titzer@chromium.org
4923810a68
Remove redundant --always-full-compiler flag.
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/538613006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-04 16:29:47 +00:00
jarin@chromium.org
1afada8d04
Ignore numbers as values of --expose-natives-as flag.
...
R=yangguo@chromium.org
BUG=408036
LOG=N
Review URL: https://codereview.chromium.org/534943004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-04 15:05:06 +00:00
bmeurer@chromium.org
0baf275e20
Enforce correct number comparisons when inlining Array.indexOf.
...
TEST=mjsunit/regress/regress-crbug-407946
BUG=407946
LOG=y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/536393003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-04 12:25:57 +00:00
jarin@chromium.org
7572e779d0
Exclude LoadMutableDouble and FunctionBindArguments from fuzzing.
...
BUG=409542,410262
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/535153002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-03 14:28:46 +00:00
verwaest@chromium.org
03b0237e1d
Fix loading non-configurable non-writable value from a constant with mismatching type feedback
...
BUG=410209
LOG=n
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/534093003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-03 12:13:46 +00:00
jarin@chromium.org
a668cd6fc8
Context deoptimization and removal of the deoptimization block in Turbofan
...
This adds context deoptimization to Turbofan and Crankshaft (also submitted separately as https://codereview.chromium.org/515723004/ ).
The second patchset removes the deoptimization/continuation block from calls.
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/522873002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-01 09:31:14 +00:00
jarin@chromium.org
73da434b8e
Fix manual allocation folding of RegExpConstructResult.
...
R=mstarzinger@chromium.org
BUG=409533
LOG=N
Review URL: https://codereview.chromium.org/532453003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-01 08:08:31 +00:00
verwaest@chromium.org
2a37ab79ad
Fixed inlining of constant values
...
Use CopyToRepresentation to elide HForceRepresentation of HConstant
BUG=v8:3529
LOG=y
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/507613002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-26 11:34:25 +00:00
yangguo@chromium.org
ba09fa35fd
Handle null receiver in sloppy mode in %GetFrameDetails.
...
R=jarin@chromium.org
BUG=405922
LOG=N
Review URL: https://codereview.chromium.org/492303006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-22 12:55:23 +00:00
bmeurer@chromium.org
0142786cea
Don't inline Array.shift() if receiver map is not extensible.
...
TEST=mjsunit/regress/regress-crbug-405517
BUG=405517
LOG=y
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/491863002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-21 06:23:44 +00:00
yangguo@chromium.org
f7947b8ec4
Fix --expose-debug-as with number as argument.
...
R=jkummerow@chromium.org
BUG=405491
LOG=N
Review URL: https://codereview.chromium.org/468803004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-20 11:52:22 +00:00
hpayer@chromium.org
91599ffc6c
Do not install fillers when right trimming large objects.
...
BUG=
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/487703002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-19 08:35:39 +00:00
jkummerow@chromium.org
dacca11cb9
Correctly handle holes when concat()ing double arrays
...
BUG=chromium:403409
LOG=y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/468863003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-18 08:51:35 +00:00
dslomov@chromium.org
eebb61a3f9
Fix OrderedHashTabelIterator accessors.
...
They might be undefined for uninitialized iterators.
The rest of the code is ready for this eventuality.
R=arv@chromium.org , adamk@chromium.org
BUG=403292
LOG=N
Review URL: https://codereview.chromium.org/468813003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23126 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-14 10:24:19 +00:00
yangguo@chromium.org
413b20b6c1
Make %DebugPushPromise more robust wrt fuzzing.
...
If %DebugPushPromise and throwing is called outside its intended context,
we may encounter assertion failures.
R=hpayer@chromium.org
BUG=401915
LOG=N
Review URL: https://codereview.chromium.org/453933002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-11 07:59:10 +00:00
adamk@chromium.org
bcf8b05072
Enable ES6 Map and Set by default
...
In doing so also remove all references to the --harmony-collections flag.
Due to the way context snapshotting works, it's not possible to simply
enable the flag by default.
Depends on ES6 Symbols: https://codereview.chromium.org/421313004
BUG=v8:1622
LOG=Y
R=arv@chromium.org , rossberg@chromium.org
Review URL: https://codereview.chromium.org/427723002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-05 19:37:32 +00:00
adamk@chromium.org
d8c30bd8e7
Enable ES6 Symbols by default
...
In doing so also remove all references to the --harmony-symbols flag.
