Upgrade to V8 3.6
Merge V8 at 3.6.6.11
Simple merge required updates to makefiles only.
Bug: 5688872
Change-Id: Ib38b7ffbcd409585f6cb6fccc59c767029cecc77
diff --git a/src/objects.cc b/src/objects.cc
index 0660dba..6085b4e 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -41,7 +41,6 @@
#include "objects-visiting.h"
#include "macro-assembler.h"
#include "safepoint-table.h"
-#include "scanner-base.h"
#include "string-stream.h"
#include "utils.h"
#include "vm-state-inl.h"
@@ -85,7 +84,7 @@
MaybeObject* Object::ToObject() {
- if (IsJSObject()) {
+ if (IsJSReceiver()) {
return this;
} else if (IsNumber()) {
Isolate* isolate = Isolate::Current();
@@ -238,6 +237,7 @@
// Extract trap function.
Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol("get");
Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
+ if (isolate->has_pending_exception()) return Failure::Exception();
if (trap->IsUndefined()) {
// Get the derived `get' property.
trap = isolate->derived_get_trap();
@@ -592,7 +592,7 @@
return holder->GetPropertyWithInterceptor(recvr, name, attributes);
}
case MAP_TRANSITION:
- case EXTERNAL_ARRAY_TRANSITION:
+ case ELEMENTS_TRANSITION:
case CONSTANT_TRANSITION:
case NULL_DESCRIPTOR:
break;
@@ -628,6 +628,7 @@
} else if (heap_object->IsBoolean()) {
holder = global_context->boolean_function()->instance_prototype();
} else if (heap_object->IsJSProxy()) {
+ // TODO(rossberg): do something
return heap->undefined_value(); // For now...
} else {
// Undefined and null have no indexed properties.
@@ -1048,6 +1049,7 @@
global_object ? "Global Object: " : "",
vowel ? "n" : "");
accumulator->Put(str);
+ accumulator->Put('>');
printed = true;
}
}
@@ -1173,6 +1175,12 @@
HeapNumber::cast(this)->HeapNumberPrint(accumulator);
accumulator->Put('>');
break;
+ case JS_PROXY_TYPE:
+ accumulator->Add("<JSProxy>");
+ break;
+ case JS_FUNCTION_PROXY_TYPE:
+ accumulator->Add("<JSFunctionProxy>");
+ break;
case FOREIGN_TYPE:
accumulator->Add("<Foreign>");
break;
@@ -1251,6 +1259,9 @@
case JS_PROXY_TYPE:
JSProxy::BodyDescriptor::IterateBody(this, v);
break;
+ case JS_FUNCTION_PROXY_TYPE:
+ JSFunctionProxy::BodyDescriptor::IterateBody(this, v);
+ break;
case FOREIGN_TYPE:
reinterpret_cast<Foreign*>(this)->ForeignIterateBody(v);
break;
@@ -1435,13 +1446,12 @@
// it's unrelated to properties.
int descriptor_index = old_descriptors->Search(name);
- // External array transitions are stored in the descriptor for property "",
- // which is not a identifier and should have forced a switch to slow
- // properties above.
+ // Element transitions are stored in the descriptor for property "", which is
+ // not a identifier and should have forced a switch to slow properties above.
