Commit Graph

1064 Commits

Author SHA1 Message Date
yangguo
aba76874db [regexp] support \p in character classes.
R=littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1774623005

Cr-Commit-Position: refs/heads/master@{#34695}
2016-03-10 23:24:23 +00:00
adamk
dea9559457 Remove destructuring and default arguments runtime flags
These flags have been on by default since version 4.9, which has been
in stable Chrome for over a week now, demonstrating that they're
here to stay.

Also moved the tests out of harmony/ and into es6/.

Review URL: https://codereview.chromium.org/1776683003

Cr-Commit-Position: refs/heads/master@{#34692}
2016-03-10 23:22:30 +00:00
neis
cd6a5a45ad Fix corner case in iterator finalization for array destructuring.
The comment was correct but the code didn't match :(
Must not close when .value throws.

R=adamk@chromium.org
BUG=v8:3566
LOG=n

Review URL: https://codereview.chromium.org/1778333002

Cr-Commit-Position: refs/heads/master@{#34691}
2016-03-10 19:13:48 +00:00
neis
3062af70eb Implement iterator finalization in array destructuring.
We must close the iterator whenever the destructuring didn't exhaust it, unless an iterator operation (eg. next) threw.  We do this by wrapping the iterator use in a try-catch-finally similar to the desugaring of for-of.

This is behind --harmony-iterator-close.

R=adamk@chromium.org
BUG=v8:3566
LOG=Y

Review URL: https://codereview.chromium.org/1772793002

Cr-Commit-Position: refs/heads/master@{#34654}
2016-03-10 09:34:36 +00:00
yangguo
48f9c16184 [regexp] allow loose matching for property names.
As described in unicode database file PropertyValueAliases.txt

R=littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1776953002

Cr-Commit-Position: refs/heads/master@{#34638}
2016-03-09 19:07:46 +00:00
littledan
3f8af30ee7 Ensure the @@species protector is updated for accessors
The initial species protector hooked into property declaration in an
incomplete place, and missed definitions of accessors. This patch repairs
them by calling out to update the protector from an additional location.

R=adamk
CC=verwaest,cbruni
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1746323002

Cr-Commit-Position: refs/heads/master@{#34599}
2016-03-08 19:55:28 +00:00
neis
998a6e5b92 Fix completion value of empty catch block in the presence of destructuring.
R=adamk@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1767063002

Cr-Commit-Position: refs/heads/master@{#34575}
2016-03-08 09:36:18 +00:00
yangguo
13d18c0079 [regexp] extend property classes by script category.
R=littledan@chromium.org
BUG=v8:4743
LOG=N

Committed: https://crrev.com/22f6735ccbe2e341d341e61b9c38ce308b8da655
Cr-Commit-Position: refs/heads/master@{#34553}

Review URL: https://codereview.chromium.org/1774513002

Cr-Commit-Position: refs/heads/master@{#34562}
2016-03-07 20:10:55 +00:00
yangguo
7dc13c2a8c Revert of [regexp] extend property classes by script category. (patchset id:1 of https://codereview.chromium.org/1774513002/ )
Reason for revert:
wrong noi18n expectations

Original issue's description:
> [regexp] extend property classes by script category.
>
> R=littledan@chromium.org
> BUG=v8:4743
> LOG=N
>
> Committed: https://crrev.com/22f6735ccbe2e341d341e61b9c38ce308b8da655
> Cr-Commit-Position: refs/heads/master@{#34553}

TBR=littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4743

Review URL: https://codereview.chromium.org/1772563003

Cr-Commit-Position: refs/heads/master@{#34554}
2016-03-07 18:13:33 +00:00
yangguo
22f6735ccb [regexp] extend property classes by script category.
R=littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1774513002

Cr-Commit-Position: refs/heads/master@{#34553}
2016-03-07 17:40:21 +00:00
yangguo
9113402b53 [debugger] break at each initialization in a multiple var declaration.
R=rossberg@chromium.org
BUG=v8:4807
LOG=N

Committed: https://crrev.com/ee98147ea0d994bcfb0d14d43f490ee828d2426f
Cr-Commit-Position: refs/heads/master@{#34531}

Review URL: https://codereview.chromium.org/1768973002

Cr-Commit-Position: refs/heads/master@{#34540}
2016-03-07 13:41:18 +00:00
machenbach
c6dbb071a3 Revert of [debugger] break at each initialization in a multiple var declaration. (patchset id:1 of https://codereview.chromium.org/1768973002/ )
Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5160

Original issue's description:
> [debugger] break at each initialization in a multiple var declaration.
>
> R=rossberg@chromium.org
> BUG=v8:4807
> LOG=N
>
> Committed: https://crrev.com/ee98147ea0d994bcfb0d14d43f490ee828d2426f
> Cr-Commit-Position: refs/heads/master@{#34531}

TBR=rossberg@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4807

Review URL: https://codereview.chromium.org/1770783003

Cr-Commit-Position: refs/heads/master@{#34538}
2016-03-07 12:53:55 +00:00
yangguo
ee98147ea0 [debugger] break at each initialization in a multiple var declaration.
R=rossberg@chromium.org
BUG=v8:4807
LOG=N

Review URL: https://codereview.chromium.org/1768973002

Cr-Commit-Position: refs/heads/master@{#34531}
2016-03-07 12:00:16 +00:00
littledan
0e7f095c6d Restrict FunctionDeclarations in Statement position
ES2015 generally bans FunctionDeclarations in positions which expect a Statement,
as opposed to a StatementListItem, such as a FunctionDeclaration which constitutes
the body of a for loop. However, Annex B 3.2 and 3.4 make exceptions for labeled
function declarations and function declarations as the body of an if statement in
sloppy mode, in the latter case specifying that the semantics are as if the
function declaration occurred in a block. Chrome has historically permitted
further extensions, for the body of any flow control construct.

This patch addresses both the syntactic and semantic mismatches between V8 and
the spec. For the semantic mismatch, function declarations as the body of if
statements change from unconditionally hoisting in certain cases to acquiring
the sloppy mode function in block semantics (based on Annex B 3.3). For the
extra syntax permitted, this patch adds a flag,
--harmony-restrictive-declarations, which excludes disallowed function declaration
cases. A new UseCounter, LegacyFunctionDeclaration, is added to count how often
function declarations occur as the body of other constructs in sloppy mode. With
this patch, the code generally follows the form of the specification with respect
to parsing FunctionDeclarations, rather than allowing them in arbitrary Statement
positions, and makes it more clear where our extensions occur.

BUG=v8:4647
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1757543003

Cr-Commit-Position: refs/heads/master@{#34470}
2016-03-03 21:34:26 +00:00
caitpotter88
18b9c1ce70 [proxies] throw TypeError if is_callable Map bit is unset
Per ProxyCreate() (https://tc39.github.io/ecma262/#sec-proxycreate), a Proxy
is only given a [[Call]] slot if the target has a [[Call]] slot as well. This
was previously implemented correctly for [[Construct]], but not for [[Call]].

BUG=v8:4797, v8:4796, v8:1543
LOG=N
R=cbruni@chromium.org, neis@chromium.org, adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1752133004

Cr-Commit-Position: refs/heads/master@{#34461}
2016-03-03 15:23:05 +00:00
yangguo
d9fe836dd4 [debugger] fix break locations for assignments and return.
We used to emit debug break location on block entry. This cannot be
ported to the interpreted as we do not emit bytecode for block entry.
This made no sense to begin with though, but accidentally added
break locations for var declarations.

With this change, the debugger no longer breaks at var declarations
without initialization. This is in accordance with the fact that the
interpreter does not emit bytecode for uninitialized var declarations.

Also fix the bytecode to match full-codegen's behavior wrt return
positions:
- there is a break location before the return statement, with the source
  position of the return statement.
- right before the actual return, there is another break location. The
  source position points to the end of the function.

R=rmcilroy@chromium.org, vogelheim@chromium.org
TBR=rossberg@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1744123003

Cr-Commit-Position: refs/heads/master@{#34388}
2016-03-01 12:47:55 +00:00
neis
ef8fa8521c Fix accidental bug in yield* desugaring.
The for-of-finalization CL incorrectly removed the input argument from
BuildIteratorClose.  I'm reverting this, adding a regression test, and fixing an
existing test that was wrong.

BUG=
R=rossberg

Review URL: https://codereview.chromium.org/1750543002

Cr-Commit-Position: refs/heads/master@{#34384}
2016-03-01 09:39:18 +00:00
nikolaos
de817ef9c7 Fix issue with re-scoping in do expressions
R=rossberg@chromium.org
BUG=v8:4783
LOG=N

Review URL: https://codereview.chromium.org/1747853002

Cr-Commit-Position: refs/heads/master@{#34382}
2016-03-01 09:04:38 +00:00
neis
a40d5d544d Remove [[Enumerate]] leftovers.
R=littledan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1746713002

Cr-Commit-Position: refs/heads/master@{#34366}
2016-02-29 17:02:50 +00:00
littledan
227fd1d4ed Ship ES2015 iterator finalization
This patch moves iterator finalization (calling .return() when a
for-of loop exits early) to shipping. The only part of this feature
which is currently known to be missing is destructuring--.return()
should be also be called when destructuring with an array which
does not end in a rest pattern, but it currently does not. The rest
of this feature, including calling .return() from certain builtins,
is implemented.

R=adamk
BUG=v8:3566
LOG=Y

Review URL: https://codereview.chromium.org/1738463003

Cr-Commit-Position: refs/heads/master@{#34307}
2016-02-25 23:16:53 +00:00
littledan
1aee75551e Ensure IteratorClose is called for errors in non-declaring assignments
There was a bug in for-of loops without newly declared variables: If,
in performing the assignment, an exception were thrown, then
IteratorClose would not be called. The problem was that the assignment
is done as part of assign_each, which happens before the loop is put
back in the state which is recognized to be breaking/throwing/returning
early.

This patch modifies the for-of desugaring by setting the loop state
before, rather than after, evaluating the assign_each portion, which is
responsible for evaluating the assignment in for-of loops which do not
have a declaration.

This patch, together with https://codereview.chromium.org/1728973002 ,
allow all test262 iterator return-related tests to pass.

R=rossberg
BUG=v8:4776
LOG=Y

Review URL: https://codereview.chromium.org/1731773003

Cr-Commit-Position: refs/heads/master@{#34262}
2016-02-24 18:52:29 +00:00
littledan
5f67e34aed Fix priority of exceptions being thrown from for-of loops
In the for-of desugaring, IteratorClose is a subtle thing to get right.
When return exists, the logic for which exception to throw is as follows:
1. Get the 'return' property and property any exception that might come from
  the property read
2. Call return, not yet propagating an exception if it's thrown.
3. If we are closing the iterator due to an exception, propagate that error.
4. If return threw, propagate that error.
5. Check if return's return value was not an object, and throw if so

Previously, we were effectively doing step 5 even if an exception "had already
been thrown" by step 3. Because this took place in a finally block, the exception
"won the race" and was the one propagated to the user. The fix is a simple change
to the desugaring to do step 5 only if step 3 didn't happen.

R=rossberg
BUG=v8:4775
LOG=Y

Review URL: https://codereview.chromium.org/1728973002

Cr-Commit-Position: refs/heads/master@{#34261}
2016-02-24 18:21:44 +00:00
mstarzinger
ee8108b71c [fullcodegen] Implement control flow across do-expressions.
This implements proper handling of local control flow (i.e. break and
continue) that spans the boundary of a do-expression. We can no longer
determine the number of operands to be dropped from the nesting of
statements alone, instead we use the new precise operand stack depth
tracking.

R=jarin@chromium.org
TEST=mjsunit/harmony/do-expressions-control
BUG=v8:4488
LOG=n

Review URL: https://codereview.chromium.org/1724753002

Cr-Commit-Position: refs/heads/master@{#34246}
2016-02-24 11:06:08 +00:00
mstarzinger
38915ed71c [fullcodegen] Implement operand stack depth tracking.
This implements a mechanism to track the exact depth of the operand
stack in full-codegen for every sub-expression visitation. So far we
only tracked the depth at statement level, but not at expression level.
With the introduction of do-expressions it will be possible to construct
local control flow (i.e. break, continue and friends) that target labels
at an arbitrary operand stack depth, making this tracking a prerequisite
for full do-expression support.

R=rossberg@chromium.org,jarin@chromium.org
BUG=v8:4755,v8:4488
LOG=n

Review URL: https://codereview.chromium.org/1706283002

Cr-Commit-Position: refs/heads/master@{#34211}
2016-02-23 13:41:44 +00:00
littledan
579c01072d Remove the Proxy enumerate trap
In ES2016, the Proxy enumerate trap is removed. This patch changes
for-in iteration on Proxies to use the ownKeys trap. Due to the clean
organization of that code, the patch basically consists of deletions.

R=adamk
LOG=Y
BUG=v8:4768

Review URL: https://codereview.chromium.org/1717893002

Cr-Commit-Position: refs/heads/master@{#34200}
2016-02-22 21:11:36 +00:00
littledan
7033ae511f Optimize @@species based on a global 'protector' cell
This patch makes ArraySpeciesCreate fast in V8 by avoiding two property reads
when the following conditions are met:
- No Array instance has had its __proto__ reset
- No Array instance has had a constructor property defined
- Array.prototype has not had its constructor changed
- Array[Symbol.species] has not been reset

For subclasses of Array, or for conditions where one of these assumptions is
violated, the full lookup of species is done according to the ArraySpeciesCreate
algorithm. Although this is a "performance cliff", it does not come up in the
expected typical use case of @@species (Array subclassing), so it is hoped that
this can form a good start. Array subclasses will incur the slowness of looking
up @@species, but their use won't slow down invocations of, for example,
Array.prototype.slice on Array base class instances.

Possible future optimizations:
- For the fallback case where the assumptions don't hold, optimize the two
  property lookups.
- For Array.prototype.slice and Array.prototype.splice, even if the full lookup
  of @@species needs to take place, we still could take the rest of the C++
  fastpath. However, to do this correctly requires changing the calling convention
  from C++ to JS to pass the @@species out, so it is not attempted in this patch.

With this patch, microbenchmarks of Array.prototype.slice do not suffer a
noticeable performance regression, unlike their previous 2.5x penalty.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1689733002

Cr-Commit-Position: refs/heads/master@{#34199}
2016-02-22 21:02:48 +00:00
littledan
0b53b7d36b Remove Reflect.enumerate
The Proxy enumerate trap and Reflect.enumerate are removed from the
ES2016 draft specification. This patch removes the Reflect.enumerate
function, and a follow-on patch will be responsible for the Proxy
trap changes.