Due to the way context snapshotting works, it's not possible to simply enable
the flag by default.
BUG=v8:2158
LOG=Y
R=dslomov@chromium.org
Review URL: https://codereview.chromium.org/421313004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-04 18:17:54 +00:00
mstarzinger@chromium.org
57c315d0b3
Fix handling of potential string additions in hydrogen.
...
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3476
BUG=v8:3476
LOG=N
Review URL: https://codereview.chromium.org/423083004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-29 14:53:11 +00:00
verwaest@chromium.org
f08d2690c6
Fix Object.freeze with field type tracking.
...
Keep the descriptor properly intact while update the field type.
BUG=v8:3458
LOG=y
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/424093002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-29 13:30:29 +00:00
mvstanton@chromium.org
6980c4277c
CallIC customization stubs must accept that a vector slot is cleared.
...
The CallIC Array custom IC stub read from the type vector, expecting
to get an AllocationSite. But there are paths in the system where a
type vector can be re-created with default values, even though we
currently grant an exception to clearing of vector slots with
AllocationSites in them at gc time.
BUG=392114
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/418023002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-29 11:53:30 +00:00
danno@chromium.org
afcfa7d2b7
Keep new arrays allocated with 'new Array(N)' in fast mode (revisited)
...
Also explicit length setting with a.length = N should remain in fast mode.
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/416403002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-28 13:12:26 +00:00
verwaest@chromium.org
60df9dabad
In GrowMode, force the value to the right representation to avoid deopts between storing the length and storing the value.
...
BUG=16459193
LOG=n
R=danno@chromium.org
Review URL: https://codereview.chromium.org/419683004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22616 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-25 11:48:25 +00:00
verwaest@chromium.org
77a37e44f6
Fix issue with setters and their holders in accessors.cc
...
BUG=3462
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/417793002
Patch from Erik Arvidsson <arv@chromium.org>.
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22606 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-24 16:42:54 +00:00
danno@chromium.org
b5a5148260
Revert 22595: "Keep new arrays allocated with 'new Array(N)' in fast mode"
...
Due to failures in mjsunit/array-functions-prototype-misc
TBR=verwaest@chromium.org
Review URL: https://codereview.chromium.org/417953004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-24 13:38:05 +00:00
danno@chromium.org
ac89b17813
Keep new arrays allocated with 'new Array(N)' in fast mode
...
Also explicit length setting with a.length = N should remain in fast mode.
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/397593008
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-24 12:08:23 +00:00
verwaest@chromium.org
6798779031
Fix ArrayLengthSetter to not throw on non-extensible receivers.
...
BUG=v8:3460
LOG=n
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/411983003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-23 20:27:32 +00:00
danno@chromium.org
1d2a4b8333
Remove experimental flags that are now required
...
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/397253002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-18 07:17:21 +00:00
rodolph.perfetta@arm.com
56ec59bd26
ARM64: always restore regexp register cache after a C function call.
...
BUG=v8:3444
TEST=mjsunit/regress/regress-regexp-nocase.js
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/392403002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-17 09:55:48 +00:00
yangguo@chromium.org
49ae3081d2
Error.captureStackTrace should define "stack" property as configurable.
...
R=verwaest@chromium.org
BUG=393988
LOG=N
Review URL: https://codereview.chromium.org/396063008
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22420 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-16 07:55:05 +00:00
verwaest@chromium.org
1d55a634a9
Replace AddProperty by AddNamedProperty to speed up the common case
...
BUG=
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/384003003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-14 14:05:30 +00:00
verwaest@chromium.org
aa7198dfdd
This CL simplifies var / const by ensuring the behavior is consistent in itself, and with regular JS semantics; between regular var/const and eval-ed var/const.
...
Legacy const is changed so that a declaration declares a configurable, but non-writable, slot, and the initializer reconfigures it (when possible) to non-configurable non-writable. This avoids the need for "the hole" as marker value in JSContextExtensionObjects and GlobalObjects. Undefined is used instead.
BUG=
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/379893002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-14 14:01:04 +00:00
jarin@chromium.org
457de26330
Fix arm64 deoptimization from double registers (reverts r20613).
...
This reverts "ARM64: Use pair memory access in deoptimizer entry", r20613. It does not really make sense to micro-optimize the deoptimizer as it is the ultra-slow path. Moreover, the original code was easier to read (in addition to being correct).
