AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
19,279 Commits 1 Branch 0 Tags 839 MiB
1c3a3407c7
Commit Graph

3019 Commits

Author SHA1 Message Date
danno@chromium.org
36fc96a4b8 Reland r20974: Unify and simplify the FastCloneShallowArrayStub 
- Don't bake in length/capacity into full codegen calls of stubs,
allowing boilerplates to increase their capacity without regenerating
code.
- Unify all variants of the clone stub into a single,
length-independent version.
- Various tweaks to make sure that the clone stub doesn't spill and
therefore need an eager stack frame.
- Handle all lengths of array literals in the fast case.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/272513004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 15:55:45 +00:00
ishell@chromium.org
cb1a32885c [Sheriff] This reverts commits r21225 and r21226 for breaking Linux64 build. 
Revert "Make BitField3 a raw uint32 field, and move to the start of the map."
Revert "Make space available in bf3 by moving FunctionWithPrototype to bf1"

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/278883002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 14:28:59 +00:00
verwaest@chromium.org
ec195cd929 Make BitField3 a raw uint32 field, and move to the start of the map. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/272163002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 13:18:25 +00:00
yangguo@chromium.org
3fa6100ed3 Require SSE2 support for the ia32 port. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/275433004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 13:01:50 +00:00
ishell@chromium.org
ff2d004f85 Presubmit checks recover: 
1) runtime/references checks temporarily disabled (56 items left)
2) other errors fixed

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/277913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 12:59:24 +00:00
yangguo@chromium.org
c02ad39c10 Clean up stack guard interrupts. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/264233005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 09:13:12 +00:00
bmeurer@chromium.org
7c45d49861 Improve Array.shift() performance for small arrays. 
TEST=mjsunit/array-shift,mjsunit/array-shift2,mjsunit/array-shift3
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/279743002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21203 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-09 08:28:25 +00:00
bmeurer@chromium.org
066955e452 Remove GenerateBooleanCheck() since we have a boolean map now. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/269343003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-07 12:18:23 +00:00
bmeurer@chromium.org
b040340fc2 Turn CHECK()s into ASSERT()s. 
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/275433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21187 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-07 08:42:20 +00:00
mvstanton@chromium.org
f2903b6f6c Fix for 3303 MultithreadedParallelIsolates has a race condition. 
The fix is to make the code aging sequence hang off the isolate.

BUG=v8:3303
R=svenpanne@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/261953002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-06 11:25:37 +00:00
mstarzinger@chromium.org
55c077f96e Remove broken %_Log functionality. 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/265283007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-06 09:28:08 +00:00
bmeurer@chromium.org
a051bc5762 Next bunch of fixes for check elimination. 
- Canonicalize HCheckMapValue with constant map to
  HCheckMaps, and get rid of the special treatment
  during check elimination.
- Track only stable object maps for HConstants and
  add CHECK()s to verify state during code generation.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/263923004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-06 07:05:07 +00:00
bmeurer@chromium.org
785bdf7c1e Don't add code dependencies eagerly for HCheckMaps. 
Instead of adding code dependencies on stable during
graph creation, we now add them during code generation
for those HCheckMaps that survived dead code elimination.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/264973013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-05 11:03:14 +00:00
svenpanne@chromium.org
96517fbed0 Inlined IsFoundByRuntimeProbingOnly. 
It is only used internally at a single place.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/265243004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21137 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-05 09:52:03 +00:00
yangguo@chromium.org
db904a20da Always initialize the debugger eagerly. 
There is no point doing it lazily, since compiling and executing the tiniest piece of code triggers lazy init.
Also removed some dead code.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/265593004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-05 07:10:38 +00:00
bmeurer@chromium.org
7c1036d424 Various cleanups in check elimination. 
- Move IsMapAccess() to HObjectAccess.
- Collect the actual objects instead of HStoreNamedFields in
  effects, and also consider HTransitionElementsKind.
- Fix ownership of HCheckMaps::maps() and HLoadNamedField::maps().
- Avoid heavy copying of the same map sets all the time during
  check elimination, and do something useful with the memory
  instead by slightly bumping the maximum number of tracked
  objects.
- Slightly optimize UniqueSet::Contains().

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/264693011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-05 06:53:19 +00:00
bmeurer@chromium.org
50d8259fea Fix crash in debug builds introduced with r21110. 
Basically we should not check for map deprecation during
code selection, because that may run on the concurrent
compiler thread. So the fix is to move this logic to the
code generation phase instead, which is always run on the
main thread.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/263803005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21112 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-02 08:08:23 +00:00
bmeurer@chromium.org
59e5c97ec0 Don't add code dependencies on transitioning stores eagerly. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/256303007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-05-02 06:37:54 +00:00
mvstanton@chromium.org
287f65aec9 CallICStub with a "never patch" approach by default. Patching will 
occur only when custom feedback needs to be gathered (future CLs).

Now rebased on https://codereview.chromium.org/254623002/, which moves the type feedback vector to the SharedFunctionInfo.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/247373002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 14:33:35 +00:00
mvstanton@chromium.org
15dc39a86f Simplify feedback vector creation and store in SharedFunctionInfo. 
LOG=N
BUG=v8:3212
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/254623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 10:51:01 +00:00
svenpanne@chromium.org
d60dbdaf27 Unbreak the build after r21083. 
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/266493003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21084 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 10:24:03 +00:00
svenpanne@chromium.org
4dca23f825 Added a Isolate* parameter to Serializer::enabled(). 
This parameter will soon be used when a few pseudo-classes like
Serializer are turned into real classes. The current CL is already big
enough, untying our Gordian knot called "startup" will continue...

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/260003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-30 09:50:58 +00:00
bmeurer@chromium.org
d4b533d41b Bulk update of Google copyright headers in source files. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/259183002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-29 06:42:26 +00:00
yangguo@chromium.org
38b82f40d0 Remove some remnants of MaybeObjects in objects.*. 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/256993003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-28 15:33:16 +00:00
danno@chromium.org
9aaa5367ba Revert r20974: Unify and simplify the FastCloneShallowArrayStub 
Due to Layout test redness.

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/256873007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-28 10:28:15 +00:00
ulan@chromium.org
60b14ea631 Convert function.name to API-style accessor and make CallApiGetterStub serializable. 
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/254783003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-28 08:26:35 +00:00
svenpanne@chromium.org
2fe0f48d39 Simplified CPU/CpuFeatures a bit. 
This is a necessary intermediate step to disentangle the startup.

In the long run CPU and CpuFeatures should probably be merged,
and Serializer::enabled usage should be radically reduced, but
we're not there yet.

BUG=359977
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/258993002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-28 08:18:38 +00:00
jochen@chromium.org
8795d02bfd Enter a description of the change. 
Reland 20968 - "Merge v8utils.* and utils.*"

>  BUG=none
>  R=mstarzinger@chromium.org
>  LOG=n
>
>  Review URL: https://codereview.chromium.org/256753002

BUG=none
LOG=n
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/250733004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20984 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 13:47:01 +00:00
jochen@chromium.org
f2a1176f90 Revert 20968 - "Merge v8utils.* and utils.*" 
>  BUG=none
>  R=mstarzinger@chromium.org
>  LOG=n
>
>  Review URL: https://codereview.chromium.org/256753002

BUG=none
LOG=n
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/250823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20975 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 12:21:32 +00:00
danno@chromium.org
198c4769f2 Unify and simplify the FastCloneShallowArrayStub 
- Don't bake in length/capacity into full codegen calls of stubs,
  allowing boilerplates to increase their capacity without regenerating
  code.
- Unify all variants of the clone stub into a single,
  length-independent version.
- Various tweaks to make sure that the clone stub doesn't spill and
  therefore need an eager stack frame.
- Handle all lengths of array literals in the fast case.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/257563004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 11:54:01 +00:00
yangguo@chromium.org
cb2f43cb14 Always include debugger support. 
Motivation: we do not have test coverage for debuggersupport=off.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/256653004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 11:00:37 +00:00
jochen@chromium.org
c0380f6a56 Merge v8utils.* and utils.* 
BUG=none
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/256753002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20968 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 10:57:34 +00:00
svenpanne@chromium.org
66f0df5a18 Added an Isolate* field to NoTrackDoubleFieldsForSerializerScope, PlatformFeatureScope and BinaryOpIC::State. 
The serializer state and even the CPU features will be per-Isolate
later. Currently we get away with global state, because mksnapshot
runs single-threaded and has only 1 Isolate, but this will change.
Furthermore, these changes are yet another prerequisite for removing a
catch-22 at initialization time when we try to enable serialization.

This CL is similar in spirit to r20919, BTW.

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/250553005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-25 08:40:23 +00:00
verwaest@chromium.org
a55821eef2 Mark the simulate before EnterInlined with BailoutId::None(), and set ReturnId on EnterInlined. When merging simulates into the simulate before enter-inlined, adopt the last AST id that gets merged into it. 
BUG=v8:3282
LOG=n
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/257583004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 15:20:53 +00:00
ishell@chromium.org
cb46971aa3 NameDictionary's key type is now Handle<Name> instead of Name*. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/252383006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 14:59:09 +00:00
svenpanne@chromium.org
b8d27f9d38 CodeStubs contain their corresponding Isolate* now. (part 2) 
This CL mechanically removes all useless Isolate* parameters from code
stub functions, making things quite a bit simpler.

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/255543003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 12:07:40 +00:00
svenpanne@chromium.org
dd30db9021 CodeStubs contain their corresponding Isolate* now. (part 1) 
This is a purely mechanical change, adding an Isolate* to the CodeStub
constructor and a corresponding field plus a getter. A few methods in
CodeStub and its subclasses can be simplified now, but this is done in
a separate CL.

The underlying reason apart from simplicity is that deep down in the
call chain we need to detect if the serializer is active or not. This
information will be part of the Isolate, not a global variable with
funky synchronization primitives around it (which is fundamentally
wrong and the underlying cause for race conditions and a catch-22
during initialization).

