yangguo@chromium.org
efc01f4736
Prevent recursion in the debug event listener.
...
R=ulan@chromium.org
BUG=chromium:409614
LOG=N
Review URL: https://codereview.chromium.org/684573005
Cr-Commit-Position: refs/heads/master@{#24924}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-28 09:44:43 +00:00
adamk@chromium.org
f1954232b0
SimpleMove now calls [[Has]] before [[Get]] when moving elements
...
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/678753002
Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-27 13:05:13 +00:00
jarin@chromium.org
23df66ee24
Add more missing deopts
...
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/639883002
Cr-Commit-Position: refs/heads/master@{#24886}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-26 10:25:48 +00:00
adamk@chromium.org
c9ea8d6512
SimpleSlice now calls [[Get]] before [[Has]] when generating copy
...
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/674003002
Cr-Commit-Position: refs/heads/master@{#24884}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-24 18:08:13 +00:00
adamk@chromium.org
02d37b8f10
Widen definition of %HasComplexElements() to include non-enumerability
...
This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/672323003
Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-24 18:04:13 +00:00
adamk@chromium.org
0ef073d556
Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value
...
BUG=chromium:423633
LOG=n
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/673893002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 21:13:29 +00:00
adamk@chromium.org
5f1ae66d56
Narrow cases where Sparse/Smart versions of Array methods are used
...
Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.
Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.
These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.
Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.
This patch depends on https://codereview.chromium.org/666883009 , which
better-aligns the behavior of SmartMove with SimpleMove.
BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/656423004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 18:21:50 +00:00
ishell@chromium.org
5509cc2c07
Fixed mutable heap numbers leak in JSON parser.
...
BUG=chromium:423687
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/669403002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 14:41:39 +00:00
dslomov@chromium.org
96105a90fc
harmony-scoping: Allow 'const' iteration variables in strict mode.
...
R=rossberg@chromium.org
BUG=v8:2506
LOG=N
Committed: https://code.google.com/p/v8/source/detail?r=24834
Review URL: https://codereview.chromium.org/671913002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 12:30:20 +00:00
dslomov@chromium.org
707ed29a51
Revert "harmony-scoping: Allow 'const' iteration variables in strict mode."
...
This reverts commit r24834 for breaking debug tests.
TBR=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/672193002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 11:55:19 +00:00
dslomov@chromium.org
b54f7d3c46
harmony-scoping: Allow 'const' iteration variables in strict mode.
...
R=rossberg@chromium.org
BUG=v8:2506
LOG=N
Review URL: https://codereview.chromium.org/671913002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-23 11:18:50 +00:00
rodolph.perfetta@arm.com
ecbfc43f37
ARM64: Fix stack manipulation.
...
Builtins::Generate_StringConstructCode was claiming stack space instead of
giving it back.
BUG=chromium:425585
LOG=Y
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/672623003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-22 18:24:20 +00:00
dslomov@chromium.org
b664c12235
Flatten the string in StringToDouble function.
...
R=yangguo@chromium.org
BUG=chromium:425551
LOG=N
Review URL: https://codereview.chromium.org/654763003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-22 08:19:05 +00:00
adamk@chromium.org
b6d0113abc
Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value
...
BUG=chromium:423633
LOG=N
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/649063003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-21 17:46:42 +00:00
mvstanton@chromium.org
8330178b4c
The issue is that by handling strings with map/handler pairs instead of a special
...
version of the keyed load stub (https://code.google.com/p/v8/source/detail?r=24661 ),
I allowed polymorphism between string and non-string types in the IC. Before, the
IC would go generic.
Then, at crankshaft time, we special case when we only saw strings. The error
here is that crankshaft can't emit code that handles polymorphism between string
and non-string types. The choice is either to get that to happen (I don't deem
this necessary from a performance point of view, an IC with such type feedback
before would have gone generic), or simply check for the case of "polymorphic
with some string maps" and require crankshaft to go generic. I'll do the latter.
BUG=425519
LOG=N
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/667923004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-21 13:04:51 +00:00
yangguo@chromium.org
83ddaa0df7
Fix break location calculation.
...