BUG=391313
LOG=N
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/389583003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-11 19:30:09 +00:00
mstarzinger@chromium.org
50beec9738
Follow-up to a pre-existing regression test.
...
R=yangguo@chromium.org
BUG=v8:1530,v8:1872
TEST=mjsunit/regress/regress-1530
LOG=N
Review URL: https://codereview.chromium.org/378233006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-09 10:23:58 +00:00
verwaest@chromium.org
ad6202d989
Fix computed properties on object literals with a double as propertyname.
...
BUG=390732
LOG=y
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/371973002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-07 17:08:54 +00:00
yangguo@chromium.org
a0c10d119a
Revert "Turn old space cons strings into regular external strings (not short)."
...
This reverts commits r22192 and r22194.
TBR=hpayer@chromium.org
Review URL: https://codereview.chromium.org/367113003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-03 12:24:41 +00:00
yangguo@chromium.org
6574f33d2a
Turn old space cons strings into regular external strings (not short).
...
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/368223002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22192 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-03 11:46:31 +00:00
ishell@chromium.org
2fba190240
One of the fast cases in JSObject::MigrateFastToFast() should not be taken if the number of fields did not change.
...
BUG=chromium:390918
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/363073002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-02 19:10:19 +00:00
yangguo@chromium.org
f353ff668a
Harden Runtime_LiveEditCheckAndDropActivations against unsafe args.
...
R=jarin@chromium.org
BUG=390925
LOG=N
Review URL: https://codereview.chromium.org/362983004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-02 15:09:44 +00:00
yangguo@chromium.org
44d6ef37ab
Reland "Fix stack trace accessor behavior."
...
BUG=v8:3404
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/349033007
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-07-02 14:18:10 +00:00
yangguo@chromium.org
5d408ee73d
Revert "Fix stack trace accessor behavior."
...
This reverts r22089.
TBR=verwaest@chromium.org
Review URL: https://codereview.chromium.org/360033002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-30 13:16:42 +00:00
yangguo@chromium.org
e1d80e2858
Fix stack trace accessor behavior.
...
R=verwaest@chromium.org
BUG=v8:3404
LOG=N
Review URL: https://codereview.chromium.org/343563009
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-30 11:48:20 +00:00
verwaest@chromium.org
8945c69855
Don't leak the global object in the Function constructor.
...
BUG=
R=dcarney@chromium.org
Review URL: https://codereview.chromium.org/359713005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-27 13:50:37 +00:00
verwaest@chromium.org
63431b23d1
Split SetProperty(...attributes, strictmode) into DefineProperty(...attributes) and SetProperty(...strictmode)
...
BUG=
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/351853005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-27 13:48:37 +00:00
yangguo@chromium.org
0133d96be3
Remove script collected debug event.
...
R=yurys@chromium.org
Review URL: https://codereview.chromium.org/358873005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-27 12:10:43 +00:00
yangguo@chromium.org
58bf19e9d5
Remove bogus assertions in HCompareObjectEqAndBranch.
...
R=jkummerow@chromium.org , danno@chromium.org
BUG=387636
LOG=Y
Review URL: https://codereview.chromium.org/331863015
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21959 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-24 09:33:05 +00:00
yangguo@chromium.org
438f49a322
Do not eagerly update allow_osr_at_loop_nesting_level.
...
Having debug break points prevents OSR. That causes
allow_osr_at_loop_nesting_level and the actually patched state
to go out of sync.
R=jkummerow@chromium.org
BUG=387599
LOG=Y
Review URL: https://codereview.chromium.org/346223007
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21958 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-24 09:31:30 +00:00
yangguo@chromium.org
2411bc9447
Harden %FunctionBindArguments wrt optimized code cache.
...
R=jkummerow@chromium.org
BUG=387627
LOG=N
Review URL: https://codereview.chromium.org/345463005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 13:17:42 +00:00
mvstanton@chromium.org
c0179a50da
Re-land "Clusterfuzz identified overflow check needed in dehoisting."
...
BUG=380092
LOG=N
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/335063005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 09:09:05 +00:00
jarin@chromium.org
e56faa9909
Add missing map check to optimized f.apply(...)
...
This is a cutdown version of https://codereview.chromium.org/346473002/ , which aimed to fix f.call and f.apply. Optimized f.call was removed by r21887, this is what was left.