ASSERT(descriptor_index == DescriptorArray::kNotFound ||
- old_descriptors->GetType(descriptor_index) != EXTERNAL_ARRAY_TRANSITION);
+ old_descriptors->GetType(descriptor_index) != ELEMENTS_TRANSITION);
bool can_insert_transition = descriptor_index == DescriptorArray::kNotFound ||
- old_descriptors->GetType(descriptor_index) == EXTERNAL_ARRAY_TRANSITION;
+ old_descriptors->GetType(descriptor_index) == ELEMENTS_TRANSITION;
bool allow_map_transition =
can_insert_transition &&
(isolate->context()->global_context()->object_function()->map() != map());
@@ -1989,61 +1999,25 @@
}
-static JSObject::ElementsKind GetElementsKindFromExternalArrayType(
- ExternalArrayType array_type) {
- switch (array_type) {
- case kExternalByteArray:
- return JSObject::EXTERNAL_BYTE_ELEMENTS;
- break;
- case kExternalUnsignedByteArray:
- return JSObject::EXTERNAL_UNSIGNED_BYTE_ELEMENTS;
- break;
- case kExternalShortArray:
- return JSObject::EXTERNAL_SHORT_ELEMENTS;
- break;
- case kExternalUnsignedShortArray:
- return JSObject::EXTERNAL_UNSIGNED_SHORT_ELEMENTS;
- break;
- case kExternalIntArray:
- return JSObject::EXTERNAL_INT_ELEMENTS;
- break;
- case kExternalUnsignedIntArray:
- return JSObject::EXTERNAL_UNSIGNED_INT_ELEMENTS;
- break;
- case kExternalFloatArray:
- return JSObject::EXTERNAL_FLOAT_ELEMENTS;
- break;
- case kExternalDoubleArray:
- return JSObject::EXTERNAL_DOUBLE_ELEMENTS;
- break;
- case kExternalPixelArray:
- return JSObject::EXTERNAL_PIXEL_ELEMENTS;
- break;
- }
- UNREACHABLE();
- return JSObject::DICTIONARY_ELEMENTS;
-}
-
-
-MaybeObject* Map::GetExternalArrayElementsMap(ExternalArrayType array_type,
- bool safe_to_add_transition) {
+MaybeObject* Map::GetElementsTransitionMap(ElementsKind elements_kind,
+ bool safe_to_add_transition) {
Heap* current_heap = heap();
DescriptorArray* descriptors = instance_descriptors();
- String* external_array_sentinel_name = current_heap->empty_symbol();
+ String* elements_transition_sentinel_name = current_heap->empty_symbol();
if (safe_to_add_transition) {
// It's only safe to manipulate the descriptor array if it would be
// safe to add a transition.
ASSERT(!is_shared()); // no transitions can be added to shared maps.
- // Check if the external array transition already exists.
+ // Check if the elements transition already exists.
DescriptorLookupCache* cache =
current_heap->isolate()->descriptor_lookup_cache();
- int index = cache->Lookup(descriptors, external_array_sentinel_name);
+ int index = cache->Lookup(descriptors, elements_transition_sentinel_name);
if (index == DescriptorLookupCache::kAbsent) {
- index = descriptors->Search(external_array_sentinel_name);
+ index = descriptors->Search(elements_transition_sentinel_name);
cache->Update(descriptors,
- external_array_sentinel_name,
+ elements_transition_sentinel_name,
index);
}
@@ -2051,8 +2025,8 @@
// return it.
if (index != DescriptorArray::kNotFound) {
PropertyDetails details(PropertyDetails(descriptors->GetDetails(index)));
- if (details.type() == EXTERNAL_ARRAY_TRANSITION &&
- details.array_type() == array_type) {
+ if (details.type() == ELEMENTS_TRANSITION &&
+ details.elements_kind() == elements_kind) {
return descriptors->GetValue(index);
} else {
safe_to_add_transition = false;
@@ -2060,28 +2034,29 @@
}
}
- // No transition to an existing external array map. Make a new one.
+ // No transition to an existing map for the given ElementsKind. Make a new
+ // one.
Object* obj;
{ MaybeObject* maybe_map = CopyDropTransitions();
if (!maybe_map->ToObject(&obj)) return maybe_map;
}
Map* new_map = Map::cast(obj);
- new_map->set_elements_kind(GetElementsKindFromExternalArrayType(array_type));
+ new_map->set_elements_kind(elements_kind);
GetIsolate()->counters()->map_to_external_array_elements()->Increment();
// Only remember the map transition if the object's map is NOT equal to the
// global object_function's map and there is not an already existing
- // non-matching external array transition.
+ // non-matching element transition.
bool allow_map_transition =
safe_to_add_transition &&
(GetIsolate()->context()->global_context()->object_function()->map() !=
map());
if (allow_map_transition) {
// Allocate new instance descriptors for the old map with map transition.
