Commits · 2f796cdb0c1ea0689f4b056e230845f6e1b5f44a · Linshizhi / V8

03 May, 2016 31 commits

Reland of [heap] Fix clearing slots for map and size during LeftTrimFixedArray... · 2f796cdb

mlippautz authored May 03, 2016

Reland of [heap] Fix clearing slots for map and size during LeftTrimFixedArray (patchset #1 id:1 of https://codereview.chromium.org/1947473002/ )

Reason for revert:
Unrelated to waterfall failures.

Original issue's description:
> Revert of [heap] Fix clearing slots for map and size during LeftTrimFixedArray (patchset #1 id:1 of https://codereview.chromium.org/1943263002/ )
>
> Reason for revert:
> GC-stress failures: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305/steps/Mjsunit/logs/array-copywithin
>
> Original issue's description:
> > [heap] Fix clearing slots for map and size during LeftTrimFixedArray
> >
> > BUG=chromium:598319
> > LOG=N
> >
> > Committed: https://crrev.com/5aa1d9c3cfde4389fb5a34e98a5dccbca9dc9f12
> > Cr-Commit-Position: refs/heads/master@{#35970}
>
> TBR=ulan@chromium.org,mlippautz@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:598319
>
> Committed: https://crrev.com/a4129bb45a3bb8cc68bb2e07ee1e0a734f04ce4b
> Cr-Commit-Position: refs/heads/master@{#35979}

TBR=ulan@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:598319

Review-Url: https://codereview.chromium.org/1947503002
Cr-Commit-Position: refs/heads/master@{#35986}

2f796cdb

[turbofan] Better test for for-in/continue OSR problem. · caf460b2

jarin authored May 03, 2016

The problem is actually not related to try-catch, so here is a test
without try-catch.

BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1943883002
Cr-Commit-Position: refs/heads/master@{#35985}

caf460b2

Reland of [turbofan] Restore basic write barrier elimination. (patchset #1... · 95b8f3b0

mlippautz authored May 03, 2016

Reland of [turbofan] Restore basic write barrier elimination. (patchset #1 id:1 of https://codereview.chromium.org/1943743003/ )

Reason for revert:
Jakob found the actual issue with the CL and is going to land the fix after relanding the WB elimination.

Original issue's description:
> Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )
>
> Reason for revert:
> Breaks WBs that should be there ;)
>
> https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305
>
> Will open repro bug asap.
>
> Original issue's description:
> > [turbofan] Restore basic write barrier elimination.
> >
> > Restore the basic write barrier elimination that we used to run as part
> > of the simplified lowering phase (in ChangeLowering actually) before, by
> > moving the write barrier computation to SimplifiedLowering where we can
> > still look at types and consider the heap/isolate, and just update the
> > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
> > lowering to a machine Load/Store.
> >
> > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
> > R=mstarzinger@chromium.org
> > BUG=v8:4969,chromium:608636
> > LOG=n
> >
> > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
> > Cr-Commit-Position: refs/heads/master@{#35969}
>
> TBR=mstarzinger@chromium.org,bmeurer@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4969,chromium:608636
>
> Committed: https://crrev.com/a782e93c617e728cded5ad878de11137a67891b7
> Cr-Commit-Position: refs/heads/master@{#35983}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4969,chromium:608636

Review-Url: https://codereview.chromium.org/1943323002
Cr-Commit-Position: refs/heads/master@{#35984}

95b8f3b0

Revert of [turbofan] Restore basic write barrier elimination. (patchset #2... · a782e93c

mlippautz authored May 03, 2016

Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )

Reason for revert:
Breaks WBs that should be there ;)

https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305

Will open repro bug asap.

Original issue's description:
> [turbofan] Restore basic write barrier elimination.
>
> Restore the basic write barrier elimination that we used to run as part
> of the simplified lowering phase (in ChangeLowering actually) before, by
> moving the write barrier computation to SimplifiedLowering where we can
> still look at types and consider the heap/isolate, and just update the
> WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
> lowering to a machine Load/Store.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
> R=mstarzinger@chromium.org
> BUG=v8:4969,chromium:608636
> LOG=n
>
> Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
> Cr-Commit-Position: refs/heads/master@{#35969}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4969,chromium:608636

Review-Url: https://codereview.chromium.org/1943743003
Cr-Commit-Position: refs/heads/master@{#35983}

a782e93c

[turbofan] Fix OSR environment in for-in. · 2da181b0

jarin authored May 03, 2016

BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1949433002
Cr-Commit-Position: refs/heads/master@{#35982}

2da181b0

[turbofan] Move some member methods off Pipeline. · 7c6ff54e

mstarzinger authored May 03, 2016

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1947463002
Cr-Commit-Position: refs/heads/master@{#35981}

7c6ff54e

[serializer] cache ICs only as code stubs with key. · b80bfbfe

yangguo authored May 03, 2016

Some uninitialized ICs used to be implemented as builtins. This is apparently
no longer the case.

