Commit Graph

3961 Commits

Author SHA1 Message Date
yangguo
f8db4327ad Migrate error messages, part 9.
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1130783002

Cr-Commit-Position: refs/heads/master@{#28291}
2015-05-07 10:00:23 +00:00
yangguo
2f9411df89 Revert of Revert of Wrap runtime.js in a function. (patchset #1 id:1 of https://codereview.chromium.org/1123353004/)
Reason for revert:
Failing test has been fixed.

Original issue's description:
> Revert of Wrap runtime.js in a function. (patchset #2 id:20001 of https://codereview.chromium.org/1126213002/)
>
> Reason for revert:
> [Sheriff] Breaks nosnap:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/2872
>
> Original issue's description:
> > Wrap runtime.js in a function.
> >
> > R=jkummerow@chromium.org
> >
> > Committed: https://crrev.com/65c56d49b2d671ac9e379de726bff3eb03a508c1
> > Cr-Commit-Position: refs/heads/master@{#28275}
>
> TBR=jkummerow@chromium.org,yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/62bd294f909ff448d0f876a3d745966a24cdc3f7
> Cr-Commit-Position: refs/heads/master@{#28277}

TBR=jkummerow@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1131843002

Cr-Commit-Position: refs/heads/master@{#28287}
2015-05-07 08:39:53 +00:00
machenbach
5cab6be83a Revert of Resolve references to "this" the same way as normal variables (patchset #2 id:20001 of https://codereview.chromium.org/1130733003/)
Reason for revert:
[Sheriff] Breaks jetstream benchmark with errors like this:

>>> Running suite: JetStream/bigfib.cpp
>>> Stdout (#1):
undefined:93: ReferenceError: this is not defined
  this['Module'] = Module;
  ^
ReferenceError: this is not defined
    at eval (eval at __run (runner.js:13:3), <anonymous>:93:3)
    at eval (native)
    at __run (runner.js:13:3)
    at Object.runSimpleBenchmark (runner.js:44:31)
    at runner.js:97:13

Original issue's description:
> Resolve references to "this" the same way as normal variables
>
> Make the parser handle references to "this" as unresolved variables, so the
> same logic as for the rest of function parameters is used for the receiver.
> Minor additions to the code generation handle copying the receiver to the
> context, along with the rest of the function parameters.
>
> Based on work by Adrian Perez de Castro <aperez@igalia.com>.
>
> BUG=v8:2700
> LOG=N
>
> Committed: https://crrev.com/06a792b7cc2db33ffce7244c044a9c05afbb6116
> Cr-Commit-Position: refs/heads/master@{#28263}

TBR=rossberg@chromium.org,arv@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2700

Review URL: https://codereview.chromium.org/1129723003

Cr-Commit-Position: refs/heads/master@{#28283}
2015-05-07 07:20:49 +00:00
machenbach
62bd294f90 Revert of Wrap runtime.js in a function. (patchset #2 id:20001 of https://codereview.chromium.org/1126213002/)
Reason for revert:
[Sheriff] Breaks nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/2872

Original issue's description:
> Wrap runtime.js in a function.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/65c56d49b2d671ac9e379de726bff3eb03a508c1
> Cr-Commit-Position: refs/heads/master@{#28275}

TBR=jkummerow@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1123353004

Cr-Commit-Position: refs/heads/master@{#28277}
2015-05-06 20:03:11 +00:00
yangguo
65c56d49b2 Wrap runtime.js in a function.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1126213002

Cr-Commit-Position: refs/heads/master@{#28275}
2015-05-06 19:25:00 +00:00
caitpotter88
fda20efb2f [es6] implement Object.assign
BUG=v8:4007
LOG=N
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/548833002

Cr-Commit-Position: refs/heads/master@{#28270}
2015-05-06 16:17:50 +00:00
conradw
382435480d [es6] Fix symbol comparison on some architectures
https://codereview.chromium.org/1125783002 did not handle all cases for some
architectures. These cases are now covered, and tests have been extended to
check them.