R=ulan@chromium.org
BUG=chromium:419663
LOG=Y
Review URL: https://codereview.chromium.org/658723005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-17 14:11:01 +00:00
adamk@chromium.org
ae7161e4cb
Revert "Remove SmartMove, bringing Array methods further into spec compliance"
...
This reverts https://code.google.com/p/v8/source/detail?r=24647
It caused test failures in Array methods in Linux64 OptimizeForSize.
BUG=v8:2615
TBR=verwaest@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/656683003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-15 23:53:02 +00:00
adamk@chromium.org
bb885a79db
Remove SmartMove, bringing Array methods further into spec compliance
...
This is one step towards a single codepath for each method in array.js.
This patch is based on rafaelw's https://codereview.chromium.org/349073002
BUG=v8:2615
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/455933002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-15 23:36:58 +00:00
adamk@chromium.org
a6ff3f7f4a
Handle exceptions thrown by Array.observe machinery
...
BUG=chromium:417709
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/651323003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-15 18:22:20 +00:00
verwaest@chromium.org
23868b419c
Optimize Function.prototype.call
...
BUG=
R=verwaest@chromium.org , jarin@chromium.org , jkummerow@chromium.org
Review URL: https://codereview.chromium.org/588573002
Patch from Petka Antonov <p.antonov@partner.samsung.com>.
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-15 12:22:15 +00:00
yangguo@chromium.org
9a21ba499c
Catch exceptions thrown when enqueuing change records.
...
R=ishell@chromium.org
BUG=chromium:417709
LOG=N
Review URL: https://codereview.chromium.org/653593002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-14 14:46:11 +00:00
ulan@chromium.org
29296d7e50
Fix computation of UTC time from local time at DST change points.
...
This also reverts r23606, which was an incorrect fix.
BUG=v8:3116,chromium:417640,chromium:415424
LOG=Y
TEST=mjsunit/regress/regress-3116.js
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/639383002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-09 14:17:33 +00:00
jkummerow@chromium.org
1bb52d0da8
Fix Hydrogen's BuildStore()
...
BUG=chromium:417508
LOG=y
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/612423002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-01 13:17:34 +00:00
jarin@chromium.org
5b742b356d
Adding more missing deoptimization points in Turbofan.
...
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/595863002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-29 13:37:58 +00:00
jarin@chromium.org
b11c925142
Disable merging simulates across captured objects.
...
BUG=chromium:416730
LOG=N
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/607453002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-25 12:16:32 +00:00
yangguo@chromium.org
86b3c3eea7
Insert materialized context at the right place in DebugEvaluate.
...
R=aandrey@chromium.org , ulan@chromium.org
BUG=chromium:323936
LOG=N
Review URL: https://codereview.chromium.org/599113002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24218 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-25 09:33:40 +00:00
jkummerow@chromium.org
1903e560b0
Non-JSArrays must always have holey elements.
...
Drive-by cleanup: remove unused elements_kind_ field in CallNew.
BUG=chromium:416558
LOG=n
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/595333002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-25 08:25:25 +00:00
mvstanton@chromium.org
b0b59073ac
Fix IC cache confusion on String.prototype.length
...
BUG=416416
LOG=N
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/587363002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-24 09:33:04 +00:00
jarin@chromium.org
9ef343c18d
[Turbofan] Insert nops for lazy bailout patching, fix translation of literals.
...
The code for EnsureSpaceForLazyDeopt is taken from lithium-codegen-*.
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/562033003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-23 08:46:18 +00:00
verwaest@chromium.org
83f64e8c1f
Fix escaped index JSON parsing
...
BUG=416449
LOG=y
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/592813002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-22 15:21:19 +00:00
mstarzinger@chromium.org
429924b780
Fix typed lowering to number comparison.
...
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3564
BUG=v8:3564
LOG=N
Review URL: https://codereview.chromium.org/574653002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-16 11:33:30 +00:00
mstarzinger@chromium.org
d313551a3e
Disable lowering to StringAdd due to various issues.
...
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/566303003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-16 08:29:46 +00:00
yangguo@chromium.org
7cb82a76b4
Reland "Remove V8_HOST_CAN_READ_UNALIGNED and its uses."
...
