Skip to content
This repository has been archived by the owner on Apr 22, 2023. It is now read-only.

Commit

Permalink
Browse files Browse the repository at this point in the history
v8: upgrade to v3.11.10.10
  • Loading branch information
piscisaureus committed Jun 20, 2012
1 parent fe464a2 commit 6b26583
Show file tree
Hide file tree
Showing 22 changed files with 182 additions and 44 deletions.
7 changes: 4 additions & 3 deletions deps/v8/build/common.gypi
Expand Up @@ -239,6 +239,7 @@
'WIN32',
],
'msvs_configuration_attributes': {
'OutputDirectory': '<(DEPTH)\\build\\$(ConfigurationName)',
'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)',
'CharacterSet': '1',
},
Expand Down Expand Up @@ -270,7 +271,7 @@
'target_conditions': [
['_toolset=="host"', {
'variables': {
'm32flag': '<!((echo | $(echo ${CXX_host:-$(which g++)}) -m32 -E - > /dev/null 2>&1) && echo "-m32" || true)',
'm32flag': '<!((echo | $(echo ${CXX_host:-$(which g++)}) -m32 -E - > /dev/null 2>&1) && echo -n "-m32" || true)',
},
'cflags': [ '<(m32flag)' ],
'ldflags': [ '<(m32flag)' ],
Expand All @@ -280,7 +281,7 @@
}],
['_toolset=="target"', {
'variables': {
'm32flag': '<!((echo | $(echo ${CXX_target:-${CXX:-$(which g++)}}) -m32 -E - > /dev/null 2>&1) && echo "-m32" || true)',
'm32flag': '<!((echo | $(echo ${CXX_target:-${CXX:-$(which g++)}}) -m32 -E - > /dev/null 2>&1) && echo -n "-m32" || true)',
},
'cflags': [ '<(m32flag)' ],
'ldflags': [ '<(m32flag)' ],
Expand Down Expand Up @@ -323,7 +324,7 @@
},
'conditions': [
['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="netbsd"', {
'cflags': [ '-Wno-unused-parameter',
'cflags': [ '-Wall', '<(werror)', '-W', '-Wno-unused-parameter',
'-Wnon-virtual-dtor', '-Woverloaded-virtual' ],
}],
],
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/arm/full-codegen-arm.cc
Expand Up @@ -328,7 +328,7 @@ void FullCodeGenerator::EmitProfilingCounterReset() {
}
if (isolate()->IsDebuggerActive()) {
// Detect debug break requests as soon as possible.
reset_value = FLAG_interrupt_budget >> 4;
reset_value = 10;
}
__ mov(r2, Operand(profiling_counter_));
__ mov(r3, Operand(Smi::FromInt(reset_value)));
Expand Down
12 changes: 6 additions & 6 deletions deps/v8/src/arm/lithium-codegen-arm.cc
Expand Up @@ -2594,15 +2594,15 @@ void LCodeGen::EmitLoadFieldOrConstantFunction(Register result,
} else {
// Negative lookup.
// Check prototypes.
HeapObject* current = HeapObject::cast((*type)->prototype());
Handle<HeapObject> current(HeapObject::cast((*type)->prototype()));
Heap* heap = type->GetHeap();
while (current != heap->null_value()) {
Handle<HeapObject> link(current);
__ LoadHeapObject(result, link);
while (*current != heap->null_value()) {
__ LoadHeapObject(result, current);
__ ldr(result, FieldMemOperand(result, HeapObject::kMapOffset));
__ cmp(result, Operand(Handle<Map>(JSObject::cast(current)->map())));
__ cmp(result, Operand(Handle<Map>(current->map())));
DeoptimizeIf(ne, env);
current = HeapObject::cast(current->map()->prototype());
current =
Handle<HeapObject>(HeapObject::cast(current->map()->prototype()));
}
__ LoadRoot(result, Heap::kUndefinedValueRootIndex);
}
Expand Down
3 changes: 2 additions & 1 deletion deps/v8/src/arm/macro-assembler-arm.cc
Expand Up @@ -2878,7 +2878,8 @@ void MacroAssembler::LoadTransitionedArrayMapConditional(
Context::SlotOffset(Context::JS_ARRAY_MAPS_INDEX)));
size_t offset = expected_kind * kPointerSize +
FixedArrayBase::kHeaderSize;
cmp(map_in_out, scratch);
ldr(ip, FieldMemOperand(scratch, offset));
cmp(map_in_out, ip);
b(ne, no_map_match);

