v8/test/mjsunit/compiler
mstarzinger 37f5e23b5c [turbofan] Fix receiver binding for inlined callees.
This introduces a JSConvertReceiver operator to model the implicit
conversion of receiver values for sloppy callees. It is used by the
JSInliner for now, but can also be used to model direction function
calls that bypass call stubs.

Also note that a hint is passed to said operator whenever the source
structure constrains the receiver value type. This hint allows for
optimizations in the lowering of the operator.

The underlying specification in ES6, section 9.2.1.2 is the basis for
this implementation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/receiver-conversion
BUG=v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1412223015

Cr-Commit-Position: refs/heads/master@{#31598}
2015-10-27 12:13:49 +00:00
..
stubs Create a internal native context used only for TF-generated code stubs 2015-07-13 09:45:51 +00:00
alloc-number-debug.js
alloc-number.js
alloc-object-huge.js
alloc-object.js
array-access.js
array-length.js
assignment-deopt.js
assignment.js
binary-ops.js
call-keyed.js
compare-map-elim2.js
compare-map-elim.js
compare-objeq-elim.js
compare.js
complex-for-in.js
concurrent-invalidate-transition-map.js Fix mjsunit/compiler/concurrent-invalidate-transition-map.js test. 2014-03-17 17:00:48 +00:00
concurrent-proto-change.js
control-flow-0.js
control-flow-1.js
control-flow-2.js
count-deopt.js
countoperation.js
dead-code2.js
dead-code3.js
dead-code4.js
dead-code5.js
dead-code6.js
dead-code.js
dead-loops-neg.js
dead-loops.js
dead-string-add-warm.js
dead-string-add.js
dead-string-char-code-at2.js
dead-string-char-code-at.js Refactor optimized in hydrogen only runtime functions. 2014-03-25 14:26:55 +00:00
dead-string-char-from-code.js
delete.js
deopt-args.js
deopt-bool2.js Add test for deoptimization bug. 2015-04-22 14:32:49 +00:00
deopt-bool.js Add test for deoptimization bug. 2015-04-22 14:32:49 +00:00
deopt-inlined-from-call.js Optimize Function.prototype.call 2014-10-15 12:22:15 +00:00
deopt-inlined-smi.js
deopt-tonumber-binop.js [turbofan] Fix lazy deopt for JSToNumber conversions in binary operations. 2015-03-09 13:24:42 +00:00
deopt-tonumber-compare.js [turbofan] Add frame state before JavaScript comparisons. 2015-05-13 07:38:35 +00:00
deopt-tonumber-shift.js [turbofan] Use frame state before for shift operations as well. 2015-05-13 11:17:28 +00:00
division-by-constant.js [turbofan] Optimize add operations to use 'leal' instruction on x64 2014-11-07 16:47:45 +00:00
eager-deopt-simple.js [turbofan] Only reduce inline %DeoptimizeNow. 2015-03-09 13:20:26 +00:00
escape-analysis-arguments.js
escape-analysis-representation.js
escape-analysis.js
eval-introduced-closure.js
expression-trees.js
for-stmt.js
function-call.js
generic-add.js Fix maybe_string_add for adds that have no type feedback where --always-opt is on. 2015-04-08 13:14:30 +00:00
global-accessors.js
global-delete.js [turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer. 2015-04-27 12:15:06 +00:00
global-var-delete.js [turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer. 2015-04-27 12:15:06 +00:00
globals.js
increment-typefeedback.js
inline-accessors.js
inline-arguments.js Allow inlining of functions containing %_Arguments. 2014-06-27 11:04:35 +00:00
inline-arity-mismatch.js
inline-closures.js
inline-compare.js
inline-conditional.js
inline-construct.js
inline-context-slots.js
inline-function-apply.js
inline-global-access.js
inline-literals.js
inline-param.js
inline-throw.js
inline-two.js
inlined-call-mapcheck.js %GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present 2015-04-14 14:57:48 +00:00
inlined-call.js %GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present 2015-04-14 14:57:48 +00:00
lazy-const-lookup.js
lazy-deopt-in-literal.js Fix stack layout of full code arm64 for object literal. 2015-04-27 08:31:33 +00:00
lazy-iife-no-parens.js Parsing especially large nested functions takes up more memory than necessary. 2015-09-10 14:41:14 +00:00
literals-assignment.js
literals-optimized.js
literals.js Correctly escape RegExp source. 2014-11-21 10:50:24 +00:00
