kmillikin@chromium.org dc91c4218b Make optimized Function.prototype.apply safe for non-JSObject first arguments. ... If we have a property access of the form this.x, where the access site sees the global object, we can specialize the IC stub so that it performs a map check without first performing a heap object check. Ensure that we do not get in JS code with a non-JSObject this value by deoptimizing at Function.prototype.apply if the first argument is not a JSObject. BUG=v8:1128 Review URL: http://codereview.chromium.org/6463025 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00		2011-02-09 16:43:23 +00:00
..
alloc-number.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
array-access.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
array-length.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
assignment-deopt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
assignment.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
binary-ops.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
call-keyed.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
compare.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
complex-for-in.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
control-flow-0.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
control-flow-1.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
control-flow-2.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
count-deopt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
countoperation.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
delete.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
deopt-args.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
deopt-inlined-smi.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
expression-trees.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
for-stmt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
function-call.js	Support for function calls on an arbitrary expression that returns	2009-11-02 12:04:35 +00:00
globals.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
inline-compare.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
inline-conditional.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
inline-global-access.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
inline-param.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
inline-two.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
jsnatives.js	Added fast compiler support for calling JS runtime functions.	2009-11-27 00:28:06 +00:00
literals-assignment.js	Support for object literals in fast compiler.	2009-10-26 13:21:48 +00:00
literals.js	Fix bug in object literals with large array indexes as strings.	2011-02-02 14:02:58 +00:00
logical-and.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
logical-or.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
loopcount.js	Fix code generation for fast smi loops to support parameters as well.	2010-03-22 11:55:12 +00:00
loops.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
null-compare.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
objectliterals.js	Fix bug in the fast compiler's object literal code	2009-11-26 21:13:20 +00:00
optimized-function-calls.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
pic.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
property-calls.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
property-refs.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
property-simple.js	Support for property access (named, keyed) in the fast compiler.	2009-10-27 16:11:12 +00:00
property-stores.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
recursive-deopt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-0.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-1.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-2.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-3.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-4.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-5.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-6.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-7.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-8.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-1085.js	Fix a bug in the placement of minus-zero checks and in GVN.	2011-01-31 12:36:54 +00:00
regress-3136962.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-3185901.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-3218915.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-3249650.js	Speed up a regression test regress-3249650.js so it does not timeout.	2011-01-07 13:52:36 +00:00
regress-3260426.js	Be more careful about exiting inlined functions in a test context.	2010-12-07 12:07:40 +00:00
regress-arguments.js	Make optimized Function.prototype.apply safe for non-JSObject first arguments.	2011-02-09 16:43:23 +00:00
regress-arrayliteral.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-closures-with-eval.js	Make closures optimizable by Crankshaft compiler.	2011-01-17 08:11:03 +00:00
regress-funarguments.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-funcaller.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-gap.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-gvn.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-intoverflow.js	Reduce number of iterations in new regression test, this times out on arm and the regression is hit with an order of magnitude less iterations.	2010-12-17 07:23:06 +00:00
regress-loop-deopt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-max.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-or.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-rep-change.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-serialized-slots.js	Properly create variables to access outer arguments and function names.	2011-01-19 08:16:17 +00:00
regress-stacktrace-methods.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
regress-stacktrace.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
safepoint.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
short-circuit.js	Introduce 'top-of-stack caching' to the toplevel code generator by	2010-01-18 14:04:55 +00:00
simple-bailouts.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
simple-binary-op.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
simple-deopt.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
simple-global-access.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
simple-inlining.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
simple-osr.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
switch-bailout.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
this-property-refs.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
thisfunction.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00
unary-add.js	Implement unary addition in the full (non-optimizing) code generator.	2010-01-26 13:57:11 +00:00
variables.js	Update V8 to version 3.0 (re-land r5920).	2010-12-07 11:31:57 +00:00