan@chromium.org
BUG=357108
LOG=N

Review URL: https://codereview.chromium.org/214543003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 12:54:26 +00:00
svenpanne@chromium.org
fe58e3d7b8 Removed 'executable' bits from mjsunit tests. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/214413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 12:32:27 +00:00
jarin@chromium.org
10606aa756 Fix missing representation for the result of HIsSmiAndBranch. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/211273010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 13:14:08 +00:00
dslomov@chromium.org
f66af4feb4 Refactor optimized in hydrogen only runtime functions. 
This splits all runtime function into 3 categories:
1) RUNTIME: implemented in runtime and called from both full and optimized code.
2) RUNTIME_HIDDEN: implemented in runtime, never called directly from JS builtins.
3) INLINE: inlined in both full and optimized code
4) INLINE_OPTIMIZED: inlined in optimized code, implemented in runtime for full code.

R=yangguo@chromium.org, yannguo@chromium.org

Review URL: https://codereview.chromium.org/209353006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:26:55 +00:00
verwaest@chromium.org
c432f7166c Don't convert dictionary sloppy arguments to fast double mode. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/207683006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20251 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:14:58 +00:00
ulan@chromium.org
cb0f49c18a Add index check in DoAccessArgumentsAt. 
BUG=355523
LOG=N
TEST=mjsunit/regress/regress-355523
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/210053003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 13:26:41 +00:00