R=adamk
LOG=Y
BUG=v8:4768

Review URL: https://codereview.chromium.org/1721453002

Cr-Commit-Position: refs/heads/master@{#34196}
2016-02-22 19:10:43 +00:00
mvstanton
deb7d5b090 ES6: Desugaring of instanceof to support @@hasInstance
This is a rework of the instanceof operator to support ES6 semantics
(as per section 12.10.4 of the spec:
https://tc39.github.io/ecma262/#sec-instanceofoperator).

It's behind flag --harmony-instanceof for now, which is turned on for staging.

BUG=v8:4447
LOG=N

Review URL: https://codereview.chromium.org/1692713005

Cr-Commit-Position: refs/heads/master@{#34170}
2016-02-19 19:20:38 +00:00
adamk
cc2ea25747 Don't reflect ES2015 Function name inference in Function.prototype.toString
Various syntactic forms now cause functions to have names where they
didn't before. Per the upcoming changes to the toString spec, only
a name that was literally part of a function's expression or declaration
is meant to be reflected in toString. This also happens to be the same
set of names that V8 currently outputs (without the --harmony-function-name
flag).

This required distinguishing anonymous FunctionExpressions from other sorts
of function definitions (like methods and getters/setters) in the AST, parser,
and at runtime.

The patch also takes the opportunity to remove one more argument (and enum)
from FunctionLiteral, as well as adding a special factory method for the
case of a FunctionLiteral representing toplevel or eval'd code.

BUG=v8:4760
LOG=n

Review URL: https://codereview.chromium.org/1712833002

Cr-Commit-Position: refs/heads/master@{#34132}
2016-02-19 02:51:10 +00:00
rossberg
cb1bf4af3c [es6] Implement for-of iterator finalization
Implements iterator finalisation by desugaring for-of loops with an additional try-finally wrapper. See comment in parser.cc for details.

Also improved some AST printing facilities while there.

@Ross, I had to disable the bytecode generation test for for-of, because it got completely out of hand after this change (the new bytecode has 150+ lines). See the TODO that I assigned to you.

Patch set 1 is WIP patch by Georg (http://crrev.com/1695583003), patch set 2 relative changes.

@Georg, FYI, I changed the following:

- Moved try-finally out of the loop body, for performance, and in order to be able to handle `continue` correctly.
- Fixed scope management in ParseForStatement, which was the cause for the variable allocation failure.
- Fixed pre-existing zone initialisation bug in rewriter, which caused the crashes.
- Enabled all tests, adjusted a few others, added a couple more.

BUG=v8:2214
LOG=Y

Review URL: https://codereview.chromium.org/1695393003

Cr-Commit-Position: refs/heads/master@{#34111}
2016-02-18 10:49:55 +00:00
bmeurer
1e79bd5cc8 [builtins] Support SameValue and SameValueZero via runtime functions.
Also move Object.is implementation to C++ builtin, which is faster
than the current implementation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1695743003

Cr-Commit-Position: refs/heads/master@{#34069}
2016-02-17 10:54:25 +00:00
yangguo
42309697c1 [regexp] parse RegExpUnicodeEscapeSequence according to spec.
See http://tc39.github.io/ecma262/#prod-RegExpUnicodeEscapeSequence

R=erik.corry@gmail.com, erikcorry@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1681893002

Cr-Commit-Position: refs/heads/master@{#33892}
2016-02-11 12:29:29 +00:00
yangguo
e0d0c96a53 [regexp] experimental implementation for \p property class.
Currently we only support general categories for property classes.

R=erik.corry@gmail.com, erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1685593002

Cr-Commit-Position: refs/heads/master@{#33872}
2016-02-10 16:24:05 +00:00
neis
ff97dc820d [proxies] Implement spec change to consistency check in [[SetPrototypeOf]].
See https://github.com/tc39/ecma262/pull/331.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1680133002

Cr-Commit-Position: refs/heads/master@{#33855}
2016-02-10 08:07:40 +00:00
yangguo
33c78c39d7 [regexp] simplify unanchored advance for unicode regexps.
When doing advance at the start of an unanchored unicode regexp,
we do not have to care about surrogate pairs. If we actually advance
into the middle of a surrogate pair, the only choice is to also
consume trail surrogate as nothing else can match from there.

This reduces the emitted code slightly. By not having choice in the
loop, we do not have to push backtrack onto the stack, preventing
stack overflow.

R=erik.corry@gmail.com, erikcorry@chromium.org

Review URL: https://codereview.chromium.org/1676293003

Cr-Commit-Position: refs/heads/master@{#33838}
2016-02-09 09:11:24 +00:00
yangguo
5082eaee5f [regexp] fix off-by-one in UnicodeRangeSplitter.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1681873002

Cr-Commit-Position: refs/heads/master@{#33837}
2016-02-09 09:10:31 +00:00
caitpotter88
e708dd54b9 reland [es7] refactor and fix Object.values() / Object.entries()
Previously, Object.values() and Object.entries() were piggy-backing on
Object.keys(). This meant that they would pre-filter non-enumerable properties,
violating the runtime behaviour of the methods. Unfortunately, this does not
match the current proposal text.

Also incorporates several tests verifying this behaviour based on tests included
in the ChakraCore implementation.

In this reland, the new patch fills up the longer-lasting FixedArray with
`undefined` to avoid the crash in Heap::Verify().

Originally reviewed at https://codereview.chromium.org/1637753004

BUG=v8:4663
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1673673002

Cr-Commit-Position: refs/heads/master@{#33818}
2016-02-08 14:11:05 +00:00
machenbach
bdfcc61325 Revert of [es7] refactor and fix Object.values() / Object.entries() (patchset id:100001 of https://codereview.chromium.org/1637753004/ )
Reason for revert:
[Sheriff] Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/1642

Original issue's description:
> [es7] refactor and fix Object.values() / Object.entries()
>
> Previously, Object.values() and Object.entries() were piggy-backing on
> Object.keys(). This meant that they would pre-filter non-enumerable properties,
> violating the runtime behaviour of the methods. Unfortunately, this does not
> match the current proposal text.
>
> Also incorporates several tests verifying this behaviour based on tests included
> in the ChakraCore implementation.
>
> BUG=v8:4663
> LOG=N
> R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org
>
> Committed: https://crrev.com/5c5ccd9d7f8693990d1a9eb26ba3a94f376dcf0b
> Cr-Commit-Position: refs/heads/master@{#33782}

TBR=littledan@chromium.org,adamk@chromium.org,cbruni@chromium.org,rossberg@chromium.org,caitpotter88@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4663

Review URL: https://codereview.chromium.org/1675663002

Cr-Commit-Position: refs/heads/master@{#33787}
2016-02-05 15:36:02 +00:00
caitpotter88
5c5ccd9d7f [es7] refactor and fix Object.values() / Object.entries()
Previously, Object.values() and Object.entries() were piggy-backing on
Object.keys(). This meant that they would pre-filter non-enumerable properties,
violating the runtime behaviour of the methods. Unfortunately, this does not
match the current proposal text.

Also incorporates several tests verifying this behaviour based on tests included
in the ChakraCore implementation.

BUG=v8:4663
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1637753004

Cr-Commit-Position: refs/heads/master@{#33782}
2016-02-05 14:38:34 +00:00
adamk
21c045a2fa Support computed properties for ES2015 Function.name
Adds a new runtime function, %DefineDataPropertyInLiteral, which
takes a fifth argument specifying whether the property and value
are syntactically such that the value is a function (or class)
literal that should have its name set at runtime.

The new runtime call also allows us to eliminate the now-redundant
%DefineClassMethod runtime function.

This should get much less ugly once we can desugar the "dynamic"
part of object literals in the parser (but that work is currently
blocked on having a performant way of desugaring literals).

BUG=v8:3699, v8:3761
LOG=n

Review URL: https://codereview.chromium.org/1626423003

Cr-Commit-Position: refs/heads/master@{#33756}
2016-02-04 22:36:48 +00:00
caitpotter88
ee10b595f9 [esnext] implement Object.getOwnPropertyDescriptors() proposal
BUG=v8:4725
LOG=N
R=adamk@chromium.org, cbruni@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1658773003

Cr-Commit-Position: refs/heads/master@{#33752}
2016-02-04 21:56:24 +00:00
cbruni
07d05dddce [proxies] allow duplicate keys for [[OwnPropertyKeys]] trap.
BUG=v8:4724, v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1668853002

Cr-Commit-Position: refs/heads/master@{#33747}
2016-02-04 17:55:35 +00:00
neis
dbd8640813 [generators] Implement Generator.prototype.return.
Note: This is currently only used by yield*, we still need to support it in
other places (such as for-of loops).  It can be used manually of course.

(This CL does not touch the full-codegen implementation of yield* because that
code is already dead.  The yield* desugaring already supports return and doesn't
need to be touched.)

BUG=v8:3566
LOG=y

Review URL: https://codereview.chromium.org/1639343005

Cr-Commit-Position: refs/heads/master@{#33744}
2016-02-04 17:14:15 +00:00
adamk
8a4a5bf9e0 Remove flags for ES2015 features shipped in M48
This removes --harmony-completion, --harmony-concat-spreadable, and
--harmony-tolength and moves the appropriate tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1667453002

Cr-Commit-Position: refs/heads/master@{#33712}
2016-02-03 20:51:46 +00:00
yangguo
aff7bd54be [regexp] fix zero-length matches for RegExp.prototype.@@split.
BUG=v8:4717
LOG=N

Review URL: https://codereview.chromium.org/1663543003

Cr-Commit-Position: refs/heads/master@{#33706}
2016-02-03 14:49:07 +00:00
yangguo
d77d657731 Revert of [regexp] implement /ui to mirror the implementation for /i. (patchset id:20001 of https://codereview.chromium.org/1641613002/ )
Reason for revert:
This test fails:

assertEquals(["as"], /^a[\u017F]/ui.exec("as"));

The reason is that we end up with a character class that is not stand alone, so we do not perform case folding on it correctly (with unicode flag).

Original issue's description:
> [regexp] implement /ui to mirror the implementation for /i.
>
> R=erik.corry@gmail.com, erikcorry@chromium.org
>
> Committed: https://crrev.com/eea1a4c003c559c99bcc9f08aa7eadf931975aad
> Cr-Commit-Position: refs/heads/master@{#33655}

TBR=erik.corry@gmail.com,erikcorry@chromium.org,erikcorry@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1661483002

Cr-Commit-Position: refs/heads/master@{#33676}
2016-02-02 11:44:45 +00:00
yangguo
bb6a53573c [regexp] restrict pattern syntax for unicode mode.
ES2015 Annex B.1.4 specifies a restricted pattern language for unicode
mode. This change reflects that, based on some test262 test cases.

R=littledan@chromium.org
BUG=v8:2952
LOG=N

Committed: https://crrev.com/e918c4ec464456a374098049ca22eac2107f6223
Cr-Commit-Position: refs/heads/master@{#33584}

Review URL: https://codereview.chromium.org/1645573002

Cr-Commit-Position: refs/heads/master@{#33603}
2016-01-29 09:21:16 +00:00
machenbach
8b5a7eb6bf Revert of [regexp] restrict pattern syntax for unicode mode. (patchset id:120001 of https://codereview.chromium.org/1645573002/ )
Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/4222

Original issue's description:
> [regexp] restrict pattern syntax for unicode mode.
>
> ES2015 Annex B.1.4 specifies a restricted pattern language for unicode
> mode. This change reflects that, based on some test262 test cases.
>
> R=littledan@chromium.org
> BUG=v8:2952
> LOG=N
>
> Committed: https://crrev.com/e918c4ec464456a374098049ca22eac2107f6223
> Cr-Commit-Position: refs/heads/master@{#33584}

TBR=vogelheim@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2952

Review URL: https://codereview.chromium.org/1648673002

Cr-Commit-Position: refs/heads/master@{#33588}
2016-01-28 15:27:12 +00:00
yangguo
e918c4ec46 [regexp] restrict pattern syntax for unicode mode.
ES2015 Annex B.1.4 specifies a restricted pattern language for unicode
mode. This change reflects that, based on some test262 test cases.

R=littledan@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1645573002

Cr-Commit-Position: refs/heads/master@{#33584}
2016-01-28 14:24:37 +00:00
neis
e2466bb5ff Implement the function.sent proposal.
The body of a generator function can now refer to the generator's input value via a new
"function.sent" expression.  We extend the proposal at
https://github.com/allenwb/ESideas/blob/master/Generator%20metaproperty.md
in the obvious way to also apply to GeneratorResumeAbrupt.
This will enable us to desugar yield*.

The new syntax is behind a new --harmony-function-sent flag.

BUG=v8:4700
LOG=n

Review URL: https://codereview.chromium.org/1620253003

Cr-Commit-Position: refs/heads/master@{#33574}
2016-01-28 08:54:51 +00:00
adamk
dadb3a5bb6 Add ES2015 Function.name support to pattern and default parameter initializers
Note that in these cases, we don't support computed property names yet, just
as we don't for object and class literals.

BUG=v8:3699, v8:4710
LOG=n

Review URL: https://codereview.chromium.org/1634403002

Cr-Commit-Position: refs/heads/master@{#33562}
2016-01-27 19:13:20 +00:00
yangguo
57d202d879 [regexp] correctly advance zero length matches for global/unicode.
R=erik.corry@gmail.com
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1630633002

Cr-Commit-Position: refs/heads/master@{#33550}
2016-01-27 13:09:04 +00:00
yangguo
f22a5663a6 [regexp] character class for desugaring cannot be part of RegExpText.
We only do the desugaring in RegExpCharacterClass::ToNode, which is not
called if it is part of a RegExpText.

R=erik.corry@gmail.com, erikcorry@chromium.org

Review URL: https://codereview.chromium.org/1641593002

Cr-Commit-Position: refs/heads/master@{#33543}
2016-01-27 11:07:07 +00:00
yangguo
49fda47c5f [regexp] back refs must not start/end in the middle of a surrogate pair
R=littledan@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1601653006

Cr-Commit-Position: refs/heads/master@{#33540}
2016-01-27 10:51:30 +00:00
yangguo
a2baaaac93 [regexp] implement case-insensitive unicode regexps.
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1599303002

Cr-Commit-Position: refs/heads/master@{#33538}
2016-01-27 08:25:38 +00:00
littledan
22be78430a Support @@species in Array.prototype.concat
This patch makes Array.prototype.concat support subclassing Arrays
and constructing instances properly with Symbol.species. It is
guarded by the --harmony-species flag.