load-elimination-global.js
load-elimination-osr.js
load-elimination-params.js
load-elimination.js
logical-and.js
logical-or.js
loopcount.js
loops.js
manual-concurrent-recompile.js
math-floor-global.js Simplify ConfigureHeap and change --max_new_space_size to --max_semi_space_size. 2014-05-09 08:38:27 +00:00
math-floor-local.js Simplify ConfigureHeap and change --max_new_space_size to --max_semi_space_size. 2014-05-09 08:38:27 +00:00
minus-zero.js
multiply-add.js
multiply-sub.js
named-load.js [turbofan] Fix reduction of LoadProperty/StoreProperty to LoadNamed/StoreNamed. 2015-04-21 15:12:58 +00:00
named-store.js [turbofan] Fix reduction of LoadProperty/StoreProperty to LoadNamed/StoreNamed. 2015-04-21 15:12:58 +00:00
null-compare.js
objectliterals.js
opt-next-call-turbo.js Enable test coverage for test coverage. 2015-01-21 14:07:19 +00:00
opt-next-call.js Remove overzealous check from %OptimizeFunctionOnNextCall. 2015-01-19 15:52:00 +00:00
optimize_max.js Add mjsunit tests for optimization of float min/max. 2015-06-23 17:26:25 +00:00
optimize_min.js Add mjsunit tests for optimization of float min/max. 2015-06-23 17:26:25 +00:00
optimize-bitnot.js
optimized-closures.js
optimized-for-in.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
optimized-function-calls.js
osr-alignment.js Reduce the number of iterations in some OSR tests by using an explicit %OptimizeOsr(). 2015-02-10 09:53:22 +00:00
osr-array-len.js [turbofan] Support vector IC feedback in the JSTypeFeedbackTable. 2015-05-19 08:58:29 +00:00
osr-assert.js
osr-backedges1.js [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR. 2015-02-11 13:26:45 +00:00
osr-big.js
osr-block-scope-func.js [turbofan] Simplify context specialization and fix for OSR. 2015-02-19 11:36:50 +00:00
osr-block-scope-id.js [turbofan] Rename context stack as part of the environment for OSR. 2015-02-17 18:10:11 +00:00
osr-block-scope.js [turbofan] Simplify context specialization and fix for OSR. 2015-02-19 11:36:50 +00:00
osr-follow.js [turbofan] Fix usage of ThisFunction parameter in OSR. 2015-01-30 13:09:44 +00:00
osr-for-let.js [turbofan] Simplify context specialization and fix for OSR. 2015-02-19 11:36:50 +00:00
osr-forin-nested.js [turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in. 2015-03-10 09:27:40 +00:00
osr-forin.js Speed up tests for OSR of for-in and for-of loops. 2015-02-02 11:52:07 +00:00
osr-forof.js Speed up tests for OSR of for-in and for-of loops. 2015-02-02 11:52:07 +00:00
osr-function-id2.js [turbofan] Fix usage of ThisFunction parameter in OSR. 2015-01-30 13:09:44 +00:00
osr-function-id.js [turbofan] Fix usage of ThisFunction parameter in OSR. 2015-01-30 13:09:44 +00:00
osr-function.js [turbofan] Fix usage of ThisFunction parameter in OSR. 2015-01-30 13:09:44 +00:00
osr-infinite.js [turbofan] Fix bug in OSR deconstruction. 2015-03-17 17:55:29 +00:00
osr-labeled.js [turbofan] Fix bug in OSR deconstruction. 2015-03-17 17:55:29 +00:00
osr-literals-adapted.js [turbofan] Fix loading of JSFunction from activation in case of adapter frame. 2015-03-25 17:46:16 +00:00
osr-literals.js [turbofan] Fix loading of JSFunction from activation in case of adapter frame. 2015-03-25 17:46:16 +00:00
osr-manual1.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-manual2.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-maze1.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
osr-maze2.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
osr-multiple2.js [turbofan] Implement OSR for outer loops. 2015-01-12 11:39:58 +00:00
osr-multiple3.js [turbofan] Implement OSR for outer loops. 2015-01-12 11:39:58 +00:00
osr-multiple.js [turbofan] Implement OSR for outer loops. 2015-01-12 11:39:58 +00:00
osr-nested2.js [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR. 2015-02-11 13:26:45 +00:00
osr-nested2b.js [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR. 2015-02-11 13:26:45 +00:00
osr-nested3.js [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR. 2015-02-11 13:26:45 +00:00
osr-nested3b.js [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR. 2015-02-11 13:26:45 +00:00
osr-nested.js
osr-one.js
