Reviewers: Mads Ager,
Description:
Ensure correct boxing of values when calling functions on them
When a function is called with a value type as the receiver this is now
boxed as
an object.
This is a low-impact solution where the receiver is only boxed when
required.
For IC calls to the V8 builtins values are not boxed and as most of the
functions on String.prototype, Number.prototype and Boolean.prototype are
sitting there most IC calls on values will not need any boxing of the
receiver.
For calls which are not IC calls but calls through the CallFunctionStub a
flag
is used to determine whether the receiver might be a value and only when
that is
the case will the receiver be boxed.
No changtes to Function.call and Function.apply - they already boxed values.
According to the ES5 spec the receiver should not be boxed for these
functions,
but current browsers have not adopted that change yet.
BUG=223
TEST=test/mjsunit/value-wrapper.js
TEST=test/mjsunit/regress/regress-crbug-3184.js
Please review this at http://codereview.chromium.org/542087
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/
Affected files:
M src/arm/codegen-arm.h
M src/arm/codegen-arm.cc
M src/arm/fast-codegen-arm.cc
M src/arm/stub-cache-arm.cc
M src/codegen.h
M src/debug.cc
M src/globals.h
M src/ia32/codegen-ia32.h
M src/ia32/codegen-ia32.cc
M src/ia32/fast-codegen-ia32.cc
M src/ia32/stub-cache-ia32.cc
M src/ic.h
M src/ic.cc
M src/x64/codegen-x64.h
M src/x64/codegen-x64.cc
M src/x64/fast-codegen-x64.cc
M src/x64/stub-cache-x64.cc
D test/mjsunit/bugs/bug-223.js
A test/mjsunit/regress/regress-crbug-3184.js
A test/mjsunit/value-wrapper.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