R=cbruni
LOG=Y
BUG=v8:4093

Review URL: https://codereview.chromium.org/1577043002

Cr-Commit-Position: refs/heads/master@{#33503}
2016-01-26 06:33:25 +00:00
yangguo
3246d26b71 [regexp] step back if starting unicode regexp within surrogate pair.
See https://github.com/tc39/ecma262/issues/128

R=erik.corry@gmail.com, littledan@chromium.org
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1608693003

Cr-Commit-Position: refs/heads/master@{#33488}
2016-01-25 10:46:11 +00:00
bmeurer
88f9995d5c [for-in] Further refactorings and unification around for-in.
Cleanup %ForInPrepare runtime entry, and unify common logic with
%ForInEnumerate (renamed from %GetPropertyNamesFast). Also introduce
a TupleType to properly type JSForInPrepare and its projections w/o
special hacks in the Typer. And fix %ForInNext and JSForInNext to be
consistent with fullcodegen again (after the proxy refactorings last
quarter).

R=jarin@chromium.org
BUG=v8:3650
LOG=n

Review URL: https://codereview.chromium.org/1631583002

Cr-Commit-Position: refs/heads/master@{#33487}
2016-01-25 10:30:18 +00:00
caitpotter88
677be73e76 [es7] implement Object.values() / Object.entries() proposal
BUG=v8:4663
LOG=N
TBR=hpayer@chromium.org
R=ljharb@gmail.com, rossberg@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1581033002

Cr-Commit-Position: refs/heads/master@{#33450}
2016-01-22 03:12:56 +00:00
yangguo
e709aa24c0 [regexp] implement character classes for unicode regexps.
We divide character ranges into
- BMP, matched normally.
- non-BMP, matched as alternatives of surrogate pair ranges.
- lone surrogates, matched with lookaround assertion that its indeed lone.

R=erik.corry@gmail.com
BUG=v8:2952
LOG=N

Committed: https://crrev.com/ea820ad5fa282a323a86fe20e64f83ee67ba5f04
Cr-Commit-Position: refs/heads/master@{#33432}

Review URL: https://codereview.chromium.org/1578253005

Cr-Commit-Position: refs/heads/master@{#33437}
2016-01-21 13:33:26 +00:00
yangguo
4de91c5367 Revert of [regexp] implement character classes for unicode regexps. (patchset id:220001 of https://codereview.chromium.org/1578253005/ )
Reason for revert:
Compile failure on arm.

https://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/7341/steps/compile/logs/stdio

Original issue's description:
> [regexp] implement character classes for unicode regexps.
>
> We divide character ranges into
> - BMP, matched normally.
> - non-BMP, matched as alternatives of surrogate pair ranges.
> - lone surrogates, matched with lookaround assertion that its indeed lone.
>
> R=erik.corry@gmail.com
> BUG=v8:2952
> LOG=N
>
> Committed: https://crrev.com/ea820ad5fa282a323a86fe20e64f83ee67ba5f04
> Cr-Commit-Position: refs/heads/master@{#33432}

TBR=littledan@chromium.org,erik.corry@gmail.com,erikcorry@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2952

Review URL: https://codereview.chromium.org/1618753002

Cr-Commit-Position: refs/heads/master@{#33434}
2016-01-21 12:38:31 +00:00
nikolaos
52a01ae0c7 Fix bug with spread rewriting
It was not properly rewriting three cases:

-   [...[42]][0]
-   [...[42]].length
-   [...[42]] `foo`    (which is a type error)

R=rossberg@chromium.org
BUG=v8:4696
LOG=N

Review URL: https://codereview.chromium.org/1617713002

Cr-Commit-Position: refs/heads/master@{#33433}
2016-01-21 12:16:20 +00:00
yangguo
ea820ad5fa [regexp] implement character classes for unicode regexps.
We divide character ranges into
- BMP, matched normally.
- non-BMP, matched as alternatives of surrogate pair ranges.
- lone surrogates, matched with lookaround assertion that its indeed lone.

R=erik.corry@gmail.com
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1578253005

Cr-Commit-Position: refs/heads/master@{#33432}
2016-01-21 12:11:14 +00:00
littledan
837e374eac Separate String.prototype.replace into RegExp.prototype[Symbol.replace]
This patch implements one aspect of ES2015 RegExp subclassing:
String.prototype.replace is separated into two parts, a method on
RegExp.prototype in case the first argument is a RegExp, and the
String.prototype.replace method, which handles the string pattern
case. This separation is described in the ES2015 specification.
Most of the patch is simply moving code from string.js to regexp.js.

R=yangguo
LOG=Y
BUG=v8:4343

Review URL: https://codereview.chromium.org/1590673002

Cr-Commit-Position: refs/heads/master@{#33393}
2016-01-19 17:33:44 +00:00
nikolaos
9ed5596ade Fix re-indexing for literals in do-expressions
This became temporarily a big issue, because spreads are desugared
into do-expressions.  This patch fixes the problem with having
spreads as parameter initializers in arrow expressions, e.g., this
line would crash:

    [], ((x = [...[42]]) => x)();

R=rossberg@chromium.org
BUG=chromium:578038
LOG=N

Review URL: https://codereview.chromium.org/1581403007

Cr-Commit-Position: refs/heads/master@{#33365}
2016-01-18 15:20:58 +00:00
neis
faf5e68169 Make generators non-constructable.
BUG=v8:4163,v8:4630
LOG=y

R=rossberg

Review URL: https://codereview.chromium.org/1590873002

Cr-Commit-Position: refs/heads/master@{#33360}
2016-01-18 13:11:06 +00:00
rossberg
92e6f7a315 Don't pre-initialise block contexts with holes
Respective declarations will explicitly initialise slots
with the hole anyway, so this always was unnecessary.
With varblocks it even became wrong, because block contexts
may now host var bindings, which want undefined.

Fixes the hole leaking when accessing an unitialised,
block-context-allocated var.

R=neis@chromium.org
BUG=571149
LOG=N

Review URL: https://codereview.chromium.org/1584243002

Cr-Commit-Position: refs/heads/master@{#33309}
2016-01-14 18:04:35 +00:00
caitpotter88
2a20d51837 [es6] add SetFunctionName() behaviour to AssignmentExpression
BUG=v8:3699
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1582783004

Cr-Commit-Position: refs/heads/master@{#33276}
2016-01-13 23:36:09 +00:00
caitpotter88
d3fe473b92 [parser] fix null-dereference in DoExpression rewriting
BUG=v8:4661, v8:4488
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1575133003

Cr-Commit-Position: refs/heads/master@{#33250}
2016-01-12 19:54:12 +00:00
neis
863bf39a5f Gracefully handle proxies in AllCanWrite().
R=verwaest@chromium.org
BUG=chromium:576662,v8:1543
LOG=y

Review URL: https://codereview.chromium.org/1580723003

Cr-Commit-Position: refs/heads/master@{#33240}
2016-01-12 14:56:54 +00:00
littledan
569145019d Add @@species/better subclassing support to Promises
This patch makes Promise.prototype.then use @@species as specified
in ES2015. The fix is hoped for by certain users, such as legacy
core.js versions which encounter an unhandled Promise reject (complete
with an ugly console message) when Promise subclassing is supported
in a mostly correct way, and we do error checking on Promise
constructors, but @@species is not supported.

BUG=chromium:575314,v8:4633
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1577223002

Cr-Commit-Position: refs/heads/master@{#33225}
2016-01-12 06:33:15 +00:00
littledan
2bd9bdbe62 TypedArray and ArrayBuffer support for @@species
This patch improves ArrayBuffer and TypedArray subclassing by adding
support for @@species and constructing outputs to certain methods
by creating an instance of the constructor determined by the
SpeciesConstructor algorithm, rather than fixed to a superclass or
naively the constructor. The new behavior is enabled by the
--harmony-species flag. Care is taken to not significantly change the
observable behavior when the flag is off. Previously, TypedArrays
already supported subclassing by reading the constructor of the
receiver, but ArrayBuffers did not, and this old behavior is
preserved and tested for, to avoid a multi-stage upgrade path and keep
things simple for users.

R=adamk
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1574903004

Cr-Commit-Position: refs/heads/master@{#33223}
2016-01-12 06:07:59 +00:00
neis
2b352bb84f Do not leak private property names to proxy traps and interceptors.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1573143002

Cr-Commit-Position: refs/heads/master@{#33212}
2016-01-11 16:47:30 +00:00
yangguo
8645a5ccd0 [regexp] quantifier refers to the surrogate pair in unicode regexp.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1571563003

Cr-Commit-Position: refs/heads/master@{#33209}
2016-01-11 15:07:55 +00:00
yangguo
fbbb9cab45 [regexp] correctly parse non-BMP unicode escapes in atoms.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1568623004

Cr-Commit-Position: refs/heads/master@{#33207}
2016-01-11 14:19:21 +00:00
littledan
23235b5fdb Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset id:1 of https://codereview.chromium.org/1565263002/ )
Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset  id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}
2016-01-08 17:34:59 +00:00
nikolaos
0406fa2237 Fix for temporaries in parameter initializers
This patch introduces a mechanism for changing the scope of temporary
variables, which is necessary for rewriting arrow parameter
initializers.

It also fixes a potential bug in AstExpressionVisitor, which did not
visit the automatically generated members of ForEachStatement.

Fixes test/mjsunit/harmony/regress/regress-4658.js

R=rossberg@chromium.org
BUG=v8:4658
LOG=N

Review URL: https://codereview.chromium.org/1564343002

Cr-Commit-Position: refs/heads/master@{#33183}
2016-01-08 15:44:26 +00:00
neis
d006f617d4 [proxies] Adapt and reenable remaining tests in proxies.js
R=cbruni@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1543553002

Cr-Commit-Position: refs/heads/master@{#33180}
2016-01-08 14:57:02 +00:00
littledan
adac5956c6 Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset id:120001 of https://codereview.chromium.org/1551443002/ )
Reason for revert:
Causes frequent crashes in Canary: chromium:537816

Original issue's description:
> Ship ES2015 sloppy-mode function hoisting, let, class
>
> This patch doesn't ship all features of ES2015 variable/scoping
> changes, notably omitting the removal of legacy const. I think
> function hoisting, let and class in sloppy mode can stand to
> themselves as a package, and the legacy const change is much
> riskier and more likely to be reverted, so my intention is to
> pursue those as a separate, follow-on patch.
>
> R=adamk@chromium.org
> BUG=v8:4285,v8:3305
> LOG=Y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> Cr-Commit-Position: refs/heads/master@{#33133}

TBR=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4285,v8:3305,chromium:537816
LOG=Y

Review URL: https://codereview.chromium.org/1565263002

Cr-Commit-Position: refs/heads/master@{#33162}
2016-01-07 20:23:21 +00:00
neis
837900ef24 [tests] Fix bogus uses of assertThrows.
Some tests passed a string as second argument to assertThrows, expecting it to
be matched against the exception.  However, assertThrows simply ignored these.
(Some other tests actually seem to use that argument as a comment ...)

This CL
- changes assertThrows to fail if the second argument is not a function,
- adds assertThrowsEquals which compares the exception to a given value using
  assertEquals
- fixes some bogus tests that got exposed by this.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1544793002

Cr-Commit-Position: refs/heads/master@{#33159}
2016-01-07 14:49:21 +00:00
littledan
6e96223750 Add Array support for @@species and subclassing
This patch implements @@species, guarded behind the --harmony-species
flag, on Arrays. Methods which return an Array will instead return
the appropriate instance based on the ArraySpeciesCreate algorithm.
The algorithm is implemented in C++ to get access to realm information
and to implement some Array methods in C++, but it is also accessed
from JavaScript through a new runtime function. A couple interactive
Octane runs show no performance regression with the flag turned off,
but turning --harmony-species on will surely have a significant
regression, as Array methods now heavily use ObjectDefineProperty.

BUG=v8:4093
LOG=Y
R=adamk,cbruni

Review URL: https://codereview.chromium.org/1560763002

Cr-Commit-Position: refs/heads/master@{#33144}
2016-01-07 02:30:01 +00:00
adamk
2367abf025 [es6] Handle function names in object and class literals
This required refactoring ParsePropertyDefinition to pass the parsed
string name as an out param, since ObjectLiteralProperty stores Smis
for Smi-representable property keys.

Computed properties are not yet handled in this patch.

BUG=v8:3699
LOG=n

Review URL: https://codereview.chromium.org/1563923002

Cr-Commit-Position: refs/heads/master@{#33141}
2016-01-06 23:39:15 +00:00
littledan
fcff8588a5 Ship ES2015 sloppy-mode function hoisting, let, class
This patch doesn't ship all features of ES2015 variable/scoping
changes, notably omitting the removal of legacy const. I think
function hoisting, let and class in sloppy mode can stand to
themselves as a package, and the legacy const change is much
riskier and more likely to be reverted, so my intention is to
pursue those as a separate, follow-on patch.

R=adamk@chromium.org
BUG=v8:4285,v8:3305
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1551443002

Cr-Commit-Position: refs/heads/master@{#33133}
2016-01-06 02:03:07 +00:00
littledan
fb5cbc2e2d Add a --harmony-species flag, defining @@species on constructors
This patch adds the basis for subclassing TypedArrays, Arrays and
ArrayBuffers through the @@species hook, added in ES2015. This is
the first patch in a series. This patch simply defines the
@@species Symbol and installs it on the appropriate constructors.
The behavior is guarded behind the --harmony-species flag.