- ExternalArrayTransitionDescriptor desc(external_array_sentinel_name,
- Map::cast(new_map),
- array_type);
+ ElementsTransitionDescriptor desc(elements_transition_sentinel_name,
+ Map::cast(new_map),
+ elements_kind);
Object* new_descriptors;
MaybeObject* maybe_new_descriptors = descriptors->CopyInsert(
&desc,
@@ -2248,6 +2223,7 @@
// Extract trap function.
Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol("has");
Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
+ if (isolate->has_pending_exception()) return Failure::Exception();
if (trap->IsUndefined()) {
trap = isolate->derived_has_trap();
}
@@ -2278,6 +2254,7 @@
// Extract trap function.
Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol("set");
Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
+ if (isolate->has_pending_exception()) return Failure::Exception();
if (trap->IsUndefined()) {
trap = isolate->derived_set_trap();
}
@@ -2305,6 +2282,7 @@
// Extract trap function.
Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol("delete");
Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
+ if (isolate->has_pending_exception()) return Failure::Exception();
if (trap->IsUndefined()) {
Handle<Object> args[] = { handler, trap_name };
Handle<Object> error = isolate->factory()->NewTypeError(
@@ -2347,6 +2325,7 @@
Handle<String> trap_name =
isolate->factory()->LookupAsciiSymbol("getPropertyDescriptor");
Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
+ if (isolate->has_pending_exception()) return NONE;
if (trap->IsUndefined()) {
Handle<Object> args[] = { handler, trap_name };
Handle<Object> error = isolate->factory()->NewTypeError(
@@ -2373,9 +2352,13 @@
HandleScope scope(isolate);
Handle<JSProxy> self(this);
- isolate->factory()->BecomeJSObject(self);
+ if (IsJSFunctionProxy()) {
+ isolate->factory()->BecomeJSFunction(self);
+ // Code will be set on the JavaScript side.
+ } else {
+ isolate->factory()->BecomeJSObject(self);
+ }
ASSERT(self->IsJSObject());
- // TODO(rossberg): recognize function proxies.
}
@@ -2498,7 +2481,7 @@
return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
}
case NULL_DESCRIPTOR:
- case EXTERNAL_ARRAY_TRANSITION:
+ case ELEMENTS_TRANSITION:
return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
default:
UNREACHABLE();
@@ -2586,7 +2569,7 @@
// if the value is a function.
return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
case NULL_DESCRIPTOR:
- case EXTERNAL_ARRAY_TRANSITION:
+ case ELEMENTS_TRANSITION:
return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
default:
UNREACHABLE();
@@ -2867,7 +2850,7 @@
case CONSTANT_TRANSITION:
case NULL_DESCRIPTOR:
case INTERCEPTOR:
- case EXTERNAL_ARRAY_TRANSITION:
+ case ELEMENTS_TRANSITION:
break;
default:
UNREACHABLE();
@@ -5100,13 +5083,13 @@
}
-SmartPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
- RobustnessFlag robust_flag,
- int offset,
- int length,
- int* length_return) {
+SmartArrayPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
+ RobustnessFlag robust_flag,
+ int offset,
+ int length,
+ int* length_return) {
if (robust_flag == ROBUST_STRING_TRAVERSAL && !LooksValid()) {
- return SmartPointer<char>(NULL);
+ return SmartArrayPointer<char>(NULL);
}
Heap* heap = GetHeap();
@@ -5150,13 +5133,13 @@
character_position++;
}
result[utf8_byte_position] = 0;
- return SmartPointer<char>(result);
+ return SmartArrayPointer<char>(result);
}
-SmartPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
- RobustnessFlag robust_flag,
- int* length_return) {
+SmartArrayPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
+ RobustnessFlag robust_flag,
+ int* length_return) {
return ToCString(allow_nulls, robust_flag, 0, -1, length_return);
}
@@ -5187,9 +5170,9 @@
}
-SmartPointer<uc16> String::ToWideCString(RobustnessFlag robust_flag) {
+SmartArrayPointer<uc16> String::ToWideCString(RobustnessFlag robust_flag) {
if (robust_flag == ROBUST_STRING_TRAVERSAL && !LooksValid()) {
- return SmartPointer<uc16>();
+ return SmartArrayPointer<uc16>();
}
Heap* heap = GetHeap();
@@ -5205,7 +5188,7 @@
result[i++] = character;
}
result[i] = 0;
- return SmartPointer<uc16>(result);
+ return SmartArrayPointer<uc16>(result);
}
@@ -6219,7 +6202,7 @@
DescriptorArray* descriptors = instance_descriptors();
for (int i = 0; i < descriptors->number_of_descriptors(); i++) {
if (descriptors->GetType(i) == MAP_TRANSITION ||
- descriptors->GetType(i) == EXTERNAL_ARRAY_TRANSITION ||
+ descriptors->GetType(i) == ELEMENTS_TRANSITION ||
descriptors->GetType(i) == CONSTANT_TRANSITION) {
// Get target.