BUG=386034
LOG=N
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/348623002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-23 05:50:06 +00:00
jkummerow@chromium.org
1d35d6d871
Array.concat: properly go to dictionary mode when required
...
BUG=chromium:387031
LOG=y
R=danno@chromium.org
Review URL: https://codereview.chromium.org/342333002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-20 15:40:21 +00:00
yangguo@chromium.org
11368af66d
Interrupts must not mask stack overflow.
...
R=jarin@chromium.org
BUG=385002
LOG=N
Review URL: https://codereview.chromium.org/339883002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21874 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-17 13:54:49 +00:00
jarin@chromium.org
f69bb7fcc3
Do not eliminate bounds checks for "<const> - x".
...
Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".
R=yangguo@chromium.org
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N
Review URL: https://codereview.chromium.org/339583003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-16 13:43:50 +00:00
bmeurer@chromium.org
2591003da5
Add unit test for regression in GVN caused by field type tracking.
...
BUG=v8:3347
LOG=n
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/333273004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-16 13:21:42 +00:00
bmeurer@chromium.org
4642c2e18c
Revert "GVN fix, preventing loads hoisting above stores to the same field when HObjectAccess's representation is not the same."
...
This reverts commit r21830 for tanking performance on Deltablue.
TBR=ishell@chromium.org
Review URL: https://codereview.chromium.org/336223002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21857 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-16 13:03:59 +00:00
jkummerow@chromium.org
aae24ae40b
Fix representation of Phis for mutable-heapnumber-in-object-literal properties
...
BUG=v8:3392
LOG=y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/328343004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-16 08:41:29 +00:00
ishell@chromium.org
41e9d916c4
GVN fix, preventing loads hoisting above stores to the same field when HObjectAccess's representation is not the same.
...
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/331493006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-13 07:51:45 +00:00
svenpanne@chromium.org
2931f09144
Fix unsigned comparisons.
...
Instead of marking the comparison instruction itself as Uint32, we
look at its arguments. This is more consistent what HChange does.
BUG=v8:3380
TEST=mjsunit/regress/regress-3380
LOG=y
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/325133004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-11 09:09:15 +00:00
bmeurer@chromium.org
0fcd89161b
Fix invalid attributes when generalizing because of incompatible map change.
...
BUG=382143
LOG=y
TEST=mjsunit/regress/regress-382143
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/324933003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-10 12:24:54 +00:00
ishell@chromium.org
6dc967e2e0
Bugfix in inlined versions of Array.indexOf() and Array.lastIndexOf() with a regression test.
...
BUG=chromium:381534
LOG=N
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/319343002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-10 09:01:45 +00:00
bmeurer@chromium.org
7eea77bc5c
Fix missing smi check in inlined indexOf/lastIndexOf.
...
BUG=382513
LOG=y
R=danno@chromium.org
Review URL: https://codereview.chromium.org/313233005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-10 04:26:15 +00:00
mvstanton@chromium.org
2714fd2399
Revert "Re-land Clusterfuzz identified overflow check needed in dehoisting."
...
This reverts commit r21712
TBR=danno@chromium.org
Review URL: https://codereview.chromium.org/315843005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-06 13:16:24 +00:00
mvstanton@chromium.org
c0cb82274c
Re-land Clusterfuzz identified overflow check needed in dehoisting.
...
Overflow check needs to be smarter.
BUG=380092
R=danno@google.com , danno@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/317963004
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-06 13:00:07 +00:00
mvstanton@chromium.org
35933119fe
Revert "Clusterfuzz identified overflow check needed in dehoisting."
...
This reverts commit r21708, due to ASAN-reported issue.
TBR=danno@chromium.org
Review URL: https://codereview.chromium.org/318073002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-06 09:47:14 +00:00
mvstanton@chromium.org
7d2d0839ad
Clusterfuzz identified overflow check needed in dehoisting.
...
BUG=380092
R=danno@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/315593002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-06 09:12:16 +00:00
bmeurer@chromium.org
9244429707
Fix invalid loop condition for Array.lastIndexOf().
...
BUG=380512
LOG=y
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/313073003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-04 08:21:39 +00:00
mvstanton@chromium.org
d19aaa2b1c
Revert "Reland "Make 'name' property on functions configurable.""
...
This reverts commit r21609 due to browser test failures.
TBR=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/313583002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 11:52:07 +00:00
mvstanton@chromium.org
848a9af6b4
%ObjectFreeze needs to exclude non-fast-path objects.