R=cbruni
BUG=v8:4093
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1558543002

Cr-Commit-Position: refs/heads/master@{#33095}
2016-01-04 19:39:59 +00:00
littledan
e549c7a356 Reland of Use ES2015-style TypedArray prototype chain (patchset id:1 of https://codereview.chromium.org/1554523002/ )
Reason for revert:
Should be fixed again with this Blink change to add NeedsManualRebaseline

Original issue's description:
> Revert of Use ES2015-style TypedArray prototype chain (patchset  id:80001 of https://codereview.chromium.org/1541233002/ )
>
> Reason for revert:
> [Sheriff] Changes layout tests. Please fix upstream first if intended.
>
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3689
>
> Original issue's description:
> > Use ES2015-style TypedArray prototype chain
> >
> > This patch switches TypedArrays to use the prototype chain described
> > in the ES2015 specification, which adds a %TypedArray% superclass above
> > all individual TypedArray types. Most methods are defined on the
> > superclass rather than the subclasses.
> >
> > In order to prevent a performance regression, a few methods are
> > marked as inline. Inlining might prevent code which was previously
> > monomorphic from becoming polymorphic, and it was specifically
> > applied in places where methods became more polymorphic than before.
> > Tests with realistic workloads would be nice to do before this
> > ships in stable.
> >
> > This patch does not bring TypedArrays up to full spec compliance. In
> > particular, @@species is not yet supported.
> >
> > R=cbruni
> > BUG=v8:4085
> > LOG=Y
> >
> > Committed: https://crrev.com/07c91dccbe55c7be3ec75857dee5ad59873330b7
> > Cr-Commit-Position: refs/heads/master@{#33050}
>
> TBR=caitpotter88@gmail.com,cbruni@chromium.org,littledan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4085
>
> Committed: https://crrev.com/28b55ffd1e32e09aaf42b8bbb407944d4808e07c
> Cr-Commit-Position: refs/heads/master@{#33053}

TBR=caitpotter88@gmail.com,cbruni@chromium.org,machenbach@chromium.org
BUG=v8:4085
LOG=Y

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1558663002

Cr-Commit-Position: refs/heads/master@{#33067}
2015-12-30 22:14:16 +00:00
machenbach
28b55ffd1e Revert of Use ES2015-style TypedArray prototype chain (patchset id:80001 of https://codereview.chromium.org/1541233002/ )
Reason for revert:
[Sheriff] Changes layout tests. Please fix upstream first if intended.

https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3689

Original issue's description:
> Use ES2015-style TypedArray prototype chain
>
> This patch switches TypedArrays to use the prototype chain described
> in the ES2015 specification, which adds a %TypedArray% superclass above
> all individual TypedArray types. Most methods are defined on the
> superclass rather than the subclasses.
>
> In order to prevent a performance regression, a few methods are
> marked as inline. Inlining might prevent code which was previously
> monomorphic from becoming polymorphic, and it was specifically
> applied in places where methods became more polymorphic than before.
> Tests with realistic workloads would be nice to do before this
> ships in stable.
>
> This patch does not bring TypedArrays up to full spec compliance. In
> particular, @@species is not yet supported.
>
> R=cbruni
> BUG=v8:4085
> LOG=Y
>
> Committed: https://crrev.com/07c91dccbe55c7be3ec75857dee5ad59873330b7
> Cr-Commit-Position: refs/heads/master@{#33050}

TBR=caitpotter88@gmail.com,cbruni@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4085

Review URL: https://codereview.chromium.org/1554523002

Cr-Commit-Position: refs/heads/master@{#33053}
2015-12-29 08:43:29 +00:00
littledan
07c91dccbe Use ES2015-style TypedArray prototype chain
This patch switches TypedArrays to use the prototype chain described
in the ES2015 specification, which adds a %TypedArray% superclass above
all individual TypedArray types. Most methods are defined on the
superclass rather than the subclasses.

In order to prevent a performance regression, a few methods are
marked as inline. Inlining might prevent code which was previously
monomorphic from becoming polymorphic, and it was specifically
applied in places where methods became more polymorphic than before.
Tests with realistic workloads would be nice to do before this
ships in stable.

This patch does not bring TypedArrays up to full spec compliance. In
particular, @@species is not yet supported.

R=cbruni
BUG=v8:4085
LOG=Y

Review URL: https://codereview.chromium.org/1541233002

Cr-Commit-Position: refs/heads/master@{#33050}
2015-12-28 17:28:54 +00:00
yangguo
b00d9e25bf [debugger] step on every assignment in destructuring bind.
R=caitpotter88@gmail.com, littledan@chromium.org

Review URL: https://codereview.chromium.org/1542813003

Cr-Commit-Position: refs/heads/master@{#33009}
2015-12-22 13:29:33 +00:00
yangguo
831b7ee3aa [debugger] step on every assignment in a destructuring assignment.
R=caitpotter88@gmail.com, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1533313002

Cr-Commit-Position: refs/heads/master@{#33000}
2015-12-22 08:21:33 +00:00
caitpotter88
76f6d2a3c8 [es6] use correct --harmony-destructuring-assignment flag when preparsing
BUG=v8:811, v8:4636
LOG=N
R=adamk@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/1544483002

Cr-Commit-Position: refs/heads/master@{#32991}
2015-12-21 20:13:46 +00:00
verwaest
01b8e7c7f6 Throw TypeError when reading global references through a JSProxy
Allowing global references to be read through a proxy results in cross-origin information leaks. The ES6 spec currently does not mitigate this in any way. This CL adds a workaround that's easy for V8: throw whenever an unresolved reference would result in a proxy trap to be fired. I'm landing this so we can move forwards with staging proxies without putting users of --harmony at risk.

BUG=chromium:399951
LOG=n

Review URL: https://codereview.chromium.org/1529303003

Cr-Commit-Position: refs/heads/master@{#32949}
2015-12-17 14:37:41 +00:00
neis
641cdd3067 [proxies] Fix Object.prototype.hasOwnProperty
It must call the 'getOwnPropertyDescriptor' trap, not the 'has' trap.

R=cbruni@chromium.org, jkummerow@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1532723005

Cr-Commit-Position: refs/heads/master@{#32944}
2015-12-17 12:12:10 +00:00
neis
0d83aad557 [proxies] Correctly handle proxies in Function.prototype.bind
- Before getting the length property, we must check for it
  using [[GetOwnProperty]].  Also, if the obtained length
  is a number, we must properly convert it to an integer.

- In order to get the prototype we must use [[GetPrototypeOf]],
  and do so before checking the length.

R=cbruni@chromium.org, jkummerow@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1530893002

Cr-Commit-Position: refs/heads/master@{#32934}
2015-12-17 09:07:57 +00:00
cbruni
2c75e3d2ab [proxies] fix access issue when having proxies on the prototype-chain of global objects.
We can no longer just walk the prototype chain without doing proper access-checks. When installing a proxy as the __proto__ of the global object we might accidentally end up invoking cross-realm code without access-checks (see proxies-cross-realm-ecxeption.js).

Review URL: https://codereview.chromium.org/1521953002

Cr-Commit-Position: refs/heads/master@{#32903}
2015-12-16 14:31:39 +00:00
neis
d0ef84b340 [proxies] Make Array.prototype.concat work correctly with proxies.
R=rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1525983002

Cr-Commit-Position: refs/heads/master@{#32900}
2015-12-16 14:17:25 +00:00
jkummerow
35e5b6824e [proxies] Fix bogus cast in HasOwnPropertyImplementation
BUG=v8:1543,chromium:570120
LOG=n

Review URL: https://codereview.chromium.org/1530873002

Cr-Commit-Position: refs/heads/master@{#32892}
2015-12-16 11:42:47 +00:00
yangguo
8bee91a58b [debugger] remove step count parameter from prepare step.
And tons of changes to debugger tests.

R=bmeurer@chromium.org
BUG=chromium:569835
LOG=N

Review URL: https://codereview.chromium.org/1525173003

Cr-Commit-Position: refs/heads/master@{#32885}
2015-12-16 08:39:54 +00:00
yangguo
44a8fec8a1 [regexp] break recursion in mutually recursive capture/back references.
TBR=adamk@chromium.org
R=erik.corry@gmail.com
BUG=v8:4616
LOG=N

Review URL: https://codereview.chromium.org/1522353002

Cr-Commit-Position: refs/heads/master@{#32879}
2015-12-16 06:58:58 +00:00
jkummerow
3d8b51e248 [proxies] Check for stack overflow in Proxy internal methods
The proxy may be on its own target's or handler's prototype chain, leading
to infinite recursion either when looking up the trap, or when calling
through to the target.
We can't eagerly prevent this from happening (e.g. at "foo.__proto__ = bar"
calling time) because the presence of traps can change at any time.

BUG=v8:1543,chromium:569882
LOG=n

Review URL: https://codereview.chromium.org/1526953002

Cr-Commit-Position: refs/heads/master@{#32872}
2015-12-15 17:23:44 +00:00
jkummerow
0e2ea6a508 [proxies] [tests] Un-skip proxies-with-unscopables, delete proxies-symbols
- proxies-with-unscopables needed updating of trap names
- proxies-symbols doesn't make sense any more: it tested symbol fitering/
  blacklisting, but Proxies interact with Symbols just fine according to
  the current spec.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1529473002

Cr-Commit-Position: refs/heads/master@{#32844}
2015-12-14 16:37:53 +00:00
neis
1596b015ff [proxies] Support proxies in JSON.parse and JSON.stringify.
This CL tries to correctly support the following:
- stringifying a proxy,
- stringifying with a proxy as replacer (callable or arraylike),
- stringifying with a replacer that returns a proxy,
- parsing with a callable proxy as reviver,
- parsing with a reviver that inserts proxies into the object,
- and whatever else you can imagine.

This also fixes some bugs observable without proxies.

BUG=v8:3139,v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1515133002

Cr-Commit-Position: refs/heads/master@{#32843}
2015-12-14 15:12:12 +00:00
neis
4460b85a3e [proxies] Add missing condition to GetProperty consistency check.
BUG=v8:1543
LOG=N
R=cbruni@chromium.org,jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1519073002

Cr-Commit-Position: refs/heads/master@{#32832}
2015-12-14 12:49:59 +00:00
adamk
a229c9b94f Remove --harmony-array-includes flag
Array.prototype.includes shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1513843006

Cr-Commit-Position: refs/heads/master@{#32818}
2015-12-12 01:04:10 +00:00
adamk
819c429ca2 [es6] Support Function name inference in variable declarations
This is behind the --harmony-function-name flag, currently disabled.

With the flag enabled, we now pass the relevant tests in
language/statements/*/fn-name-*.

BUG=v8:3699
LOG=y

Review URL: https://codereview.chromium.org/1518873004

Cr-Commit-Position: refs/heads/master@{#32817}
2015-12-12 00:20:37 +00:00
adamk
5ceb4feca3 Remove always-on --harmony-rest-parameters flag
It shipped in Chrome 47.

Review URL: https://codereview.chromium.org/1519073004

Cr-Commit-Position: refs/heads/master@{#32816}
2015-12-12 00:00:38 +00:00
caitpotter88
18f41e4653 [es6] support AssignmentPattern as LHS in for-in/of loops
BUG=v8:811, v8:4599
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1517973002

Cr-Commit-Position: refs/heads/master@{#32814}
2015-12-11 19:39:40 +00:00
jkummerow
cf46317483 [proxies] Fix JSObject::AllCanRead for Proxies on the prototype chain
Review URL: https://codereview.chromium.org/1517753003

Cr-Commit-Position: refs/heads/master@{#32805}
2015-12-11 15:51:46 +00:00
cbruni
df2a92972b [proxy] fixing for-in for proxies, fixing harmony/proxy.js tests, improving error messages and some drive-by fixes
BUG=v8:1543
LOG=n

patch from issue 1519473002 at patchset 1 (http://crrev.com/1519473002#ps1)

Review URL: https://codereview.chromium.org/1516843002

Cr-Commit-Position: refs/heads/master@{#32801}
2015-12-11 14:56:00 +00:00
jkummerow
a83546932b Move Object.assign implementation to C++
This avoids a pair of super-high-degree polymorphic load/store ICs, and
creates the opportunity to add more fast paths if needed.

Review URL: https://codereview.chromium.org/1517963002

Cr-Commit-Position: refs/heads/master@{#32799}
2015-12-11 14:10:55 +00:00
adamk
8b968b70e9 Revert of [es6] support AssignmentPattern as LHS in for-in/of loops (patchset id:280001 of https://codereview.chromium.org/1508933004/ )
Reason for revert:
Hits unreachable code (found by fuzzer). Example crasher:

"for(();;);"

Original issue's description:
> [es6] support AssignmentPattern as LHS in for-in/of loops
>
> BUG=v8:811, v8:4599
> LOG=N
> R=adamk@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/e47bdb775564b2cd8365047425898ab4274190a6
> Cr-Commit-Position: refs/heads/master@{#32773}

TBR=rossberg@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811, v8:4599

Review URL: https://codereview.chromium.org/1511773009

Cr-Commit-Position: refs/heads/master@{#32774}
2015-12-11 02:00:01 +00:00
caitpotter88
e47bdb7755 [es6] support AssignmentPattern as LHS in for-in/of loops
BUG=v8:811, v8:4599
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1508933004

Cr-Commit-Position: refs/heads/master@{#32773}
2015-12-11 01:06:48 +00:00
ishell
dddcd0ac17 Fix Function subclassing.
Function subclasses did not have function properties installed (name, prototype, etc.).
Now when an instance of a Function subclass is created it gets initial map that corresponds
to the language mode of the function body. The language mode dependent maps are cached as
special transitions on initial map of the subclass constructor.

BUG=v8:4597, v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1510753005

Cr-Commit-Position: refs/heads/master@{#32764}
2015-12-10 17:28:08 +00:00
cbruni
c20156c550 [runtime] [proxies] adding tests for uncovered branches
fly-by fix of Proxy [[Construct]] on mips.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1517463002

Cr-Commit-Position: refs/heads/master@{#32758}
2015-12-10 15:35:15 +00:00
verwaest
2d13f6ec43 Fix Promise intrinsicDefaultProto
BUG=v8:3900, v8:3931, v8:1543, v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1511893002

Cr-Commit-Position: refs/heads/master@{#32731}
2015-12-10 00:33:51 +00:00
cbruni
a2d5641bc4 [runtime] [proxy] implement [[Construct]]
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1509603005

Cr-Commit-Position: refs/heads/master@{#32718}
2015-12-09 14:55:33 +00:00
jkummerow
453e1dfa7a [proxies] Fix HasProperty and getOwnPropertySymbols
JSProxy::HasProperty was missing an early "return Nothing<bool>".
KeyAccumulator's FilterProxyKeys() didn't handle SKIP_STRINGS correctly.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1505253002

Cr-Commit-Position: refs/heads/master@{#32699}
2015-12-09 09:41:12 +00:00
verwaest
175c90f8f2 Support intriscDefaultProto for Error functions
BUG=v8:3900, v8:3931, v8:1543, v8:3330, v8:4002
LOG=n

Review URL: https://codereview.chromium.org/1496333002

Cr-Commit-Position: refs/heads/master@{#32692}
2015-12-09 07:53:34 +00:00
cbruni
7299412473 [runtime] [proxy] Implementing [[Call]]
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1499593003

Cr-Commit-Position: refs/heads/master@{#32675}
2015-12-08 16:05:09 +00:00
yangguo
a607ec84d5 [debugger] add test case for stepping into proxy traps.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1508653002

Cr-Commit-Position: refs/heads/master@{#32671}
2015-12-08 07:10:49 +00:00
verwaest
e8adbe7821 Reflect.construct / Proxies: Fall back to intrinsicDefaultProto for non-instance prototypes
Error still to be done, since that's not yet available in the bootstrapper.

