summaryrefslogtreecommitdiff
path: root/deps/v8/src
Commit message (Collapse)AuthorAgeFilesLines
* deps: backport 60c316 from v8 trunkFedor Indutny2014-09-091-1/+12
| | | | | | | | | | | | | | | | | | Original commit message: Extend the interceptor setter ASSERT to support the JSGlobalProxy case. BUG=v8:3463 LOG=n R=dcarney@chromium.org Review URL: https://codereview.chromium.org/415973004 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 Signed-off-by: Fedor Indutny <fedor@indutny.com> fix #7969
* deps: cherry-pick r21466 from v8 trunkBen Noordhuis2014-09-091-1/+8
| | | | | | | | | | Check for cached transition to ExternalArray elements kind. See [1] and [2] for details. [1] https://code.google.com/p/v8/issues/detail?id=3337 [2] https://codereview.chromium.org/291193011 Signed-off-by: Fedor Indutny <fedor@indutny.com>
* deps: cherry-pick r21297 from v8 trunkBen Noordhuis2014-09-091-7/+17
| | | | | | | | | | Changes the return value of PropertyCallbackInfo<T>::This() from Local<Value> back to Local<Object>. See [1] and [2] for background. [1] https://groups.google.com/forum/#!topic/v8-users/wP2UcQ4cBW4 [2] https://codereview.chromium.org/285643008/ Signed-off-by: Fedor Indutny <fedor@indutny.com>
* v8: Upgrade 3.26.33 with 14 patchesTrevor Norris2014-09-0932-292/+253
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | V8 3.26.31 has received 14 patches since the upgrade to 3.26.33. Since 3.26.33 is technically a tag on the 3.27 branch, reverting back to 3.26.31 would remove now default functionality like WeakMaps. Because of that the patches have simply been cherry-picked and squashed. Here is a summary of all patches: * Fix index register assignment in LoadFieldByIndex for arm, arm64, and mips. * Fix invalid attributes when generalizing because of incompatible map change. * Skip write barriers when updating the weak hash table. * MIPS: Avoid HeapObject check in HStoreNamedField. * Do GC if CodeRange fails to allocate a block. * Array.concat: properly go to dictionary mode when required. * Keep CodeRange::current_allocation_block_index_ in range. * Grow heap slower if GC freed many global handles. * Do not eliminate bounds checks for "<const> - x". * Add missing map check to optimized f.apply(...). * In GrowMode, force the value to the right representation to avoid deopts between storing the length and storing the value. * Reduce max executable size limit. * Fix invalid condition in check elimination effects. * Fix off-by-one error in Array.concat slow mode check. For more information see: https://github.com/v8/v8/commits/3.26 Reviewed-By: Fedor Indutny <fedor@indutny.com>
* deps: backport 60c316 from v8 trunkFedor Indutny2014-07-251-1/+12
| | | | | | | | | | | | | | | | | | Original commit message: Extend the interceptor setter ASSERT to support the JSGlobalProxy case. BUG=v8:3463 LOG=n R=dcarney@chromium.org Review URL: https://codereview.chromium.org/415973004 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 Signed-off-by: Fedor Indutny <fedor@indutny.com> fix #7969
* deps: cherry-pick r21466 from v8 trunkBen Noordhuis2014-06-121-1/+8
| | | | | | | | | | Check for cached transition to ExternalArray elements kind. See [1] and [2] for details. [1] https://code.google.com/p/v8/issues/detail?id=3337 [2] https://codereview.chromium.org/291193011 Signed-off-by: Fedor Indutny <fedor@indutny.com>
* deps: cherry-pick r21297 from v8 trunkBen Noordhuis2014-06-121-7/+17
| | | | | | | | | | Changes the return value of PropertyCallbackInfo<T>::This() from Local<Value> back to Local<Object>. See [1] and [2] for background. [1] https://groups.google.com/forum/#!topic/v8-users/wP2UcQ4cBW4 [2] https://codereview.chromium.org/285643008/ Signed-off-by: Fedor Indutny <fedor@indutny.com>
* deps: upgrade v8 to 3.26.33Ben Noordhuis2014-06-12602-44492/+32901
| | | | Signed-off-by: Fedor Indutny <fedor@indutny.com>
* deps: upgrade v8 to 3.25.30Ben Noordhuis2014-04-02345-18915/+83351
|
* v8: upgrade to 3.24.35.22Trevor Norris2014-04-0130-151/+281
|
* deps: update v8 to 3.24.35.17Fedor Indutny2014-03-18203-63261/+4839
|
* deps: allow allocations in gc epilogue/prologueFedor Indutny2014-03-133-11/+48
