Commit Graph

179 Commits

Author SHA1 Message Date
verwaest
8e28e851ee Install ConstructNonConstructable as construct stub for non-constructables.
BUG=

Review URL: https://codereview.chromium.org/1467473002

Cr-Commit-Position: refs/heads/master@{#32223}
2015-11-24 17:17:00 +00:00
mstarzinger
7c45b00529 [turbofan] Switch passing of new.target to register.
This passes the new.target value in a register instead of through a
side-channel via the construct stub. Note that only TurboFan code uses
the register value so far, but unoptimized code will be switched soon.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1460503008

Cr-Commit-Position: refs/heads/master@{#32203}
2015-11-24 11:39:23 +00:00
bmeurer
a61a6f9998 [turbofan] Allow to consume feedback on CallConstruct.
Add an eager deoptimization location for JSCallConstruct and adapt the
JSCallReducer to consume target feedback for construction sites (only
applies to explicit new F(...args) not the super constructor calls).
Also recognize the new Array(...args) constructs with only target
feedback.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1467173002

Cr-Commit-Position: refs/heads/master@{#32177}
2015-11-23 13:34:29 +00:00
mstarzinger
0227857d26 [turbofan] Make new.target explicit in JSCallDescriptor.
This adds an explicit parameter to the call descriptor having kind
kJSCallFunction representing the new.target value. Note that for now
this parameter is not yet passed in and hence cannot be used yet. Also
contains some refactoring of how parameter index value are calculated,
establishing Linkage as the central point for such index computations.

This is a preparatory CL to allows us passing new.target in a register
instead of via a side-channel through the construct stub frame.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1461973002

Cr-Commit-Position: refs/heads/master@{#32112}
2015-11-19 12:48:25 +00:00
bmeurer
9b14e5bb63 [turbofan] Decouple inlining and native context specialization.
Retrieve the native context/global object from the Node being
specialized in the JSNativeContextSpecialization and the
JSGlobalObjectSpecialization classes. For this we introduce two
new methods NodeProperties::GetSpecializationNativeContext and
NodeProperties::GetSpecializationGlobalObject, which walk up
the context chain and might in the end take the native context
from the outermost activation (if native context specialization
is enabled). This allows us to run the native context specialization
pass as part of the inlining phase without hacking some of that into
the JSInliner.

Also refactor the NodeProperties::GetSpecializationContext method
that was previously local to the JSContextSpecialization.

Also refactor two other oddities in JSNativeContextSpecialization.

R=jarin@chromium.org
BUG=v8:4470, v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1451143005

Cr-Commit-Position: refs/heads/master@{#32076}
2015-11-18 10:04:03 +00:00
mstarzinger
83e9ea1e49 [turbofan] Ensure inlined constructor calls still throw.
This makes sure that inlining a constructor call to a function which
cannot be used as a constructor (e.g. strong mode function) still does
throw correctly when the implicit receiver is created.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-inline-strong-as-construct
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1447443002

Cr-Commit-Position: refs/heads/master@{#31982}
2015-11-13 14:05:48 +00:00
mstarzinger
83a6ab85cc [turbofan] Rename "original constructor" to "new target".
This aligns the naming of "new target" with the spec text throughout
TurboFan and the stack frame walker. The goal is to avoid unnecessary
confusion for people familiar with the spec.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1442643002

Cr-Commit-Position: refs/heads/master@{#31978}
2015-11-13 11:53:38 +00:00
mstarzinger
bae4492a3e [turbofan] Pass new target to JSCreate nodes.
This passes both, the actual constructor and the original constructor,
to nodes having the {JSCreate} operator. This is required for allocating
properly subclassed implicit receiver objects.

R=verwaest@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1434873004

Cr-Commit-Position: refs/heads/master@{#31955}
2015-11-12 09:33:37 +00:00
mstarzinger
11d5d09ce1 [turbofan] Initial support for constructor call inlining.
This implements a first version of support for constructor call inlining
in the inlining machinery. For now we can only inline calls where the
actual constructor and the original constructor coincide (i.e. no super
constructor calls). Note that the target of a super constructor call is
loaded with a runtime call, so there is no way for it to be constant
promoted at the moment.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1435873002

Cr-Commit-Position: refs/heads/master@{#31954}
2015-11-12 08:51:28 +00:00
bmeurer
30aca03ad1 [turbofan] Implement the call protocol properly for direct calls.
The callees are expected to properly set the number of actual
arguments passed to the callee, which is now represented correctly
in the TurboFan graphs by a new Parameter right before the context
Parameter.  Currently this is only being used for outgoing calls.