BUG=v8:4073
LOG=N

Review URL: https://codereview.chromium.org/1128143002

Cr-Commit-Position: refs/heads/master@{#28266}
2015-05-06 15:04:47 +00:00
wingo
06a792b7cc Resolve references to "this" the same way as normal variables
Make the parser handle references to "this" as unresolved variables, so the
same logic as for the rest of function parameters is used for the receiver.
Minor additions to the code generation handle copying the receiver to the
context, along with the rest of the function parameters.

Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1130733003

Cr-Commit-Position: refs/heads/master@{#28263}
2015-05-06 14:18:08 +00:00
conradw
97bee8e964 [strong] Fix inlining issue
The Hydrogen representation for binops was never changed to care about the
language mode. We thought this was ok, but it turns out we need to keep track
of it to make sure inlining doesn't mess with the "strongness" of binops.

Also added more rigorous inlining testing.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1123043002

Cr-Commit-Position: refs/heads/master@{#28253}
2015-05-06 10:40:38 +00:00
yangguo
a5de69f4f8 Migrate error messages, part 8.
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1118273004

Cr-Commit-Position: refs/heads/master@{#28250}
2015-05-06 07:52:05 +00:00
yangguo
8b6c2a805d Mark mjsunit/allocation-site-info.js as NO_VARIANTS.
NOTRY=true
TBR=machenbach@chromium.org
BUG=4078
LOG=N

Review URL: https://codereview.chromium.org/1123183003

Cr-Commit-Position: refs/heads/master@{#28248}
2015-05-06 07:20:57 +00:00
dslomov
cf53fed972 Handle the case when derived constructor is [[Call]]ed with 0 args.
ArgumentsAdaptorStub for derived constructor (the one that needs
new.target) works in this way:
 - If the constructor is invoked via the Construct stub, we know that
   actual arguments always include new.target. ``arguments`` object
   however should not include a new.target, therefore we remove it.
   We achieve this by decrementing the argument count.
 - If the constructor is invoked as a call, we do not care for a correct
   ``arguments`` array since the constructor will immediately throw on
   entrance.
The bug is that the call could actually pass 0 actual arguments, but I
decrement unconditionally :(. The fix is to detect this case and avoid
decrementing. ``arguments`` is bogus, but it is ok as constructor
throws.

Long-term we should just remove mucking about with arguments for
new.target and just get it from the stack.

R=arv@chromium.org,rossberg@chromium.org
BUG=chromium:474783
LOG=Y

Review URL: https://codereview.chromium.org/1126783003

Cr-Commit-Position: refs/heads/master@{#28242}
2015-05-05 19:57:04 +00:00
wingo
1e4173d93a Revert of Resolve references to "this" the same way as normal variables (patchset #11 id:240001 of https://codereview.chromium.org/1097283003/)
Reason for revert:
nosnap failures

Original issue's description:
> Resolve references to "this" the same way as normal variables
>
> Make the parser handle references to "this" as unresolved variables, so the
> same logic as for the rest of function parameters is used for the receiver.
> Minor additions to the code generation handle copying the receiver to the
> context, along with the rest of the function parameters.
>
> Based on work by Adrian Perez de Castro <aperez@igalia.com>.
>
> BUG=
> LOG=N
>
> Committed: https://crrev.com/18619d355192e2699203d12d9ebb9caea107b693
> Cr-Commit-Position: refs/heads/master@{#28236}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,dslomov@chromium.org,adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1113133006

Cr-Commit-Position: refs/heads/master@{#28238}
2015-05-05 17:24:25 +00:00
danno
a988d5f261 Revert of Collect type feedback on result of Math.[round|ceil|floor] (patchset #13 id:230001 of https://codereview.chromium.org/1053143005/)
Reason for revert:
All sorts of performance regressions

Original issue's description:
> Collect type feedback on result of Math.[round|ceil|floor]
>
> By recording invocations of these builtins that can return -0, we now learn to not emit Crankshaft code that only handles integer results, avoiding deopt loops.
>
> Committed: https://crrev.com/f36ecaf3a4d61568ca50a20718acce7dd5da9a5f
> Cr-Commit-Position: refs/heads/master@{#28215}

TBR=mvstanton@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1115973005

Cr-Commit-Position: refs/heads/master@{#28237}
2015-05-05 16:42:16 +00:00
wingo
18619d3551 Resolve references to "this" the same way as normal variables
Make the parser handle references to "this" as unresolved variables, so the
same logic as for the rest of function parameters is used for the receiver.
Minor additions to the code generation handle copying the receiver to the
context, along with the rest of the function parameters.