BUG=v8:3900, v8:3931, v8:1543, v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1499923002

Cr-Commit-Position: refs/heads/master@{#32662}
2015-12-07 16:35:17 +00:00
neis
ef1ac72901 [proxies] Make Object.{isFrozen,isSealed} behave correctly for proxies.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1502983002

Cr-Commit-Position: refs/heads/master@{#32660}
2015-12-07 15:36:14 +00:00
neis
4e2c0dd7a9 [proxies] Make Object.{freeze,seal} behave correctly for proxies.
- Add JSReceiver::SetIntegrityLevel, with a fast path for regular objects.
- Make Object.{freeze,seal} call this via %Object{Freeze,Seal}, thus no longer
  using broken or deprecated functions from v8natives.js.
- Add JSReceiver::OwnPropertyKeys convenience function.
- Reenable harmony/proxies-hash.js test.

R=rossberg
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1489423002

Cr-Commit-Position: refs/heads/master@{#32651}
2015-12-07 11:01:35 +00:00
yangguo
18a3ddcfb9 [debugger] add test case for stepping into default parameter.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1500413002

Cr-Commit-Position: refs/heads/master@{#32649}
2015-12-07 10:08:29 +00:00
caitpotter88
b634a61d84 [es6] implement destructuring assignment
Attempt #<really big number>

Parses, and lazily rewrites Destructuring Assignment expressions. The rewriting strategy involves inserting a placeholder RewritableAssignmentExpression into the AST, whose content expression can be completely rewritten at a later time.

Lazy rewriting ensures that errors do not occur due to eagerly rewriting nodes which form part of a binding pattern, thus breaking the meaning of the pattern --- or by eagerly rewriting ambiguous constructs that are not immediately known

BUG=v8:811
LOG=Y
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1309813007

Cr-Commit-Position: refs/heads/master@{#32623}
2015-12-04 17:20:24 +00:00
jkummerow
7d1263db47 [proxies] Use JSReceiver::GetKeys() for more purposes
Having beefed up GetKeys() to support everything, use it for everything now.

This fixes Object.getOwnPropertyNames and Object.getOwnPropertySymbols for
Proxies, and gets rid of a bunch of code duplication.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1498593006

Cr-Commit-Position: refs/heads/master@{#32620}
2015-12-04 15:20:57 +00:00
cbruni
747f455b07 [runtime] [proxy] removing JSFunctionProxy and related code.
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1496503002

Cr-Commit-Position: refs/heads/master@{#32616}
2015-12-04 13:49:24 +00:00
neis
eb9407c6f5 [es6] Set correct length for Reflect.get (should be 2, not 3).
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1498983003

Cr-Commit-Position: refs/heads/master@{#32615}
2015-12-04 13:40:43 +00:00
neis
62127d00ae [proxies] Implement Proxy.revocable.
For now, we revoke a proxy by setting its handler to null (as in the spec).

Change the "target" field from Object to JSReceiver as there's no point in
allowing more.

R=jkummerow@chromium.org, rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1496243003

Cr-Commit-Position: refs/heads/master@{#32608}
2015-12-04 10:56:01 +00:00
machenbach
154a493cb7 Revert of [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors. (patchset id:20001 of https://codereview.chromium.org/1500543002/ )
Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
>
> The ArrayBuffer and SharedArrayBuffer constructors should raise an
> exception when called with no arguments or undefined length.  Also
> unified the ArrayBuffer and SharedArrayBuffer implementations as C++
> builtins, and removed some (now) obsolete runtime entries.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/3235ccbb7826ceec2188f6ebab98fc851b54f60e
> Cr-Commit-Position: refs/heads/master@{#32590}

TBR=yangguo@chromium.org,cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1501673002

Cr-Commit-Position: refs/heads/master@{#32606}
2015-12-04 10:38:48 +00:00
machenbach
2cb40dc722 Reland of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset id:1 of https://codereview.chromium.org/1494283002/ )
Reason for revert:
Did not help...

Original issue's description:
> Revert of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset  id:20001 of https://codereview.chromium.org/1492863002/ )
>
> Reason for revert:
> [Sheriff] Speculative revert for:
> https://uberchromegw.corp.google.com/i/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225
>
> Can just be relanded if it doesn't get green.
>
> Original issue's description:
> > [proxies] Make Object.prototype.isPrototypeOf step into proxies.
> >
> > R=rossberg, verwaest@chromium.org
> > BUG=v8:1543
> > LOG=n
> >
> > Committed: https://crrev.com/4ca1180d2e7c409312ae0761cb12843989466573
> > Cr-Commit-Position: refs/heads/master@{#32569}
>
> TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:1543
>
> Committed: https://crrev.com/48fba9439f291edd5929e19951262dc7e8a09609
> Cr-Commit-Position: refs/heads/master@{#32588}

TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1491743010

Cr-Commit-Position: refs/heads/master@{#32598}
2015-12-04 06:39:16 +00:00
bmeurer
3235ccbb78 [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
The ArrayBuffer and SharedArrayBuffer constructors should raise an
exception when called with no arguments or undefined length.  Also
unified the ArrayBuffer and SharedArrayBuffer implementations as C++
builtins, and removed some (now) obsolete runtime entries.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1500543002

Cr-Commit-Position: refs/heads/master@{#32590}
2015-12-03 21:16:31 +00:00
machenbach
48fba9439f Revert of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset id:20001 of https://codereview.chromium.org/1492863002/ )
Reason for revert:
[Sheriff] Speculative revert for:
https://uberchromegw.corp.google.com/i/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3225

Can just be relanded if it doesn't get green.

Original issue's description:
> [proxies] Make Object.prototype.isPrototypeOf step into proxies.
>
> R=rossberg, verwaest@chromium.org
> BUG=v8:1543
> LOG=n
>
> Committed: https://crrev.com/4ca1180d2e7c409312ae0761cb12843989466573
> Cr-Commit-Position: refs/heads/master@{#32569}

TBR=rossberg@chromium.org,verwaest@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1494283002

Cr-Commit-Position: refs/heads/master@{#32588}
2015-12-03 20:24:46 +00:00
neis
384ec6dc92 [proxies] Adapt and reenable harmony/proxies-for.js test.
R=rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1491863002

Cr-Commit-Position: refs/heads/master@{#32579}
2015-12-03 17:41:40 +00:00
caitpotter88
3ed71daff4 [proxies] do not leak private symbols to proxy traps
BUG=v8:4537
LOG=N
R=neis@chromium.org, rossberg@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1492923002

Cr-Commit-Position: refs/heads/master@{#32570}
2015-12-03 15:05:00 +00:00
neis
4ca1180d2e [proxies] Make Object.prototype.isPrototypeOf step into proxies.
R=rossberg, verwaest@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1492863002

Cr-Commit-Position: refs/heads/master@{#32569}
2015-12-03 15:03:24 +00:00
jkummerow
e478a8ac39 [proxies] Implement Symbol/DONT_ENUM filtering for GetKeys()
And use it to fix Object.keys() for proxies.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1488873003

Cr-Commit-Position: refs/heads/master@{#32496}
2015-12-02 10:19:59 +00:00
yangguo
62dcf2fab6 [es6] correctly handle object wrappers in JSON.stringify.
R=bmeurer@chromium.org
BUG=v8:4581
LOG=N

Review URL: https://codereview.chromium.org/1495473002

Cr-Commit-Position: refs/heads/master@{#32494}
2015-12-02 08:44:03 +00:00
caitpotter88
5058f68596 [parser] treat MethodDefinitions in ObjectPatterns as SyntaxErrors
BUG=v8:4585
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1488043002

Cr-Commit-Position: refs/heads/master@{#32477}
2015-12-01 20:33:11 +00:00
cbruni
f4d4051521 [runtime] [proxy] Runtime_HasOwnProperty and thus
Object.prototype.hasOwnProperty should use JSReceiver::HasOwnProperty for
proxies.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1480213004

Cr-Commit-Position: refs/heads/master@{#32475}
2015-12-01 17:33:04 +00:00
cbruni
df36d046a4 [runtime] [proxy] Fix Object.prototype.PropertyIsEnumerable to support
proxies.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1484313003

Cr-Commit-Position: refs/heads/master@{#32473}
2015-12-01 17:12:08 +00:00
cbruni
d9e0a5a9ad [runtime] [proxy] Adding [[SetPrototypeOf]] trap.
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1481383003

Cr-Commit-Position: refs/heads/master@{#32471}
2015-12-01 15:59:44 +00:00
cbruni
7e8fa4b96a [runtime] [proxy] implementing [[Get]] trap.
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1482283002

Cr-Commit-Position: refs/heads/master@{#32466}
2015-12-01 14:04:43 +00:00
neis
031751d5c4 [proxies] Implement [[Set]].
R=rossberg
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1481103002

Cr-Commit-Position: refs/heads/master@{#32457}
2015-12-01 12:27:09 +00:00
jkummerow
2ba464e11c [proxies] [[HasProperty]]: fix trap call.
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1479143002

Cr-Commit-Position: refs/heads/master@{#32391}
2015-11-30 09:21:10 +00:00
jkummerow
2fee8a0f1d [proxies] Implement [[Enumerate]] and [[OwnPropertyKeys]]
Both are integrated into JSReceiver::GetKeys().

For now, the implementation ignores Symbol/DONT_ENUM filtering.

BUG=v8:1543
LOG=n

Committed: https://crrev.com/42c6056e6f247724d14dc887f6619a6bf5867a97
Cr-Commit-Position: refs/heads/master@{#32384}

Review URL: https://codereview.chromium.org/1474083003

Cr-Commit-Position: refs/heads/master@{#32386}
2015-11-28 15:03:13 +00:00
machenbach
97def40dc0 Revert of [proxies] Implement [[Enumerate]] and [[OwnPropertyKeys]] (patchset id:40001 of https://codereview.chromium.org/1474083003/ )
Reason for revert:
[Sheriff] Speculative revert for gc mole:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/5164

Original issue's description:
> [proxies] Implement [[Enumerate]] and [[OwnPropertyKeys]]
>
> Both are integrated into JSReceiver::GetKeys().
>
> For now, the implementation ignores Symbol/DONT_ENUM filtering.
>
> BUG=v8:1543
> LOG=n
>
> Committed: https://crrev.com/42c6056e6f247724d14dc887f6619a6bf5867a97
> Cr-Commit-Position: refs/heads/master@{#32384}

TBR=verwaest@chromium.org,bmeurer@chromium.org,jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1543

Review URL: https://codereview.chromium.org/1482113002

Cr-Commit-Position: refs/heads/master@{#32385}
2015-11-28 14:16:29 +00:00
jkummerow
42c6056e6f [proxies] Implement [[Enumerate]] and [[OwnPropertyKeys]]
Both are integrated into JSReceiver::GetKeys().

For now, the implementation ignores Symbol/DONT_ENUM filtering.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1474083003

Cr-Commit-Position: refs/heads/master@{#32384}
2015-11-28 10:48:43 +00:00
verwaest
970a7ad758 Fix Reflect.construct wrt proxy, generator, and non-subclass new.target
This makes sure that proxy + Function/Array works
Makes sure that new.target can be a generator
Makes sure that if new.target is not a subclass, but does not have a prototype, that we'll get that same prototype back the next time we look at new.target.prototype.

BUG=v8:1543, v8:3330, v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1484473002

Cr-Commit-Position: refs/heads/master@{#32382}
2015-11-27 21:44:48 +00:00
neis
39efa4348a [proxies] Implement [[Delete]].
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1479543002

Cr-Commit-Position: refs/heads/master@{#32320}
2015-11-26 09:34:28 +00:00
neis
a25018905d [proxies] Implement [[PreventExtensions]] and [[IsExtensible]].
BUG=

Review URL: https://codereview.chromium.org/1441043002

Cr-Commit-Position: refs/heads/master@{#32212}
2015-11-24 14:16:24 +00:00
yangguo
eeb7c05558 [es6] Implement @@match subclassing.
BUG=v8:4305
LOG=N

Review URL: https://codereview.chromium.org/1434523002

Cr-Commit-Position: refs/heads/master@{#32210}
2015-11-24 13:57:31 +00:00
pan.deng
154ddde42b Support offset-TypedArray in futex API
BUG=v8:4555
LOG=N

Review URL: https://codereview.chromium.org/1462833002

Cr-Commit-Position: refs/heads/master@{#32142}
2015-11-20 11:40:00 +00:00
jkummerow
6f0850c63d [proxies] Update Object.defineProperty/ies for JSProxies
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1456613002

Cr-Commit-Position: refs/heads/master@{#32103}
2015-11-19 09:21:46 +00:00
adamk
7d1d978654 Rename destructuring flag to "--harmony-destructuring-bind"
This is in preparation for the addition of --harmony-destructuring-assignment.

BUG=v8:811
LOG=n

Review URL: https://codereview.chromium.org/1450193002

Cr-Commit-Position: refs/heads/master@{#32098}
2015-11-18 23:30:09 +00:00
neis
b270813388 [es6] Partially implement Reflect.ownKeys.
Proxies are not properly supported yet.

This is a reland of 1405243006.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1460563002

Cr-Commit-Position: refs/heads/master@{#32065}
2015-11-18 00:52:50 +00:00
pan.deng
81fe5b3c45 Support SAB atomics for offset-TypedArray
BUG=497295
LOG=n

Review URL: https://codereview.chromium.org/1422533009

Cr-Commit-Position: refs/heads/master@{#32064}
2015-11-18 00:19:54 +00:00
yangguo
906903acb5 Experimental support for RegExp lookbehind.
R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
Cr-Commit-Position: refs/heads/master@{#32029}

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32043}
2015-11-17 13:33:34 +00:00
jkummerow
9c35e4b23c [proxies] Wire up Object.getOwnPropertyDescriptor
using the new JSReceiver::GetOwnPropertyDescriptor implementation.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1451703003

Cr-Commit-Position: refs/heads/master@{#32037}
2015-11-17 13:08:51 +00:00
yangguo
5b2ae9d908 Revert of Experimental support for RegExp lookbehind. (patchset id:340001 of https://codereview.chromium.org/1418963009/ )
Reason for revert:
gc stress breaks due to string_start_minus_one not being set correctly.

