Commit Graph

2365 Commits

Author SHA1 Message Date
mvstanton@chromium.org
cec8548d0e Correct handling of arrays with callbacks in the prototype chain.
Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 15:45:43 +00:00
bmeurer@chromium.org
980739a29c Improve implementation of HSeqStringSetChar.
This improves the generated code for HSeqStringSetChar across
all platforms, taking advantage of constant operands whenever
possible. It also drops the unused DefineSameAsFirst constraint
for the register allocator on x64 and ia32, where it caused
unnecessary spills when the string operand was live across the
HSeqStringSetChar instruction.

A new GVN flag StringChars is introduced to express dependencies
between HSeqStringSetChar, HStringCharCodeAt and the upcoming
HSeqStringGetChar (the GVNFlags type is now 64bit in size).

Also improves the test case.

TEST=mjsunit/string-natives
R=mstarzinger@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/57383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 13:09:22 +00:00
rafaelw@chromium.org
13f722cae4 [Object.observe] rename intrinsic change record types for consitency.
Note the spec now reflects the updated naming:

http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes

R=rossberg@chromium.org, rossberg
BUG=v8:2940

Review URL: https://codereview.chromium.org/46043020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 12:14:24 +00:00
machenbach@chromium.org
4539c6ba5f [Sheriff] Mark flaky test on windows.
It was marked as flaky on linux nosnap, arm and nacl before. Now it's marked universally flaky since windows joined the list.

BUG=v8:2921
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/54713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 19:29:58 +00:00
yangguo@chromium.org
371265eec4 Revert "Handlify concat string and substring."
This reverts r17490.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/59973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 15:36:15 +00:00
yangguo@chromium.org
23d085c691 Handlify concat string and substring.
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50073005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 14:07:07 +00:00
yangguo@chromium.org
a5ed9a71c8 Correctly load message from an Error object.
R=mstarzinger@chromium.org
BUG=306220

Review URL: https://codereview.chromium.org/46593010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 13:04:51 +00:00
rafaelw@chromium.org
e78081ca1c Make Object.freeze/seal/preventExtensions observable
Note: spec has been updated here: http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes.

R=rossberg@chromium.org, rossberg
BUG=v8:2975,v8:2941

Review URL: https://codereview.chromium.org/47703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 12:25:32 +00:00
rafaelw@chromium.org
4a8319c7c6 [Object.observe] Implement implicit notification from performChange
R=arv@chromium.org, rossberg@chromium.org, rossberg
BUG=v8:2942

Review URL: https://codereview.chromium.org/36313002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 11:23:08 +00:00
jkummerow@chromium.org
2ebfd6e90e Add missing negative dictionary lookup to NonexistentHandlerFrontend
BUG=v8:2980
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/57433003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-04 14:14:09 +00:00
machenbach@chromium.org
3e6044d3f3 [Sheriff] Mark failing test for nacl port.
BUG=v8:2978
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/50333005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17445 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-31 11:51:59 +00:00
machenbach@chromium.org
230b47a63b [Sheriff] Mark flaky test.
BUG=v8:2921
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/54423002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-31 11:48:31 +00:00
jkummerow@chromium.org
316271fc35 Fix uint32-to-smi conversion in Lithium
BUG=chromium:309623
R=vegorov@google.com, yangguo@chromium.org

Review URL: https://codereview.chromium.org/54393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-31 10:18:51 +00:00
yangguo@chromium.org
3f1a833524 Do not remove HAdd with zero if the other operand is a double.
The other operand might be minus zero, and -0 + 0 = +0

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/52173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-30 10:22:52 +00:00
jkummerow@chromium.org
9e88c23cbf ia32: Fix comparisons of two constant double operands when exactly one of them is in new space.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/46883008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-29 14:34:07 +00:00
svenpanne@chromium.org
acb06df0e9 Tune mjsunit/compiler/expression-trees.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/43703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-28 07:24:19 +00:00
svenpanne@chromium.org
ee87c867e9 Tune mjsunit/array-functions-prototype-misc
Again, this brings testing times down quite a bit without losing test
coverage.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/44143003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17403 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-28 07:23:27 +00:00
mvstanton@chromium.org
a85c825bb9 The Elements pointer in a JSObject can have a filler map instead of a
valid fixed array, iff a gc occurred while allocating a fixed array as
part of array construction. Heap verification needs protection against
examining the elements object in this case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/43383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 12:26:47 +00:00
yangguo@chromium.org
7dd2d6c590 Reland "Make Array.prototype.pop throw if the last element is not configurable."
This relands r17346.