...
ClusterFuzz will call it with sloppy arguments and similar cases.
BUG=380049
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/315533002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21624 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 07:59:36 +00:00
mvstanton@chromium.org
adeaedf547
When flag --nouse-osr is set, don't allow osr from hidden runtime calls.
...
BUG=379770
R=yangguo@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/310773003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 07:45:40 +00:00
adamk@chromium.org
509a1a405c
ES6: Add support for values/keys/entries for Map and Set
...
This allows code like this:
var map = new Map();
map.set(1, 'One');
...
var iter = map.values();
var res;
while (!(res = iter.next()).done) {
print(res.value);
}
BUG=v8:1793
LOG=Y
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/259883002
Patch from Erik Arvidsson <arv@chromium.org>.
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21615 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 00:34:01 +00:00
mstarzinger@chromium.org
d6500b6cf7
Reland "Make 'name' property on functions configurable."
...
R=rossberg@chromium.org
BUG=v8:3333
LOG=N
Review URL: https://codereview.chromium.org/303463006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21609 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-02 13:35:26 +00:00
bmeurer@chromium.org
5cd009a004
HRor and HSar can deoptimize.
...
BUG=v8:3359
LOG=y
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/309483002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-30 16:12:25 +00:00
mvstanton@chromium.org
8c54a373dd
Changing the attributes of a data property implemented with
...
ExecutableAccessorInfo turns the property into a field. Better
to keep it as a callback, and correctly deal with the changed
property attributes.
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/262053011
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21558 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-28 09:58:27 +00:00
mstarzinger@chromium.org
6b33e50701
Revert "Make 'name' property on functions configurable."
...
R=danno@google.com , danno@chromium.org
Review URL: https://codereview.chromium.org/297163009
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21534 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-27 15:00:26 +00:00
yangguo@chromium.org
94b4aef7d6
Fix arm64 gc stress issue.
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/306483002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-27 06:35:45 +00:00
mvstanton@chromium.org
d755611e93
Reland "Customized support for feedback on calls to Array." and follow-up fixes.
...
Comparing one CallIC::State to another was not done correctly, leading to a failure to patch a CallIC when transitioning from monomorphic Array to megamorphic.
BUG=chromium:377198,chromium:377290
LOG=Y
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/305493003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-26 13:59:24 +00:00
mstarzinger@chromium.org
82b3b2a367
Make 'name' property on functions configurable.
...
R=rossberg@chromium.org
BUG=v8:3333
LOG=N
Review URL: https://codereview.chromium.org/296413003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-26 11:42:56 +00:00
yangguo@chromium.org
32f433c12e
Fix leak in debug mirror cache.
...
When fetching loaded scripts, mirror objects are created and cached.
If the cache is not cleared, it holds script objects alive.
This also fixes a minor issue with script unloading.
R=ulan@chromium.org
BUG=376534
LOG=N
Review URL: https://codereview.chromium.org/296953005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-26 07:05:56 +00:00
mstarzinger@chromium.org
cf448aa15f
Fix representation inference for mutable double boxes.
...
R=jarin@chromium.org
BUG=v8:3307
TEST=mjsunit/regress/regress-3307
LOG=N
Review URL: https://codereview.chromium.org/298723014
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-23 14:02:08 +00:00
jarin@chromium.org
3d0bf69cd8
Attempt no. 3 to fix Heap::IsHeapIterable and HeapIterator.
...
Now we remember new space's top pointer after the last GC to find out if there was a new space allocation since the last GC.
Unfortunately, this not completely safe - the debugger has a callback hook (that can call to JS) at the end of the GC epilogue that can in theory allocate and possibly make the heap non-iterable. We can only hope this does not happen.
BUG=373283
R=hpayer@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/291193005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-22 11:13:37 +00:00
jarin@chromium.org
02f1a1b987
Revert "Fix Heap::IsHeapIterable." (again)
...
This reverts commit r21397.
TBR=hpayer@chromium.org
Review URL: https://codereview.chromium.org/299813002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-21 09:49:18 +00:00
jkummerow@chromium.org
58661c150f
Fix ArrayShift hydrogen support
...
BUG=chromium:374838
LOG=y
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/299713003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-21 08:51:29 +00:00
jarin@chromium.org
58a130da6e
Reland "Fix Heap::IsHeapIterable."
...
This relands r21388 (+ handlification of an offending function).
