Commit Graph

134 Commits

Author SHA1 Message Date
kmillikin@chromium.org
1959409f6d Fix presubmit failure.
TBR=ulan@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8364004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-20 17:28:14 +00:00
kmillikin@chromium.org
e3792a6830 Handlify the stub cache lookup and patching for CallIC and KeyedCallIC.
R=ulan@chromium.org,vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8357010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-20 17:08:53 +00:00
ulan@chromium.org
a5da9320d2 Reset failure flag before retrying stub compilation.
BUG=
TEST=

Review URL: http://codereview.chromium.org/8365003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-20 16:39:26 +00:00
ulan@chromium.org
997ad6387a Handlify upper layers of KeyedStoreIC.
BUG=
TEST=

Review URL: http://codereview.chromium.org/8356039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-20 13:54:16 +00:00
ulan@chromium.org
f985b15aae Handlify upper layers of KeyedLoadIC.
BUG=
TEST=

Review URL: http://codereview.chromium.org/8352003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-20 09:35:47 +00:00
ulan@chromium.org
80e3843dc3 Handlify upper layers of StoreIC based on 8337008.
BUG=
TEST=

Review URL: http://codereview.chromium.org/8341008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-19 09:17:01 +00:00
ulan@chromium.org
feeb0b0211 Handlify upper layers of LoadIC.
BUG=
TEST=

Review URL: http://codereview.chromium.org/8337008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-18 12:19:18 +00:00
jkummerow@chromium.org
184fdcf28b Track elements_kind transitions in KeyedStoreICs.
Review URL: http://codereview.chromium.org/8166017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9577 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-11 09:33:00 +00:00
erik.corry@gmail.com
af20990e0e Don't need to protect pregenerated stubs from flushing from the
cache.  They are in a different cache that is not flushed.  Keep
the marking of pregenerated stubs for assertion purposes.
Review URL: http://codereview.chromium.org/8065028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-29 11:52:05 +00:00
erik.corry@gmail.com
bbcafaa2d5 Make sure we don't flush the pregenerated stubs, since they need
to be always present, so that we can call them from other stubs
without trying to generate stubs while we are generating stubs.
Review URL: http://codereview.chromium.org/8052029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-28 10:32:12 +00:00
kmillikin@chromium.org
40cd59f238 Remove in-loop tracking for call ICs.
We passed this flag around in a lot of places and had differenc call
ICs based on it, but never did any real specialization based on its
value.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7869009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-13 12:53:28 +00:00
kmillikin@chromium.org
636991a0b3 Use the BitField class for Code::Flags.
Use the BitField helper class for the code flags, so that we do not have to
define both a shift and a mask explicitly.  This makes changing the flags
layout simpler.

Also, make the 'mask' and 'max' members of BitField into constants, because
they are constant and so that they can be used as constant expressions.
E.g., so they can be used in declaring other const members or in static
asserts.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7787028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-12 10:50:50 +00:00
vitalyr@chromium.org
633e615b89 Improve memory usage of receiver type feedback.
Some AST nodes (Property, Call, etc.) store either a list of receiver
types or a monomorphic receiver type. This patch merges the two fields
using a small pointer list. GetMonomorphicReceiverType() is now a
purely convenience function returning the first and only recorded
type.

This saves about 500K (of about 39M) on average when compiling V8
benchmark as measured by a simple patch adding a zone allocation
counter (https://gist.github.com/1149397).

R=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7655017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-08-22 14:23:37 +00:00
danno@chromium.org
07def3cb1e Unify handling of element IC stubs.
In the process, add shared stubs for DictionaryValue lookups that are handled in the same way as fast elements and external array elements.

Includes code for MIPS, which compiles and run polymorph-arrays.js successfully.

R=jkummerow@chromium.org
BUG=none
TEST=test/mjsunit/polymorph-arrays.js

Review URL: http://codereview.chromium.org/7227010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-07-08 10:46:10 +00:00
jkummerow@chromium.org
39b06d8850 Add support for dictionary elements to polymorphic crankshaft code.
Review URL: http://codereview.chromium.org/7285001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-30 08:40:31 +00:00
karlklose@chromium.org
f4e4bc43a8 Merge arguments branch to bleeding edge (second try).
Review URL: http://codereview.chromium.org/7187007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-16 14:12:58 +00:00
karlklose@chromium.org
cc19d1e278 Revert "Merge arguments branch to bleeding merge."
This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d.