Note that this requires disabling two of the TF code stub tests,
because of the JavaScript graphs are not automagically compatible
with abitrary (incoming) code stub interface descriptors.  If we
want to support JS code stubs at all, then we need to find a sane
way to feed in this information.

Drive-by-fix: Don't insert a direct call to a classConstructor.

R=mstarzinger@chromium.org
BUG=v8:4413, v8:4428
LOG=n

Review URL: https://codereview.chromium.org/1410633006

Cr-Commit-Position: refs/heads/master@{#31789}
2015-11-04 14:08:59 +00:00
bmeurer
4eb41ba738 [turbofan] Split JSGlobalObjectSpecialization into separate class.
The JSNativeContextSpecialization class is getting rather huge with all
the stuff related to property and element access going in. Splitting off
the global object related stuff into JSGlobalObjectSpecialization seems
like a natural separation, especially since the global object
specialization is sort of separate issue anyway.  This is neutral
functionality- and performance-wise.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1417043006

Cr-Commit-Position: refs/heads/master@{#31748}
2015-11-03 14:20:35 +00:00
bmeurer
6040d5c0db [turbofan] Fix missing bailout point before calls.
In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1425883004

Cr-Commit-Position: refs/heads/master@{#31668}
2015-10-30 06:59:07 +00:00
mstarzinger
37f5e23b5c [turbofan] Fix receiver binding for inlined callees.
This introduces a JSConvertReceiver operator to model the implicit
conversion of receiver values for sloppy callees. It is used by the
JSInliner for now, but can also be used to model direction function
calls that bypass call stubs.

Also note that a hint is passed to said operator whenever the source
structure constrains the receiver value type. This hint allows for
optimizations in the lowering of the operator.

The underlying specification in ES6, section 9.2.1.2 is the basis for
this implementation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/receiver-conversion
BUG=v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1412223015

Cr-Commit-Position: refs/heads/master@{#31598}
2015-10-27 12:13:49 +00:00
akos.palfi
f5c227b27d Fix gcc 4.9.2 signed-compare error.
BUG=

Review URL: https://codereview.chromium.org/1418693005

Cr-Commit-Position: refs/heads/master@{#31497}
2015-10-23 08:21:26 +00:00
mstarzinger
2e61d92884 [turbofan] Make JSInliner use temporary zone again.
This switches inlining back to use a temporary zone for parsing and
analyzing inlinees. The inlinee graph however is still built in the
same zone as the parent graph.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1422503005

Cr-Commit-Position: refs/heads/master@{#31471}
2015-10-22 12:22:06 +00:00
mstarzinger
4054961fa4 [turbofan] Fix JSInliner strong mode bailout.
This moves the bailout point in the JSInliner up to a point where it is
still allowed to decide not to inline. Once the inlining decision has
been recorded with CompilationInfo::AddInlinedFunction, we should not
abort anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1410023006

Cr-Commit-Position: refs/heads/master@{#31469}
2015-10-22 11:42:17 +00:00
jarin
14ba9c3dea Introduce a reference to the code object of inlined functions in CompilationInfo.
The newly introduced root makes sure that we do not flush the
optimized code while the function is being compiled.

BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1415133002

Cr-Commit-Position: refs/heads/master@{#31444}
2015-10-21 15:05:32 +00:00
mstarzinger
68a74034f2 [turbofan] Temporary workaround for JSInliner zone.
This is exactly what it looks like. A temporary hack that ensures we
can make forward progress with the JSInliner despite other components
have a hard time picking the correct zone. This hack is a hack!

R=bmeurer@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1410963003

Cr-Commit-Position: refs/heads/master@{#31380}
2015-10-19 15:09:20 +00:00
bmeurer
f6a886d571 [turbofan] Rename JSGlobalSpecialization to JSNativeContextSpecialization.
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410353002

Cr-Commit-Position: refs/heads/master@{#31356}
2015-10-19 08:21:07 +00:00
bmeurer
e1088b27b5 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31352}
2015-10-19 05:24:51 +00:00
jarin
5c53481233 Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset #3 id:100001 of https://codereview.chromium.org/1396333010/ )
Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}
2015-10-16 14:56:25 +00:00
bmeurer
3a0bf860b7 [turbofan] Initial support for monomorphic/polymorphic property loads.
Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}
2015-10-16 14:09:17 +00:00
mstarzinger
b7990793cf [turbofan] Move SimplifiedOperatorBuilder into JSGraph.
This fixes the lifetime of nodes created by JSGlobalSpecialization that
contain a simplified operator. In the case where this reducer runs as
part of the inliner, the SimplifiedOperatorBuilder was instantiated with
the wrong zone. This led to use-after-free of simplified operators.