R=machenbach@chromium.org
BUG=311164

Review URL: https://codereview.chromium.org/43923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 11:55:56 +00:00
svenpanne@chromium.org
2e2579da1b Tune mjsunit/regexp-global.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/42993004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 08:57:50 +00:00
svenpanne@chromium.org
c2596a257c Temporarily disable mjsunit/regress/regress-2612 to make our tree green again.
TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/40203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 13:30:40 +00:00
svenpanne@chromium.org
7fb61a78d4 Tune mjsunit/regress/regress-2612.
Lower the bounds to something bearable which would still timeout if we
used a quadratic algorithm.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/39863003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 13:07:16 +00:00
bmeurer@chromium.org
56a46e591b Add performance.now() to the d8 shell.
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=17366

Committed: https://code.google.com/p/v8/source/detail?r=17368

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 12:25:40 +00:00
bmeurer@chromium.org
bef9819190 Revert "Fix shared library build after r17368." and "Add performance.now() to the d8 shell.".
This reverts commit r17372 and r17368 for breaking the shared
library build.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/40043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17374 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 12:16:00 +00:00
bmeurer@chromium.org
0a90cab56a Add performance.now() to the d8 shell.
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=17366

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 10:48:18 +00:00
bmeurer@chromium.org
67b4eb9ac1 Revert "Add window.performance.now() to the d8 shell."
This reverts commit r17366 for breaking the mozilla tests.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/38753006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 10:42:02 +00:00
bmeurer@chromium.org
d07231021e Add window.performance.now() to the d8 shell.
TEST=mjsunit/d8-performance-now
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/32433010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 09:27:17 +00:00
svenpanne@chromium.org
f2122438e0 Removed long-running obselete test case.
The test was the 2nd longest-running test case in debug mode, and the
stuff it tests has already been moved long ago to some other place,
which is in turn heavily tested by far simpler and faster things
(%TruncateString etc.).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/39233003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 08:09:32 +00:00
yangguo@chromium.org
0f564cb1b0 Revert "Make Array.prototype.pop throw if the last element is not configurable."
This reverts commit r17346.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/39593002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 07:48:23 +00:00
yangguo@chromium.org
e25920da19 Make Array.prototype.pop throw if the last element is not configurable.
Popping an element from an array should call [[Delete]] internal method
and pass true as the second argument (ECMA-262/5.1/#sec-15.4.4.6).
When the last element can't be deleted, throw a Type Error.
Not throwing the error would result in endless loop in the following test.

TEST=var a=[];Object.defineProperty(a,0,{});while(a.length)a.pop();

By the way fix another bug, or else i can't post any issues.
"presubmit.py" throw a "missing a correct copyright header" on windows.
Both the slash and the backslash are valid path separator on windows.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/29513004

Patch from Yanagi <admin@web-tinker.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 16:19:24 +00:00
jkummerow@chromium.org
8259439ae8 Fix HObjectAccess for loads from migrating prototypes
BUG=chromium:305309
R=danno@chromium.org

Review URL: https://codereview.chromium.org/35173005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17345 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 15:15:15 +00:00
hpayer@chromium.org
fbaf016b6d Add a soft-deopt in keyed element access when current IC is pre-monomorphic and no type feedback was collected.
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/32643004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 10:41:21 +00:00
mstarzinger@chromium.org
be3ed75ff3 Fix materialization of captured objects with field tracking.
R=titzer@chromium.org
BUG=chromium:298990
TEST=mjsunit/compiler/escape-analysis-representation