Original issue's description:
> Experimental support for RegExp lookbehind.
>
> R=erikcorry@chromium.org, littledan@chromium.org
> BUG=v8:4545
> LOG=N
>
> Committed: https://crrev.com/37632606bbce1418238b13fd90cb6ef6705871cd
> Cr-Commit-Position: refs/heads/master@{#32029}

TBR=littledan@chromium.org,erikcorry@chromium.org,erikcorry@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4545

Review URL: https://codereview.chromium.org/1451373003

Cr-Commit-Position: refs/heads/master@{#32032}
2015-11-17 11:55:21 +00:00
yangguo
37632606bb Experimental support for RegExp lookbehind.
R=erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4545
LOG=N

Review URL: https://codereview.chromium.org/1418963009

Cr-Commit-Position: refs/heads/master@{#32029}
2015-11-17 11:15:06 +00:00
adamk
fd3ff03da2 Fix harmony sloppy block scoping dynamic redeclaration check
The previous code did not properly check for harmony const when
doing the dynamic redeclaration check. This was masked in the
test because each eval had an initializer, and the initializer was what
triggered the exception.

This patch tightens the test by removing initializers and fixes the bug in
DeclareLookupSlot.

Also change the test to use assertThrows where possible.

BUG=v8:4550
LOG=n

Review URL: https://codereview.chromium.org/1437003006

Cr-Commit-Position: refs/heads/master@{#31995}
2015-11-13 21:04:15 +00:00
cbruni
24e058d0ed [runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1417063011

Cr-Commit-Position: refs/heads/master@{#31983}
2015-11-13 14:14:07 +00:00
neis
69d218c03f [proxies] Remove "fix" functionality, add (still unused) target property.
BUG=

Review URL: https://codereview.chromium.org/1427743011

Cr-Commit-Position: refs/heads/master@{#31972}
2015-11-12 22:12:06 +00:00
yangguo
9a569ec2c8 [es6] Implement @@split subclassing.
RegExp.prototye[@@split] is not yet implement to spec regarding creating
new RegExp object with the SpeciesConstructor.

R=littledan@chromium.org
BUG=v8:4345
LOG=N

Review URL: https://codereview.chromium.org/1427573005

Cr-Commit-Position: refs/heads/master@{#31911}
2015-11-10 07:00:44 +00:00
neis
ec0f891d1e Revert of "[es6] Partially implement Reflect.ownKeys."
Reason for revert: failed tests on a Windows build.

TBR=rossberg,cbruni,neis
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1426943007

Cr-Commit-Position: refs/heads/master@{#31907}
2015-11-10 00:05:21 +00:00
neis
4194d0ebad [es6] Partially implement Reflect.ownKeys.
Proxies are not properly supported yet.

R=cbruni, rossberg
BUG=

Review URL: https://codereview.chromium.org/1405243006

Cr-Commit-Position: refs/heads/master@{#31906}
2015-11-09 23:30:53 +00:00
adamk
7b556cd24f Split default parameters that require destructuring into their own file
This allows testing the configuration where --harmony-default-parameters
is passed without --harmony-destructuring.

R=rossberg@chromium.org
BUG=v8:2160
LOG=n

Review URL: https://codereview.chromium.org/1410023015

Cr-Commit-Position: refs/heads/master@{#31863}
2015-11-06 15:49:01 +00:00
adamk
e33c4b450f Re-re-land "[es6] Implement destructuring binding in try/catch"
http://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860 was reverted
due to a Blink test failure. That test has been marked as failing on
the Blink side in https://chromium.googlesource.com/chromium/src/+/ac11c6df133.

BUG=v8:811
LOG=y
TBR=rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1409093005

Cr-Commit-Position: refs/heads/master@{#31842}
2015-11-05 20:21:50 +00:00
machenbach
35a60c211e Revert of Revert "Revert of [es6] Implement destructuring binding in try/catch" (patchset id:20001 of https://codereview.chromium.org/1411323008/ )
Reason for revert:
[Sheriff] Breaks a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/2750

Please request rebase upstream first if intended.

Original issue's description:
> Revert "Revert of [es6] Implement destructuring binding in try/catch"
>
> Reland try/catch destructuring with a fix for the MemorySanitizer failure:
> initialization_pos needs to be initialized in the DeclarationDescriptor.
>
> This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/80a1e004f4ef619b54a2d87bf2108719a8411860
> Cr-Commit-Position: refs/heads/master@{#31834}

TBR=littledan@chromium.org,rossberg@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1421193006

Cr-Commit-Position: refs/heads/master@{#31840}
2015-11-05 19:29:08 +00:00
adamk
80a1e004f4 Revert "Revert of [es6] Implement destructuring binding in try/catch"
Reland try/catch destructuring with a fix for the MemorySanitizer failure:
initialization_pos needs to be initialized in the DeclarationDescriptor.

This is a one line fix to http://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1411323008

Cr-Commit-Position: refs/heads/master@{#31834}
2015-11-05 17:27:57 +00:00
bmeurer
a210c3757e [runtime] Remove the very dangerous %_CallFunction intrinsic.
The %_CallFunction doesn't implement the call sequence properly, it
doesn't do the receiver wrapping, nor does it check for
classConstructor. Also the eager deoptimization for %_CallFunction was
seriously b0rked (we must have been lucky with TurboFan so far).

R=yangguo@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1419813010

Cr-Commit-Position: refs/heads/master@{#31821}
2015-11-05 11:48:21 +00:00
littledan
5d44bf0263 Ship Harmony ToLength
This patch moves ES2015 ToLength semantics on array operations, etc
to from staging to shipping.

R=adamk
BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1433473003

Cr-Commit-Position: refs/heads/master@{#31810}
2015-11-05 00:45:05 +00:00
caitpotter88
55e1cfebfd [parser] early error when declaration Pattern missing Initializer
Emit an early error when BindingPatterns are used in a VariableDeclaration
or LexicalBinding without an Initializer.

BUG=v8:4532
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1416753009

Cr-Commit-Position: refs/heads/master@{#31802}
2015-11-04 19:26:40 +00:00
adamk
f687c4f4e6 Revert of [es6] Implement destructuring binding in try/catch (patchset id:40001 of https://codereview.chromium.org/1417483014/ )
Reason for revert:
MSAN errors on arm64: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/5123/

Original issue's description:
> [es6] Implement destructuring binding in try/catch
>
> The approach is to desugar
>
>   try { ... }
>   catch ({x, y}) { ... }
>
> into
>
>   try { ... }
>   catch (.catch) {
>     let x = .catch.x;
>     let y = .catch.y;
>     ...
>   }
>
> using the PatternRewriter's normal facilities. This has the side benefit
> of throwing the appropriate variable conflict errors for declarations
> made inside the catch block.
>
> No change is made to non-destructured cases, which will hopefully save
> us some work if https://github.com/tc39/ecma262/issues/150 is adopted
> in the spec.
>
> There's one big problem with this patch, which is a lack of PreParser
> support for the redeclaration errors. But it seems we're already lacking
> good PreParser support for such errors, so I'm not sure that should
> block this moving forward.
>
> BUG=v8:811
> LOG=y
>
> Committed: https://crrev.com/a316db995e6e4253664920652ed4e5a38b2caeba
> Cr-Commit-Position: refs/heads/master@{#31797}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1408063013

Cr-Commit-Position: refs/heads/master@{#31798}
2015-11-04 16:39:59 +00:00
adamk
a316db995e [es6] Implement destructuring binding in try/catch
The approach is to desugar

  try { ... }
  catch ({x, y}) { ... }

into

  try { ... }
  catch (.catch) {
    let x = .catch.x;
    let y = .catch.y;
    ...
  }

using the PatternRewriter's normal facilities. This has the side benefit
of throwing the appropriate variable conflict errors for declarations
made inside the catch block.

No change is made to non-destructured cases, which will hopefully save
us some work if https://github.com/tc39/ecma262/issues/150 is adopted
in the spec.

There's one big problem with this patch, which is a lack of PreParser
support for the redeclaration errors. But it seems we're already lacking
good PreParser support for such errors, so I'm not sure that should
block this moving forward.

BUG=v8:811
LOG=y

Review URL: https://codereview.chromium.org/1417483014

Cr-Commit-Position: refs/heads/master@{#31797}
2015-11-04 16:06:38 +00:00
jkummerow
41775a3e73 Fix HasProperty/HasElement for Proxies on the prototype chain
Review URL: https://codereview.chromium.org/1414403003

Cr-Commit-Position: refs/heads/master@{#31775}
2015-11-04 10:17:43 +00:00
neis
b5d0e31582 Fix another corner-case behavior of Object::SetSuperProperty.
If the property is a data property on the holder (or does not exist) and is a readonly data property in the receiver, then we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1424233005

Cr-Commit-Position: refs/heads/master@{#31751}
2015-11-03 14:53:09 +00:00
neis
8c1377a5b4 Fix corner-case behavior of Object::SetSuperProperty.
When the property is an accessor property in the receiver but not on the
holder (ES6 "target"), we must fail.

R=rossberg, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1427113002

Cr-Commit-Position: refs/heads/master@{#31733}
2015-11-03 08:04:32 +00:00
neis
5820adf276 [es6] Partially implement Reflect.set.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1415883007

Cr-Commit-Position: refs/heads/master@{#31685}
2015-10-30 11:48:43 +00:00
neis
98dfe024ca [es6] Partially implement Reflect.getOwnPropertyDescriptor.
Proxies are not properly supported yet.

R=rossberg, jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1408163005

Cr-Commit-Position: refs/heads/master@{#31674}
2015-10-30 10:05:03 +00:00
neis
8e35d8ebec [es6] Partially implement Reflect.defineProperty.
Proxies are not properly supported yet.

R=rossberg,jkummerow@chromium.org
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1421033002

Cr-Commit-Position: refs/heads/master@{#31661}
2015-10-29 15:39:49 +00:00
adamk
0bdaa4d877 Fix eval calls in initializers of arrow function parameters
This requires copying usage flags from the outer scope to the
arrow scope upon encountering the arrow token.

In order to properly pass-on the calls_eval bit, now record
that bit on script scopes just like everywhere else, and add
necessary code to scopes.cc to handle that change in behavior.

Also factored out scope flag propagation to its own method to
make the call site simple (though note that only the eval
bit makes any difference for arrows).

BUG=v8:4395
LOG=n

Review URL: https://codereview.chromium.org/1423613002

Cr-Commit-Position: refs/heads/master@{#31660}
2015-10-29 15:16:40 +00:00
adamk
720c531a70 Remove --harmony-new-target flag
It was shipped in M46 without incident.

Review URL: https://codereview.chromium.org/1411723007

Cr-Commit-Position: refs/heads/master@{#31636}
2015-10-28 16:47:08 +00:00
adamk
a4689fc21f Remove flags for spread calls and arrays
These features shipped in M46 without issue.

Review URL: https://codereview.chromium.org/1429653006

Cr-Commit-Position: refs/heads/master@{#31635}
2015-10-28 15:57:27 +00:00
littledan
b436635ac4 Update to ES2015 == semantics for Symbol/SIMD wrappers
When == is invoked on a Symbol or SIMD vector and an object, the object should
be converted to a primitive with ToPrimitive and then compared again. This means,
for example, that for a Symbol or SIMD vector s, s == Object(s). This patch makes
that change in the implementation of ==. Only the runtime function needed to be
changed, as the code stubs and compiler specializations don't operate on Symbols
or SIMD vectors, and on these types, a fallback to the runtime function is always
used.

BUG=v8:3593
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1421413002

Cr-Commit-Position: refs/heads/master@{#31614}
2015-10-27 20:20:24 +00:00
littledan
8adb1c4705 Reland of Check that array length stays a safe integer in Array.prototype.push (patchset id:1 of https://codereview.chromium.org/1418093007/ )
Reason for revert:
The test failure was unrelated; relanding.

Original issue's description:
> Revert of Check that array length stays a safe integer in Array.prototype.push (patchset  id:120001 of https://codereview.chromium.org/1428483002/ )
>
> Reason for revert:
> Caused for-in-opt test to fail
>
> Original issue's description:
> > Check that array length stays a safe integer in Array.prototype.push
> >
> > This patch adds a check in Array.prototype.push to assert that the new
> > length does not become greater than 2**53-1. Such a length would be
> > dangerous because integer arithmetic becomes imprecise after the
> > boundary. The check is also required by a test262 test.
> >
> > R=adamk
> > LOG=Y
> > BUG=v8:3087
> >
> > Committed: https://crrev.com/e68adf4548dd101dc08fcbff14444152fb1b7fe7
> > Cr-Commit-Position: refs/heads/master@{#31588}
>
> TBR=adamk@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3087
>
> Committed: https://crrev.com/78abedb94431a233842fcb2f7a910805a05bed09
> Cr-Commit-Position: refs/heads/master@{#31590}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3087

Review URL: https://codereview.chromium.org/1424823005

Cr-Commit-Position: refs/heads/master@{#31610}
2015-10-27 16:30:45 +00:00
littledan
78abedb944 Revert of Check that array length stays a safe integer in Array.prototype.push (patchset id:120001 of https://codereview.chromium.org/1428483002/ )
Reason for revert:
Caused for-in-opt test to fail

Original issue's description:
> Check that array length stays a safe integer in Array.prototype.push
>
> This patch adds a check in Array.prototype.push to assert that the new
> length does not become greater than 2**53-1. Such a length would be
> dangerous because integer arithmetic becomes imprecise after the
> boundary. The check is also required by a test262 test.
>
> R=adamk
> LOG=Y
> BUG=v8:3087
>
> Committed: https://crrev.com/e68adf4548dd101dc08fcbff14444152fb1b7fe7
> Cr-Commit-Position: refs/heads/master@{#31588}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3087

Review URL: https://codereview.chromium.org/1418093007

Cr-Commit-Position: refs/heads/master@{#31590}
2015-10-27 05:46:23 +00:00
littledan
e68adf4548 Check that array length stays a safe integer in Array.prototype.push
This patch adds a check in Array.prototype.push to assert that the new
length does not become greater than 2**53-1. Such a length would be
dangerous because integer arithmetic becomes imprecise after the
boundary. The check is also required by a test262 test.