R=bmeurer@chromium.org, mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/1940283002
Cr-Commit-Position: refs/heads/master@{#35980}

b80bfbfe

Revert of [heap] Fix clearing slots for map and size during LeftTrimFixedArray... · a4129bb4

yangguo authored May 03, 2016

Revert of [heap] Fix clearing slots for map and size during LeftTrimFixedArray (patchset #1 id:1 of https://codereview.chromium.org/1943263002/ )

Reason for revert:
GC-stress failures: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305/steps/Mjsunit/logs/array-copywithin

Original issue's description:
> [heap] Fix clearing slots for map and size during LeftTrimFixedArray
>
> BUG=chromium:598319
> LOG=N
>
> Committed: https://crrev.com/5aa1d9c3cfde4389fb5a34e98a5dccbca9dc9f12
> Cr-Commit-Position: refs/heads/master@{#35970}

TBR=ulan@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:598319

Review-Url: https://codereview.chromium.org/1947473002
Cr-Commit-Position: refs/heads/master@{#35979}

a4129bb4

[turbofan] Make Pipeline more private. · 3394e889

mstarzinger authored May 03, 2016

By now the Pipeline class can no longer be used to construct instances
from the outside. The constructor and all non-exposed helpers can be
made private.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1943243003
Cr-Commit-Position: refs/heads/master@{#35978}

3394e889

[API] remove (deprecated) hidden properties. · 6df9379c

yangguo authored May 03, 2016

v8::Object::{Set,Get,Delete}HiddenValue have long been deprecated.
Please use v8::Object::{Set,Has,Get}Private instead.

R=jochen@chromium.org
LOG=Y

Review-Url: https://codereview.chromium.org/1942233002
Cr-Commit-Position: refs/heads/master@{#35977}

6df9379c

[wasm] Mark all 64-bit instructions as supported on 32-bit platforms. · b6db2255

ahaas authored May 03, 2016

Additionally I removed some stale comments.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1941323002
Cr-Commit-Position: refs/heads/master@{#35976}

b6db2255

[turbofan] Fix --trace-trubo to generate complete JSON files. · 51a289b1

mstarzinger authored May 03, 2016

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1946523002
Cr-Commit-Position: refs/heads/master@{#35975}

51a289b1

[wasm] Fix bug with empty input to Wasm.instantiateModuleFromAsm() · 98c23129

titzer authored May 03, 2016

R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:605488
LOG=Y

Review-Url: https://codereview.chromium.org/1940243002
Cr-Commit-Position: refs/heads/master@{#35974}

98c23129

[wasm] Split the wasm compilation into two phases for parallel compilation. · 18c380c3

ahaas authored May 03, 2016

Graph construction, graph scheduling, instruction selection, and register
allocation has been moved to ExecuteCompilation, which will eventually be
executed on the background threads. Code generation remains in
FinishCompilation because it has to be executed by the main thread.

Additionally, WasmCompilationUnits are finished more eagerly in
wasm-module.cc to save memory.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1942773002
Cr-Commit-Position: refs/heads/master@{#35973}

18c380c3

Add HasProperty code stub that tries simple lookups or jumps to runtime otherwise. · c89e6eb5

ishell authored May 03, 2016

Code common with ObjectHasOwnProperty builtin was moved to CodeStubAssembler.

BUG=v8:2743
LOG=Y

Review-Url: https://codereview.chromium.org/1894953004
Cr-Commit-Position: refs/heads/master@{#35972}

c89e6eb5

[turbofan] Remove atomic regions during effect/control linearization. · 23a7dda9

bmeurer authored May 03, 2016

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1941373002
Cr-Commit-Position: refs/heads/master@{#35971}

23a7dda9

[heap] Fix clearing slots for map and size during LeftTrimFixedArray · 5aa1d9c3

mlippautz authored May 03, 2016

BUG=chromium:598319
LOG=N

Review-Url: https://codereview.chromium.org/1943263002
Cr-Commit-Position: refs/heads/master@{#35970}

5aa1d9c3

[turbofan] Restore basic write barrier elimination. · 7dcb6ad3

bmeurer authored May 03, 2016

Restore the basic write barrier elimination that we used to run as part
of the simplified lowering phase (in ChangeLowering actually) before, by
moving the write barrier computation to SimplifiedLowering where we can
still look at types and consider the heap/isolate, and just update the
WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
lowering to a machine Load/Store.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
R=mstarzinger@chromium.org
BUG=v8:4969,chromium:608636
LOG=n

