diff --git a/deps/v8/build/common.gypi b/deps/v8/build/common.gypi index 2d8dc11b70d..7f084b8c1db 100644 --- a/deps/v8/build/common.gypi +++ b/deps/v8/build/common.gypi @@ -239,6 +239,7 @@ 'WIN32', ], 'msvs_configuration_attributes': { + 'OutputDirectory': '<(DEPTH)\\build\\$(ConfigurationName)', 'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)', 'CharacterSet': '1', }, @@ -270,7 +271,7 @@ 'target_conditions': [ ['_toolset=="host"', { 'variables': { - 'm32flag': ' /dev/null 2>&1) && echo "-m32" || true)', + 'm32flag': ' /dev/null 2>&1) && echo -n "-m32" || true)', }, 'cflags': [ '<(m32flag)' ], 'ldflags': [ '<(m32flag)' ], @@ -280,7 +281,7 @@ }], ['_toolset=="target"', { 'variables': { - 'm32flag': ' /dev/null 2>&1) && echo "-m32" || true)', + 'm32flag': ' /dev/null 2>&1) && echo -n "-m32" || true)', }, 'cflags': [ '<(m32flag)' ], 'ldflags': [ '<(m32flag)' ], @@ -323,7 +324,7 @@ }, 'conditions': [ ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="netbsd"', { - 'cflags': [ '-Wno-unused-parameter', + 'cflags': [ '-Wall', '<(werror)', '-W', '-Wno-unused-parameter', '-Wnon-virtual-dtor', '-Woverloaded-virtual' ], }], ], diff --git a/deps/v8/src/ia32/lithium-codegen-ia32.cc b/deps/v8/src/ia32/lithium-codegen-ia32.cc index 7c9c8826065..2c6a916b04c 100644 --- a/deps/v8/src/ia32/lithium-codegen-ia32.cc +++ b/deps/v8/src/ia32/lithium-codegen-ia32.cc @@ -2359,10 +2359,15 @@ void LCodeGen::EmitPushTaggedOperand(LOperand* operand) { // Check for cases where EmitLoadFieldOrConstantFunction needs to walk the // prototype chain, which causes unbounded code generation. -static bool CompactEmit( - SmallMapList* list, Handle name, int i, Isolate* isolate) { - LookupResult lookup(isolate); +static bool CompactEmit(SmallMapList* list, + Handle name, + int i, + Isolate* isolate) { Handle map = list->at(i); + // If the map has ElementsKind transitions, we will generate map checks + // for each kind in __ CompareMap(..., ALLOW_ELEMENTS_TRANSITION_MAPS). + if (map->elements_transition_map() != NULL) return false; + LookupResult lookup(isolate); map->LookupInDescriptors(NULL, *name, &lookup); return lookup.IsFound() && (lookup.type() == FIELD || lookup.type() == CONSTANT_FUNCTION); diff --git a/deps/v8/src/version.cc b/deps/v8/src/version.cc index 03526d37642..9b9c9beb259 100644 --- a/deps/v8/src/version.cc +++ b/deps/v8/src/version.cc @@ -35,7 +35,7 @@ #define MAJOR_VERSION 3 #define MINOR_VERSION 11 #define BUILD_NUMBER 10 -#define PATCH_LEVEL 10 +#define PATCH_LEVEL 12 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) #define IS_CANDIDATE_VERSION 0 diff --git a/deps/v8/src/x64/lithium-codegen-x64.cc b/deps/v8/src/x64/lithium-codegen-x64.cc index f62528e34a4..7dc38a1429f 100644 --- a/deps/v8/src/x64/lithium-codegen-x64.cc +++ b/deps/v8/src/x64/lithium-codegen-x64.cc @@ -2235,10 +2235,15 @@ void LCodeGen::EmitLoadFieldOrConstantFunction(Register result, // Check for cases where EmitLoadFieldOrConstantFunction needs to walk the // prototype chain, which causes unbounded code generation. -static bool CompactEmit( - SmallMapList* list, Handle name, int i, Isolate* isolate) { - LookupResult lookup(isolate); +static bool CompactEmit(SmallMapList* list, + Handle name, + int i, + Isolate* isolate) { Handle map = list->at(i); + // If the map has ElementsKind transitions, we will generate map checks + // for each kind in __ CompareMap(..., ALLOW_ELEMENTS_TRANSITION_MAPS). + if (map->elements_transition_map() != NULL) return false; + LookupResult lookup(isolate); map->LookupInDescriptors(NULL, *name, &lookup); return lookup.IsFound() && (lookup.type() == FIELD || lookup.type() == CONSTANT_FUNCTION); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-134055.js b/deps/v8/test/mjsunit/regress/regress-crbug-134055.js new file mode 100644 index 00000000000..9b658fb6f65 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-134055.js @@ -0,0 +1,63 @@ +// Copyright 2012 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Flags: --allow-natives-syntax + +function crash(obj) { + return obj.foo; +} + +function base(number_of_properties) { + var result = new Array(); + for (var i = 0; i < number_of_properties; i++) { + result["property" + i] = "value" + i; + } + result.foo = number_of_properties; + return result; +} + +var a = base(12); +var b = base(13); +var c = base(14); +var d = base(15); + +crash(a); // Premonomorphic. +crash(a); +crash(b); +crash(c); +crash(d); // Polymorphic, degree 4. + +//Prepare ElementsKind transition map chain. +var x = base(13); +x[0] = "object"; +x = base(14); +x[0] = "object"; +x = base(15); +x[0] = "object"; + +%OptimizeFunctionOnNextCall(crash); +crash(a);