Based on work by Adrian Perez de Castro <aperez@igalia.com>.

BUG=
LOG=N

Review URL: https://codereview.chromium.org/1097283003

Cr-Commit-Position: refs/heads/master@{#28236}
2015-05-05 16:38:22 +00:00
arv
d26f5d3923 [es6] When comparing two symbols we may need to throw a TypeError
When comparing a symbol to istself using <, <=, > or >= we need to
throw a TypeError. This is correctly handled in the runtime function
so if we are comparing a symbol fall back to use the runtime.

BUG=v8:4073
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1125783002

Cr-Commit-Position: refs/heads/master@{#28226}
2015-05-05 14:17:46 +00:00
yangguo
7546302b67 Move more parts of stack trace formatting to runtime.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1122973002

Cr-Commit-Position: refs/heads/master@{#28223}
2015-05-05 14:17:43 +00:00
yangguo
b0eb920fe2 Reland #2 "Wrap v8natives.js into a function."
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1127693006

Cr-Commit-Position: refs/heads/master@{#28217}
2015-05-05 09:16:01 +00:00
yangguo
a3ddb1bc42 Migrate error messages, part 7.
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1122033002

Cr-Commit-Position: refs/heads/master@{#28216}
2015-05-05 07:57:36 +00:00
danno
f36ecaf3a4 Collect type feedback on result of Math.[round|ceil|floor]
By recording invocations of these builtins that can return -0, we now learn to not emit Crankshaft code that only handles integer results, avoiding deopt loops.

Review URL: https://codereview.chromium.org/1053143005

Cr-Commit-Position: refs/heads/master@{#28215}
2015-05-05 07:55:58 +00:00
machenbach
6afc0dcbfc Revert of Reland "Wrap v8natives.js into a function." (patchset #2 id:20001 of https://codereview.chromium.org/1123703002/)
Reason for revert:
[Sheriff] Speculative revert for braking arm64 nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%202/builds/2314

(reverted already titzer's CL which didn't help)

Original issue's description:
> Reland "Wrap v8natives.js into a function."
>
> Committed: https://crrev.com/72ab42172979b60a1b784ea0c6a495d7ee2bba67
> Cr-Commit-Position: refs/heads/master@{#28193}

TBR=jkummerow@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1127543003

Cr-Commit-Position: refs/heads/master@{#28208}
2015-05-04 16:49:58 +00:00
jarin
b5b47e1f88 Remove materialized objects on stack unwind.
BUG=v8:3985
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1122083002

Cr-Commit-Position: refs/heads/master@{#28206}
2015-05-04 16:44:01 +00:00
verwaest
f21ea065b3 Fix smi scanning
BUG=chromium:483176
LOG=n

Review URL: https://codereview.chromium.org/1114073003

Cr-Commit-Position: refs/heads/master@{#28202}
2015-05-04 15:02:30 +00:00
yangguo
72ab421729 Reland "Wrap v8natives.js into a function."
Review URL: https://codereview.chromium.org/1123703002

Cr-Commit-Position: refs/heads/master@{#28193}
2015-05-04 11:17:01 +00:00
yangguo
f42544b768 Set inferred name of bound function to empty string.
Otherwise it's whatever the js minifier assigns it to.

R=jkummerow@chromium.org
BUG=chromium:484077
LOG=N

Review URL: https://codereview.chromium.org/1122733002

Cr-Commit-Position: refs/heads/master@{#28190}
2015-05-04 09:55:43 +00:00
machenbach
b0b82fa89d Revert of Wrap v8natives.js into a function. (patchset #2 id:20001 of https://codereview.chromium.org/1109343004/)
Reason for revert:
[Sheriff] Speculative revert for breaking layout tests, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2682

See. e.g.:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/3130/layout-test-results/http/tests/websocket/workers/worker-reload-diff.txt