Review-Url: https://codereview.chromium.org/1938993002
Cr-Commit-Position: refs/heads/master@{#35969}

7dcb6ad3

Fix ExternalTwobyteStringUtf16CharacterStream::PushBack(kEndOfInput) · 57f0a521

vogelheim authored May 03, 2016

PushBack(end-of-input) is a little weird, but since
Utf16CharacterStream::Advance will advance pos_m, but not buffer_cursor_
when at the end of the stream, pushing back the end-of-input token needs
to do the exact inverse.

(The reason Advance does not advance buffer_cursor_ is that buffer_cursor_ is often dereferenced
 directly to access memory and so always needs to point to, well, memory.)
(The PushBack implementation for all other streams looks correct.)

R=rossberg@chromium.org
BUG=chromium:607903
LOG=Y

Review-Url: https://codereview.chromium.org/1941843002
Cr-Commit-Position: refs/heads/master@{#35968}

57f0a521

Fix Scanner::PushBack for surrogate code points. · ec2cb208

vogelheim authored May 03, 2016

A wise man once said: If you want right result, compare right value.

R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1939173002
Cr-Commit-Position: refs/heads/master@{#35967}

ec2cb208

[turbofan] Rewire all control inputs in effect/control linearization. · 0e4469fd
jarin authored May 03, 2016
```
Review-Url: https://codereview.chromium.org/1941353002
Cr-Commit-Position: refs/heads/master@{#35966}
```
0e4469fd

[turbofan] Properly hook up string operators in the effect/control chain. · 79688584

bmeurer authored May 03, 2016

The string operators not only read memory, but also write memory in case
of cons string flattening, so we better make sure to have the stub calls
in the effect chain.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1938383002
Cr-Commit-Position: refs/heads/master@{#35965}

79688584

[wasm] Remove unnecessary kExprNop from WASM_BR and other macros. · 2949e05d

titzer authored May 03, 2016

R=ahaas@chromium.org,binji@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1942873002
Cr-Commit-Position: refs/heads/master@{#35964}

2949e05d

[stubs]: Implement ArrayNoArgumentConstructor as a TF stub · fa570e55

danno authored May 03, 2016

Review-Url: https://codereview.chromium.org/1903723003
Cr-Commit-Position: refs/heads/master@{#35963}

fa570e55

Renaming cleanup of Promises · d8967c55

littledan authored May 03, 2016

The Promise code previously used many names which were gratuitiously
different from the specification. This patch swaps in names from the
ES2015 spec, and inserts crossreferences to the spec. The patch
leaves mirrors over Promises unchanged for now, as these changes
could have compatibility risk.

R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/1919143004
Cr-Commit-Position: refs/heads/master@{#35962}

d8967c55

X87: [turbofan] Run everything after representation selection concurrently. · 8d018a39

zhengxing.li authored May 03, 2016

  port d1b3d426 (r35918)

  original commit message:
  Further refactor the pipeline to even run the first scheduler (part of
  the effect control linearization) concurrently. This temporarily
  disables most of the write barrier elimination, but we will get back to
  that later.

  Drive-by-fix: Remove the dead code from ChangeLowering, and stack
  allocate the Typer in the pipeline. Also migrate the AllocateStub to a
  native code builtin, so that we have the code object + a handle to it
  available all the time.

BUG=

Review-Url: https://codereview.chromium.org/1940143002
Cr-Commit-Position: refs/heads/master@{#35961}

8d018a39

Remove some dead code in src/objects.cc · c135ab42

yangguo authored May 03, 2016

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1942163002
Cr-Commit-Position: refs/heads/master@{#35960}

c135ab42

[turbofan] Hook up the shift code stubs with TurboFan. · 577ec180

bmeurer authored May 03, 2016

Use the ShiftLeftStub, ShiftRightStub and ShiftRightLogicalStub in
JSGenericLowering instead of the old-style patching BinaryOpIC.

Also remove the machinery to support patching ICs in TurboFan
completely, as this was the last user of code patching in TurboFan!

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/1942153002
Cr-Commit-Position: refs/heads/master@{#35959}

577ec180

Update V8 DEPS. · cb73f264

v8-autoroll authored May 03, 2016

Rolling v8/build to 41661dd32f84419c998ffcb52bd5baff0fe94bc9

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/1945553002
Cr-Commit-Position: refs/heads/master@{#35958}

cb73f264

Properly disallow 'yield' in class expressions and arrow parameters · 9e9abcff

adamk authored May 03, 2016

Yield expressions are not allowed in formal parameter initializers of
generators, but we weren't properly catching the case where the yield
expression appeared in the 'extends' clause of a class expression.