| | | | See https://codereview.chromium.org/177243012/
* deps: backport a6fed7c5 from v8's trunkFedor Indutny2014-03-132-8/+8
|
* deps: update v8 to 3.24.40Fedor Indutny2014-03-13422-46431/+97995
|
* v8: unbreak freebsd buildBen Noordhuis2014-02-151-1/+1
| | | | | | reland de8c0a5 Fixes #7020 and #7021
* v8: Upgrade to 3.22.24.19Timothy J Fontaine2014-01-283-12/+8
|
* v8: upgrade to 3.22.24.17Trevor Norris2014-01-2338-147/+372
|
* v8: Upgrade to 3.22.24.10Timothy J Fontaine2013-12-312-1/+2
|
* deps: v8 apply temporary fix until backportFedor Indutny2013-12-191-22/+22
| | | | | | | Fix node.js debug build with a temporary v8 fix until the v8 team will backport the fix from the more recent version of v8. see https://code.google.com/p/v8/issues/detail?id=3062
* deps: update v8 to 3.22.24.9Fedor Indutny2013-12-1413-141/+160
|
* Merge branch 'v0.10'Fedor Indutny2013-12-146-32/+39
|\ | | | | | | | | | | | | | | | | | | Conflicts: deps/v8/src/elements-kind.cc deps/v8/src/elements-kind.h deps/v8/src/hydrogen-instructions.h deps/v8/src/hydrogen.cc deps/v8/src/lithium.cc deps/v8/src/lithium.h
| * v8: backport fix for CVE-2013-{6639|6640}jkummerow@chromium.org2013-12-146-34/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting CVE-2013-6639: The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index. Quoting CVE-2013-6640: The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index. Like 6b92a7, this is unlikely to affect node.js because it only runs local, trusted code. However, if there exists some module somewhere that populates an array index with remotely provided data this could very well be used to crash a remote server running node. Defense in depth and all. This is a backport of upstream commit r17801. Original commit log: Limit size of dehoistable array indices LOG=Y BUG=chromium:319835,chromium:319860 R=dslomov@chromium.org Review URL: https://codereview.chromium.org/74113002
| * v8: use correct timezone information on Solarisyangguo@chromium.org2013-11-121-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `timezone` variable contains the difference, in seconds, between UTC and local standard time (see `man 3 localtime` on Solaris). Call to `tzset` is required to apply contents of `TZ` variable to `timezone` variable. BUG=v8:2064 Review URL: https://chromiumcodereview.appspot.com/10967066 Patch from Maciej Małecki <me@mmalecki.com>. This is a back-port of upstream commit r12802 and a forward port of commit 9fa953d from the v0.8 branch. V8 3.22 in the master branch contains the patch so no further forward-porting is necessary.
| * v8: back-port fix for CVE-2013-2882mstarzinger@chromium.org2013-08-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting the CVE: Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion." Likely has zero impact on node.js because it only runs local, trusted code but let's apply it anyway. This is a back-port of upstream commit r15665. Original commit log: Use internal array as API function cache. R=yangguo@chromium.org BUG=chromium:260106 TEST=cctest/test-api/Regress260106 Review URL: https://codereview.chromium.org/19159003 Fixes #5973.
| * v8: add setVariableValue debugger commandBen Noordhuis2013-06-176-11/+334
| | | | | | | | | | | | | | | | | | | | Issue 2399 part 1: In debugger allow modifying local variable values Issue 2399 part 2: In debugger allow modifying local variable values Review URL: https://codereview.chromium.org/11415042 Review URL: https://codereview.chromium.org/11412310 This is a back-port of upstream svn commits r13122 and r13202.
| * v8: fix pointer arithmetic undefined behaviorTrevor Norris2013-06-111-1/+2
| | | | | | | | | | | | | | | | Clang branch release_33 would optimize out a != NULL check because of some undefined behavior. This is a floating patch as a backport of that fix. Committed: http://code.google.com/p/v8/source/detail?r=13570
| * v8: re-apply floating patchesTimothy J Fontaine2013-05-238-17/+36
| |
| * v8: fix GetLocalizedMessage usageTimothy J Fontaine2013-05-231-1/+1
| | | | | | | | | | As is the backport of the abort on uncaught exception wouldn't compile because we it was passing in `this` when it was unnecessary.