Original issue's description:
> Wrap v8natives.js into a function.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/ee1b39b4303829e6c6805fe8b2f2602b13f6463a
> Cr-Commit-Position: refs/heads/master@{#28174}

TBR=jkummerow@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1121453003

Cr-Commit-Position: refs/heads/master@{#28182}
2015-04-30 17:33:19 +00:00
yangguo
ac50edfee0 Migrate error messages, part 6. (string.js and date.js)
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1116953002

Cr-Commit-Position: refs/heads/master@{#28180}
2015-04-30 16:22:05 +00:00
yangguo
ee1b39b430 Wrap v8natives.js into a function.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1109343004

Cr-Commit-Position: refs/heads/master@{#28174}
2015-04-30 14:59:09 +00:00
titzer
b0dcf6abf2 Allow TurboFan to compile more methods.
Reorganize some bailout conditions to be after the decision to use TurboFan.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1110573002

Cr-Commit-Position: refs/heads/master@{#28172}
2015-04-30 14:50:45 +00:00
machenbach
1621dbf370 [test] Mark test as flaky.
BUG=v8:3803
LOG=n
TBR=mstarzinger@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1112373002

Cr-Commit-Position: refs/heads/master@{#28166}
2015-04-30 13:25:09 +00:00
mvstanton
fb8e613638 Use a stub in crankshaft for grow store arrays.
We were deopting without learning anything.

This is a rebase/reland of https://codereview.chromium.org/368263003

BUG=v8:3417
LOG=N

Review URL: https://codereview.chromium.org/1109333003

Cr-Commit-Position: refs/heads/master@{#28163}
2015-04-30 12:34:10 +00:00
conradw
dea0d9b59e [strong] Disallow implicit conversions for add
Implements the strong mode proposal's restrictions on implicit conversions
for the binary + operator. Test suite is also cleaned up/refactored to allow
easier testing of the comparison operators in the future.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1109223004

Cr-Commit-Position: refs/heads/master@{#28159}
2015-04-30 11:46:08 +00:00
yangguo
7681432dbf JSON serializer should fail gracefully for special value wrappers.
R=mstarzinger@chromium.org
BUG=chromium:471702
LOG=N

Review URL: https://codereview.chromium.org/1120573002

Cr-Commit-Position: refs/heads/master@{#28154}
2015-04-30 10:02:21 +00:00
machenbach
38a8d369b7 [test] Skip tests on msan.
NOTRY=true
BUG=chromium:425187
LOG=n
TBR=Sven Panne, titzer

Review URL: https://codereview.chromium.org/1110903004

Cr-Commit-Position: refs/heads/master@{#28122}
2015-04-29 07:19:59 +00:00
arv
baddc25eb2 [es6] Fix return checking in derived constructors
In a derived class constructor in case undefined is returned, we
should return the receiver. If the return is any other value type
we should throw a TypeError.

BUG=v8:4061
LOG=N
R=dslomov@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1107203002

Cr-Commit-Position: refs/heads/master@{#28114}
2015-04-28 16:09:30 +00:00
conradw
6988aec61f [strong] Disallow implicit conversions for bitwise ops, shifts
See https://codereview.chromium.org/1092353002/

Due to parser rewrites, also implements restrictions for unary ~.

Still to come, implementing restrictions for binary + and comparison.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1102923002

Cr-Commit-Position: refs/heads/master@{#28104}
2015-04-28 11:19:49 +00:00
machenbach
b3000dda14 [test] Skip unsuitable tests for msan.
NOTRY=true
BUG=chromium:425187
LOG=n
TBR=Sven Panne, titzer

Review URL: https://codereview.chromium.org/1107323003

Cr-Commit-Position: refs/heads/master@{#28103}
2015-04-28 11:18:12 +00:00
yangguo
4d12e94801 Port CallSite methods to C++.
The goal is to port all of error stack trace formatting to C++.
We will do this bottom up, by first porting helper functions.

Eventually, CallSite methods will only be used when a custom
error stack trace formatter is defined via Error.prepareStackTrace.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1060583008

Cr-Commit-Position: refs/heads/master@{#28095}
2015-04-28 08:52:47 +00:00
jkummerow
f6187fb3b5 Reland "Lazily register prototype users..."
...when handing out validity cells to handlers; because invalidating said cells is
the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after
the recently introduced compaction support.