They also aren't allowed in arrow functions, which we were failing to
catch due to not looking at the obscurely-named "FormalParameterInitializerError"
bit of ExpressionClassifier.

This patch passes along an ExpressionClassifier when parsing class
expressions and accumulates the proper error for that case.

For the arrow function case, the fix is simply to check for the
"formal parameter initializer" error once we know we've parsed
an arrow function. The error message used for this has also
been made specific to yield expressions.

Tests are added both for the error case and the non-error cases (where
yield is used in such a position inside the class body).

BUG=v8:4966, v8:4968, v8:4974
LOG=n

Review-Url: https://codereview.chromium.org/1941823003
Cr-Commit-Position: refs/heads/master@{#35957}

9e9abcff

Skip new module test262 tests that fail on the waterfall · 5b8845bd

Adam Klein authored May 03, 2016

BUG=v8:4985
LOG=n
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/1939423002 .

Cr-Commit-Position: refs/heads/master@{#35956}

5b8845bd

02 May, 2016 9 commits

test262 roll · c81616fb

littledan authored May 02, 2016

R=adamk

Review-Url: https://codereview.chromium.org/1931653003
Cr-Commit-Position: refs/heads/master@{#35955}

c81616fb

PPC/s390: modify if/else block to fix debug build · d6229137

bjaideep authored May 02, 2016

changed the if/else block to fix the debug build
failure on PPC/s390.

R=adamk@chromium.org, mbrandy@us.ibm.com

BUG=
LOG=N

Review-Url: https://codereview.chromium.org/1941683003
Cr-Commit-Position: refs/heads/master@{#35954}

d6229137

S390: Fix storing to below stack to avoid sampler handler corrupting stored value · 141bc11e

jyan authored May 02, 2016

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/1936953004
Cr-Commit-Position: refs/heads/master@{#35953}

141bc11e

S390X: Prevent upper 32bit corruption in 32bit ops · 59b9ff3f

jyan authored May 02, 2016

Fix A couple places which could cause upper 32bit corruption

R=joransiu@ca.ibm.com, mbrandy@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/1939763003
Cr-Commit-Position: refs/heads/master@{#35952}

59b9ff3f

Turbofan: Add MachineOperators for SIMD. · 1c94bed6

bbudge authored May 02, 2016

Takes the SIMD runtime intrinsics as a starting point for defining TF machine operators. The rationale for omitting functions is:

 - Check functions.
 - 'FromXxxBits' functions. These are essentially casts.
 - UInt constructors. int and uint aren't distinguished in wasm.
 - Uint functions, except where their behavior is bitwise different from the Int function.

Some operators are typeless, i.e. they are the same for multiple related types, e.g. logical ops for int types, load/store for float and int types. Use a 'Simd128' prefix for these operators.

Skipped fns:

Float32x4Check
Float32x4FromInt32x4Bits
Float32x4FromUint32x4Bits
Float32x4FromInt16x8Bits
Float32x4FromUint16x8Bits
Float32x4FromInt8x16Bits
Float32x4FromUint8x16Bits

Int32x4Check
Int32x4FromUint32x4
Int32x4FromFloat32x4Bits
Int32x4FromUint32x4Bits
Int32x4FromInt16x8Bits
Int32x4FromUint16x8Bits
Int32x4FromInt8x16Bits
Int32x4FromUint8x16Bits

CreateUint32x4
Uint32x4Check
Uint32x4ExtractLane
Uint32x4ReplaceLane
Uint32x4Add
Uint32x4Sub
Uint32x4Mul
Uint32x4And
Uint32x4Or
Uint32x4Xor
Uint32x4Not
Uint32x4Equal
Uint32x4NotEqual
Uint32x4Select
Uint32x4Swizzle
Uint32x4Shuffle
Uint32x4FromInt32x4
Uint32x4FromFloat32x4Bits
Uint32x4FromInt32x4Bits
Uint32x4FromInt16x8Bits
Uint32x4FromUint16x8Bits
Uint32x4FromInt8x16Bits
Uint32x4FromUint8x16Bits

Bool32x4Check

Int16x8Check
Int16x8FromUint16x8
Int16x8FromFloat32x4Bits
Int16x8FromInt32x4Bits
Int16x8FromUint32x4Bits
Int16x8FromUint16x8Bits
Int16x8FromInt8x16Bits
Int16x8FromUint8x16Bits