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/246643014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-24 06:25:42 +00:00
yangguo@chromium.org
6d250412f1 Clean up some uses of Failures and MaybeObjects. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/245963007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-23 15:08:03 +00:00
yangguo@chromium.org
41bfa036b3 Return Object* instead of MaybeObject* from runtime calls. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/240053010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 12:50:58 +00:00
bmeurer@chromium.org
376bff2411 Optimize numeric comparison with known successors. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/246133005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 10:49:28 +00:00
bmeurer@chromium.org
af05141176 Improve code generation for bounds checks. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/246423005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20872 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 08:28:14 +00:00
bmeurer@chromium.org
eccda7f000 Fix field type handling in load elimination. 
Drive-by-fix: map_set() must return a pointer to the UniqueSet
instead of a copy.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/244383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20870 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-22 07:24:05 +00:00
adamk@chromium.org
3308cb5857 ES6: Add support for Map/Set forEach 
This implements MapIterator and SetIterator which matches
the same constructs in the ES6 spec. However, these 2
iterators are not exposed to user code yet. They are only
used internally to implement Map.prototype.forEach and
Set.prototype.forEach.

Each iterator has a reference to the OrderedHashTable where
it directly accesses the hash table's entries.

The OrderedHashTable has a reference to the newest iterator
and each iterator has a reference to the next and previous
iterator, effectively creating a double linked list.

When the OrderedHashTable is mutated (or replaced) all the
iterators are updated.

When the iterator iterates passed the end of the data table
it closes itself. Closed iterators no longer have a
reference to the OrderedHashTable and they are removed from
the double linked list. In the case of Map/Set forEach, we
manually call Close on the iterator in case an exception was
thrown so that the iterator never reached the end.

At this point the OrderedHashTable keeps all the non finished
iterators alive but since the only thing we currently expose
is forEach there are no unfinished iterators outside a forEach
call. Once we expose the iterators to user code we will need
to make the references from the OrderedHashTable to the
iterators weak and have some mechanism to close an iterator
when it is garbage collected.

BUG=1793, 2323
LOG=Y
R=adamk@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/238063009

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20857 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-17 17:45:32 +00:00
mvstanton@chromium.org
9ce1c5144a Serializer enable/disable flags need thread safety. 
BUG=
R=hpayer@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/240193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-17 14:45:06 +00:00
danno@chromium.org
59b3dc5812 Remove hand-written assembly ArrayPush stubs 
R=mstarzinger@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/233293005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-17 11:37:59 +00:00
bmeurer@chromium.org
779e87b87a Track up to 5 stable maps as field type. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/240813002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-17 08:22:22 +00:00
adamk@chromium.org
91618cf1e9 Revert "ES6: Add support for Map/Set forEach" 
This reverts https://code.google.com/p/v8/source/detail?r=20823

It broke Windows builds. Will need to find a Windows try bot to figure
out why.

TBR=mstarzinger@chromium.org,arv@chromium.org

Review URL: https://codereview.chromium.org/238973011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 21:19:25 +00:00
adamk@chromium.org
7c300d1f83 ES6: Add support for Map/Set forEach 
This implements MapIterator and SetIterator which matches
the same constructs in the ES6 spec. However, these 2
iterators are not exposed to user code yet. They are only
used internally to implement Map.prototype.forEach and
Set.prototype.forEach.

Each iterator has a reference to the OrderedHashTable where
it directly accesses the hash table's entries.

The OrderedHashTable has a reference to the newest iterator
and each iterator has a reference to the next and previous
iterator, effectively creating a double linked list.

When the OrderedHashTable is mutated (or replaced) all the
iterators are updated.

When the iterator iterates passed the end of the data table
it closes itself. Closed iterators no longer have a
reference to the OrderedHashTable and they are removed from
the double linked list. In the case of Map/Set forEach, we
manually call Close on the iterator in case an exception was
thrown so that the iterator never reached the end.

At this point the OrderedHashTable keeps all the non finished
iterators alive but since the only thing we currently expose
is forEach there are no unfinished iterators outside a forEach
call. Once we expose the iterators to user code we will need
to make the references from the OrderedHashTable to the
iterators weak and have some mechanism to close an iterator
when it is garbage collected.

BUG=1793,2323
LOG=Y
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/240323003

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 21:12:27 +00:00
rossberg@chromium.org
926ec656de Implement structural function and array types 
Just wanted to add two constructors to a datatype, how ugly can it get?

R=bmeurer@chromium.org, jarin@chromium.org
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=20809

Committed: https://code.google.com/p/v8/source/detail?r=20815

Review URL: https://codereview.chromium.org/228263005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 16:16:37 +00:00
rossberg@chromium.org
e3e81d85bb Revert "Implement structural function and array types" 
TBR=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/237963016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 15:59:39 +00:00
rossberg@chromium.org
6782d9cea3 Implement structural function and array types 
Just wanted to add two constructors to a datatype, how ugly can it get?

R=bmeurer@chromium.org, jarin@chromium.org
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=20809

Review URL: https://codereview.chromium.org/228263005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 15:42:22 +00:00
rossberg@chromium.org
a947aeb315 Revert "Implement structural function and array types" 
TBR=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/240143003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 13:57:25 +00:00
rossberg@chromium.org
7de4c1c63f Implement structural function and array types 
Just wanted to add two constructors to a datatype, how ugly can it get?

R=bmeurer@chromium.org, jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/228263005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 13:44:26 +00:00
yangguo@chromium.org
17b33fa1da Handlify code allocation. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/235153003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 11:38:56 +00:00
adamk@chromium.org
a44e10cad6 Revert "ES6: Add support for Map/Set forEach" 
This reverts commit https://code.google.com/p/v8/source/detail?r=20781.

It broke the Win32 builders.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/239163012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 01:03:56 +00:00
adamk@chromium.org
a1af5a2a2f ES6: Add support for Map/Set forEach 
This implements MapIterator and SetIterator which matches
the same constructs in the ES6 spec. However, these 2
iterators are not exposed to user code yet. They are only
used internally to implement Map.prototype.forEach and
Set.prototype.forEach.

Each iterator has a reference to the OrderedHashTable where
it directly accesses the hash table's entries.

The OrderedHashTable has a reference to the newest iterator
and each iterator has a reference to the next and previous
iterator, effectively creating a double linked list.

When the OrderedHashTable is mutated (or replaced) all the
iterators are updated.

When the iterator iterates passed the end of the data table
it closes itself. Closed iterators no longer have a
reference to the OrderedHashTable and they are removed from
the double linked list. In the case of Map/Set forEach, we
manually call Close on the iterator in case an exception was
thrown so that the iterator never reached the end.

At this point the OrderedHashTable keeps all the non finished
iterators alive but since the only thing we currently expose
is forEach there are no unfinished iterators outside a forEach
call. Once we expose the iterators to user code we will need
to make the references from the OrderedHashTable to the
iterators weak and have some mechanism to close an iterator
when it is garbage collected.

BUG=1793,2323
LOG=Y
R=adamk@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/236143002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-16 00:40:03 +00:00
mvstanton@chromium.org
d20bf182dd JumpPatchSites can/should easily deal with uint8 sized offsets. 
Motivation is that x64 nosnapshot builds need a 129 byte delta at the moment.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/237673007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-15 15:29:23 +00:00
ulan@chromium.org
a50aca97a2 Reland r20692 "Check stack limit in ArgumentAdaptorTrampoline." 
BUG=353058
LOG=N
TEST=mjsunit/regress/regress-353058
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/236633006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-15 08:26:26 +00:00
bmeurer@chromium.org
6b4d4b7287 Reland "Track field types.". 
This is an initial step towards tracking the exact types instead of just
the representations of fields. It adds support to track up to one map of
heap object field values, eliminating various map checks on values
loaded from such fields, at the cost of making stores to such fields
slightly more expensive.

Issues with transitioning stores and fast object literals in Crankshaft
fixed.

TEST=mjsunit/field-type-tracking
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/238773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-15 07:36:47 +00:00
jarin@chromium.org
c1a3ab6b4f Revert "Track field types." 
Revert r20701.

TBR=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/236843002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-14 08:24:15 +00:00
bmeurer@chromium.org
9cf3909975 Track field types. 
This is an initial step towards tracking the exact types instead of just the representations of fields. It adds support to track up to one map of heap object field values, eliminating various map checks on values loaded from such fields, at the cost of making stores to such fields slightly more expensive.

TEST=mjsunit/field-type-tracking
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/167303005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-14 06:29:15 +00:00
ulan@chromium.org
4f74f11aca Revert r20692 "Check stack limit in ArgumentAdaptorTrampoline." 
Reason: mjsunit/regress/regress-353058 failure on GC-stress.

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/234813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 15:59:12 +00:00
ulan@chromium.org
4268ce0abd Check stack limit in ArgumentAdaptorTrampoline. 
BUG=353058
LOG=N
TEST=mjsunit/regress/regress-353058
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/215853005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 13:39:19 +00:00
yangguo@chromium.org
a640707213 Implement handlified String::Equals and Name::Equals. 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/225823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-11 07:27:25 +00:00
jarin@chromium.org
008a70c47b Revert "Make new space iterable when transitioning double array to objects" 
This reverts r20603.

BUG=

Review URL: https://codereview.chromium.org/230863003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 13:39:03 +00:00
jarin@chromium.org
69d5b3c155 Make new space iterable when transitioning double array to objects 
R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/228643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20603 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-09 09:50:08 +00:00
svenpanne@chromium.org
341ec1b50e Fixed flooring division by -1 on ARM. 
We should avoid ASR #0 on ARM. Simplified and improved code a bit
while we're there on all platforms. Human brains are very bad at
understanding nested structures...

BUG=v8:3259
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/227553003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20544 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-07 12:08:40 +00:00
mvstanton@chromium.org
9e5757abee Revert "Reland of https://codereview.chromium.org/172523002/" 
This reverts commit r20516 due to a Sunspider performance issue.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/226233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-04 16:18:59 +00:00
mvstanton@chromium.org
f9a8425cd2 Reland of https://codereview.chromium.org/172523002/ 
Fixed
1) Missing line in x64 port.
2) GcStress found a logic error in the IC miss handler.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/224903005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-04 13:57:53 +00:00
svenpanne@chromium.org
f32ef903da Reland "Fixed environment assignment for LCheckNonSmi." 
Now with (hopefully correct) ARM64 part... :-}

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/225313003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-04 07:07:34 +00:00
jochen@chromium.org
5a57e644d7 Revert r20476. 
Reason for revert: crashes arm64.debug cctest

Fatal error in ../src/hydrogen-instructions.h, line 2968
CHECK(value->IsCheckHeapObject()) failed

Fixed environment assignment for LCheckNonSmi.

