AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
13,731 Commits 1 Branch 0 Tags 839 MiB
d5cb83f4aa
Commit Graph

2373 Commits

Author SHA1 Message Date
mstarzinger@chromium.org
d5cb83f4aa Fix invalid reuse of weak global handle in GetScriptWrapper. 
This fixes a direct usage of a weak global handle in GetScriptWrapper
that just casted it to a strong local handle, while a subsequent GC
might clear it. Handlepocalypse anyone?

R=machenbach@chromium.org
BUG=v8:2988
TEST=mjsunit/regress/regress-2988

Review URL: https://codereview.chromium.org/67273004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-11 16:27:36 +00:00
mstarzinger@chromium.org
c6841f1180 Tame mjsunit/fast-literal after fixing allocations. 
Not that allocations go through Heap::AllocateRaw and actually respect
the allocation timeout, the runtime of this test spiked. This adjusts
the limit to sane values now that the values are actually respected.

R=mvstanton@chromium.org
TEST=mjsunit/fast-literal

Review URL: https://codereview.chromium.org/63603009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-11 10:22:46 +00:00
ulan@chromium.org
bc4ad49b25 Do not add values to HGraph in Lithium. 
Lithium uses indexes after the maximium value ID in the HGraph as indexes
of virtual registers and assumes that the maximum value ID does not change.

The IsStandardConstant and GetConstantXX functions could add constants to
HGraph, which aliased virtual registers with real values. This could confuse
the register allocator to think that a value in a virtual register is tagged
and to incorrectly set it in the pointer map.

BUG=298269
TEST=mjsunit/regress/regress-298269.js
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/66693002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 14:16:34 +00:00
yangguo@chromium.org
9f104a1a3e Revert "Implement Math.sin, cos and tan using table lookup and spline interpolation." 
This reverts commit r17594.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59153007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 13:44:27 +00:00
yangguo@chromium.org
063b7c4ebb Implement Math.sin, cos and tan using table lookup and spline interpolation. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50563003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 13:10:39 +00:00
mstarzinger@chromium.org
59536de77d Make HCapturedObjects non-deletable for DCE. 
R=jkummerow@chromium.org
BUG=v8:2987
TEST=mjsunit/regress/regress-2987

Review URL: https://codereview.chromium.org/64433002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-07 16:07:19 +00:00
verwaest@chromium.org
dccc06e132 Disable stress-gc for memento-related test. 
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/64003004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17559 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-07 12:20:45 +00:00
yangguo@chromium.org
eb550c6da4 Fix y-umlaut to uppercase. 
R=dcarney@chromium.org
BUG=v8:2984

Review URL: https://codereview.chromium.org/59853006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-07 09:08:34 +00:00
mvstanton@chromium.org
cec8548d0e Correct handling of arrays with callbacks in the prototype chain. 
Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-06 15:45:43 +00:00
bmeurer@chromium.org
980739a29c Improve implementation of HSeqStringSetChar. 
This improves the generated code for HSeqStringSetChar across
all platforms, taking advantage of constant operands whenever
possible. It also drops the unused DefineSameAsFirst constraint
for the register allocator on x64 and ia32, where it caused
unnecessary spills when the string operand was live across the
HSeqStringSetChar instruction.

A new GVN flag StringChars is introduced to express dependencies
between HSeqStringSetChar, HStringCharCodeAt and the upcoming
HSeqStringGetChar (the GVNFlags type is now 64bit in size).

Also improves the test case.

TEST=mjsunit/string-natives
R=mstarzinger@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/57383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-06 13:09:22 +00:00
rafaelw@chromium.org
13f722cae4 [Object.observe] rename intrinsic change record types for consitency. 
Note the spec now reflects the updated naming:

http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes

R=rossberg@chromium.org, rossberg
BUG=v8:2940

Review URL: https://codereview.chromium.org/46043020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-06 12:14:24 +00:00
machenbach@chromium.org
4539c6ba5f [Sheriff] Mark flaky test on windows. 
It was marked as flaky on linux nosnap, arm and nacl before. Now it's marked universally flaky since windows joined the list.