R=adamk
LOG=Y
BUG=v8:3087

Review URL: https://codereview.chromium.org/1428483002

Cr-Commit-Position: refs/heads/master@{#31588}
2015-10-27 04:39:25 +00:00
caitpotter88
b078960e70 [es7] bailout Crankshaft in VisitDoExpression
For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}
2015-10-24 07:06:59 +00:00
neis
193410062e Fix corner-case behavior of JSObject::SetPrototype.
Setting the prototype to whatever it currently is must succeed even if
the object is not extensible.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1423603002

Cr-Commit-Position: refs/heads/master@{#31527}
2015-10-23 14:52:26 +00:00
neis
8e89e8203b Adapt tests in preparation of shipping --harmony-completion.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1415283003

Cr-Commit-Position: refs/heads/master@{#31507}
2015-10-23 10:26:01 +00:00
neis
2c7787ad84 [es6] Partially implement Reflect.setPrototypeOf.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1417243002

Cr-Commit-Position: refs/heads/master@{#31465}
2015-10-22 11:21:43 +00:00
neis
2803a3d302 [es6] Partially implement Reflect.getPrototypeOf.
Proxies are not properly supported yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1416433003

Cr-Commit-Position: refs/heads/master@{#31447}
2015-10-21 15:45:24 +00:00
adamk
7f1504f51e [es6] Handle super properly when rewriting arrow parameter initializers
R=rossberg@chromium.org
BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1414733005

Cr-Commit-Position: refs/heads/master@{#31440}
2015-10-21 13:16:07 +00:00
adamk
02e4d21f4c [es6] Fix scoping for default parameters in arrow functions
When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

This is a revert of the revert https://crrev.com/e41614a058426fb6102e4ab2dd4f98997f00c0fc
with a much-improved (though not yet perfect) Scope::ResetOuterScope
method which properly fixes not only the outer_scope_ pointer but also
fixes the inner_scope_ list in the relevant outer_scopes.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1414283002

Cr-Commit-Position: refs/heads/master@{#31435}
2015-10-21 12:04:20 +00:00
neis
79634a3ffe [es6] Partially implement Reflect.preventExtensions.
Ignore proxies for now.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397853005

Cr-Commit-Position: refs/heads/master@{#31431}
2015-10-21 09:23:47 +00:00
caitpotter88
b6596aa73b [es7] implement |do| expressions proposal
Adds an implementation of "do expression" parsing (https://webcache.googleusercontent.com/search?q=cache:MIGALjqPDNgJ:wiki.ecmascript.org/doku.php%3Fid%3Dstrawman:do_expressions+&cd=1&hl=en&ct=clnk&gl=us).

This feature provides a way to evaluate a block of statements within an expression context, producing the resulting completion value. This is very helpful for implementing certain language features via desugaring.

BUG=v8:4488
LOG=N
R=adamk@chromium.org, bmeurer@chromium.org, rossberg@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1399893002

Cr-Commit-Position: refs/heads/master@{#31428}
2015-10-21 02:58:32 +00:00
bmeurer
e41614a058 Revert of [es6] Fix scoping for default parameters in arrow functions (patchset id:80001 of https://codereview.chromium.org/1405313002/ )
Reason for revert:
Breaks nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2407/steps/Check/logs/regress-4395

Original issue's description:
> [es6] Fix scoping for default parameters in arrow functions
>
> When eagerly parsing arrow functions, expressions in default
> parameter initializers are parsed in the enclosing scope,
> rather than in the function's scope (since that scope does not
> yet exist). This leads to VariableProxies being added to the
> wrong scope, and scope chains for FunctionLiterals being incorrect.
>
> This patch addresses these problems by adding a subclass of
> AstExpressionVisitor that moves VariableProxies to the proper
> scope and fixes up scope chains of FunctionLiterals.
>
> More work likely still needs to be done to make this work completely,
> but it's very close to correct.
>
> BUG=v8:4395
> LOG=y
>
> Committed: https://crrev.com/cf72aad39e51de9b7074ea039377c1812f4a2c6b
> Cr-Commit-Position: refs/heads/master@{#31402}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4395

Review URL: https://codereview.chromium.org/1417463004

Cr-Commit-Position: refs/heads/master@{#31404}
2015-10-20 10:36:38 +00:00
adamk
cf72aad39e [es6] Fix scoping for default parameters in arrow functions
When eagerly parsing arrow functions, expressions in default
parameter initializers are parsed in the enclosing scope,
rather than in the function's scope (since that scope does not
yet exist). This leads to VariableProxies being added to the
wrong scope, and scope chains for FunctionLiterals being incorrect.

This patch addresses these problems by adding a subclass of
AstExpressionVisitor that moves VariableProxies to the proper
scope and fixes up scope chains of FunctionLiterals.

More work likely still needs to be done to make this work completely,
but it's very close to correct.

BUG=v8:4395
LOG=y

Review URL: https://codereview.chromium.org/1405313002

Cr-Commit-Position: refs/heads/master@{#31402}
2015-10-20 09:15:38 +00:00
bmeurer
e678a0f9a9 [runtime] Implement %_ToLength via ToLengthStub.
Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
that supports a fast path for small integers. Everything else is still
handled in the runtime.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
BUG=v8:4494
LOG=n

Review URL: https://codereview.chromium.org/1412963002

Cr-Commit-Position: refs/heads/master@{#31358}
2015-10-19 08:35:18 +00:00
bmeurer
e1088b27b5 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31352}
2015-10-19 05:24:51 +00:00
jarin
5c53481233 Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset id:100001 of https://codereview.chromium.org/1396333010/ )
Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}
2015-10-16 14:56:25 +00:00
bmeurer
3a0bf860b7 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}
2015-10-16 14:09:17 +00:00
yangguo
30715157fa Install iterator meta objects via utils object.
R=cbruni@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/1411653002

Cr-Commit-Position: refs/heads/master@{#31331}
2015-10-16 11:27:33 +00:00
adamk
e5db1d58e5 Remove stale references to --harmony-arrays flag in mjsunit tests
Also move those tests from mjsunit/harmony to mjsunit/es6.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1403633007

Cr-Commit-Position: refs/heads/master@{#31314}
2015-10-15 17:39:42 +00:00
littledan
5c1ef6ac82 Make RegExp use ToLength on lastIndex when flag is turned on
In the ES2015 spec, RegExp uses ToLength, not ToInteger, on lastIndex
to coerce it to an integer. This patch switches to ToLength when
the --harmony-tolength flag is on, and adds some tests to verify the
new behavior.

BUG=v8:4244
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1394023005

Cr-Commit-Position: refs/heads/master@{#31306}
2015-10-15 14:10:48 +00:00
neis
2ed1eebe9f [es6] Implement Reflect.enumerate.
R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1397443013

Cr-Commit-Position: refs/heads/master@{#31299}
2015-10-15 12:59:37 +00:00
adamk
18534dffc9 Don't throw on assignment to function name binding in harmony sloppy mode
BUG=v8:4482
LOG=n

Review URL: https://codereview.chromium.org/1397513004

Cr-Commit-Position: refs/heads/master@{#31218}
2015-10-12 16:55:35 +00:00
littledan
d515e5138d Test for var declarations in eval which conflict with let
Previously, name conflicts between var and let declarations were only
made into exceptions if they were visible at parse-time. This patch adds
runtime checks so that sloppy-mode direct eval can't introduce conflicting
var declarations. The change is implemented by traversing the scope chain
when a direct eval introduces a var declaration to look for conflicting
let declarations, up to the function boundary.

BUG=v8:4454
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1382513003

Cr-Commit-Position: refs/heads/master@{#31211}
2015-10-12 14:31:01 +00:00
cbruni
3ac2973b29 Improving error messages when adding properties to non JSObject receiver in
strict mode.

LOG=N
BUG=chromium:423739

Review URL: https://codereview.chromium.org/1381083004

Cr-Commit-Position: refs/heads/master@{#31192}
2015-10-09 09:12:47 +00:00
neis
cfe7c9c5ce [es6] Support optional "receiver" argument in Reflect.get.
Also add some more tests.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1392203002

Cr-Commit-Position: refs/heads/master@{#31181}
2015-10-08 14:23:12 +00:00
neis
7a0a682083 [es6] Implement completion value reform (--harmony-completion).
This CL depends on .

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1361403003

Cr-Commit-Position: refs/heads/master@{#31180}
2015-10-08 13:57:04 +00:00
neis
09184acad2 [es6] Implement parts of the Reflect object.
- Reflect.deleteProperty
- Reflect.get
- Reflect.has
- Reflect.isExtensible

Reflect.get doesn't support the receiver argument yet, and
some of the others don't support proxies yet.

R=rossberg
BUG=v8:3931
LOG=n

Review URL: https://codereview.chromium.org/1379313002

Cr-Commit-Position: refs/heads/master@{#31146}
2015-10-07 11:45:25 +00:00
erikcorry
9081ee11af RegExp: Fix update of lastIndex on non-global sticky
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1378693004

Cr-Commit-Position: refs/heads/master@{#31133}
2015-10-06 21:24:12 +00:00
littledan
2e7077e02c Destructuring array without initializer throws an exception
Previously, cases like
  var [foo]
led to a parser crash because the parser tried to do something with
the initializer, which was not syntactically present.

This patch fixes the parser issue (implicitly creating an undefined
initializer) and inserts a check for array destructuring that the
right-hand side is coercible to an object, so it can have iterator
methods called on it safely.

BUG=v8:4462
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1384413002

Cr-Commit-Position: refs/heads/master@{#31128}
2015-10-06 17:01:28 +00:00
littledan
38465598c8 Fix legacy const for-of/in destructuring
Previously, using legacy const in for-of/in loops led to a check-fail
in the parser. This was due to the fact that the destructuring bind
led to an undefined initialization to undefined in the parser, which
caused the for loop code to go down a strange path. This patch
eliminates the undefined initialization in variables declared in
for-in/of loops, so that that path is not used and the error is
fixed.

BUG=v8:4461
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1385913003

Cr-Commit-Position: refs/heads/master@{#31117}
2015-10-05 22:36:33 +00:00
littledan
7e113c47b7 Prohibit let in lexical bindings
This patch prohibits lexical bindings from being called 'let', even in
sloppy mode, following the ES2015 specification. The change affects
multiple cases of lexical bindings, including simple let/const declarations
and both kinds of for loops. var and legacy const bindings still permit
the name to be let, including in destructuring cases. Tests are added to
verify, though some cases are commented out since they led to (pre-existing)
crashes.

BUG=v8:4403
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1371263003

Cr-Commit-Position: refs/heads/master@{#31115}
2015-10-05 20:29:22 +00:00
rossberg
2c2848dccf [es6] Scoping & initialization for var shadowing non-simple parameters
Var-bindings may shadow parameters from a non-simple parameter list. When that happens: they create separate bindings, but are initialised with the respective parameter value. Thus:

(function(x, f = () => x) { var x; var y = x; x = 2; return [x, y, f()] })(1) -->  [2, 1, 1]

This CL implements that by inserting a suitable assignment for every shadwowing var-variable (e.g., x = outer_x above) at the beginning of the function's body block.

R=adamk@chromium.org
BUG=v8:4440,v8:811
LOG=N

Review URL: https://codereview.chromium.org/1371333004

Cr-Commit-Position: refs/heads/master@{#31042}
2015-10-01 10:42:33 +00:00
littledan
76da493315 Extend Annex B 3.3 sloppy-mode block-scoped hoisting to scripts, eval
The ES2015 spec is missing an extension of sloppy-mode block-scoped function
behavior to the global scope in scripts, as well as to eval. This patch
brings that hoisting to those two areas. The behavior is not perfectly
spec-compliant since properties created on the global scope should be
set as enumerable even if they are non-enumerable previously, but the
attributes will not be modified if the property already exists under
this patch.

BUG=v8:4441
LOG=Y
R=adamk
TEST=reddit comment functionality seems to be fixed

Review URL: https://codereview.chromium.org/1376623002

Cr-Commit-Position: refs/heads/master@{#31037}
2015-09-30 23:48:34 +00:00
adamk
163419e8fa Remove --harmony-arrow-functions flag
Arrow functions have been enabled by default since the 4.5 branch.

Review URL: https://codereview.chromium.org/1373633002

Cr-Commit-Position: refs/heads/master@{#31031}
2015-09-30 19:50:40 +00:00
neis
d3ef8f4b95 [es6] Ship rest parameters.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1371963002

Cr-Commit-Position: refs/heads/master@{#30970}
2015-09-28 11:19:35 +00:00
bmeurer
ff2c9eace4 [es6] Remove left-overs from Function.prototype.toMethod.
The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod.  This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.

The original removal of Function.prototype.toMethod was in February
2015 in 68e4897586.

R=jarin@chromium.org
BUG=v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1366063002

Cr-Commit-Position: refs/heads/master@{#30925}
2015-09-25 04:04:36 +00:00
adamk
7485da7ace Don't crash when preparsing destructured arguments
This adds the materialized literal count accumulated while parsing the
parameters (in the parser proper) to that accumulated by the preparser.

This should have been caught in cctest/test-parsing, but it's not covered
because the parsing tests call directly into the preparser rather than
using Parser::ParseFunctionLiteral (which fully-parses the parameters
and then calls into the preparser to skip over the function body).

Note that this further-inflates the materialized literal count for
functions with destructured arguments, since some of the counted
literals are actually binding patterns. But that's not specific to
binding patterns in formal parameters: it happens in function bodies, too.

BUG=v8:4400,v8:4407
LOG=n

Review URL: https://codereview.chromium.org/1350913005

Cr-Commit-Position: refs/heads/master@{#30868}
2015-09-22 17:43:43 +00:00
littledan
e5ff10d767 Implement sloppy-mode block-defined functions (Annex B 3.3)
ES2015 specifies very particular semantics for functions defined in blocks.
In strict mode, it is simply a lexical binding scoped to that block. In sloppy
mode, in addition to that lexical binding, there is a var-style binding in
the outer scope, which is overwritten with the local binding when the function
declaration is evaluated, *as long as* introducing ths var binding would not
create a var/let conflict in the outer scope.

This patch implements the semantics by introducing a DelegateStatement, which
is initially filled in with the EmptyStatement and overwritten with the
assignment when the scope is closed out and it can be checked that there is
no conflict.

This patch is tested with a new mjsunit test, and I tried staging it and running
test262, finding that the tests that we have disabled due to lack of Annex B
support now pass.

R=adamk,rossberg
LOG=Y
BUG=v8:4285

Review URL: https://codereview.chromium.org/1332873003

Cr-Commit-Position: refs/heads/master@{#30842}
2015-09-21 04:31:09 +00:00
adamk
7462e99667 Remove on-by-default flag --harmony-object
It's been enabled since M45, which is now well into its stable period,
with no problems reported.