TBR=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/223873003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 14:04:05 +00:00
mvstanton@chromium.org
5c0d85163c Revert r20474 
This reverts commit r20474 due to an x64 release issue.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/223823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 12:27:24 +00:00
svenpanne@chromium.org
48ccdd9f7e Fixed environment assignment for LCheckNonSmi. 
This fixes browsing facebook.com with a debug version of Chrome.

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/223763003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 12:12:28 +00:00
mvstanton@chromium.org
c21cf2d334 Function calls are handled with a LoadIC and a FunctionCallStub. This works well, but we can create a platform to gather custom feedback by inventing a CallIC. CallIC takes a JSFunction as input, maintains UNINIT/MONO/MEGA state in a feedback slot, and engages in limited patching for the most efficient code. 
The change creates a degrade in NBody tests, but a follow-on CL addresses it by using this custom feedback platform to give a 45% improvement.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/172523002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 11:41:03 +00:00
jarin@chromium.org
0b53ed2d2b Check in Lithium that allocation size in Smi range. 
This is to avoid triggering an assertion from Smi::FromInt. The
generated code is unreachable, so it is not a real bug.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/221743005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-03 07:04:46 +00:00
svenpanne@chromium.org
4e40600485 Check that environments assigned via AssignEnvironment are actually used. 
Removed some temporary marker comments on the way.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/218403006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20430 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-02 11:30:13 +00:00
rossberg@chromium.org
45118bfdfb Make invalid LHSs that are calls late errors 
Necessary for web legacy compatibility.

Also fold in additional strict mode checks into LHS checks.
Minor constness clean-ups on the way.

R=marja@chromium.org
BUG=chromium:358346
LOG=Y

Review URL: https://codereview.chromium.org/217823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-02 11:03:05 +00:00
svenpanne@chromium.org
e853c8a996 Fixed build (unused vars in release mode). 
TBR=bmeuerer@chromium.org

Review URL: https://codereview.chromium.org/218623017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 11:59:24 +00:00
svenpanne@chromium.org
497487beec Consistently use a separate Lithium instruction for flooring division. 
Previously we tried to share some code on by a slightly confusing re-use
of LDivI for a (general) flooring division. Now we cleanly separate
concerns, just like for the rest of the division-like operations. Note
that ARM64 already did it this way.

If we really want to save some code, we can introduce some macro
assembler instructions and/or helper functions in the code generator in
a future CL, but we should really try to avoid being "clever" to save
just a few lines of trivial code. Effort != complexity. :-)

Renamed some related Lithium operands on the way for more consistency.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/212703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20395 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 11:42:42 +00:00
svenpanne@chromium.org
4da732e321 Fixed power-of-2 predicates, excluding 0. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/219213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20383 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 09:20:28 +00:00
svenpanne@chromium.org
51c209c609 Only assign environments when they are actually needed. (ARM and ARM64 only) 
Twin of https://codereview.chromium.org/210783003/ and https://codereview.chromium.org/211153003/.

Cleaned up DoChange a bit on the way, making things more uniform across platforms, removed useless comments etc.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/214613004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20376 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-04-01 07:21:31 +00:00
verwaest@chromium.org
019e27d8db Reland and fix "Fix LoadFieldByIndex to take mutable heap-numbers into account."" 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/218663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 14:21:04 +00:00
yangguo@chromium.org
c0fa861726 Do not check for interrupt when allocating stack locals. 
R=dcarney@chromium.org
BUG=357137
LOG=N

Review URL: https://codereview.chromium.org/219373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20357 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 14:14:54 +00:00
jochen@chromium.org
163044e7ba Revert 20348 - "Fix LoadFieldByIndex to take mutable heap-numbers into account." 
Reason for revert: crashes benchmarks/sunspider/string-fasta on ia32.debug

This also reverts r20350 and r20352

> Fix LoadFieldByIndex to take mutable heap-numbers into account.
>
> BUG=
> R=ishell@chromium.org
>
> Review URL: https://codereview.chromium.org/213213002

BUG=none
LOG=n
TBR=verwaest@chromium.org

Revert "Use sarq on x64"

This reverts commit e2a8ef9321345c6bc091054443bf2b9535ff6b1c.

Revert "Don't | int and bool"

This reverts commit c90d713d3a8ceba4fec41933a63beb6e50a3d7c0.

Review URL: https://codereview.chromium.org/219393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 13:23:32 +00:00
verwaest@chromium.org
55a6318560 Fix LoadFieldByIndex to take mutable heap-numbers into account. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/213213002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20348 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 11:59:29 +00:00
jarin@chromium.org
d65fe51ca0 Add missing lazy deopt point for the TransitionElementsKind instruction. 
R=mvstanton@chromium.org, yangguo@chromium.org
BUG=357105
TEST=test/mjsunit/regress/regress-357105.js
LOG=N

Review URL: https://codereview.chromium.org/216963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-31 11:58:53 +00:00
yangguo@chromium.org
dae7ecbfdf Reland "Clean up runtime functions for Maths." 
BUG=
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/216643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-28 10:07:23 +00:00
yangguo@chromium.org
e8d5e6377e Revert "Clean up runtime functions for Maths." 
This reverts r20307.

TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/214593005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 16:30:03 +00:00
yangguo@chromium.org
1110f4fcbb Clean up runtime functions for Maths. 
R=dslomov@google.com, dslomov@chromium.org

Review URL: https://codereview.chromium.org/212763008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 14:45:56 +00:00
yangguo@chromium.org
8847b52097 Reland "Correctly OOM in the CEntryStub after retries." 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/214473003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 10:41:45 +00:00
yangguo@chromium.org
caad1de770 Revert "Correctly OOM in the CEntryStub after retries." 
This reverts r20292 due to no-snapshot failures.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/214413005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 09:59:07 +00:00
yangguo@chromium.org
3ee0783686 Correctly OOM in the CEntryStub after retries. 
This fixes a bug introduced in r20179.

R=jkummerow@chromium.org
BUG=356211
LOG=N

Review URL: https://codereview.chromium.org/213193011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-27 09:26:47 +00:00
yangguo@chromium.org
9be61ddb8a Hide some runtime functions. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/212163004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 15:51:48 +00:00
yangguo@chromium.org
9297e8b4b5 Fix interpreted regexp build. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/212473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 08:55:19 +00:00
dslomov@chromium.org
f66af4feb4 Refactor optimized in hydrogen only runtime functions. 
This splits all runtime function into 3 categories:
1) RUNTIME: implemented in runtime and called from both full and optimized code.
2) RUNTIME_HIDDEN: implemented in runtime, never called directly from JS builtins.
3) INLINE: inlined in both full and optimized code
4) INLINE_OPTIMIZED: inlined in optimized code, implemented in runtime for full code.

R=yangguo@chromium.org, yannguo@chromium.org

Review URL: https://codereview.chromium.org/209353006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:26:55 +00:00
svenpanne@chromium.org
09753b4a81 Only assign environments when they are actually needed. (ia32 only) 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/210783003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 10:17:02 +00:00
verwaest@chromium.org
e18e650582 Ensure the constant operand for heap-object store-named-field is not a smi. 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/210193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 16:25:48 +00:00
svenpanne@chromium.org
3081e1b730 Replaced unreachable code in DoStoreNamedField by an assertion. 
This is part of the effort to assign an environment if and only if we can deopt.

Removed some related dead code on the way.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/209873005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 13:16:23 +00:00
titzer@chromium.org
df25d21dee IA32: Rename MacroAssembler::Set() and MacroAssembler::SafeSet() to Move() and SafeMove(). 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/208073003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20192 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 13:00:05 +00:00
jkummerow@chromium.org
b7c3cd5e37 [ia32/x64] Smaller instruction to check NaN 
substract 1 and test for overflow

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/202083002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 10:18:27 +00:00
yangguo@chromium.org
8b8fb30e7f Reland "Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException." 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/209903003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20184 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 10:07:15 +00:00
yangguo@chromium.org
03866841aa Revert "Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException." 
This reverts r20179.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/201573007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 09:17:18 +00:00
yangguo@chromium.org
62f65d8697 Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException. 
R=dcarney@chromium.org
BUG=v8:3060
LOG=Y

Review URL: https://codereview.chromium.org/208263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 08:47:45 +00:00
dcarney@chromium.org
493c6b3543 Do stack checks while pushing locals 
R=yangguo@chromium.org

BUG=

Review URL: https://codereview.chromium.org/207543003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 08:17:06 +00:00
titzer@chromium.org
a428b0d588 Add a utility method to the ia32 macro assembler to move a double immediate into an XMM register. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/197233011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 12:16:37 +00:00
ulan@chromium.org
f20a9473f3 Ensure that lazy deopt sequence does not override calls. 
BUG=354433
LOG=N
TEST=mjsunit/regress/regress-354433.js
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/198463006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20155 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 11:02:15 +00:00
svenpanne@chromium.org
68237f6590 Implement flooring division by a constant via truncating division by a constant. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/204583002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20123 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 13:10:23 +00:00
ulan@chromium.org
79ab5448ab Removed obsolete and dead includes. 
BUG=353954
LOG=N
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/203593014

Patch from Dmitry Zvorygin <zvorygin@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 15:40:38 +00:00
mvstanton@chromium.org
535f3427ca Pretenure call new support. 
When FLAG_pretenure_call_new is on, we emit mementos on new object creation
in full code, and consume the feedback in crankshaft. A key difference in the
generated code for stubs is the allocation of an additional type vector slot for the
CallNew AST node, which simplifies the CallConstructStub and CallFunctionStub
considerably.

Some performance tuning still needs to be addressed, therefore the flag is off at
this moment, though fully functional. The goal is to remove the flag as soon as
possible, which allows much code deletion (yay).

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/132963012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 13:39:09 +00:00
mvstanton@chromium.org
5e4febb06e Array constructor expects AllocationSite or undefined as feedback. 
Redefine Array constructor to expect an AllocationSite in the feedback
register or undefined. This will make code simpler as we support
pretenuring feedback for all constructed objects.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/203173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 11:51:30 +00:00
rmcilroy@chromium.org
0acbcf9876 Reland "Add out-of-line constant pool support to Arm." 
This CL adds out-of-line constant pool support to Arm.  A ConstantPoolBuilder
object is introduced to manage building of the ConstantPoolArray for a given
code object.