BUG=v8:2921
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/54713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 19:29:58 +00:00
yangguo@chromium.org
371265eec4 Revert "Handlify concat string and substring." 
This reverts r17490.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/59973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 15:36:15 +00:00
yangguo@chromium.org
23d085c691 Handlify concat string and substring. 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50073005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 14:07:07 +00:00
yangguo@chromium.org
a5ed9a71c8 Correctly load message from an Error object. 
R=mstarzinger@chromium.org
BUG=306220

Review URL: https://codereview.chromium.org/46593010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 13:04:51 +00:00
rafaelw@chromium.org
e78081ca1c Make Object.freeze/seal/preventExtensions observable 
Note: spec has been updated here: http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes.

R=rossberg@chromium.org, rossberg
BUG=v8:2975,v8:2941

Review URL: https://codereview.chromium.org/47703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 12:25:32 +00:00
rafaelw@chromium.org
4a8319c7c6 [Object.observe] Implement implicit notification from performChange 
R=arv@chromium.org, rossberg@chromium.org, rossberg
BUG=v8:2942

Review URL: https://codereview.chromium.org/36313002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 11:23:08 +00:00
jkummerow@chromium.org
2ebfd6e90e Add missing negative dictionary lookup to NonexistentHandlerFrontend 
BUG=v8:2980
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/57433003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-04 14:14:09 +00:00
machenbach@chromium.org
3e6044d3f3 [Sheriff] Mark failing test for nacl port. 
BUG=v8:2978
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/50333005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17445 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-31 11:51:59 +00:00
machenbach@chromium.org
230b47a63b [Sheriff] Mark flaky test. 
BUG=v8:2921
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/54423002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-31 11:48:31 +00:00
jkummerow@chromium.org
316271fc35 Fix uint32-to-smi conversion in Lithium 
BUG=chromium:309623
R=vegorov@google.com, yangguo@chromium.org

Review URL: https://codereview.chromium.org/54393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-31 10:18:51 +00:00
yangguo@chromium.org
3f1a833524 Do not remove HAdd with zero if the other operand is a double. 
The other operand might be minus zero, and -0 + 0 = +0

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/52173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-30 10:22:52 +00:00
jkummerow@chromium.org
9e88c23cbf ia32: Fix comparisons of two constant double operands when exactly one of them is in new space. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/46883008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-29 14:34:07 +00:00
svenpanne@chromium.org
acb06df0e9 Tune mjsunit/compiler/expression-trees. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/43703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-28 07:24:19 +00:00
svenpanne@chromium.org
ee87c867e9 Tune mjsunit/array-functions-prototype-misc 
Again, this brings testing times down quite a bit without losing test
coverage.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/44143003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17403 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-28 07:23:27 +00:00
mvstanton@chromium.org
a85c825bb9 The Elements pointer in a JSObject can have a filler map instead of a 
valid fixed array, iff a gc occurred while allocating a fixed array as
part of array construction. Heap verification needs protection against
examining the elements object in this case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/43383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-25 12:26:47 +00:00
yangguo@chromium.org
7dd2d6c590 Reland "Make Array.prototype.pop throw if the last element is not configurable." 
This relands r17346.

R=machenbach@chromium.org
BUG=311164

Review URL: https://codereview.chromium.org/43923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-25 11:55:56 +00:00
svenpanne@chromium.org
2e2579da1b Tune mjsunit/regexp-global. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/42993004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-25 08:57:50 +00:00
svenpanne@chromium.org
c2596a257c Temporarily disable mjsunit/regress/regress-2612 to make our tree green again. 
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/40203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 13:30:40 +00:00
svenpanne@chromium.org
7fb61a78d4 Tune mjsunit/regress/regress-2612. 
Lower the bounds to something bearable which would still timeout if we
used a quadratic algorithm.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/39863003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 13:07:16 +00:00
bmeurer@chromium.org
56a46e591b Add performance.now() to the d8 shell. 
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=17366

Committed: https://code.google.com/p/v8/source/detail?r=17368

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 12:25:40 +00:00
bmeurer@chromium.org
bef9819190 Revert "Fix shared library build after r17368." and "Add performance.now() to the d8 shell.". 
This reverts commit r17372 and r17368 for breaking the shared
library build.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/40043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17374 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 12:16:00 +00:00
bmeurer@chromium.org
0a90cab56a Add performance.now() to the d8 shell. 
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=17366