// Use the transitioned cached map.
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/hydrogen.cc
Expand Up @@ -4698,7 +4698,7 @@ HInstruction* HGraphBuilder::BuildStoreNamedField(HValue* object,
// If the property does not exist yet, we have to check that it wasn't made
// readonly or turned into a setter by some meanwhile modifications on the
// prototype chain.
if (!lookup->IsProperty()) {
if (!lookup->IsProperty() && type->prototype()->IsJSReceiver()) {
Object* proto = type->prototype();
// First check that the prototype chain isn't affected already.
LookupResult proto_result(isolate());
Expand Down
4 changes: 4 additions & 0 deletions deps/v8/src/ia32/full-codegen-ia32.cc
Expand Up @@ -317,6 +317,10 @@ void FullCodeGenerator::EmitProfilingCounterReset() {
// Self-optimization is a one-off thing: if it fails, don't try again.
reset_value = Smi::kMaxValue;
}
if (isolate()->IsDebuggerActive()) {
// Detect debug break requests as soon as possible.
reset_value = 10;
}
__ mov(ebx, Immediate(profiling_counter_));
__ mov(FieldOperand(ebx, JSGlobalPropertyCell::kValueOffset),
Immediate(Smi::FromInt(reset_value)));
Expand Down
12 changes: 6 additions & 6 deletions deps/v8/src/ia32/lithium-codegen-ia32.cc
Expand Up @@ -2325,15 +2325,15 @@ void LCodeGen::EmitLoadFieldOrConstantFunction(Register result,
} else {
// Negative lookup.
// Check prototypes.
HeapObject* current = HeapObject::cast((*type)->prototype());
Handle<HeapObject> current(HeapObject::cast((*type)->prototype()));
Heap* heap = type->GetHeap();
while (current != heap->null_value()) {
Handle<HeapObject> link(current);
__ LoadHeapObject(result, link);
while (*current != heap->null_value()) {
__ LoadHeapObject(result, current);
__ cmp(FieldOperand(result, HeapObject::kMapOffset),
Handle<Map>(JSObject::cast(current)->map()));
Handle<Map>(current->map()));
DeoptimizeIf(not_equal, env);
current = HeapObject::cast(current->map()->prototype());
current =
Handle<HeapObject>(HeapObject::cast(current->map()->prototype()));
}
__ mov(result, factory()->undefined_value());
}
Expand Down
5 changes: 5 additions & 0 deletions deps/v8/src/list.h
Expand Up @@ -74,6 +74,11 @@ class List {
AllocationPolicy::Delete(p);
}

// Please the MSVC compiler. We should never have to execute this.
INLINE(void operator delete(void* p, AllocationPolicy allocator)) {
UNREACHABLE();
}

// Returns a reference to the element at index i. This reference is
// not safe to use after operations that can change the list's
// backing store (e.g. Add).
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/mips/full-codegen-mips.cc
Expand Up @@ -332,7 +332,7 @@ void FullCodeGenerator::EmitProfilingCounterReset() {
}
if (isolate()->IsDebuggerActive()) {
// Detect debug break requests as soon as possible.
reset_value = FLAG_interrupt_budget >> 4;
reset_value = 10;
}
__ li(a2, Operand(profiling_counter_));
__ li(a3, Operand(Smi::FromInt(reset_value)));
Expand Down
13 changes: 6 additions & 7 deletions deps/v8/src/mips/lithium-codegen-mips.cc
Expand Up @@ -2338,15 +2338,14 @@ void LCodeGen::EmitLoadFieldOrConstantFunction(Register result,
} else {
// Negative lookup.
// Check prototypes.
HeapObject* current = HeapObject::cast((*type)->prototype());
Handle<HeapObject> current(HeapObject::cast((*type)->prototype()));
Heap* heap = type->GetHeap();
while (current != heap->null_value()) {
Handle<HeapObject> link(current);
__ LoadHeapObject(result, link);
while (*current != heap->null_value()) {
__ LoadHeapObject(result, current);
__ lw(result, FieldMemOperand(result, HeapObject::kMapOffset));
DeoptimizeIf(ne, env,
result, Operand(Handle<Map>(JSObject::cast(current)->map())));
current = HeapObject::cast(current->map()->prototype());
DeoptimizeIf(ne, env, result, Operand(Handle<Map>(current->map())));
current =
Handle<HeapObject>(HeapObject::cast(current->map()->prototype()));
}
__ LoadRoot(result, Heap::kUndefinedValueRootIndex);
}
Expand Down
3 changes: 1 addition & 2 deletions deps/v8/src/mips/macro-assembler-mips.cc
Expand Up @@ -4459,8 +4459,7 @@ void MacroAssembler::LoadTransitionedArrayMapConditional(
Context::SlotOffset(Context::JS_ARRAY_MAPS_INDEX)));
size_t offset = expected_kind * kPointerSize +
FixedArrayBase::kHeaderSize;
lw(at, FieldMemOperand(scratch, offset));
Branch(no_map_match, ne, map_in_out, Operand(at));
Branch(no_map_match, ne, map_in_out, Operand(scratch));