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7172030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-16 06:37:49 +00:00
karlklose@chromium.org
6cfeb2d400 Merge arguments branch to bleeding merge.
Review URL: http://codereview.chromium.org/7167006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-15 15:09:28 +00:00
svenpanne@chromium.org
9a1d430f32 Added two convenience methods to access an int/double argument from within a
runtime function and use these in various places.
Review URL: http://codereview.chromium.org/7003114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-10 12:15:30 +00:00
danno@chromium.org
bc4156ca7c Refactor platform-specific code for determining shared stub for keyed load/stores.
R=ager@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7044083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8253 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-10 07:49:49 +00:00
danno@chromium.org
9f432cd159 Dispatch on ElementsKind rather than ExternalArrayType when generating ICs and Crankshaft code for many element operations. This is preparation to be able to share more code in the various element accessor implementations.
Merge logic to maintain external array and fast element stub caches.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/7112010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-06-09 15:19:37 +00:00
ager@chromium.org
cc4a2d7e76 Fix a number of IC stubs to correctly set the call kind.
Make the call kind and call wrapper arguments explicit to force
developers to make a choice. This would have avoided the bug in the
first case.

R=fschneider@chromium.org
TEST=mjsunit/strict-mode-implicit-receiver.js

Review URL: http://codereview.chromium.org/7086029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-30 13:23:17 +00:00
ager@chromium.org
6f775f2fb0 Fix calls of strict mode function with an implicit receiver.
Only IA32 version for now. I'll start porting.

Strict mode functions are to get 'undefined' as the receiver when
called with an implicit receiver. Modes are bad! It forces us to have
checks on all function calls.

This change attempts to limit the cost by passing information about
whether or not a call is with an implicit or explicit receiver in ecx
as part of the calling convention. The cost is setting ecx on all
calls and checking ecx on entry to strict mode functions.

Implicit/explicit receiver state has to be maintained by ICs. Various
stubs have to not clobber ecx or save and restore it.

CallFunction stub needs to check if the receiver is implicit when it
doesn't know from the context.

Review URL: http://codereview.chromium.org/7039036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-24 14:01:36 +00:00
danno@chromium.org
123500999f Reland 7917:
Better support for 'polymorphic' JS and external arrays

Allow  keyed store/load stubs to switch between external array and fast JS arrays without forcing a state transition to the generic stub.

There CL consists of two pieces of functionality. First, code stubs for fast element arrays don't immediately transition to the MEGAMORPHIC state when there's a map mismatch. Second, two ICs are cached per map for fast elements, the MONOMORPHIC version, and a new MEGAMORPHIC version that handles two or more different maps and dispatches to shared stubs to perform the array operation.

Review URL: http://codereview.chromium.org/7036016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 13:17:29 +00:00
danno@chromium.org
83c84a43e8 Revert 7917
TBR=danno@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 18:47:10 +00:00
danno@chromium.org
5a9b2b3c5f Better support for 'polymorphic' JS and external arrays
Allow  keyed store/load stubs to switch between external array and fast JS arrays without forcing a state transition to the generic stub.

There CL consists of two pieces of functionality. First, code stubs for fast element arrays don't immediately transition to the MEGAMORPHIC state when there's a map mismatch. Second, two ICs are cached per map for fast elements, the MONOMORPHIC version, and a new MEGAMORPHIC version that handles two or more different maps. Currently, the only array types supported by the MEGAMORPHIC stub are fast elements for objects and JSArrays.

BUG=
TEST=

Review URL: http://codereview.chromium.org/6894003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-17 17:29:13 +00:00
jkummerow@chromium.org
bc8f6943bb Support Float64Arrays
BUG=None
TEST=mjsunit/external-arrays.js; updated cctest; existing unit tests

Review URL: http://codereview.chromium.org/6879009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-04-21 07:15:43 +00:00
vitalyr@chromium.org
a051955678 Clean up runtime functions.
Make all functions called from generated code declared using
RUNTIME_FUNCTION macro. This makes them all look consistent and allows
experimenting with various calling conventions.

Review URL: http://codereview.chromium.org/6756029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-30 14:17:39 +00:00
ager@chromium.org
d495f4934c Cleanup usage of HEAP and FACTORY in the cache stub compiler.
Review URL: http://codereview.chromium.org/6770011
Patch from Karl Klose <karlklose@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7423 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-30 08:18:56 +00:00
ager@chromium.org
1bdc8031fa Introduce accessors on builtins instance and use them to avoid TLS access when getting builtins.
R=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/6717018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 13:40:07 +00:00
ager@chromium.org
4f5de28a9b Avoid TLS access for counters.
Get rid of the COUNTERS macro and fetch the counters from a locally
stored isolate instead.

R=karlklose@chromium.org

Review URL: http://codereview.chromium.org/6723014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 11:13:07 +00:00
danno@chromium.org
88854cd712 Remember and reuse derived map for external arrays
Ensure that all objects that had the same map before attaching an external array have the same map once the external array is attached.