Map* target = Map::cast(descriptors->GetValue(i));
@@ -6262,7 +6245,7 @@
// non-live object.
PropertyDetails details(Smi::cast(contents->get(i + 1)));
if (details.type() == MAP_TRANSITION ||
- details.type() == EXTERNAL_ARRAY_TRANSITION ||
+ details.type() == ELEMENTS_TRANSITION ||
details.type() == CONSTANT_TRANSITION) {
Map* target = reinterpret_cast<Map*>(contents->get(i));
ASSERT(target->IsHeapObject());
@@ -6422,7 +6405,7 @@
void JSFunction::PrintName(FILE* out) {
- SmartPointer<char> name = shared()->DebugName()->ToCString();
+ SmartArrayPointer<char> name = shared()->DebugName()->ToCString();
PrintF(out, "%s", *name);
}
@@ -7026,7 +7009,7 @@
JSFunction* function =
JSFunction::cast(LiteralArray()->get(function_id));
unsigned height = iterator.Next();
- PrintF(out, "{ast_id=%d, \nfunction=", ast_id);
+ PrintF(out, "{ast_id=%d, function=", ast_id);
function->PrintName(out);
PrintF(out, ", height=%u}", height);
break;
@@ -7151,7 +7134,7 @@
case HANDLER: return "HANDLER";
case INTERCEPTOR: return "INTERCEPTOR";
case MAP_TRANSITION: return "MAP_TRANSITION";
- case EXTERNAL_ARRAY_TRANSITION: return "EXTERNAL_ARRAY_TRANSITION";
+ case ELEMENTS_TRANSITION: return "ELEMENTS_TRANSITION";
case CONSTANT_TRANSITION: return "CONSTANT_TRANSITION";
case NULL_DESCRIPTOR: return "NULL_DESCRIPTOR";
}
@@ -7190,7 +7173,6 @@
if (is_inline_cache_stub()) {
PrintF(out, "ic_state = %s\n", ICState2String(ic_state()));
PrintExtraICState(out, kind(), extra_ic_state());
- PrintF(out, "ic_in_loop = %d\n", ic_in_loop() == IN_LOOP);
if (ic_state() == MONOMORPHIC) {
PrintF(out, "type = %s\n", PropertyType2String(type()));
}
@@ -7541,7 +7523,7 @@
if (maybe_smi_length->ToObject(&smi_length) && smi_length->IsSmi()) {
const int value = Smi::cast(smi_length)->value();
if (value < 0) return ArrayLengthRangeError(GetHeap());
- JSObject::ElementsKind elements_kind = GetElementsKind();
+ ElementsKind elements_kind = GetElementsKind();
switch (elements_kind) {
case FAST_ELEMENTS:
case FAST_DOUBLE_ELEMENTS: {
@@ -10151,6 +10133,8 @@
// If the object is in dictionary mode, it is converted to fast elements
// mode.
MaybeObject* JSObject::PrepareElementsForSort(uint32_t limit) {
+ ASSERT(!HasExternalArrayElements());
+
Heap* heap = GetHeap();
if (HasDictionaryElements()) {
@@ -10180,9 +10164,6 @@
set_map(new_map);
set_elements(fast_elements);
- } else if (HasExternalArrayElements()) {
- // External arrays cannot have holes or undefined elements.
- return Smi::FromInt(ExternalArray::cast(elements())->length());
} else if (!HasFastDoubleElements()) {
Object* obj;
{ MaybeObject* maybe_obj = EnsureWritableFastElements();