- 10 Feb, 2011 13 commits
-
-
ricow@chromium.org authored
This should fix the flaky cctest failure on the debug run of x64 with crankshaft enabled. Review URL: http://codereview.chromium.org/6480032 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement may throw or its behaviour can be altered. Instead operate on plain FixedArrays and turn them into JSArry later. BUG=v8:1130 TEST=test/mjsunit/regress/regress-1130.js Review URL: http://codereview.chromium.org/6481001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
Review URL: http://codereview.chromium.org/6480003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
Do not do standard property lookup on hidden properties object as it might reach Object.prototype which can be altered to forge identity hashes. Instead do only local lookup. Review URL: http://codereview.chromium.org/6472001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
fschneider@chromium.org authored
In the case where the function is not found in the global object, we have to generate a generic call. BUG=v8:1106 TEST=mjsunit/regress/regress-1106.js Review URL: http://codereview.chromium.org/6483010 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
vegorov@chromium.org authored
BUG=v8:1131 TEST=test/mjsunit/regress/regress-1131.js Review URL: http://codereview.chromium.org/6469006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
danno@chromium.org authored
Review URL: http://codereview.chromium.org/6410112 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
fschneider@chromium.org authored
Already done on ia-32. This change is for x64 and ARM. We now always require fixed input registers at calls to avoid overlap with temp registers. This fixes the affected instructions on ARM. Review URL: http://codereview.chromium.org/6471021 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
kmillikin@chromium.org authored
We could try to treat an HPhi as an HInstruction because the code did not properly handle the case of a phi in a block with itself as one of the predecessors. BUG=v8:1134 Review URL: http://codereview.chromium.org/6471020 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
kmillikin@chromium.org authored
Review URL: http://codereview.chromium.org/6480027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
fschneider@chromium.org authored
Whenever we use a fixed temp at a call that can eagerly deopt we now allow fixed register exclusively to avoid any overlap. Review URL: http://codereview.chromium.org/6479014 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
kmillikin@chromium.org authored
Make esi available to the register allocator rather than dedicating it permanently to the context. The context is still passed in register esi to JavaScript and to the runtime as part of the calling convention. Because some stubs might end up calling JS or the runtime, it is also conservatively passed to stubs. Roughly half the calls have been modified to use the context as an input value in fixed register esi. The other half are marked as calls or deferred code so esi is spilled and can be explicitly set. It is no longer necessary to restore the context to esi after a call that might change it. Review URL: http://codereview.chromium.org/6452001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
mikhail.naganov@gmail.com authored
As they are no more used in DevTools profiler, there is no need to prefix them with "devtools.profiler" namespace. Review URL: http://codereview.chromium.org/6456025 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 09 Feb, 2011 17 commits
-
-
antonm@chromium.org authored
Review URL: http://codereview.chromium.org/6463022 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
http://code.google.com/p/v8/source/detail?r=6555antonm@chromium.org authored
Compare JSObjects by identity immediately. When invoking EQUALS JS builtin, 1st argument is passed as a receiver and if it's a global object, it gets overwritten with global proxy object and thus one gets incorrect results. BUG=v8:1082 TBR=ricow@chromium.org Review URL: http://codereview.chromium.org/6461028 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
kmillikin@chromium.org authored
If we have a property access of the form this.x, where the access site sees the global object, we can specialize the IC stub so that it performs a map check without first performing a heap object check. Ensure that we do not get in JS code with a non-JSObject this value by deoptimizing at Function.prototype.apply if the first argument is not a JSObject. BUG=v8:1128 Review URL: http://codereview.chromium.org/6463025 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
whesse@chromium.org authored
Make VS2005 project files compile without errors: changelist http://codereview.chromium.org/6286135/. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
whesse@chromium.org authored
Review URL: http://codereview.chromium.org/6459023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
sgjesse@chromium.org authored
Change the comparison in the full code generator to use CompareIC instead of the CompareStub to record the types. This also implements the patching in the full code generator where the inlined smi code is de-activated by default to call the CompareIC once and then activating the inlined smi code by patching the code. Fixed the smi comparison in the ICCompareStub. Fixed ToBooleanStub to ensure that the scratch register used is not the input. Use r9 as default as that will never be input with Crankshaft. Implemented lithium instruction CmpTAndBranch. Make sure that the lithium instruction CmpID have operands in registrers as the current optimized code expects that. Review URL: http://codereview.chromium.org/6461017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
the code generated by the full code generator after my previous change. The generated code is the same as on ia32 and so is the patching. Review URL: http://codereview.chromium.org/6456023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
erik.corry@gmail.com authored
Review URL: http://codereview.chromium.org/6458026 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
lrn@chromium.org authored
BUG=v8::1126 TEST=test/mjsunit/regress/regress-1126.js Review URL: http://codereview.chromium.org/6459021 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
floitschV8@gmail.com authored
Review URL: http://codereview.chromium.org/6461018 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
whesse@chromium.org authored
Review URL: http://codereview.chromium.org/6458027 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
whesse@chromium.org authored
Review URL: http://codereview.chromium.org/6460030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
whesse@chromium.org authored
Review URL: http://codereview.chromium.org/6447007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
fschneider@chromium.org authored
Instead of using the stack, use a temporary integer register and avoid memory access. Review URL: http://codereview.chromium.org/6452002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ricow@chromium.org authored
Since our zap values are valid heap object addreses we might hit asserts if a heap object gets the value of a zap constant as its address. Review URL: http://codereview.chromium.org/6456022 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
kmillikin@chromium.org authored
When constructing stack traces we interpret the deoptimization data for optimized frames to find the receiver value. This value could sometimes be eliminated from the deoptimization data if we though it was unused. BUG=v8:1118 Review URL: http://codereview.chromium.org/6465023 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
BUG=1125 TEST=test/mjsunit/regress/regress-1125.js Review URL: http://codereview.chromium.org/6463001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 08 Feb, 2011 10 commits
-
-
antonm@chromium.org authored
If --debug-code is on, check that returned value and Top::has_pending_exception agree on exception state. Review URL: http://codereview.chromium.org/6450004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
BUG=v8:1121 TEST=test/mjsunit/regress/regress-1121.js Review URL: http://codereview.chromium.org/6454004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
Review URL: http://codereview.chromium.org/6458001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
Plus use more robust path when formatting messages---work directly with fixed arrays. BUG=v8:1107 TEST=test/mjsunit/getter-in-prototype.js,test/mjsunit/regress/regress-1107.js Review URL: http://codereview.chromium.org/6451004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
BUG=v8:1111 Review URL: http://codereview.chromium.org/6450005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
antonm@chromium.org authored
2) We cannot assert the declared property will go to the extension in the presence of callbacks and interceptors. BUG=1119 TEST=test/mjsunit/regress/regress-1119.js Review URL: http://codereview.chromium.org/6454011 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
Review URL: http://codereview.chromium.org/6453009 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
BUG=none TEST=none Review URL: http://codereview.chromium.org/6447003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
vegorov@chromium.org authored
BUG=v8:1109 TEST=test/mjsunit/regress/regress-1109.js Review URL: http://codereview.chromium.org/6453005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
ager@chromium.org authored
Review URL: http://codereview.chromium.org/6452004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-