// Use the transitioned cached map.
offset = transitioned_kind * kPointerSize +
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/objects.cc
Expand Up @@ -7388,7 +7388,7 @@ void Map::ClearNonLiveTransitions(Heap* heap) {
} else {
keep_entry = true;
}
} else if (!getter->IsTheHole()) {
} else if (!setter->IsTheHole()) {
keep_entry = true;
}
} else {
Expand Down
4 changes: 4 additions & 0 deletions deps/v8/src/profile-generator.cc
Expand Up @@ -2692,6 +2692,10 @@ void V8HeapExplorer::TagGlobalObjects() {
Object* obj_document;
if (global_obj->GetProperty(*document_string)->ToObject(&obj_document) &&
obj_document->IsJSObject()) {
// FixMe: Workaround: SharedWorker's current Isolate has NULL context.
// As result GetProperty(*url_string) will crash.
if (!Isolate::Current()->context() && obj_document->IsJSGlobalProxy())
continue;
JSObject* document = JSObject::cast(obj_document);
Object* obj_url;
if (document->GetProperty(*url_string)->ToObject(&obj_url) &&
Expand Down
10 changes: 6 additions & 4 deletions deps/v8/src/runtime.cc
Expand Up @@ -1123,11 +1123,13 @@ static MaybeObject* GetOwnProperty(Isolate* isolate,
elms->set(IS_ACCESSOR_INDEX, heap->true_value());

AccessorPair* accessors = AccessorPair::cast(result.GetCallbackObject());
if (CheckAccess(*obj, *name, &result, v8::ACCESS_GET)) {
elms->set(GETTER_INDEX, accessors->GetComponent(ACCESSOR_GETTER));
Object* getter = accessors->GetComponent(ACCESSOR_GETTER);
if (!getter->IsMap() && CheckAccess(*obj, *name, &result, v8::ACCESS_GET)) {
elms->set(GETTER_INDEX, getter);
}
if (CheckAccess(*obj, *name, &result, v8::ACCESS_SET)) {
elms->set(SETTER_INDEX, accessors->GetComponent(ACCESSOR_SETTER));
Object* setter = accessors->GetComponent(ACCESSOR_SETTER);
if (!setter->IsMap() && CheckAccess(*obj, *name, &result, v8::ACCESS_SET)) {
elms->set(SETTER_INDEX, setter);
}
} else {
elms->set(IS_ACCESSOR_INDEX, heap->false_value());
Expand Down
13 changes: 11 additions & 2 deletions deps/v8/src/splay-tree.h
Expand Up @@ -66,9 +66,13 @@ class SplayTree {
AllocationPolicy allocator = AllocationPolicy())) {
return allocator.New(static_cast<int>(size));
}
INLINE(void operator delete(void* p, size_t)) {
INLINE(void operator delete(void* p)) {
AllocationPolicy::Delete(p);
}
// Please the MSVC compiler. We should never have to execute this.
INLINE(void operator delete(void* p, AllocationPolicy policy)) {
UNREACHABLE();
}