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 10:48:18 +00:00
bmeurer@chromium.org
67b4eb9ac1 Revert "Add window.performance.now() to the d8 shell." 
This reverts commit r17366 for breaking the mozilla tests.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/38753006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 10:42:02 +00:00
bmeurer@chromium.org
d07231021e Add window.performance.now() to the d8 shell. 
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 09:27:17 +00:00
svenpanne@chromium.org
f2122438e0 Removed long-running obselete test case. 
The test was the 2nd longest-running test case in debug mode, and the
stuff it tests has already been moved long ago to some other place,
which is in turn heavily tested by far simpler and faster things
(%TruncateString etc.).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/39233003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 08:09:32 +00:00
yangguo@chromium.org
0f564cb1b0 Revert "Make Array.prototype.pop throw if the last element is not configurable." 
This reverts commit r17346.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/39593002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-24 07:48:23 +00:00
yangguo@chromium.org
e25920da19 Make Array.prototype.pop throw if the last element is not configurable. 
Popping an element from an array should call [[Delete]] internal method
and pass true as the second argument (ECMA-262/5.1/#sec-15.4.4.6).
When the last element can't be deleted, throw a Type Error.
Not throwing the error would result in endless loop in the following test.

TEST=var a=[];Object.defineProperty(a,0,{});while(a.length)a.pop();

By the way fix another bug, or else i can't post any issues.
"presubmit.py" throw a "missing a correct copyright header" on windows.
Both the slash and the backslash are valid path separator on windows.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/29513004

Patch from Yanagi <admin@web-tinker.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-23 16:19:24 +00:00
jkummerow@chromium.org
8259439ae8 Fix HObjectAccess for loads from migrating prototypes 
BUG=chromium:305309
R=danno@chromium.org

Review URL: https://codereview.chromium.org/35173005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17345 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-23 15:15:15 +00:00
hpayer@chromium.org
fbaf016b6d Add a soft-deopt in keyed element access when current IC is pre-monomorphic and no type feedback was collected. 
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/32643004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-23 10:41:21 +00:00
mstarzinger@chromium.org
be3ed75ff3 Fix materialization of captured objects with field tracking. 
R=titzer@chromium.org
BUG=chromium:298990
TEST=mjsunit/compiler/escape-analysis-representation

Review URL: https://codereview.chromium.org/35133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-22 13:48:54 +00:00
svenpanne@chromium.org
d65cc1e21b Temporarily deactive regress-2185-2 until our array handling is in good shape again. 
BUG=v8:2950
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/30443005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-22 13:02:04 +00:00
svenpanne@chromium.org
dd74f5aa08 Removed obsolete unit tests. 
As discussed offline, these tests don't test what they were supposed to
test anymore and were the longest running ones.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/32433009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-22 11:26:07 +00:00
titzer@chromium.org
a255312491 Handle misaligned loads and stores in load elimination. Do not track misaligned loads and be conservative about invalidating misaligned stores. Add more tests for number conversion to string (NumberToStringStub exhibits misaligned loads) 
BUG=v8:2934
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/28383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-21 13:33:03 +00:00
yangguo@chromium.org
2d6dab1f2e Harmony: implement Math.trunc. 
BUG=v8:2938
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/28793002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-21 11:15:11 +00:00
yangguo@chromium.org
575438518c Harmony: implement Math.sign. 
R=dslomov@chromium.org
BUG=v8:2938

Review URL: https://codereview.chromium.org/28723002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-21 09:16:31 +00:00
titzer@chromium.org
4d0f2cdd3b Implement global load elimination based on flow engine. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/27148004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-18 14:28:24 +00:00
rafaelw@chromium.org
ce2c9b1db1 Prevent changes to hidden properties from being observable via Object.observe 
This addresses the leak that mstarzinger points out (https://codereview.chromium.org/26390003/) and includes the test.

Note that this adds a test that observing changes to the empty-string property remains possible.

BUG=
R=mstarzinger@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/26592012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-17 20:49:45 +00:00
svenpanne@chromium.org
882778bf09 Make it possible to run a test only in the standard variant. 
Use this for mjsunit/unicode-case-overoptimization, which is not
related to Crankshaft at all and takes ages.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/27704002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-17 13:09:28 +00:00
mstarzinger@chromium.org
0a2b4ecdcc Add regression test for optimized count operation. 
This is a regression test for a bug with handling of count operations
that target a JavaScript accessor on the prototype chain in Crankshaft.

R=jkummerow@chromium.org
BUG=chromium:306851
TEST=mjsunit/regress/regress-crbug-306851

Review URL: https://codereview.chromium.org/27702002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-17 12:48:28 +00:00