This CL depends on the following CLs landing first:
  https://codereview.chromium.org/138503002/
  https://codereview.chromium.org/179813005/
  https://codereview.chromium.org/183553003/
  https://codereview.chromium.org/183803022/
  https://codereview.chromium.org/183883011/
  https://codereview.chromium.org/186733006/
  https://codereview.chromium.org/188063002/
  https://codereview.chromium.org/190793002/
  https://codereview.chromium.org/190823002/
  https://codereview.chromium.org/190833002/
  https://codereview.chromium.org/190883002/

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/204323004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 10:32:12 +00:00
yangguo@chromium.org
bd2397c90c Revert "Add out-of-line constant pool support to Arm." 
This reverts commit r20051.

TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/204403002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 09:53:58 +00:00
rmcilroy@chromium.org
9415863c97 Add out-of-line constant pool support to Arm. 
This CL adds out-of-line constant pool support to Arm.  A ConstantPoolBuilder
object is introduced to manage building of the ConstantPoolArray for a given
code object.

This CL depends on the following CLs landing first:
  https://codereview.chromium.org/138503002/
  https://codereview.chromium.org/179813005/
  https://codereview.chromium.org/183553003/
  https://codereview.chromium.org/183803022/
  https://codereview.chromium.org/183883011/
  https://codereview.chromium.org/186733006/
  https://codereview.chromium.org/188063002/
  https://codereview.chromium.org/190793002/
  https://codereview.chromium.org/190823002/
  https://codereview.chromium.org/190833002/
  https://codereview.chromium.org/190883002/

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/191233003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 09:38:20 +00:00
svenpanne@chromium.org
1a6f977d6a Tweaked FlooringDiv back to TruncatingDiv again. 
This is a first step towards getting the flooring division by a
constant working again (which will be a separate CL).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/197873029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20048 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 07:01:08 +00:00
ulan@chromium.org
487ca9e384 Fix TransitionElementsKindStub to handle non-JSArray objects correctly. 
BUG=352982
LOG=N
TEST=mjsunit/regress/regress-352982.js
R=danno@chromium.org

Review URL: https://codereview.chromium.org/196343023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-18 13:29:29 +00:00
ishell@chromium.org
3b257c35e5 Fixed spec violation of storing to length of a frozen object. 
BUG=chromium:350890
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/196653015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 15:43:33 +00:00
mvstanton@chromium.org
6a4a934d8d Utility functions for pretenure call new. These functions aren't yet called in the tree but will be in the next days. AssertUndefinedOrAllocationSite is to be used in several places where AllocationSite feedback is optional. 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/197643008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 13:55:22 +00:00
rossberg@chromium.org
c3c185c173 Make invalid LHSs a parse-time (reference) error 
This is required by the spec. It also prevents crashes resulting from the attempt to read type feedback for the RHS of an invalid assignment which full codegen never actually allocated info for.

To do: check properly in preparser already.

R=marja@chromium.org, mstarzinger@chromium.org
BUG=351658
LOG=Y

Review URL: https://codereview.chromium.org/200473003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 10:21:01 +00:00
mvstanton@chromium.org
e3f3f6d98b Revert "Continued fix for 351257. Reusing the feedback vector is too complex." 
This reverts commit r19919.

TBR=bmeuer@chromium.org

Review URL: https://codereview.chromium.org/196343021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 08:31:21 +00:00
rmcilroy@chromium.org
f1f6d3095a Fix deoptimization for out-of-line constant pool. 
Ensure that the stack contains the correct constant pool pointer when a
function deopts.

This CL depends on https://codereview.chromium.org/183803022/ landing first.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/188063002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-14 15:11:58 +00:00
mvstanton@chromium.org
11df4b8815 Fix for issue 351261. 
This relands the following fix: "HAllocate should never generate
allocation code if the requested size does not fit into page. Regression
test included. (bug 347543)" along with additional fixes to KeyedStoreIC.

BUG=351261
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/200113002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-14 10:22:55 +00:00
mvstanton@chromium.org
dd28969c1c Continued fix for 351257. Reusing the feedback vector is too complex. 
Attempting to re-use the type feedback vector stored in the
SharedFunctionInfo turns out to be difficult among the various cases.
It will be much easier to do this when deferred type feedback processing
is removed, as is in the works.

Created bug v8:3212 to track re-introducing the optimization of reusing
the type vector on recompile before optimization.

The CL also brings back the type vector on the SharedFunctionInfo.

BUG=351257
LOG=Y
R=bmeurer@chromium.org, bmeuer@chromium.org

Review URL: https://codereview.chromium.org/199973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-14 09:28:37 +00:00
hpayer@chromium.org
7b810f4593 Revert "Moved type feedback vector to SharedFunctionInfo." 
This reverts commit 828f1d563a3f0972135886888fd26526e04da07f.

Conflicts:
	src/compiler.cc
	test/cctest/test-compiler.cc

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/196283015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 17:47:12 +00:00
verwaest@chromium.org
c2af96ba7b Turn StringLengthStub (used by string wrappers only) into a hydrogen stub. 
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/197603002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 10:57:07 +00:00
bmeurer@chromium.org
4da15df008 Remove uses of CanBeNegative() in HMod. 
BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/195793016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 08:17:44 +00:00
bmeurer@chromium.org
929313bd6b Remove uses of RangeCanInclude() in flooring division by power of 2. 
Drive-By-Fix: Improve ARM code generation for flooring division by
power of 2.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/196653009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19877 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 07:58:58 +00:00
bmeurer@chromium.org
750f2d98f8 Fix uses of range analysis results in HChange. 
BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/195023002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19872 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 06:11:52 +00:00
rmcilroy@chromium.org
e57d0296da Reland "Pass a Code object to Assembler::(set_)target_address_at for use by ool constant pool." 
The ool constant pool will require a pointer to the code's constant pool when
updating or reading target addresses using set_target_address_at()
and target_address_at().

Original Review URL: https://codereview.chromium.org/183803022

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/195983002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-12 15:23:54 +00:00
svenpanne@chromium.org
be328fd4ce Disable special handling of flooring division by constant until it is fixed for real. 
Added a test to check the various division-like operations more exhaustively.

R=bmeurer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/194863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19852 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-12 14:28:59 +00:00
jkummerow@chromium.org
8a1812f252 Fix lazy deopt after tagged binary ops 
Also add policing code to ensure that optimized frames can in fact lazily deopt
at their respective current PC when we patch them for lazy bailout.

BUG=chromium:350434
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/194703008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-12 09:59:36 +00:00
rmcilroy@chromium.org
0896bd70a2 Revert "Pass a Code object to Assembler::(set_)target_address_at for use by ool constant pool." 
This reverts r19825 for breaking ia32.debug checks.

Original Review URL: https://codereview.chromium.org/183803022

Update serializer to be able to deal with ool constant pool.

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/195373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 21:46:26 +00:00
rmcilroy@chromium.org
38732785dd Pass a Code object to Assembler::(set_)target_address_at for use by ool constant pool. 
The ool constant pool will require a pointer to the code's constant pool when
updating or reading target addresses using set_target_address_at()
and target_address_at().

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/183803022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19825 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 20:31:23 +00:00
rossberg@chromium.org
8e3f3cee9e Eliminate extended mode, and other modes clean-up 
- Merge LanguageMode and StrictModeFlag enums
- Make harmony-scoping depend only on strict mode
- Free some bits on the way
- Plus additional clean-up and renaming

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/181543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:41:22 +00:00
rossberg@chromium.org
3f702d4bf9 Mode clean-up pt 1: rename classic/non-strict mode to sloppy mode 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/177683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:39:08 +00:00
bmeurer@chromium.org
4ac0876a8c Cleanup some of the range uses in ModI/DivI. 
BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/191293013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 11:57:27 +00:00
titzer@chromium.org
91a2aa6a2c Add MacroAssembler::Move(reg, immediate) on IA32. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/188463003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 08:52:48 +00:00
rmcilroy@chromium.org
9cfd807cba Special case the recording of constant pool entries in the slot buffer. 
This CL enables RelocInfo pointers which live in the constant pool to be treated
as normal pointers by the slot buffer, avoiding the requirement of creating fake
RelocInfo objects during UpdateSlots() in order to update these slots.  This
is possible because constant pool entries are just pointers and don't require
the RelocInfo machinary to be updated.

EmbeddedObject constant pool entries can be added untyped to the slot buffer,
while code targets are still typed in order to correctly update the target
address based on the relocated code object.

Note: this is required in order to enable OOL constant pool support on Arm, but
should be benifitial for the current inline constant pool used by Arm code.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/179813005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 18:47:57 +00:00
bmeurer@chromium.org
bf86e624d4 Reland "Handle non-power-of-2 divisors in division-like operations". 
Fixed the flooring div bug and added a test case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/191293012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 10:39:17 +00:00
dcarney@chromium.org
132d4428e5 allowed keyed store callbacks ic generation 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/173853005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19744 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 08:40:03 +00:00
yangguo@chromium.org
4f15fd2977 Reland "Introduce intrinsics for double values in Javascript." 
This relands r19704 with a fix to the test case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/189823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 14:58:41 +00:00
svenpanne@chromium.org
fa6d25a602 Revert "Handle non-power-of-2 divisors in division-like operations", "A64 tweaks for division-like operations." and "Windows build fix.". 
This reverts commit 19719, 19720 and 19721 because
mozilla/ecma/Date/15.9.3.1-1 fails (in release mode only?).

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/189963005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 13:11:56 +00:00
svenpanne@chromium.org
94c450fcb9 Handle non-power-of-2 divisors in division-like operations 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/190383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 11:44:04 +00:00
svenpanne@chromium.org
819315db4e Consistenly handle power-of-2 divisors in division-like operations 
Lithium currently supports 3 division-like operations on integral operands: "Normal" division (rounding towards zero), flooring division (rounding towards -Infinity) and modulus calculation (the counterpart for the "normal" division). For divisors which are a power of 2, one can efficiently use some bit fiddling to avoid the actual division for such operations. This CL cleanly splits off these operations into separate Lithium instructions, making the code much more maintainable and more consistent across platforms.