BUG=75639
TEST=fast/canvas/webgl/uninitialized-test.html

Review URL: http://codereview.chromium.org/6685073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 09:57:12 +00:00
vitalyr@chromium.org
7976ca2cbc Merge isolates to bleeding_edge.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 20:35:07 +00:00
vitalyr@chromium.org
76e226f832 Revert r7268: it borked the history.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 19:41:05 +00:00
vitalyr@chromium.org
6ff7fdebd3 Merge isolates to bleeding_edge.
Review URL: http://codereview.chromium.org/6685088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 18:49:56 +00:00
antonm@chromium.org
6311105e00 Refactor fast API call.
Make it use custom call generator infrastructure.

Review URL: http://codereview.chromium.org/6686003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7246 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-17 17:25:54 +00:00
danno@chromium.org
9cca7d2733 Combine typed and pixel arrays.
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.

Review URL: http://codereview.chromium.org/6546036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-09 15:01:16 +00:00
mmaly@chromium.org
30bd09cbd6 Renaming strict to strict_mode for uniformity.
Review URL: http://codereview.chromium.org/6611003/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 16:17:28 +00:00
mmaly@chromium.org
1d040083b0 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 04:53:43 +00:00
mmaly@chromium.org
749b69853a Revert "Assignment to read only properties throws in strict mode."
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 01:42:37 +00:00
danno@chromium.org
36088cb64f Implement specialized IC code stubs for pixel array stores.
Review URL: http://codereview.chromium.org/6478027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 21:21:33 +00:00
mmaly@chromium.org
e0be3072b5 Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-13 16:19:53 +00:00
mmaly@chromium.org
3f4701df7f Revert r6756. Check failed on V8 arm - debug - crankshaft.
Need to investigate.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 23:25:07 +00:00
mmaly@chromium.org
fd6338bdda Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 21:39:59 +00:00
danno@chromium.org
a2fb4a12bb Create specialized code stubs for PixelArray loads.
Review URL: http://codereview.chromium.org/6287030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 12:50:50 +00:00
kbr@chromium.org
cbc1c0fca6 Truncate rather than round to nearest when performing float-to-integer
conversions for external array types, which implement the Typed Array
spec. (Revision of http://codereview.chromium.org/6315004 .)

Prefer SSE2 code path on x86 processors. Non-SSE2 processors now make
a slow runtime call for float-to-int conversions. Use SSE3 for 32-bit
signed and unsigned int array types where possible.

The movement of code from ic-arm.cc to stub-cache-arm.cc caused the
VFP3 code path to be tested for the first time. Fixed bugs in the
register usage and in the constant value stored into integer arrays
for NaN and +/-Infinity.

Added new truncation test to test-api.cc. Storage of NaN and +/-Inf
was already covered. Ran unit tests on x86, x64 and ARM simulator.
Tested ia32 and x64 code in Chromium on Mac and Linux respectively
with Typed Array unit tests and WebGL content.

BUG=http://code.google.com/p/chromium/issues/detail?id=50972
TEST=test-api/ExternalArrays

Review URL: http://codereview.chromium.org/6303012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-21 23:58:00 +00:00
ager@chromium.org
6b4d29766c Revert r6376 and r6373 which changes external array support. The ARM
version did not work.

TBR=kbr@chromium.org
Review URL: http://codereview.chromium.org/6295013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-19 08:20:42 +00:00
kbr@chromium.org
27f0ae7aad Truncate rather than round to nearest when performing float-to-integer
conversions for external array types, which implement the Typed Array
spec. The new code paths are for SSE3 and SSE2 capable processors.
The code for non-SSE2 processors is unchanged for now. The ARM port
appears to already be correct.

Moved the generation of the external array load and store intrinsics
to the stub cache (on all platforms) so that they are generated at run
time and can take advantage of CPU features.

This functionality is covered by the array-unit-tests.html test in the
WebGL conformance test suite:
http://khronos.org/webgl/wiki/Testing/Conformance
https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/array-unit-tests.html

Manually verified all of the SSE3/SSE2/non-SSE2 code paths by enabling
each in turn. Tested in Chromium on 32-bit Mac OS X and 64-bit Linux.

BUG=http://code.google.com/p/chromium/issues/detail?id=50972
TEST=none (see above)

Review URL: http://codereview.chromium.org/6315004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6373 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-18 21:51:50 +00:00
vitalyr@chromium.org
11a4cb5718 Introduce extra IC state to record additional feedback from IC-s.
Extra IC state is only two bits and only supported for call IC-s for
now. To change its extra state an IC stub jumps to a new miss stub
that goes to runtime as usual but then instead of going megamorphic
generates a monomorphic stub with the updated state.

Review URL: http://codereview.chromium.org/6344005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-18 16:54:48 +00:00