Review URL: https://codereview.chromium.org/35133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 13:48:54 +00:00
svenpanne@chromium.org
d65cc1e21b Temporarily deactive regress-2185-2 until our array handling is in good shape again.
BUG=v8:2950
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/30443005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 13:02:04 +00:00
svenpanne@chromium.org
dd74f5aa08 Removed obsolete unit tests.
As discussed offline, these tests don't test what they were supposed to
test anymore and were the longest running ones.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/32433009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 11:26:07 +00:00
titzer@chromium.org
a255312491 Handle misaligned loads and stores in load elimination. Do not track misaligned loads and be conservative about invalidating misaligned stores. Add more tests for number conversion to string (NumberToStringStub exhibits misaligned loads)
BUG=v8:2934
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/28383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-21 13:33:03 +00:00
yangguo@chromium.org
2d6dab1f2e Harmony: implement Math.trunc.
BUG=v8:2938
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/28793002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-21 11:15:11 +00:00
yangguo@chromium.org
575438518c Harmony: implement Math.sign.
R=dslomov@chromium.org
BUG=v8:2938

Review URL: https://codereview.chromium.org/28723002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-21 09:16:31 +00:00
titzer@chromium.org
4d0f2cdd3b Implement global load elimination based on flow engine.
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/27148004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-18 14:28:24 +00:00
rafaelw@chromium.org
ce2c9b1db1 Prevent changes to hidden properties from being observable via Object.observe
This addresses the leak that mstarzinger points out (https://codereview.chromium.org/26390003/) and includes the test.

Note that this adds a test that observing changes to the empty-string property remains possible.

BUG=
R=mstarzinger@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/26592012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 20:49:45 +00:00
svenpanne@chromium.org
882778bf09 Make it possible to run a test only in the standard variant.
Use this for mjsunit/unicode-case-overoptimization, which is not
related to Crankshaft at all and takes ages.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/27704002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 13:09:28 +00:00
mstarzinger@chromium.org
0a2b4ecdcc Add regression test for optimized count operation.
This is a regression test for a bug with handling of count operations
that target a JavaScript accessor on the prototype chain in Crankshaft.

R=jkummerow@chromium.org
BUG=chromium:306851
TEST=mjsunit/regress/regress-crbug-306851

Review URL: https://codereview.chromium.org/27702002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 12:48:28 +00:00
mstarzinger@chromium.org
3e0f828b8f Revert "TransitionAndStoreStub bailout needs to transition (and store)."
This reverts commit r17216 breaking fast/js/cross-frame-bad-time.html test.

R=mvstanton@chromium.org
TEST=webkit:fast/js/cross-frame-bad-time.html

Review URL: https://codereview.chromium.org/27516002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-16 14:17:31 +00:00
mvstanton@chromium.org
8f9f192f6e AllocationSites for all literals
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/24250005


Review URL: https://codereview.chromium.org/27366003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-16 08:10:36 +00:00
mvstanton@chromium.org
f4edc076d8 Revert "AllocationSites for all literals"
This reverts commit r17219 due to WebKit failures.

R=mstarzinger@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/26539010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 15:35:23 +00:00
mvstanton@chromium.org
362c0cfbca AllocationSites for all literals
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/24250005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 14:52:58 +00:00
mvstanton@chromium.org
3769a2d24d TransitionAndStoreStub bailout needs to transition (and store).
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/26911007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17216 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 12:42:03 +00:00
dslomov@chromium.org
5ccd697875 Do not look up ArrayBuffer on global object in typed array constructor.
BUG=v8:2931
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/27238009

Patch from Ben Noordhuis <info@bnoordhuis.nl>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 11:27:12 +00:00
yangguo@chromium.org
71ba8c5fb4 Retire concurrent recompilation delay for non-stress testing.
Instead, we block concurrent recompilation until unblocked. This makes
affected tests more predictable and run shorter.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/26758003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 14:15:22 +00:00
olivf@chromium.org
93d4fbd2ee Truncate booleans to 0/1 in truncating t-to-i.
Thanks to weiliang.lin2@gmail.com for discovering the issue.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/26824002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-11 15:13:12 +00:00