BUG=chromium:412967
LOG=N
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/571903002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-15 10:54:49 +00:00
jarin@chromium.org
00e90b7e6e
Remove deoptimization by patching the call stack.
...
We go back to patching the code for lazy deoptimization because ICs need the on-stack return address to read/update the IC address/state.
The change also fixes bunch of tests, mostly by adding more deoptimization points.
(We still need to add code to ensure lazy deopt patching does not overwrite ICs and other lazy deopts; this is coming next.)
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/568783002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-15 09:21:39 +00:00
jarin@chromium.org
e401262400
Reland "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic."
...
This relands commit r23899.
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/565093002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-12 10:58:43 +00:00
jarin@chromium.org
bc0674d0a7
Revert "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic."
...
This reverts commit r23899.
TBR=ulan@chromium.org
Review URL: https://codereview.chromium.org/552253003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-12 08:49:22 +00:00
jkummerow@chromium.org
b4375b77ec
Fix Smi vs. HeapObject confusion in HConstants.
...
Representation and HType should agree with each other.
BUG=chromium:412215
LOG=y
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/556563005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-12 08:44:14 +00:00
jarin@chromium.org
91e97f8371
Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic.
...
This makes the syntactic order consistent with the evaluation order.
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/561133005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-12 08:18:29 +00:00
rossberg@chromium.org
fc71f7fdb3
Fix inaccurate type condition in Hydrogen
...
R=bmeurer@chromium.org
BUG=chromium:412210
LOG=Y
Review URL: https://codereview.chromium.org/550453003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-11 12:13:34 +00:00
jkummerow@chromium.org
bd97fcaed0
Fix regress-crbug-412203.js
...
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/563733002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-11 11:47:39 +00:00
jkummerow@chromium.org
11f7584d0a
Fix ElementsKind handling of prototypes in Array.concat
...
Double elements, typed elements, and sloppy arguments elements were all erroneously marked UNREACHABLE.
BUG=chromium:412203
LOG=n
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/560463002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-11 10:04:13 +00:00
ulan@chromium.org
d66ed1176f
Don't inline Array functions if receiver map is not extensible.
...
BUG=405517
LOG=N
TEST=mjsunit/regress/regress-crbug-405517.js
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/552333002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-10 09:22:13 +00:00
ulan@chromium.org
99301fc8c5
Fix regress-411210 after r23824.
...
BUG=
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/559863004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-10 08:48:40 +00:00
hpayer@chromium.org
ed37edc5c0
Remove guard page mechanism from promotion queue.
...
BUG=chromium:411210
LOG=n
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/557243002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-10 07:51:29 +00:00
jarin@chromium.org
01d63e43b2
Handle non-object constants in HConstant::GetMonomorphicJSObjectMap.
...
R=ulan@chromium.org
BUG=chromium:412162
LOG=N
Review URL: https://codereview.chromium.org/552243002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-09 12:58:34 +00:00
jkummerow@chromium.org
fd3e505fb6
Hydrogen: bailout when there is a throw statement in a non-effect context.
...
This mirrors the behavior of the compilation pipeline before recent OptimizeFunctionOnNextCall changes.
BUG=chromium:412208
LOG=n
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/558593002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-09 12:16:33 +00:00
yangguo@chromium.org
4b0c076052
Turn old space cons strings into regular external strings (not short).
...
R=hpayer@chromium.org
BUG=v8:3530
LOG=N
Review URL: https://codereview.chromium.org/368223002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-09 11:41:56 +00:00
jarin@chromium.org
83af12c21b
Harden OptimizeFunctionOnNextCall.
...
BUG=411237
LOG=N
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/547553003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-05 15:13:44 +00:00
verwaest@chromium.org
1dddf69fdc
Allocate a new empty number dictionary when resetting elements
...
BUG=410332
LOG=y
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/545773003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-05 11:38:22 +00:00
jarin@chromium.org
b74fae5511
Fix EvacuateJSFunction to obtain the target address from the forwarding pointer.
...
R=mstarzinger@chromium.org
BUG=410912
LOG=N
Review URL: https://codereview.chromium.org/541353003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-05 09:38:04 +00:00