// Inserts the given key in this tree with the given value. Returns
// true if a node was inserted, otherwise false. If found the locator
Expand Down Expand Up @@ -119,9 +123,14 @@ class SplayTree {
INLINE(void* operator new(size_t size, AllocationPolicy allocator)) {
return allocator.New(static_cast<int>(size));
}
INLINE(void operator delete(void* p, size_t)) {
INLINE(void operator delete(void* p)) {
return AllocationPolicy::Delete(p);
}
// Please the MSVC compiler. We should never have to execute
// this.
INLINE(void operator delete(void* p, AllocationPolicy allocator)) {
UNREACHABLE();
}

Key key() { return key_; }
Value value() { return value_; }
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/version.cc
Expand Up @@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 11
#define BUILD_NUMBER 10
#define PATCH_LEVEL 0
#define PATCH_LEVEL 10
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Expand Down
4 changes: 4 additions & 0 deletions deps/v8/src/x64/full-codegen-x64.cc
Expand Up @@ -310,6 +310,10 @@ void FullCodeGenerator::EmitProfilingCounterReset() {
// Self-optimization is a one-off thing; if it fails, don't try again.
reset_value = Smi::kMaxValue;
}
if (isolate()->IsDebuggerActive()) {
// Detect debug break requests as soon as possible.
reset_value = 10;
}
__ movq(rbx, profiling_counter_, RelocInfo::EMBEDDED_OBJECT);
__ movq(kScratchRegister,
reinterpret_cast<uint64_t>(Smi::FromInt(reset_value)),
Expand Down
12 changes: 6 additions & 6 deletions deps/v8/src/x64/lithium-codegen-x64.cc
Expand Up @@ -2218,15 +2218,15 @@ void LCodeGen::EmitLoadFieldOrConstantFunction(Register result,
} else {
// Negative lookup.
// Check prototypes.
HeapObject* current = HeapObject::cast((*type)->prototype());
Handle<HeapObject> current(HeapObject::cast((*type)->prototype()));
Heap* heap = type->GetHeap();
while (current != heap->null_value()) {
Handle<HeapObject> link(current);
__ LoadHeapObject(result, link);
while (*current != heap->null_value()) {
__ LoadHeapObject(result, current);
__ Cmp(FieldOperand(result, HeapObject::kMapOffset),
Handle<Map>(JSObject::cast(current)->map()));
Handle<Map>(current->map()));
DeoptimizeIf(not_equal, env);
current = HeapObject::cast(current->map()->prototype());
current =
Handle<HeapObject>(HeapObject::cast(current->map()->prototype()));
}
__ LoadRoot(result, Heap::kUndefinedValueRootIndex);
}
Expand Down
36 changes: 36 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-115100.js
@@ -0,0 +1,36 @@
// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

// Flags: --allow-natives-syntax

function foo(obj) { obj.prop = 0; }
function mk() { return Object.create(null); }

foo(mk());
foo(mk());
%OptimizeFunctionOnNextCall(foo);
foo(mk());
35 changes: 35 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-133211.js
@@ -0,0 +1,35 @@
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

// Make sure we don't leak maps when reading intermediate property descriptors.

var o = {};
var x = {};
Object.defineProperty(o, "foo", { get: undefined });
Object.defineProperty(x, "foo", { get: undefined, set: undefined });
var pd = Object.getOwnPropertyDescriptor(o, "foo");
assertEquals(undefined, pd.set);
39 changes: 39 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-133211b.js
@@ -0,0 +1,39 @@
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
// * Redistributions of source code must retain the above copyright
// notice, this list of conditions and the following disclaimer.
// * Redistributions in binary form must reproduce the above
// copyright notice, this list of conditions and the following
// disclaimer in the documentation and/or other materials provided
// with the distribution.
// * Neither the name of Google Inc. nor the names of its
// contributors may be used to endorse or promote products derived
// from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

// Flags: --expose-gc

setter = function(x) { return; }
var o = {};
Object.defineProperty(o, "foo", { set: setter });
var x = {};
Object.defineProperty(x, "foo", { set: setter });
x.bar = 20;
x = {};
gc();
o.foo = 20;
assertEquals(undefined, o.foo);

0 comments on commit 6b26583

Please sign in to comment.