Review URL: https://codereview.chromium.org/1356793002

Cr-Commit-Position: refs/heads/master@{#30835}
2015-09-18 18:37:57 +00:00
aperez
d4e1299f16 ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32
Defines a new --harmony-tolength flag, and a ToLengthFlagged() runtime function,
that is used where ES6 requires ToLength(), but a pre-ES6 conversion existed
before. When the flag is disabled, the function uses TO_UINT32(), which is
the pre-ES6 behaviour. When the flag enabled, the ES6-compliant ToLength()
conversion is used.

Based on a patch initially from Diego Pino <dpino@igalia.com>

BUG=v8:3087
LOG=Y

Review URL: https://codereview.chromium.org/1309243003

Cr-Commit-Position: refs/heads/master@{#30772}
2015-09-16 18:01:52 +00:00
caitpotter88
b444da41ad [es6] support get and set in shorthand properties
Add support for `get` and `set` as shorthand properties. Also
supports them for CoverInitializedName in BindingPatterns and (once implemented)
AssignmentPatterns.

BUG=v8:4412, v8:3584
LOG=N
R=adamk, aperez, wingo, rossberg

Review URL: https://codereview.chromium.org/1328083002

Cr-Commit-Position: refs/heads/master@{#30769}
2015-09-16 16:02:05 +00:00
binji
f5bec4bcd4 [Atomics] Remove support for atomic accesses on floating-point values.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1318713007

Cr-Commit-Position: refs/heads/master@{#30755}
2015-09-15 21:25:14 +00:00
adamk
f44efd6b31 Fix spread operator in ArrayLiterals when nested in other literals
Mark ArrayLiterals utilizing the spread operator as non-simple.
This causes them to return false for IsCompileTimeValue, and thus
causes spread to work as expected in nested literals.

BUG=v8:4417
LOG=y

Review URL: https://codereview.chromium.org/1336123002

Cr-Commit-Position: refs/heads/master@{#30754}
2015-09-15 16:43:39 +00:00
bmeurer
db2ba190db [runtime] Replace many buggy uses of %_CallFunction with %_Call.
The semantics of the %_CallFunction intrinsic seem to be very unclear,
which resulted in a lot of bugs. Especially the combination with
%IsSloppyModeFunction is always a bug, because the receiver would be
wrapped in the wrong context. So the %IsSloppyModeFunction helper is
gone now, and many of the buggy uses of %_CallFunction are also
eliminated.

If you ever need to call something with a different receiver, then
%_Call is your friend now. It does what you want and implements the
call sequence fully (and correct).

BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1325573004

Cr-Commit-Position: refs/heads/master@{#30634}
2015-09-08 13:35:32 +00:00
caitpotter88
510baeacba [es6] Re-implement rest parameters via desugaring.
Kills the kRestParameter bailout/disabled optimization, and fixes
lazily parsed arrow functions with rest parameters.

Supercedes https://crrev.com/1235153006/

BUG=chromium:508074, v8:2160, v8:2700
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1272673003

Cr-Commit-Position: refs/heads/master@{#30550}
2015-09-02 21:11:05 +00:00
binji
196d6aeec1 Remove harmony-atomics flag and collapse it into sharedarraybuffer flag
Having both flags is tedious, and it is unlikely you'd ever want them
separately.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1304163010

Cr-Commit-Position: refs/heads/master@{#30523}
2015-09-01 18:34:00 +00:00
bmeurer
3c164506f5 [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin.
This way we don't need to expose JSReceiver::OrdinaryToPrimitive
as runtime function, and we don't need the separate JS trampoline.

This also adds tests for ToPrimitive on date objects, which are
special.

R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1324713002

Cr-Commit-Position: refs/heads/master@{#30473}
2015-08-31 12:53:10 +00:00
littledan
decc7b092a Sloppy-mode let parsing
This patch makes 'let' a contextual keyword in both strict and sloppy mode.
It behaves as a keyword when used at the beginning of a StatementListItem
or lexical declaration at the beginning of a for statement, if it is followed
by an identifier, [ or {. Implementing this change requires an extra token
look-ahead by the parser which is only invoked in certain cases (so as to
avoid parsing RegExps as ECMAScript tokens). This might result in a slowdown
of the scanner, but performance testing of this patch hasn't yet found much
of a regression.

BUG=v8:3305
LOG=Y
R=adamk,vogelheim

Review URL: https://codereview.chromium.org/1315673009

Cr-Commit-Position: refs/heads/master@{#30451}
2015-08-28 18:47:40 +00:00
bmeurer
09de997b35 [runtime] Add %ToString and %_ToString and remove the TO_STRING builtin.
This adds a new ToString runtime function and a fast-path ToStringStub
(which is just a simple dispatcher for existing functionality), and also
implements %_ToName using the ToStringStub.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319973007

Cr-Commit-Position: refs/heads/master@{#30442}
2015-08-28 13:00:11 +00:00
bmeurer
c403ede42a [es6] Implement spec compliant ToName (actually ToPropertyKey).
This adds a %ToName runtime entry that uses the previously introduced
Object::ToName, which is based on the new Object::ToPrimitive method.
Also removes the need to expose ToName in various way via the builtins
and/or context.

Drive-by-fix: Let %HasProperty do the ToName conversion implicitly as
required.

BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1319133002

Cr-Commit-Position: refs/heads/master@{#30435}
2015-08-28 09:46:51 +00:00
bmeurer
f6c6d713b4 [es6] Implement spec compliant ToPrimitive in the runtime.
This is the first step towards a spec compliant ToPrimitive
implementation (and therefore spec compliant ToNumber, ToString,
ToName, and friends).  It adds support for the @@toPrimitive
symbol that was introduced with ES2015, and also adds the new
Symbol.prototype[@@toPrimitive] and Date.prototype[@@toPrimitive]
initial properties.

There are now runtime functions for %ToPrimitive, %ToNumber and
%ToString, which do the right thing and should be used as fallbacks
instead of the hairy runtime.js implementations.  I will do the
same for the other conversion operations mentioned by the spec in
follow up CLs.  Once everything is in place we can look into
optimizing things further, so that we don't always call into the
runtime.

Also fixed Date.prototype.toJSON to be spec compliant.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:4307
LOG=y

Review URL: https://codereview.chromium.org/1306303003

Cr-Commit-Position: refs/heads/master@{#30434}
2015-08-28 09:21:43 +00:00
conradw
77394fa05a [parser] disallow language mode directive in body of function with non-simple parameters
TC39 agreed to disallow "use strict" directives in function body when
non-simple parameter lists are used.

This is a continuation of caitp's CL https://codereview.chromium.org/1281163002/
with some refactorings removed for now.

Still TODO: there is a lot of duplication between the is_simple field of
FormalParametersBase and the NonSimpleParameter property ExpressionClassifier
keeps track of. It should be possible to remove the former with a minor
refactoring of arrow function parsing. This will be attempted in a follow-up CL.

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1300103005

Cr-Commit-Position: refs/heads/master@{#30388}
2015-08-26 14:59:19 +00:00
wingo
79e74db3e0 Parse arrow functions at proper precedence level
BUG=v8:4211
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1315823002

Cr-Commit-Position: refs/heads/master@{#30373}
2015-08-26 09:36:45 +00:00
rossberg
089592ad33 [es6] Remaining cases of parameter scopes for sloppy eval
R=littledan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1303013007

Cr-Commit-Position: refs/heads/master@{#30363}
2015-08-25 22:24:29 +00:00
rossberg
0b3b72671e [es6] Correct length for functions with default parameters
R=adamk@chromium.org
BUG=v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1311163002

Cr-Commit-Position: refs/heads/master@{#30361}
2015-08-25 18:52:13 +00:00
bbudge
8a278a4cc4 [simd.js] Update to spec version 0.8.2.
Adds Uint32x4, Uint16x8, and Uint8x16 types.
Adds all functions in the current spec, except for loads and stores.

LOG=Y
BUG=v8:4124

Committed: https://crrev.com/4be6d37fd1ad0a6e0ea37da8863ae5169c2b89ba
Cr-Commit-Position: refs/heads/master@{#30322}

Review URL: https://codereview.chromium.org/1294513004

Cr-Commit-Position: refs/heads/master@{#30353}
2015-08-25 12:35:19 +00:00
hablich
86016622b4 Revert of [simd.js] Update to spec version 0.8.2. (patchset id:200001 of https://codereview.chromium.org/1294513004/ )
Reason for revert:
Fails tests:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20deadcode/builds/5073/steps/steps/logs/stdio

Original issue's description:
> [simd.js] Update to spec version 0.8.2.
>
> Adds Uint32x4, Uint16x8, and Uint8x16 types.
> Adds all functions in the current spec, except for loads and stores.
>
> LOG=Y
> BUG=v8:4124
>
> Committed: https://crrev.com/4be6d37fd1ad0a6e0ea37da8863ae5169c2b89ba
> Cr-Commit-Position: refs/heads/master@{#30322}

TBR=littledan@chromium.org,bbudge@google.com,bmeurer@chromium.org,hpayer@chromium.org,bbudge@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review URL: https://codereview.chromium.org/1309513005

Cr-Commit-Position: refs/heads/master@{#30323}
2015-08-24 10:06:43 +00:00
bbudge
4be6d37fd1 [simd.js] Update to spec version 0.8.2.
Adds Uint32x4, Uint16x8, and Uint8x16 types.
Adds all functions in the current spec, except for loads and stores.

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1294513004

Cr-Commit-Position: refs/heads/master@{#30322}
2015-08-24 09:13:08 +00:00
yangguo
cc97e524a1 Revert of Parse arrow functions at proper precedence level (patchset id:60001 of https://codereview.chromium.org/1286383005/ )
Reason for revert:
Breaks layout test. Please change test expectation on blink first.

--- /mnt/data/b/build/slave/V8-Blink_Linux_64/build/layout-test-results/inspector/sources/debugger-pause/debugger-pause-in-internal-expected.txt
+++ /mnt/data/b/build/slave/V8-Blink_Linux_64/build/layout-test-results/inspector/sources/debugger-pause/debugger-pause-in-internal-actual.txt
@@ -1,4 +1,4 @@
-CONSOLE ERROR: line 9: Uncaught SyntaxError: Expected () to start arrow function, but got '}' instead of '=>'
+CONSOLE ERROR: line 9: Uncaught SyntaxError: Unexpected token )
 Tests that pause on exception in internal script does not crash.

 Script source was shown.

Original issue's description:
> Parse arrow functions at proper precedence level
>
> BUG=v8:4211
> LOG=Y
> R=rossberg@chromium.org
>
> Committed: https://crrev.com/9271b0ccf9ddb217deb1f0b9ef9b59b64dc40214
> Cr-Commit-Position: refs/heads/master@{#30298}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,fennyfanny655@gmail.com,machenbach@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4211

Review URL: https://codereview.chromium.org/1315503002

Cr-Commit-Position: refs/heads/master@{#30318}
2015-08-24 06:57:12 +00:00
wingo
9271b0ccf9 Parse arrow functions at proper precedence level
BUG=v8:4211
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1286383005

Cr-Commit-Position: refs/heads/master@{#30298}
2015-08-21 11:33:42 +00:00
rossberg
365fd7bc35 [es6] Parameter scopes for sloppy eval
This CL is a nightmare! For the utterly irrelevant edge case of a sloppy function with non-simple parameters and a call to direct eval, like here,

  let x = 1;
  function f(g = () => x) {
    var y
    eval("var x = 2")
    return g() + x  // f() = 3
  }

we have to do all of the following, on top of the declaration block ("varblock") contexts we already introduce around the body:

- Introduce the ability for varblock contexts to have both a ScopeInfo and an extension object (e.g., the body varblock in the example will contain both a static var y and a dynamic var x). No other scope needs that. Since there are no context slots left, a special new struct is introduced that pairs up scope info and extension object.

- When declaring lookup slots in the runtime, this new struct is allocated in the case where an extension object has to be added to a block scope (at which point the block's extension slot still contains a plain ScopeInfo).

- While at it, introduce some abstraction to access context extension slots in a more controlled manner, in order to keep special-casing to a minimum.

- Make sure that even empty varblock contexts do not get optimised away when they contain a sloppy eval, so that they can host the potential extension object.

- Extend dynamic search for declaration contexts (used by sloppy direct eval) to recognize varblock contexts.

- In the parser, if a function has a sloppy direct eval, introduce an additional varblock scope around each non-simple (desugared) parameter, as required by the spec to contain possible dynamic var bindings.

- In the pattern rewriter, add the ability to hoist the named variables the pattern declares to an outer scope. That is required because the actual destructuring has to be evaluated inside the protecting varblock scope, but the bindings that the desugaring introduces are in the outer scope.

- ScopeInfos need to save the information whether a block is a varblock, to make sloppy eval calls work correctly that deserialise them as part of the scope chain.

- Add the ability to materialize block scopes with extension objects in the debugger. Likewise, enable setting extension variables in block scopes via the debugger interface.

- While at it, refactor and unify some respective code in the debugger.

Sorry, this CL is large. I could try to split it up, but everything is rather entangled.

@mstarzinger: Please review the changes to contexts.
@yangguo: Please have a look at the debugger stuff.

R=littledan@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:811,v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1292753007

Cr-Commit-Position: refs/heads/master@{#30295}
2015-08-21 10:58:47 +00:00
rossberg
6dda11ff81 [es6] Implement default parameters
Based on caitp's https://codereview.chromium.org/1127063003/

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:2160
LOG=N

Review URL: https://codereview.chromium.org/1287063004

Cr-Commit-Position: refs/heads/master@{#30192}
2015-08-17 12:02:08 +00:00
caitpotter88
9b15445e6d [parser] make kInvalidLhsInFor a SyntaxError
Second item in section 13.7.5.1 states that the error should be a
SyntaxError, when previously CheckAndRewriteReferenceExpression
would always emit a ReferenceError.

BUG=v8:4373
R=adamk, rossberg
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1292393002

Cr-Commit-Position: refs/heads/master@{#30184}
2015-08-15 17:57:16 +00:00
adamk
ef52836cd8 [es6] Make assignment to new.target an early ReferenceError
In doing so, fix calls CheckAndRewriteReferenceExpression to take proper
start and end positions (instead of just pointing at the first token in
the LHS expression).

BUG=v8:4370
LOG=n

Review URL: https://codereview.chromium.org/1290013002

Cr-Commit-Position: refs/heads/master@{#30166}
2015-08-13 18:06:13 +00:00