There are 2 basic variations of these bit fiddling algorithms: One involving branches and a seemingly more clever one without branches. Choosing between the two is not as easy as it seems: Benchmarks (and probably real-world) programs seem to favor positive dividends, registers and shifting units are sometimes scarce resources, and branch prediction is quite good in modern processors. Therefore only the "normal" division by a power of 2 is implemented in a branch-free manner, this seems to be the best approach in practice. If this turns out to be wrong, we can easily and locally change this.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/175143002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 10:36:28 +00:00
mvstanton@chromium.org
1812f63fd2 Moved type feedback vector to SharedFunctionInfo. 
Type Vector followup: the type vector currently lives off the code object. This CL moves it to the SharedFunctionInfo, facilitating re-use and continued use in crankshafted code if desired.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/178463007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 10:12:17 +00:00
yangguo@chromium.org
143902bebf Revert "Introduce intrinsics for double values in Javascript." 
This reverts r19704.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/189533008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:49:28 +00:00
mvstanton@chromium.org
1d3652ebe6 Symbols for type cells. We can make more efficient code to check against type cells in the future if we use symbols, guaranteed not to conflict with user code. Currently, the "symbols" are the hole and undefined. Undefined may come in from the outside. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/181283003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:10:18 +00:00
yangguo@chromium.org
2aefde4443 Introduce intrinsics for double values in Javascript. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/178583006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:05:10 +00:00
bmeurer@chromium.org
c6bfbace87 ia32: Simplify inlined Smi code for SAR. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/188483002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 08:36:53 +00:00
bmeurer@chromium.org
a4d3fbdc8f Optimistically untag the input in tagged-to-i. 
Also drop redundant jmp instruction in deferred code.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/182723003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 08:36:13 +00:00
mvstanton@chromium.org
6115a006fd Bugfix for 349874: we incorrectly believe we saw a growing store 
When we set an out of bounds array index, the index might be so large that
it causes the array to go to dictionary mode. It's better to avoid
"learning" that this was a growing store in that case.

This fix also partially reverts a fix for bug 347543, as this fix is
comprehensive and satisfies that repro case as well (partial revert of
v19591).

BUG=349874
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/188643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-06 13:07:51 +00:00
jarin@chromium.org
7ac668f753 Deoptimization fix for HPushArgument. 
HPushArgument should never be used in a simulation environment
because the slot addresses for the arguments can be off (e.g.,
due to on-stack arguments object of an inlined caller).

R=mstarzinger@chromium.org
BUG=v8:3183
LOG=N

Review URL: https://codereview.chromium.org/178193026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-05 12:45:46 +00:00
mstarzinger@chromium.org
9ab32061ed Print properly signed displacement in disassembler. 
R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/178193028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19667 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-05 09:28:26 +00:00
mstarzinger@chromium.org
827adfe45a Print properly signed displacement in IA32 disassembler. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/176993004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-04 13:07:00 +00:00
verwaest@chromium.org
9b8021ad29 Remove all uses of field-tracking flags that do not make decisions but are subject to existing information. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/173963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-04 12:48:17 +00:00
bmeurer@chromium.org
e16cc0acaf Push safepoint registers in deferred number-to-i/u only on-demand. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/181053005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-04 12:45:00 +00:00
hpayer@chromium.org
b3ecfa32c2 Consolidate RecordWriteFromCode and RecordWriteForEvacuationFromCode. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/185233008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-03 13:27:59 +00:00
ulan@chromium.org
b9e0b87a5a Clear optimized code cache in shared function info when code gets deoptimized. 
This adds a pointer to the shared function info into deoptimization data of an optimized code. Whenever the code is deoptimized, it clears the cache in the shared function info.

This fixes the problem when the optimized function dies in new space GC before the code is deoptimized due to code dependency and before the optimized code cache is cleared in old space GC (see mjsunit/regress/regress-343609.js).

This partially reverts r19603 because we need to be able to evict specific code from the optimized code cache.

BUG=343609
LOG=Y
TEST=mjsunit/regress/regress-343609.js
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/184923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-03 11:11:39 +00:00
jkummerow@chromium.org
85367a7db9 Fail early when re-entering code that has been patched for lazy deopt 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/184373004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19607 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 12:41:25 +00:00
mvstanton@chromium.org
df988c7f6b The Array function must be looked up in the native context. 
Platforms x64, a64, arm and mips had the bug that the array function was looked
up in the global context instead of the native context. Fix this, restoring a
weakened assert in hydrogen along the way (by the fix for crbug 347528, which
helped find this case).

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/184383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 10:39:36 +00:00
ishell@chromium.org
2ab83cf192 HAllocate should never generate allocation code if the requested size does not fit into page. Regression test included. 
BUG=347543
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/180803005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19591 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-27 17:33:25 +00:00
jacob.bramley@arm.com
baf2614853 Remove the unused LoadInitialArrayMap. 
BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/173883003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-20 16:36:53 +00:00
ulan@chromium.org
db60894687 Clean up weak objects in optimized code. 
This prepares for weak objects in IC stubs.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/172233003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 14:03:48 +00:00
mvstanton@chromium.org
73b679cbee Revert "Second attempt at introducing a premonomorphic state in the call" 
This reverts commits r19463 and r19457 (includes MIPS port), there was a
Sunspider perf issue and on reflection we can achieve the necessary
result in a new way.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/172383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 13:55:25 +00:00
yangguo@chromium.org
139134acc2 Harmony: optimize Math.clz32. 
R=svenpanne@chromium.org
BUG=v8:2938
LOG=N

Review URL: https://codereview.chromium.org/172133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 13:51:49 +00:00
ulan@chromium.org
cf568ea0ed Do not emit receiver map in CheckPrototypes. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/170613002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 09:24:44 +00:00
mvstanton@chromium.org
5224c3d0f0 Second attempt at introducing a premonomorphic state in the call 
target caches.

This time we don't go through the premonomorphic state for
the Array call target caches to avoid losing information from
allocation sites that aren't only used once, but where the
resulting array is used heavily.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/169683003

Patch from Kasper Lund <kasperl@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19457 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 15:33:34 +00:00
jacob.bramley@arm.com
847aad8059 Pass a BailoutReason to Runtime::kAbort. 
BUG=
R=rmcilroy@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/168903004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 13:03:24 +00:00
svenpanne@chromium.org
dbce27047e Fixed and improved code for integral division. Fixed and extended tests. 
Arithmetic right shifting is *not* division in two's complement
representation, only in one's complement. So we convert to one's
complement, shift, and go back to two's complement. By permutating the
last steps, one can get efficient branch-free code. This insight comes
from the paleozoic era of computer science, see the paper from 1976:

   Guy Lewis Steele Jr.: "Arithmetic Shifting Considered Harmful"
   ftp://publications.ai.mit.edu/ai-publications/pdf/AIM-378.pdf

This results in better and more correct code than our previous
"neg/shift/neg" dance.

LOG=y
BUG=v8:3151
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/166793002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 10:45:27 +00:00
mvstanton@chromium.org
8bcdbc354f Revert "Add a premonomorphic state to the call target cache." 
This reverts commit r19402

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/169713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19412 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 14:22:18 +00:00
dcarney@chromium.org
127cafa846 Remove arch specific api callback generate functions 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/169353002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 12:36:44 +00:00
mvstanton@chromium.org
be731e6c95 Add a premonomorphic state to the call target cache. 
From a CL by kasperl: https://codereview.chromium.org/162903004/

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/163413003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 11:59:45 +00:00
verwaest@chromium.org
ed9bbc7051 Remove HandlerKindField and just encode the handlerkind as the only extra-ic-state. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/166883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:17:26 +00:00
verwaest@chromium.org
209b17ac31 Don't mix handler flags into regular flag computation. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/163363003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19384 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:15:08 +00:00
dcarney@chromium.org
55599b395a build fix for r19380 
R=mstarzinger@chromium.org

BUG=

Review URL: https://codereview.chromium.org/166483004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 14:48:20 +00:00
dcarney@chromium.org
0c844cc590 api accessor store ics should return passed value 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/166653003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19380 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 14:13:06 +00:00
yangguo@chromium.org
68c7523e63 Fix assignment of function name constant. 
If it's shadowed by a variable of the same name and both are forcibly
context-allocated, the function is assigned to the wrong context slot.

R=rossberg@chromium.org
BUG=v8:3138
LOG=Y

Review URL: https://codereview.chromium.org/159903008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 12:40:47 +00:00
vegorov@chromium.org
8f170a66e7 Improve positions tracking inside the HGraphBuilder. 
Instead of tracking simple absolute offset from the start of the script like other places do, track a pair of (inlining id, offset from the start of inlined function).

This enables us to pinpoint with inlining path an instruction came from. Previously in multi-script environments we emitted positions that made very little sense because inside a single optimized function they would point to different scripts without a way to distinguish them.

Start dumping the source of every inlined function to make possible IR viewing tools with integrated source views as there was previously no way to acquire this information from IR dumps. We also dump source position at which each inlining occured.

Tracked positions are written into hydrogen.cfg as pos:<inlining-id>_<offset>.

Flag --emit-opt-code-positions is renamed by this change into --hydrogen-track-positions to better convey it's meaning.