This reverts commit 968715c653.

Original review: https://codereview.chromium.org/1104813004/

Review URL: https://codereview.chromium.org/1110513002

Cr-Commit-Position: refs/heads/master@{#28076}
2015-04-27 12:59:36 +00:00
titzer
6e82fbfbaf [turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1110503002

Cr-Commit-Position: refs/heads/master@{#28073}
2015-04-27 12:15:06 +00:00
machenbach
fbf300802f Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer. (patchset #10 id:180001 of https://codereview.chromium.org/1063513003/)
Reason for revert:
[sheriff] Breaks nosnap debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/156

Original issue's description:
> [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
>
> Uses lazy deoptimization and code dependencies to introduce loads
> from property cells and also to promote globals to constants.
>
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://crrev.com/aae4a62d07e839455b1d0ad4fa512cc5d48a1a68
> Cr-Commit-Position: refs/heads/master@{#28057}

TBR=mstarzinger@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1084533003

Cr-Commit-Position: refs/heads/master@{#28063}
2015-04-27 10:07:08 +00:00
titzer
aae4a62d07 [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
Uses lazy deoptimization and code dependencies to introduce loads
from property cells and also to promote globals to constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1063513003

Cr-Commit-Position: refs/heads/master@{#28057}
2015-04-27 09:06:41 +00:00
mvstanton
caeb9004f0 Don't MISS if you read the hole from certain FastHoley arrays.
If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}
2015-04-27 08:46:38 +00:00
jarin
ae0bc41635 Fix stack layout of full code arm64 for object literal.
BUG=

Review URL: https://codereview.chromium.org/1095203005

Cr-Commit-Position: refs/heads/master@{#28055}
2015-04-27 08:31:33 +00:00
arv
2279dfe789 [es6] Map/Set size getter should have "get size" name
This reverts commit d5565c1f68.

Getter and setter function names in ES6 are defined as "get foo" and
"set foo".

This also moves the logic for handling symbols from runtime-function.cc
to v8natives.js.

BUG=None
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1093183006

Cr-Commit-Position: refs/heads/master@{#28050}
2015-04-24 18:15:59 +00:00
jkummerow
968715c653 Revert of Lazily register prototype users (patchset #2 id:20001 of https://codereview.chromium.org/1104813004/)
Reason for revert:
Suspected of causing GC stress failures.

Original issue's description:
> Lazily register prototype users
>
> when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
> Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.
>
> Committed: https://crrev.com/a4bb7643c076b014816431a9b85af3e2edf828e7
> Cr-Commit-Position: refs/heads/master@{#28047}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1108583002

Cr-Commit-Position: refs/heads/master@{#28049}
2015-04-24 14:09:48 +00:00
jkummerow
a4bb7643c0 Lazily register prototype users
when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.

Review URL: https://codereview.chromium.org/1104813004

Cr-Commit-Position: refs/heads/master@{#28047}
2015-04-24 12:51:37 +00:00
conradw
ae7ce701ae [strong] Disallow implicit conversions for binary arithmetic operations
Implements the strong mode proposal's restrictions on
implicit conversions for binary arithmetic operations, not
including the + special case. Adds some infrastructure
for future implementation of the restrictions for other
operators.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1092353002

Cr-Commit-Position: refs/heads/master@{#28045}
2015-04-24 12:32:41 +00:00
mstarzinger
6b60f19168 [turbofan] Fix frame state for class literal definition.
This introduces a bailout point for class literals right after the
%DefineClass function has been called. Otherwise the FrameState after
class literal evaluation might contain the literal itself.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-480819
BUG=chromium:480819
LOG=N

Review URL: https://codereview.chromium.org/1104673004

Cr-Commit-Position: refs/heads/master@{#28043}
2015-04-24 11:12:57 +00:00
bmeurer
4f9bc2d1c3 [turbofan] Ignore dead cached nodes in the JSGraph.
BUG=chromium:480807
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1101273002

Cr-Commit-Position: refs/heads/master@{#28041}
2015-04-24 10:51:32 +00:00