R=jkummerow@chromium.org
BUG=358059
LOG=N

Review URL: https://codereview.chromium.org/217083003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For example, invalid left hand sides are reference errors. PreParser didn't use
to produce this error ever, so the code for propagating reference errors
properly was missing, and reference errors turned into syntax errors.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/220233006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20408 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We incorrectly mark a KeyedStoreIC miss as a monomorphic prototype
failure even though it's the first time a particular (string) key has
been seen.

BUG=358088
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/219313002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=353487
TBR=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/220453007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also, rename all *Currently methods to Now*.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/219523003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20405 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Bonus cleanup: remove a few duplicate compiler flags

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/220883003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change shuffles the code in Simulator::VisitBitfield a bit
to work around a MemorySanitizer bug. New code should not be any
slower or less readable than before.

More info:
https://code.google.com/p/memory-sanitizer/issues/detail?id=50

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/212863002

Patch from Evgeniy Stepanov <eugenis@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

results, and disables the use of stos.

Random mmap() addresses conflict with sanitizer memory layout.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/212723003

Patch from Evgeniy Stepanov <eugenis@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20400 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

With the simulator, MSan detects all memory accesses from JIT code
without the need for annotations.

We'd like to keep the annotation in the native (w/o simulator) mode
until we can move all MSan+V8 users to simulator mode.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/212833002

Patch from Evgeniy Stepanov <eugenis@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20399 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/212483004

Patch from Evgeniy Stepanov <eugenis@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/216603005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=bmeuerer@chromium.org

Review URL: https://codereview.chromium.org/218623017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Previously we tried to share some code on by a slightly confusing re-use
of LDivI for a (general) flooring division. Now we cleanly separate
concerns, just like for the rest of the division-like operations. Note
that ARM64 already did it this way.

If we really want to save some code, we can introduce some macro
assembler instructions and/or helper functions in the code generator in
a future CL, but we should really try to avoid being "clever" to save
just a few lines of trivial code. Effort != complexity. :-)

Renamed some related Lithium operands on the way for more consistency.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/212703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20395 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Currently, internalizing a cons string could result in either an
in-place converted internalized cons string or a newly created
internalized sequential string, depending on allocation success.

The former could end up being embedded into an IC, which is not
supported.

R=mstarzinger@chromium.org
BUG=357103
LOG=N

Review URL: https://codereview.chromium.org/218993011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The flag was introduced to support console debugger in Chrome. That debugger was replaced by DevTools long time ago and the flag is always true now.

BUG=None
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/220743003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20393 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/219723002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/218683008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20391 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/220193007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20390 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218783003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20389 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There were some tests that are supposed to protect against js messing
with the meta data, however, they just didn't try hard enough.

BUG=354967
R=dcarney@chromium.org
LOG=y

Committed: https://code.google.com/p/v8/source/detail?r=20375

Review URL: https://codereview.chromium.org/215293005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In certain situations the PP register would be invalid in a FrameScope::Manual FrameAndConstantPoolScope

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/214623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/220763003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/218613002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/219213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20383 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Often, when we call MaybeObject::Verify, what we want is Object::ObjectVerify.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218993005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Store i18n meta data in hidden symbols instead of js accessible properties

BUG=354967
LOG=N
TBR=jochen@chromium.org

Review URL: https://codereview.chromium.org/220673002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Twin of https://codereview.chromium.org/210783003/ and https://codereview.chromium.org/211153003/.

Cleaned up DoChange a bit on the way, making things more uniform across platforms, removed useless comments etc.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/214613004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20376 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There were some tests that are supposed to protect against js messing
with the meta data, however, they just didn't try hard enough.

BUG=354967
R=dcarney@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/215293005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r20363 (235f866c)

Original commit message:
When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219923005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r20358 (5e9b653d)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/219163010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We should perform the illegal redeclaration check earlier so that we do not confuse the AST typer with missing type feedback nodes.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/218493007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218583008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, bmeurer@chromium.org
BUG=chromium:357330
LOG=Y

Review URL: https://codereview.chromium.org/219333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jarin@chromium.org
TBR=jarin@chromium.org
BUG=353487
LOG=n

Review URL: https://codereview.chromium.org/219493002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20365 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/218753005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20364 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.

R=verwaest@chromium.org
BUG=358057
LOG=Y

Review URL: https://codereview.chromium.org/219473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=358090
TEST=test/mjsunit/regress/regress-358090.js
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/213833008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Make sure when we shrink an object that we store a filler first into the free memory before updating the map or size.

BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/219103002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dcarney@chromium.org
BUG=357137
LOG=N

Review URL: https://codereview.chromium.org/219373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20357 ce2b1a6d-e550-0410-aec6-3dcde31c8c00