| * v8: update to 3.14.5.9Timothy J Fontaine2013-05-2311-37/+35
| |
| * v8: cherry-pick 75311294 from upstreamFedor Indutny2013-04-031-2/+5
| | | | | | | | | | | | | | Quote from commit message: Create a new HandleScope for each JSON-parsed object to avoid excessive growth.
| * v8: Unify kMaxArguments with number of bits used to encode it.verwaest@chromium.org2013-03-235-14/+13
| | | | | | | | | | | | | | | | | | | | Increase the number of bits by 1 by making Flags unsigned. BUG=chromium:211741 Review URL: https://chromiumcodereview.appspot.com/12886008 This is a back-port of commits 13964 and 13988 addressing CVE-2013-2632.
* | v8: unbreak freebsd buildBen Noordhuis2013-11-231-1/+1
| | | | | | | | | | | | Pending review of https://codereview.appspot.com/31500043/ Fixes #6576.
* | v8: upgrade to 3.22.24.5Timothy J Fontaine2013-11-1825-267/+347
| |
* | v8: upgrade to 3.22.24Ben Noordhuis2013-11-11289-21457/+21028
| | | | | | | | | | | | | | | | | | This commit removes the simple/test-event-emitter-memory-leak test for being unreliable with the new garbage collector: the memory pressure exerted by the test case is too low for the garbage collector to kick in. It can be made to work again by limiting the heap size with the --max_old_space_size=x flag but that won't be very reliable across platforms and architectures.
* | v8: upgrade 3.21.18.3Timothy J Fontaine2013-10-23310-22630/+20727
| |
* | v8: ugprade to 3.20.17.14Timothy J Fontaine2013-10-073-6/+23
| |
* | v8: upgrade to 3.20.17.13Timothy J Fontaine2013-09-2613-50/+268
| | | | | | | | fixes #6235
* | Revert "deps: update v8 to 3.20.17.11"Ben Noordhuis2013-09-2413-268/+50
| | | | | | | | | | | | | | | | | | | | After the upgrade from 3.20.17.7 to 3.20.17.11, we've begun hitting random assertions in V8 in memory-constrained / GC-heavy situations. The assertions all seem to be related to heap allocations and garbage collection but apart from that, they're all over the place. This reverts commit 970bdccc38fee27e10ff1a3b68f3fea3417788a1.
* | deps: update v8 to 3.20.17.11Fedor Indutny2013-09-2313-50/+268
| | | | | | | | fix #6235
* | deps: update v8 to 3.20.17.7Fedor Indutny2013-09-1837-230/+313
| |
* | v8: upgrade to 3.20.17Trevor Norris2013-08-2793-3237/+3989
| |
* | v8: fix openbsd buildBen Noordhuis2013-08-101-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | This is [1] applied ahead of time. Summary: OpenBSD doesn't have <ucontext.h>. ucontext_t lives in <signal.h> and is a typedef for struct sigcontext. There is no uc_mcontext. [1] https://codereview.chromium.org/21705003/ Note: the patch has been accepted upstream but hasn't made its way into a stable release yet.
* | v8: upgrade v8 to 3.20.14.1Ben Noordhuis2013-08-10156-5990/+5644
| |
* | v8: fix openbsd buildBen Noordhuis2013-08-051-2/+6
| | | | | | | | | | | | | | | | | | This is [1] applied ahead of time. Summary: OpenBSD doesn't have <ucontext.h>. ucontext_t lives in <signal.h> and is a typedef for struct sigcontext. There is no uc_mcontext. [1] https://codereview.chromium.org/21705003/
* | v8: upgrade v8 to 3.20.11Ben Noordhuis2013-07-3071-1499/+1654
| |
* | v8: upgrade to v8 3.20.9Ben Noordhuis2013-07-29132-3833/+4399
| |
* | v8: reapply floating patchesBen Noordhuis2013-07-221-1/+16
| |
* | v8: upgrade to v8 3.20.7Trevor Norris2013-07-22268-10360/+12932
| |
* | v8: reapply floating patchesBen Noordhuis2013-07-061-1/+16
| |
* | v8: upgrade to v3.20.2Ben Noordhuis2013-07-06293-11591/+17874
| |
View Lorry Controller Status