osr-regex-id.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-regress-max-locals.js
osr-sar.js [turbofan] Implement OSR for outer loops. 2015-01-12 11:39:58 +00:00
osr-simple.js Reduce the number of iterations in some OSR tests by using an explicit %OptimizeOsr(). 2015-02-10 09:53:22 +00:00
osr-top1.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-top2.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-top3.js Make it easier to test OSR with %OptimizeOsr() runtime call. 2015-02-09 12:47:43 +00:00
osr-two.js
osr-uint32.js
osr-warm.js [turbofan] Implement OSR for outer loops. 2015-01-12 11:39:58 +00:00
osr-while-let.js [turbofan] Simplify context specialization and fix for OSR. 2015-02-19 11:36:50 +00:00
osr-with-args.js
phi-representations.js
pic.js
property-calls.js
property-refs.js
property-simple.js
property-static.js
property-stores.js
proto-chain-constant.js
proto-chain-load.js
receiver-conversion.js [turbofan] Fix receiver binding for inlined callees. 2015-10-27 12:13:49 +00:00
recursive-deopt.js
regress-0.js
regress-1.js
regress-2.js
regress-3.js
regress-4.js
regress-5.js
regress-6.js
regress-7.js
regress-8.js
regress-1085.js
regress-1394.js
regress-3786.js [turbofan] Raise max virtual registers and call parameter limit. 2014-12-25 18:18:04 +00:00
regress-3812.js [turbofan] Fix truncation/representation sloppiness wrt. bool/bit. 2015-01-14 12:06:56 +00:00
regress-4206.js [arm64][turbofan] Fix implementation of Float64Min. 2015-06-23 11:58:58 +00:00
regress-4207.js [turbofan] NaN is never truish. 2015-06-23 12:24:54 +00:00
regress-4389-1.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4389-2.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4389-3.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4389-4.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4389-5.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4389-6.js [crankshaft] DCE must not eliminate (observable) math operations. 2015-08-25 06:24:55 +00:00
regress-4413-1.js [builtins] Make sure argument count is always valid for C++ builtins. 2015-10-06 08:23:51 +00:00
regress-4470-1.js [turbofan] Add test case for stores to properties that are also present on prototype. 2015-10-23 12:09:54 +00:00
regress-96989.js
regress-106351.js
regress-177883.js
regress-411262.js Fix more fallout from making OptimizeFunctionOnNextCall work as advertised. 2014-09-05 15:31:33 +00:00
regress-416359.js [turbofan] Add missing deopt for the assignment in the for-in statement. 2015-01-28 16:16:24 +00:00
regress-439743.js [x64] Fix optimization for certain checked load/stores. 2014-12-10 07:49:12 +00:00
regress-443744.js [turbofan] Fix unsafe out-of-bounds check for checked loads/stores. 2014-12-19 12:53:29 +00:00
regress-444508.js [turbofan] Correctify lowering of Uint8ClampedArray buffer access. 2014-12-22 08:27:59 +00:00
regress-444695.js [turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer. 2014-12-23 06:54:00 +00:00
regress-445267.js [turbofan] Fix invalid bounds check with overflowing offset. 2014-12-29 10:01:15 +00:00
regress-445732.js Fix %NeverOptimizeFunction() intrinsic. 2015-01-02 08:18:01 +00:00
regress-445858.js [x64] Rearrange code for OOB integer loads. 2015-01-02 10:15:40 +00:00
regress-445859.js [turbofan] Truncation of Bit/Word8/16 to Word32 is a no-op. 2015-01-02 10:39:10 +00:00
regress-445876.js Make control reducer revisit newly introduced merges. 2015-01-05 16:35:34 +00:00
regress-445907.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
regress-446156.js [turbofan] Don't crash when typing load from a Uint8ClampedArray. 2015-01-05 13:43:47 +00:00
regress-446647.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
regress-446778.js Restrict representation inference to avoid truncation of phi inputs. 2015-01-07 11:38:54 +00:00
regress-447567.js Fix Object.preventExtensions, .seal, .freeze on typed arrays 2015-10-26 11:08:02 +00:00
regress-451012.js [turbofan] Handle cyclic dependencies in context typing. 2015-01-27 06:57:41 +00:00
regress-452427.js [turbofan] Only replace nodes eagerly during simplified lowering if the types stay the same. 2015-01-27 09:27:37 +00:00
