1. 11 Nov, 2014 1 commit
  2. 23 Oct, 2014 1 commit
  3. 15 Oct, 2014 2 commits
  4. 10 Oct, 2014 1 commit
  5. 07 Oct, 2014 1 commit
  6. 23 Apr, 2014 1 commit
  7. 14 Jan, 2014 1 commit
  8. 22 Nov, 2013 1 commit
  9. 05 Jul, 2013 1 commit
  10. 05 Jun, 2013 1 commit
  11. 22 Apr, 2013 1 commit
  12. 18 Apr, 2013 1 commit
  13. 17 Apr, 2013 1 commit
  14. 09 Apr, 2013 1 commit
  15. 17 Sep, 2012 1 commit
  16. 28 Nov, 2011 1 commit
  17. 12 Oct, 2011 1 commit
  18. 26 Sep, 2011 1 commit
  19. 22 Sep, 2011 1 commit
  20. 13 Sep, 2011 2 commits
  21. 01 Sep, 2011 1 commit
  22. 16 Aug, 2011 1 commit
  23. 16 Jun, 2011 2 commits
  24. 15 Jun, 2011 1 commit
  25. 09 Jun, 2011 1 commit
  26. 08 Jun, 2011 1 commit
  27. 31 May, 2011 1 commit
  28. 30 May, 2011 1 commit
  29. 06 Jan, 2011 1 commit
  30. 04 Jan, 2011 2 commits
  31. 25 Oct, 2010 1 commit
  32. 14 Jun, 2010 1 commit
  33. 04 Mar, 2010 1 commit
  34. 19 Feb, 2010 1 commit
  35. 18 Feb, 2010 1 commit
  36. 15 Jan, 2010 1 commit
    • sgjesse@chromium.org's avatar
      Ensure correct boxing of values when calling functions on them · 562f90d3
      sgjesse@chromium.org authored
      When a function is called with a value type as the receiver this is now boxed as an object.
      
      This is a low-impact solution where the receiver is only boxed when required. For IC calls to the V8 builtins values are not boxed and as most of the functions on String.prototype, Number.prototype and Boolean.prototype are sitting there most IC calls on values will not need any boxing of the receiver.
      
      For calls which are not IC calls but calls through the CallFunctionStub a flag is used to determine whether the receiver might be a value and only when that is the case will the receiver be boxed.
      
      No changtes to Function.call and Function.apply - they already boxed values. According to the ES5 spec the receiver should not be boxed for these functions, but current browsers have not adopted that change yet.
      
      BUG=223
      TEST=test/mjsunit/value-wrapper.js
      TEST=test/mjsunit/regress/regress-crbug-3184.js
      Review URL: http://codereview.chromium.org/542087
      
      git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
      562f90d3