In addition this change assigned global unique identifier to each optimization performed inside isolate. This allows to precisely match compilation artifacts (e.g. IR and disassembly) and deoptimizations.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/140683011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-13 16:09:28 +00:00
bmeurer@chromium.org
85856feaf7 Omit redundant smi checks in write barriers. 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/155843006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 12:36:53 +00:00
svenpanne@chromium.org
ad536f2afc Improved variable-related assembler comments in fullcode. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/157033012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 12:06:11 +00:00
mvstanton@chromium.org
1d88f09092 Cleanup: ContextualMode doesn't need to be passed to ICs. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/154113010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 12:41:58 +00:00
mvstanton@chromium.org
516ed9fa90 Adding a type vector to replace type cells. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/137403009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-10 21:38:17 +00:00
yangguo@chromium.org
db1a685b8f Revert "Fix inconsistencies wrt whitespaces." 
This reverts r19196.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/147443008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-07 14:13:00 +00:00
yangguo@chromium.org
d0f57e1195 Fix inconsistencies wrt whitespaces. 
\u0085 (NEL) is now considered a whitespace in accordance to http://www.unicode.org/Public/6.3.0/ucd/PropList.txt

R=mstarzinger@chromium.org
BUG=v8:3109
LOG=Y

Review URL: https://codereview.chromium.org/146983007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19196 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-07 12:34:45 +00:00
dcarney@chromium.org
12039c97c6 swap in global proxy on accessors 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/156623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 10:50:07 +00:00
bmeurer@chromium.org
8150c34c82 Optimize redundant HCompareMap instructions with known successors. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/150663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 09:30:53 +00:00
jkummerow@chromium.org
4058d90747 Cleanup: Unify CodeGenerator class across platforms 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/134643026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 13:53:41 +00:00
dcarney@chromium.org
ef2ca4ac09 let load and store api callbacks use global proxy as receiver 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/151063003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-03 15:19:38 +00:00
verwaest@chromium.org
ae7a209e71 Remove CallICs 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/148223002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 16:52:17 +00:00
jochen@chromium.org
253edf246f Remove IsRegExpEquivalent. 
It's not used anywhere.

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/141563013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 14:17:02 +00:00
hpayer@chromium.org
dae054e7f0 Fix compiler error on MacOS, remove unused ParameterCount member in CallInterceptorCompiler. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/132113004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 07:02:33 +00:00
verwaest@chromium.org
a9ba16dee3 Fix the context check in LoadGlobalFunctionPrototype 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/146303003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18958 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 17:45:09 +00:00
dcarney@chromium.org
5c589640bf crankshaft support for api method calls 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/148333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 13:18:41 +00:00
verwaest@chromium.org
b73101d539 Optimize HWrapReceiver 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/135593006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 12:52:49 +00:00
dcarney@chromium.org
a1f55c107f stub api getters 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/150213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18941 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 12:15:51 +00:00
ulan@chromium.org
979cd4b0f3 Disable tracking of double fields during snapshot creation. 
Follow-up to r18298.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/101123004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:18:55 +00:00
bmeurer@chromium.org
4a0959e360 Replace HThrow with HCallRuntime. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131103021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:03:32 +00:00
bmeurer@chromium.org
f80e76cd58 Remove the unused HElementsKind instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/136093004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:44:50 +00:00
bmeurer@chromium.org
87a3951c11 Remove the HValueOf instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/139233004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:41:00 +00:00
bmeurer@chromium.org
3ba2f104c9 Turn RegExpConstructResultStub into a HydrogenCodeStub. 
This has the additional benefit that it is now possible to
inline the RegExpResult construction code into Hydrogen
builtins.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141703018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:10:35 +00:00
bmeurer@chromium.org
1e6606849a Don't create dummy uses for control dependencies. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/149513002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 12:48:32 +00:00
bmeurer@chromium.org
c12593cf2b Kill obsolete HLoadExternalArrayPointer instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/141583011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:27:35 +00:00
bmeurer@chromium.org
1e7bbbc921 Both HGlobalObject and HGlobalReceiver can be replaced with HLoadNamedField. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148453009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:26:52 +00:00
bmeurer@chromium.org
a2d1f8b8f6 Drop the native FastNewBlockContextStub. 
This code is almost never executed in real world and benchmarks,
and there's obviously absolutely no need to have this native code
hanging around for no benefit.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 13:43:04 +00:00
mvstanton@chromium.org
371d6f6a98 We shouldn't throw under FLAG_debug_code, rather abort. 
Throwing under FLAG_debug_code confuses the rest of our infrastructure
which expects a safe point at the site of call into the runtime
for throw. We were doing that to make a clusterfuzz test happy, but
the better solution is to assert/abort under debug_code, and prevent
clusterfuzz from fuzzing on internal APIs that crash on incorrect
values.

We'll need to alter the fuzzer to turn off fuzzing for:

string-natives.js
lithium/SeqStringSetChar.js
regress/regress-seqstrsetchar-ex3.js
regress/regress-seqstrsetchar-ex1.js
regress/regress-crbug-320922.js

So as to prevent the fuzzer from running
%_OneByteSeqStringSetChar() and
%_TwoByteSeqStringSetChar().

BUG=
R=hpayer@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/139903005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 11:53:11 +00:00
bmeurer@chromium.org
f9575fb82a Remove obsolete instruction HOuterContext. 
HOuterContext can be expressed in terms of HLoadNamedField.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131513015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 09:42:24 +00:00
dcarney@chromium.org
d1a10c6e37 stub fast api calls 
R=verwaest@chromium.org, vervaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/140613004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 09:57:54 +00:00
dslomov@chromium.org
1a67b7f86a External Array renaming and boilerplate scrapping 
Replaced symbolic names with correct JS name (byte -> int8, unsigned int -> uint32 etc).
Using macros to scrap the boilerplate
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145133013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18835 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 16:01:15 +00:00
svenpanne@chromium.org
13395a8392 Simplify HUnaryMathOperation::Canonicalize. 
Made the logic architecture-independent, although we should really have some kind of instruction selection instead of trying to handle some weird cases at the hydrogen level.

Some tiny related cleanups on the way.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141653015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 14:05:11 +00:00
verwaest@chromium.org
21532ddfdc Reland ArrayPop / ArrayPush. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138443012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 11:47:53 +00:00
jkummerow@chromium.org
ee4e034d70 Revert broken ArrayPop changes 
This reverts:
r18749 "Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs."",
r18790 "Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft.", and
r18798 "MIPS: Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft."

For causing crashes on Canary.

BUG=chromium:337686
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/146003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18805 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 08:32:50 +00:00
verwaest@chromium.org
6b60546b16 Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137693003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 16:20:25 +00:00
hpayer@chromium.org
83a1df2354 Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141653016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 13:02:27 +00:00
bmeurer@chromium.org
5e0f020d3a Turn FastNewContextStub into a HydrogenCodeStub. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145513002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 08:36:22 +00:00
dcarney@chromium.org
02c02fe567 Reland r18714 'Unify calling to GenerateFastApiCallBody before stubbing it' 
TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/144543004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 08:14:00 +00:00
bmeurer@chromium.org
e5f1ac1ded Get rid of the unused native code StringAddStub. 
BUG=v8:2990
LOG=n
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/144023009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:48:05 +00:00
verwaest@chromium.org
f30330325e Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/144913003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:22:58 +00:00
mvstanton@chromium.org
1b3280c491 Revert "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
This reverts commit r18709, due to deopt fuzzer issue.
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/143983010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 10:41:23 +00:00
mvstanton@chromium.org
796a244bea Revert "Unify calling to GenerateFastApiCallBody before stubbing it" 
This reverts commit r18714 for breaking webkit tests with an assert.

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/144143002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 17:04:17 +00:00
rossberg@chromium.org
0d906a8bdb Zonify types in compiler frontend 
Clean up some zone/isolate handling in AST and its visitors on the way.

(Based on https://codereview.chromium.org/103743004/)

R=jkummerow@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/102563004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:22:52 +00:00
mvstanton@chromium.org
c472ee85f8 Array constructor shouldn't require a Cell, just an AllocationSite. 
The Array constructor has a needless dependency on an input argument
that is a Cell. It uses this to walk through to an AllocationSite.
The dependency hampers future work. Instead, pass the AllocationSite
as input to the Array constructor.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/140963004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:04:39 +00:00
dcarney@chromium.org
058c5c9f40 Unify calling to GenerateFastApiCallBody before stubbing it 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/142973005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 15:06:46 +00:00
verwaest@chromium.org
2d9a4eb355 Add hydrogen support for ArrayPop, and remove the handwritten call stubs. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137783023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 12:42:24 +00:00
verwaest@chromium.org
342b534e7e Stay in fast enum case if the empty_slow_element_dictionary is used. 
This fixes slow for-in over frozen objects.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/135903014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 11:20:11 +00:00
verwaest@chromium.org
9f64f43a1c Turn ArrayPush into a stub specialized on the elements kind and argc. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/143213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 17:09:24 +00:00
mvstanton@chromium.org
04b1baa4c4 We no longer need to recover type cells from the oracle. 
We only need the values within them. Function calls to Array from optimized code needed the cell in the past, but no longer.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 09:48:05 +00:00
svenpanne@chromium.org
0757d56057 De-virtualize GenerateNameCheck. 
Currently there are two kinds of "vtables" used in the load/store stub
compilers: kind() and C++'s own vtables. This is a bit confusing, and
this is a step towards simplifying things.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/141763002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18676 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 07:05:23 +00:00
bmeurer@chromium.org
23842bbc0a Fix compilation with latest Xcode toolchain. 
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/142563002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-19 12:24:25 +00:00
verwaest@chromium.org
db3bc1ee85 Remove special String.fromCharCode call IC support. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/141773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 16:08:54 +00:00
verwaest@chromium.org
5b5feaa92d Remove the special MathFloor / MathAbs call handlers. 
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/141733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 14:21:01 +00:00
mvstanton@chromium.org
431dcc9342 Moving logic to AstNode to determine how many type cells are required. 
With this change, we'll be able to discover how many type cells we
need at parse time, enabling future optimizations.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141533004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 14:08:50 +00:00
verwaest@chromium.org
e9f957ce2c Remove special charAt and charCodeAt handling in the ICs. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/136443006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:28:22 +00:00
verwaest@chromium.org
ef52aeb701 Remove special ArrayCode CallIC. 
Once Call ICs are replaced by LoadIC + CallFunctionStub, we'll need a new way
of tracking this information.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141073006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18662 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:24:36 +00:00
mvstanton@chromium.org
155ef100e9 Fix logic error in assert in IsUndeclaredGlobal() 
Recent changes in IC logic meant that CallStubs no longer use the Contextual bit. IsUndeclaredGlobal() needed to adjust for that.

In fact, now the CL has morphed to remove the notion of storing contextual state in the IC at all, it just becomes some extra ic state of the load ic. This took some adjustment in harmony code to use the global receiver for certain stores.

Now it's clearer that only LoadICs actually record any information about contextual or not.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/140943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:08:24 +00:00
dcarney@chromium.org
7cee52948f Fix stub-invoked setter callback handling. 
When invoking a setter callback for a property using
JSObject::SetPropertyWithCallback(),the callback arguments includes
a correct pair of receiver and holder objects.