regress-463056.js [turbofan] Fix deferred replacement in simplified lowering. 2015-03-02 12:49:49 +00:00
regress-468162.js [turbofan] Fix lowering of Math.max for integral inputs. 2015-03-20 12:05:19 +00:00
regress-468727.js [turbofan] Remember types for deoptimization during simplified lowering. 2015-03-19 14:00:33 +00:00
regress-469089.js [turbofan] Work-around untagged result of CompareIC in pointer maps. 2015-03-20 09:45:12 +00:00
regress-491578.js [turbofan] Properly kill Terminate nodes when removing loops. 2015-05-26 10:48:07 +00:00
regress-3136962.js
regress-3185901.js
regress-3218915.js
regress-3249650.js
regress-3260426.js
regress-arguments.js
regress-arrayliteral.js
regress-bit-number-constant.js [turbofan] Fix truncation/representation sloppiness wrt. bool/bit. 2015-01-14 12:06:56 +00:00
regress-closures-with-eval.js
regress-const.js
regress-crbug-540593.js [turbofan] Don't try to inline non-inlineable functions. 2015-10-07 11:43:39 +00:00
regress-deopt-call-as-function.js
regress-funarguments.js
regress-funcaller.js
regress-gap.js
regress-gvn.js %GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present 2015-04-14 14:57:48 +00:00
regress-inline-callfunctionstub.js
regress-int32array-outofbounds-nan.js [turbofan] Quickfix for invalid number truncation of typed array loads. 2014-12-12 10:45:38 +00:00
regress-intoverflow.js
regress-lazy-deopt.js
regress-lbranch-double.js
regress-loadfield.js
regress-loop-deopt.js
regress-max.js
regress-ntl-effect.js Do not reduce effect phis for loops. 2015-01-03 12:46:00 +00:00
regress-or.js
regress-register-allocator2.js [x86] Fix register constraints for multiply high and modulus. 2014-11-03 06:28:12 +00:00
regress-register-allocator3.js [turbofan] phis cannot take registers as inputs 2014-11-06 12:56:44 +00:00
regress-register-allocator.js [x86] Fix register constraints for multiply-high. 2014-10-24 09:36:40 +00:00
regress-rep-change.js
regress-serialized-slots.js
regress-shared-deopt.js
regress-shift-left.js [turbofan] Right hand side of shifts needs ToUint32. 2015-07-03 11:42:00 +00:00
regress-shift-right-logical.js [turbofan] Right hand side of shifts needs ToUint32. 2015-07-03 11:42:00 +00:00
regress-shift-right.js [turbofan] Right hand side of shifts needs ToUint32. 2015-07-03 11:42:00 +00:00
regress-stacktrace-methods.js
regress-stacktrace.js Port CallSite methods to C++. 2015-04-28 08:52:47 +00:00
regress-to-number-binop-deopt.js [turbofan] Avoid ToNumber conversions if they could deoptimize. 2015-02-16 12:59:20 +00:00
regress-toint32.js
regress-uint8-deopt.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
regress-valueof.js
regress-variable-liveness-let.js [turbofan] Fix liveness analysis for let variable in TDZ. 2015-10-21 12:23:06 +00:00
regress-variable-liveness.js [turbofan] Fix variable liveness control structure creation. 2015-05-21 09:57:11 +00:00
rotate.js
safepoint.js
shift-shr.js Remove FLAG_opt_safe_uint32_operations. 2014-10-06 13:15:23 +00:00
short-circuit.js
simple-bailouts.js
simple-binary-op.js
simple-deopt.js
simple-global-access.js
simple-inlining.js
smi-stores-opt.js
store-elimination.js First implementation of store elimination. 2014-03-25 09:06:16 +00:00
strict-recompile.js
string-length.js [turbofan] Optimize string "length" property access based on types. 2015-07-13 06:02:22 +00:00
switch-bailout.js
this-property-refs.js
thisfunction.js
to-fast-properties.js
truncating-store-deopt.js [turbofan] Support lazy deopt for truncating store to a typed array. 2015-03-19 05:46:30 +00:00
truncating-store.js [turbofan] Insert appropriate conversions for typed array stores. 2014-11-25 08:40:29 +00:00
try-binop.js [turbofan] Fix throwing conversion inserted by JSTypedLowering. 2015-06-12 04:42:14 +00:00
try-deopt.js [mjsunit] Remove unsupported flag --turbo-deoptimization from tests. 2015-06-15 09:43:11 +00:00
try-osr.js [turbofan] Add mjsunit tests for try-catch-finally and OSR. 2015-06-09 08:16:41 +00:00
type-feedback-after-throw.js
uint32.js Treat HArgumentsObject as a safe use during Uint32 analysis phase. 2015-04-13 10:47:15 +00:00
unary-add.js
variables.js