CreateUint16x8
Uint16x8Check
Uint16x8ExtractLane
Uint16x8ReplaceLane
Uint16x8Add
Uint16x8Sub
Uint16x8Mul
Uint16x8And
Uint16x8Or
Uint16x8Xor
Uint16x8Not
Uint16x8Equal
Uint16x8NotEqual
Uint16x8Select
Uint16x8Swizzle
Uint16x8Shuffle
Uint16x8FromInt16x8
Uint16x8FromFloat32x4Bits
Uint16x8FromInt32x4Bits
Uint16x8FromUint32x4Bits
Uint16x8FromInt16x8Bits
Uint16x8FromInt8x16Bits
Uint16x8FromUint8x16Bits

Bool16x8Check

Int8x16Check
Int8x16FromUint8x16
Int8x16FromFloat32x4Bits
Int8x16FromInt32x4Bits
Int8x16FromUint32x4Bits
Int8x16FromInt16x8Bits
Int8x16FromUint16x8Bits
Int8x16FromUint8x16Bits

CreateUint8x16
Uint8x16Check
Uint8x16ExtractLane
Uint8x16ReplaceLane
Uint8x16Add
Uint8x16Sub
Uint8x16Mul
Uint8x16And
Uint8x16Or
Uint8x16Xor
Uint8x16Not
Uint8x16Equal
Uint8x16NotEqual
Uint8x16Select
Uint8x16Swizzle
Uint8x16Shuffle
Uint8x16FromInt8x16
Uint8x16FromFloat32x4Bits
Uint8x16FromInt32x4Bits
Uint8x16FromUint32x4Bits
Uint8x16FromInt16x8Bits
Uint8x16FromUint16x8Bits
Uint8x16FromInt8x16Bits

Bool8x16Check

Generic operators for Float, Int types:

Simd128Load
Simd128Load1
Simd128Load2
Simd128Load3
Simd128Store
Simd128Store1
Simd128Store2
Simd128Store3

Generic operators for Int types:

Simd128And
Simd128Or
Simd128Xor
Simd128Not

LOG=N
BUG=v8:4124

Committed: https://crrev.com/3831d41e4ce7b162775732cb6ac1f8139e60aa30
Cr-Commit-Position: refs/heads/master@{#35213}

Review-Url: https://codereview.chromium.org/1848433003
Cr-Commit-Position: refs/heads/master@{#35951}

1c94bed6

S390: [turbofan] Run everything after representation selection concurrently. · 5d84567a

bryleun authored May 02, 2016

    Port d1b3d426

    Original commit message:

        Further refactor the pipeline to even run the first scheduler (part of
        the effect control linearization) concurrently. This temporarily
        disables most of the write barrier elimination, but we will get back to
        that later.

        Drive-by-fix: Remove the dead code from ChangeLowering, and stack
        allocate the Typer in the pipeline. Also migrate the AllocateStub to a
        native code builtin, so that we have the code object + a handle to it
        available all the time.

    R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, mbrandy@us.ibm.com

BUG=

Review-Url: https://codereview.chromium.org/1941783003
Cr-Commit-Position: refs/heads/master@{#35950}

5d84567a

Use InternalArrays from certain Intl code · 4f374bbc

littledan authored May 02, 2016

The ECMA 402 implementation previously pushed directly to real
Arrays, which risks having observably incorrect behavior in the
presence of monkey patching. This patch uses InternalArrays instead
to avoid that hazard.

R=jshin@chromium.org,yangguo@chromium.org
BUG=chromium:604299
LOG=N

Review-Url: https://codereview.chromium.org/1923803002
Cr-Commit-Position: refs/heads/master@{#35949}

4f374bbc

[debugger] Add JSProxy support in Runtime::GetInternalProperties · f65e06b9

kozyatinskiy authored May 02, 2016

For proxy object this methods returns target value, handler object and is revoked flag.

R=yangguo@chromium.org,cbruni@chromium.org
BUG=chromium:588705
LOG=Y

Review-Url: https://codereview.chromium.org/1938663002
Cr-Commit-Position: refs/heads/master@{#35948}

f65e06b9

Avoid infinite loop in RegExp.prototype[Symbol.split] · 96746cc7

adamk authored May 02, 2016

Our implementation of the spec got one comparison wrong, at
step 19.d.iii (we were comparing against 'q' instead of 'p').

R=littledan@chromium.org
BUG=chromium:607566
LOG=n

Review-Url: https://codereview.chromium.org/1940643002
Cr-Commit-Position: refs/heads/master@{#35947}

96746cc7