Such a pair of _possibly different_ arguments (receiver, holder) must
also be supplied when invoking the same setter callback from JITed
code, when the setter is invoked through the StoreCallbackProperty
stub.

An example where this matters are the accessor properties kept on the
global scope of Worker (i.e., properties kept on the global object
itself, and not on its prototype.) Conflating the receiver with the
holder leads to general confusion when attempting to fetch out the
wrapper object.

LOG=N
R=dcarney@chromium.org, dcarney
BUG=239669

Review URL: https://codereview.chromium.org/139263008

Patch from Sigbjorn Finne <sigbjornf@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 10:34:43 +00:00
dslomov@chromium.org
5da41be7b8 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 17:08:45 +00:00
dslomov@chromium.org
34eeeb8953 Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18649 for breaking Linux/nosnap and Win64 tests.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 16:00:36 +00:00
dslomov@chromium.org
97040ce67b Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18646

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 15:01:27 +00:00
dslomov@chromium.org
95f572389e Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18646 for breaking Win32 build.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/132233012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:26:15 +00:00
dslomov@chromium.org
0c960c2e96 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:18:37 +00:00
jarin@chromium.org
33b3f5639b Fix Win32 buildbreak (caused by overriden methods that have disappeared 
while having the patch out for code review).

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/136303004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 17:51:09 +00:00
jarin@chromium.org
19d832719e This is a preview of a first step towards unification of the hydrogen 
call machinery.  The change replaces CallNamed, CallKeyed,
CallConstantFunction and CallKnownGlobal hydrogen instructions with two
new instructions with a more lower level semantics:

1. CallJSFunction for direct calls of JSFunction objects (no
   argument adaptation)

2. CallWithDescriptor for calls of a given Code object according to
   the supplied calling convention.

Details:

CallJSFunction should be straightforward, the main difference from the
existing InvokeFunction instruction is the absence of argument adaptor
handling. (As a next step, we will replace InvokeFunction with an
equivalent hydrogen code.)

For CallWithDescriptor, the calling conventions are represented by a
tweaked version of CallStubInterfaceDescriptor. In addition to the
parameter-register mapping, we also define parameter-representation
mapping there. The CallWithDescriptor instruction has variable number of
parameters now - this required some simple tweaks in Lithium, which
assumed fixed number of arguments in some places.

The calling conventions used in the calls are initialized in the
CallDescriptors class (code-stubs.h, <arch>/code-stubs-<arch>.cc), and
they live in a new table in the Isolate class. I should say I am not
quite sure about Representation::Integer32() representation for some of
the params of ArgumentAdaptorCall - it is not clear to me wether the
params could not end up on the stack and thus confuse the GC.

The change also includes an earlier small change to argument adaptor
(https://codereview.chromium.org/98463007) that avoids passing a naked
pointer to the code entry as a parameter. I am sorry for packaging that
with an already biggish change.

Performance implications:

Locally, I see a small regression (.2% or so). It is hard to say where
exactly it comes from, but I do see inefficient call sequences to the
adaptor trampoline. For example:

;;; <@78,#24> constant-t
bf85aa515a     mov edi,0x5a51aa85          ;; debug: position 29
;;; <@72,#53> load-named-field
8b7717         mov esi,[edi+0x17]          ;; debug: position 195
;;; <@80,#51> constant-s
b902000000     mov ecx,0x2                 ;; debug: position 195
;;; <@81,#51> gap
894df0         mov [ebp+0xf0],ecx
;;; <@82,#103> constant-i
bb01000000     mov ebx,0x1
;;; <@84,#102> constant-i
b902000000     mov ecx,0x2
;;; <@85,#102> gap
89d8           mov eax,ebx
89cb           mov ebx,ecx
8b4df0         mov ecx,[ebp+0xf0]
;;; <@86,#58> call-with-descriptor
e8ef57fcff     call ArgumentsAdaptorTrampoline  (0x2d80e6e0)    ;; code: BUILTIN

Note the silly handling of ecx; the hydrogen for this code is:

0 4 s27 Constant 1  range:1_1 <|@
0 3 t30 Constant 0x5bc1aa85 <JS Function xyz (SharedFunctionInfo 0x5bc1a919)> type:object <|@
0 1 t36 LoadNamedField t30.[in-object]@24 <|@
0 1 t38 Constant 0x2300e6a1 <Code> <|@
0 1 i102 Constant 2  range:2_2 <|@
0 1 i103 Constant 1  range:1_1 <|@
0 2 t41 CallWithDescriptor t38 t30 t36 s27 i103 i102 #2 changes[*] <|@

BUG=
R=verwaest@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/104663004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 17:00:35 +00:00
machenbach@chromium.org
4398efe84d Reland "Remove flags argument from EmitCallWithStub" and "MIPS: Remove flags argument from EmitCallWithStub."" 
This reverts commit r18606 since suspected problems still remained.

BUG=
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/139013005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18609 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 09:05:21 +00:00
machenbach@chromium.org
b0d92e0c3a Revert "Remove flags argument from EmitCallWithStub" and "MIPS: Remove flags argument from EmitCallWithStub." 
This reverts commits r18598 and r18604 for breaking GC stress.

BUG=
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/133393003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18606 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 08:12:39 +00:00
verwaest@chromium.org
ca9ee7b53b Remove flags argument from EmitCallWithStub 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/135653003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18598 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 17:31:31 +00:00
verwaest@chromium.org
72125bafcc Remove HCallGlobal and merge uses with HCallNamed. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/134333007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 16:15:52 +00:00
verwaest@chromium.org
53f46c5214 Get rid of ContextualMode for call ICs. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137083002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 16:15:05 +00:00
mstarzinger@chromium.org
4d338985b9 Closed generator returns a completed object instead of throwing a error 
From ES6 rev20 draft, closed generator returns completed object (the
value is `undefined` and done is `true`).
Since a error thrown in generator is propagated to the caller without
setting status of a thrown generator to "completed", once a generator is
suspended by a error, status becomes "executing" forever. This is filed
as v8:3096

LOG=N
BUG=v8:3097
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/136003003

Patch from Yusuke Suzuki <yusukesuzuki@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18591 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 15:19:34 +00:00
verwaest@chromium.org
1257ba358c Remove CALL_AS_FUNCTION and CALL_AS_METHOD. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/136403005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 14:36:24 +00:00
jkummerow@chromium.org
1ed94acf0c Turn Runtime_MigrateInstance into Runtime_TryMigrateInstance 
because it must not cause lazy deopts because it is called from deferred code that cannot handle lazy deopts.

Hat tip to Ben for doing most of the debugging work, and to Toon for writing the regression test.

BUG=chromium:315252
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/131243003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 13:41:09 +00:00
verwaest@chromium.org
f2245a9cf9 Make the strict-mode calling convention for contextual calls the default one. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/131663003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 12:04:10 +00:00
bmeurer@chromium.org
be986094a3 Use std:: on symbols declared in C++-style C headers. 
Some libraries (e.g. Dinkumware) perform strict checks on whether
the symbols defined in classic C library headers (e.g. <stdio.h>),
or in C++-style C library headers (e.g. <cmath>) are used correctly
(respectively, in the global namespace, or in namespace std).

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/121303005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18578 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 09:57:05 +00:00
jkummerow@chromium.org
839297487f Skip back edge creation for "do ... while(false)" loops 
Drive-by fix: Fix disassembling "prefetch" instruction on ia32

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/131733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 15:20:25 +00:00
mvstanton@chromium.org
380aa6dc8d Array constructor can be simplified by loading context from JSFunction. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/128683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 15:07:23 +00:00
mvstanton@chromium.org
fc5834343f Remove flag track-allocation-sites. 
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.

R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18385

Review URL: https://codereview.chromium.org/104923010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 15:58:25 +00:00
rmcilroy@chromium.org
687537ded3 Fix some out-of-line constant pool garbage collection bugs. 
This CL fixes some bugs in the out of line constant pool implementation when
constant pools are GCed.  Namely:
  - Push/Pop pp register in exit frames and VisitPointer on it to ensure it is
    updated if the ConstantPoolArray is moved by GC.
  - Mark pp as a SafePoint Register for optimized functions.
  - Ensure that StandardFrame::IterateExpressions also iterates over the
    constant pool pointer in the stackframe.
  - Fix calculation of last_ptr_offset in ConstantPoolArray body iterator.
  - Make ensure that CONSTANT_POOL_ARRAY_TYPE is a pointer object InstanceType.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/123263005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 15:53:54 +00:00
jarin@chromium.org
acf24331e3 Fixed Lithium environment generation bug for captured objects (created 
by escape analysis). Added several tests that expose the bug.

Summary:
LCodegen::AddToTranslation assumes that Lithium environments are
generated by depth-first traversal, but LChunkBuilder::CreateEnvironment
was generating them in breadth-first fashion. This fixes the
CreateEnvironment to traverse the captured objects depth-first.

Note:
It might be worth considering representing LEnvironment by a list
with the same order as the serialized translation representation
rather than having two lists with a subtle relationship between
them (and then serialize in a slightly different order again).

R=titzer@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/93803003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 14:36:26 +00:00
mvstanton@chromium.org
e3e7daf01c We need to know if a load, store or call IC is assumed 
to be on the global object. Previously, this information
was stored in RelocInfo. A more logical place for this kind
of structural information is ExtraICState. Storing it there
makes it easier for us to gather type feedback from these
sites too.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/96083005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 14:14:34 +00:00
verwaest@chromium.org
4615e9edac Reland v8:18458 "Load the global proxy from the context of the target function." 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/104013008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 10:46:39 +00:00
rossberg@chromium.org
2879f2104c Revert "Load the global proxy from the context of the target function." 
This reverts commit https://code.google.com/p/v8/source/detail?r=18458, since it exhibits a bug that breaks some tests.