BUG=373283
LOG=N
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/294903003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-21 06:44:38 +00:00
jarin@chromium.org
014bf8b407
Revert "Fix Heap::IsHeapIterable."
...
This reverts commit r21387.
TBR=hpayer@chromium.org
Review URL: https://codereview.chromium.org/291193002
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-20 14:03:38 +00:00
jarin@chromium.org
dd4c82bbb3
Fix Heap::IsHeapIterable.
...
We only consider heap iterable if the new space is empty (in addition to the exisiting old space check).
The change also moves the iterability forcing + allocation prevention gadgets to HeapIterator so that it is impossible to miss them when iterating the heap.
R=hpayer@chromium.org
BUG=373283
LOG=N
Review URL: https://codereview.chromium.org/285693006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-20 13:19:21 +00:00
jarin@chromium.org
c3cd2f0301
Fix %SetFlags("--stress-compaction")
...
BUG=369943
LOG=N
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/261253006
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-12 10:39:08 +00:00
jarin@chromium.org
cbf8c3f460
Make escape analysis preserve all representations required by HCompareNumericAndBranch.
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/257803012
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-12 08:43:18 +00:00
adamk@chromium.org
fb70df076b
Object.observe: avoid accessing acceptList properties more than once
...
BUG=v8:3315
LOG=Y
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/270763003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 18:22:28 +00:00
jarin@chromium.org
3976ebef93
Make new space iterable for --log-gc and --heap-stats options
...
R=hpayer@chromium.org
BUG=370827
TEST=test/mjsunit/regress/regress-370827.js
LOG=N
Review URL: https://codereview.chromium.org/272503005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 09:23:10 +00:00
hpayer@chromium.org
de21c8a245
Simplify ConfigureHeap and change --max_new_space_size to --max_semi_space_size.
...
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/271843005
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21204 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 08:38:27 +00:00
ulan@chromium.org
8999a006be
Fix index register assignment in LoadFieldByIndex for arm, arm64, and mips.
...
This instruciton clobbers the index register.
BUG=368243
LOG=N
TEST=mjsunit/regress/regress-368243
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/269273003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21196 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-08 08:51:51 +00:00
rossberg@chromium.org
ae0a36ee32
Re^3-land "Ship promises and weak collections"
...
R=jochen@chromium.org
BUG=
Review URL: https://codereview.chromium.org/266243003
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-06 14:48:34 +00:00
ishell@chromium.org
9be0c4d378
Fixed jump in non-SSE4.1 implementation of LMathFloor instruction on x64.
...
BUG=chromium:370384
LOG=N
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/261853009
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21171 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-06 14:20:46 +00:00
hpayer@chromium.org
dde49c9dc3
Set max new space size in tests to proper MB value.
...
Revert "Limit old space size in test which require a large new space."
This reverts commit r21103.
Revert "Remove max space limits in tests."
This reverts commit r21104.
BUG=
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/263103006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-05 16:48:33 +00:00
ishell@chromium.org
b4c1eda032
Checks for empty array case added before casting elements to FixedDoubleArray.
...
BUG=chromium:369450
LOG=N
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/264973008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21118 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-02 11:30:24 +00:00
svenpanne@chromium.org
7bfc426fc9
Object.defineProperty shouldn't be a hint that we're constructing a dictionary.
...
BUG=362870
LOG=y
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/261583004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-02 06:02:00 +00:00
hpayer@chromium.org
56d0b9757e
Remove max space limits in tests.
...
BUG=
Review URL: https://codereview.chromium.org/263703003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 19:32:47 +00:00
hpayer@chromium.org
3dd05f8fc7
Limit old space size in test which require a large new space.
...
BUG=
Review URL: https://codereview.chromium.org/265673003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21103 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 18:57:25 +00:00
mvstanton@chromium.org
5e2ee2bac2
A new test needs to exit early on non-internationalization builds.
...
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/265513003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 09:04:17 +00:00
mstarzinger@chromium.org
129c58c47d
Fix some more missing ToObject on Array.prototype.
...
R=mvstanton@chromium.org
BUG=
Review URL: https://codereview.chromium.org/254103002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 08:52:00 +00:00
mvstanton@chromium.org
0c3e70a3b6
Bugfix: internationalization routines fail on monkeypatching.
...
Calls to Object.defineProperty() and Object.apply() are not safe.
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/253903003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 07:36:12 +00:00