TBR=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/93863006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 09:55:25 +00:00
verwaest@chromium.org
5b40c38679 Load the global proxy from the context of the target function. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/111613003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 08:21:17 +00:00
bmeurer@chromium.org
ad4231c495 Reland "Allocation site support for monomorphic StringAdds in BinaryOps". 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/106313003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 15:31:27 +00:00
bmeurer@chromium.org
4d88b0b4be Revert "Fix compilation with C++11." and "Allocation site support for monomorphic StringAdds in BinaryOps.". 
This reverts commit r18431 and r18432 for breaking
the Linux nosnapshot build.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/122463004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 10:38:45 +00:00
bmeurer@chromium.org
a91499fec7 Allocation site support for monomorphic StringAdds in BinaryOps. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/106453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 09:17:52 +00:00
rmcilroy@chromium.org
78ab4379d3 Out-of-line constant pool on Arm: Stage 3 - Set Constant Pool Pointer on Function Entry 
Third stage of implementing an out-of-line constant pool for Arm.  This CL adds
a ConstantPool field to Code objects and initializes the pp register on
function entry, and saves the pp register on the stack frame. The ConstantPool
object is always empty and is unused currently.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/88043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18425 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-30 11:23:59 +00:00
yangguo@chromium.org
2a4be7067c Refactor the compiling pipeline. 
Goals:
 - easier to read, more suitable identifiers.
 - better distinction between compiling optimized/unoptimized code
 - compiler does not install code on the function.
 - easier to add features (e.g. caching optimized code for osr).
 - remove unnecessary code.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/110203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-23 14:30:35 +00:00
hpayer@chromium.org
f583b73b70 Revert "Remove flag track-allocation-sites." 
This reverts commit 6c430da40efe388035504d3603756aa8c46ed1dc.

BUG=

Review URL: https://codereview.chromium.org/109303006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-20 12:04:34 +00:00
mvstanton@chromium.org
e654c88fab Remove flag track-allocation-sites. 
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/104923010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-20 11:46:31 +00:00
svenpanne@chromium.org
b6c3701aea Handle Math.log(NaN) correctly in Crankshaft on Intel platforms. 
This never worked...

TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/118233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 13:31:16 +00:00
verwaest@chromium.org
fb7218dc3d Enable optimization of functions with generic switches. 
R=jkummerow@chromium.org, titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/110123002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 11:44:38 +00:00
svenpanne@chromium.org
84aa5263f3 Remove the last remnants of the TranscendentalCache. 
It was only used for Math.log, and even then only in full code and in %_MathLog. For crankshafted code, Intel already used the FP operations directly, while the ARM/MIPS ports were a bit lazy and simply called the stub. The latter directly call the C library now without any cache. It would be possible to directly generate machine code if somebody has the time, from what I've seen out in the wild it should be only about a dozen instructions.

LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/113343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 10:40:26 +00:00
ulan@chromium.org
b764068347 Fix NotifyStubFailureSaveDoubles generation for ia32. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/112833002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18319 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-17 09:09:55 +00:00
verwaest@chromium.org
be509eecf1 Properly restore the receiver after the interceptor call. 
R=dcarney@chromium.org

Review URL: https://chromiumcodereview.appspot.com/108803006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-10 14:36:10 +00:00
verwaest@chromium.org
7ee571bee6 Fix patching the receiver (global object -> global proxy) after the interceptor. 
This is a temporary fix that will be replaced by loading the proxy from the target function.

R=dcarney@chromium.org

Review URL: https://chromiumcodereview.appspot.com/108913006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-10 13:11:08 +00:00
yurys@chromium.org
cd5ea74700 Replace 'operator*' with explicit 'get' method on SmartPointer 
Made operator* return reference to the raw type, not pointer. New method 'get()' should be used when raw pointer is needed.

Also removed useless inline modifier from the SmaprtPointer methods and added const modifier to the methods that don't change smart pointer.

Made ~SmartPointerBase protected to avoid accidental calls of the non-virtual base class's destructor.

drive-by: fixed use after free in src/factory.cc

BUG=None
LOG=N
R=alph@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/101763003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-09 07:41:20 +00:00
jkummerow@chromium.org
64e9cbc305 Fix compilation with clang 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/106863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-06 11:45:26 +00:00
jkummerow@chromium.org
b1a1968ac1 Remove outdated profiler flags 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/103293006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-06 09:52:40 +00:00
yangguo@chromium.org
96b58ba4a3 Fix incorrect patching for OSR. 
If OSR happens before regular recompilation, the unoptimized function code
on the stack may not have deoptimization support.  In that case, graph
creation compiles the unoptimized code again to include support.  That
code is then installed as shared code.  When we patch code for OSR, the
function code on the stack and not the shared code is what we want.

R=titzer@chromium.org
TEST=block-conflicts.js with --always-osr --concurrent-osr

Review URL: https://codereview.chromium.org/99013003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-05 16:17:44 +00:00
yangguo@chromium.org
5df90d2c74 Remove unused trigonometric code. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/104203003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-04 11:39:24 +00:00
ulan@chromium.org
a06c84354c Make LCodeGen::RegisterDependentCodeForEmbeddedMaps platform independent. 
BUG=
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/99053002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-03 12:32:35 +00:00
mvstanton@chromium.org
de96489df8 Bug in StoreIC::GenerateMegamorphic: strict_mode/extra_ic_state mismatch. 
When computing the code flags for a megamorphic store IC, we mistakenly
passed a strict_mode variable when an ExtraICState was expected.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/98633005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 15:38:50 +00:00
bmeurer@chromium.org
9b892b86b1 Refactor BinaryOpIC to be able to use different stubs. 
Previously BinaryOpIC and BinaryOpStub were pretty much interdependent.
However, in order to use allocation sites for string adds on-demand,
we need to be able to use different stubs (with a different number of
register parameters, via trampolines) depending on the BinaryOpIC state.

R=hpayer@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/97543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 13:14:07 +00:00
mvstanton@chromium.org
30c77be771 Removed pieces of extra_ic_state scattered around the stub compiler class hierarchy, and pushed down to a extra_ic_state in the base class. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/98853002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 11:59:44 +00:00
bmeurer@chromium.org
a3d1df29f1 Fix HInnerAllocatedObject to use an HValue for the offset. 
R=hpayer@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/98673003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 11:24:31 +00:00
bmeurer@chromium.org
46fbeec7ab Remove the obsolete Code::IsPregenerated flag. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96753003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18172 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 09:46:35 +00:00
bmeurer@chromium.org
0de769aebd Fix compilation error with latest Xcode. 
The build failed because of unused private fields.

R=titzer@chromium.org
BUG=v8:3030
LOG=n

Review URL: https://codereview.chromium.org/94793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18171 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 08:09:17 +00:00
bmeurer@chromium.org
6e373493aa Drop IsPregenerated() and allow_stub_calls flag. 
This also removes the fixed register hack that was required to support RecordWriteStub in the snapshot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96853003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-29 20:49:15 +00:00
mvstanton@chromium.org
5ba1304d60 Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects. 
BUG=299979
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/80623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-29 15:22:16 +00:00
verwaest@chromium.org
4d5ec5e656 Reupload CallIC changes. 
Relands https://codereview.chromium.org/91963003/ with fix for the invalid receiver patching in case of the global object / interceptor.
BUG=
R=ishell@chromium.org

Review URL: https://chromiumcodereview.appspot.com/96763002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-29 12:57:47 +00:00
mstarzinger@chromium.org
c8bfa60c0f Fix context register allocation in LTransitionElementsKind. 
R=yangguo@chromium.org
BUG=chromium:324306
LOG=N

Review URL: https://codereview.chromium.org/95293003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-29 09:47:40 +00:00
yangguo@chromium.org
09c63bc961 Revert r18131 and r18139 "Clean up in the CallStubCompiler". 
and "Fix register usage."

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/96573002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18146 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-29 09:02:00 +00:00
verwaest@chromium.org
60d995fc99 Fetch strictmode in the interceptor setter from the IC. 
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/95373002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-28 18:11:15 +00:00
mvstanton@chromium.org
e066a3667d Move responsibility for definition of ExtraICState bits into the ICs. 
Currently it's in the Code object for some ICs and in ICs for other ICs.
This should make it easier to alter bits as needed.

2) Recover an extra bit in the code object to give us 6 bits for the extra ic state. We'll need it soon to store contextual state.

3) Cleanup code that treated StrictMode enum and ExtraICState enum as interchangeble.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/91803003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-28 15:32:55 +00:00
verwaest@chromium.org
bb86f02462 Cleanup in the CallStubCompiler. 
BUG=
R=ishell@chromium.org

Review URL: https://chromiumcodereview.appspot.com/91963003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18131 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-28 15:26:04 +00:00
verwaest@chromium.org
bbef8af130 Use the HandlerFrontendHeader in most call compilers. 
R=ishell@chromium.org

Review URL: https://chromiumcodereview.appspot.com/83753002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-28 13:56:49 +00:00
mvstanton@chromium.org
f3a22f965e The goal is to discover the appropriate heap space for objects created in full 
code. By the time we optimize the code, we'll be able to decide on new or old
space based on the number of surviving objects after one or more gcs.

The mechanism is a "memento" placed behind objects in the heap. It's currently
done for array and object literals, with plans to use mementos for constructed
objects as well (in a later CL).

The feature is behind the flag allocation_site_pretenuring, currently off.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/40063002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-27 14:03:40 +00:00
dslomov@chromium.org
c3a4d718ce Generate TypedArrayInitialize builtin in hydrogen. 
R=danno@chromium.org

Review URL: https://codereview.chromium.org/59023003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-25 14:41:46 +00:00
bmeurer@chromium.org
253d155048 Drop unused Assembler::set_external_target_at() method. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/85793002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-25 14:07:05 +00:00
verwaest@chromium.org
80545b59fc Minor cleanup in calling interceptors for loading properties. 
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/82743003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-25 14:06:06 +00:00
mvstanton@chromium.org
81b22bbf96 A performance regression in array literal creation was caused by refactoring that eliminated a special fast case for shallow arrays. At the same time the general case got a bit slower. This CL restores most of the performance without coding the special fast case. The virtual dispatching is unnecessary because we know what we want to do at compile time. A flag was added to Runtime::CreateArrayLiteral. The flags delivers information about shallowness but also whether or not allocation mementos should be created. This is useful for crankshafted code. 
BUG=v8:3008
LOG=Y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/77293003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-25 12:41:27 +00:00
mstarzinger@chromium.org
8982971213 Add counters for write barriers in generated code. 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/78953003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-22 17:37:34 +00:00