To avoid such situations in the future, we decided to move this operator
builder into the JSGraph and make the situation uniform with all other
operator builders.

R=bmeurer@chromium.org
BUG=chromium:543528
LOG=n

Review URL: https://codereview.chromium.org/1409993002

Cr-Commit-Position: refs/heads/master@{#31334}
2015-10-16 12:38:52 +00:00
mstarzinger
e6a923ab56 [turbofan] Fix various issues with --turbo-inlining enabled.
This is in preparation to enabling --turbo-inlining by default, fixing
various issues when general purpose inlining is running against our
entire test suite.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407533004

Cr-Commit-Position: refs/heads/master@{#31294}
2015-10-15 12:02:06 +00:00
bmeurer
ffd0a2ae74 [turbofan] Make native context specialization dependent on the typed pipeline.
Also refactor the JSGlobalSpecialization somewhat to reduce the amount
of duplicated code somewhat.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1403223003

Cr-Commit-Position: refs/heads/master@{#31286}
2015-10-15 10:25:47 +00:00
rmcilroy
822b493bee Move AccessorTable from full-codegen.h to ast.h.
It is used by AstGraphBuilder (TF) and BytecodeGenerator (Ignition), so is no
longer a full-codegen datastructure. Removes full-codegen.h dependency from
compiler/ and interpreter/

Review URL: https://codereview.chromium.org/1393393003

Cr-Commit-Position: refs/heads/master@{#31256}
2015-10-14 12:22:22 +00:00
bmeurer
d702f70795 [turbofan] Move native context specialization before inlining.
Perform native context specialization immediately after graph
construction (also after inlinee graph construction). This way
we can do unified inlining before we go to typing and typed
lowering. And we will get better typing due to constants and
(checked) type feedback.

R=mstarzinger@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1404123002

Cr-Commit-Position: refs/heads/master@{#31255}
2015-10-14 12:21:03 +00:00
mstarzinger
0a6863f029 [turbofan] Separate JSInliningHeuristic into own class.
This separates the core machinery and the heuristics involved with
inlining functions calls. So far the heuristic only respects our
%SetForceInlineFlag hint, but it will the place where general inlining
heuristics can live without impeding clarity of the core machinery.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1391903002

Cr-Commit-Position: refs/heads/master@{#31150}
2015-10-07 12:18:32 +00:00
bmeurer
a916059aa7 [turbofan] Don't try to inline non-inlineable functions.
R=mstarzinger@chromium.org
BUG=chromium:540593
LOG=n

Review URL: https://codereview.chromium.org/1395453002

Cr-Commit-Position: refs/heads/master@{#31145}
2015-10-07 11:43:39 +00:00
mstarzinger
da9c42dd45 [turbofan] Make Node::set_op safer via wrapper.
This introduces the NodeProperties::ChangeOp helper which guards node
operator changes so that additional checking can be done without any
additional dependencies being pulled into the Node class. For now only
the input count is checked, but additional checking might follow.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1366753003

Cr-Commit-Position: refs/heads/master@{#30916}
2015-09-24 14:46:37 +00:00
mstarzinger
2c54dbda35 [turbofan] Make arguments object materialization inlinable.
This makes sure that the arguments object materialization in the method
prologue is composable with respect to inlining. The generic runtime
functions materializing those objects now respect the deoptimization
information when reconstructing the original arguments.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1340313003

Cr-Commit-Position: refs/heads/master@{#30766}
2015-09-16 13:04:34 +00:00
mstarzinger
9e47ec6eda [turbofan] Fix JSInliner to handle non-returning bodies.
The assumption that every function body produces a value does not hold
for functions that e.g. unconditionally throw or endlessly loop. This
fixes the inlining logic to handle such cases.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-530598
BUG=chromium:530598
LOG=n

Review URL: https://codereview.chromium.org/1333193005

Cr-Commit-Position: refs/heads/master@{#30738}
2015-09-15 11:19:23 +00:00
mstarzinger
c505907dce [turbofan] Handle stack overflow exceptions in JSInliner.
R=bmeurer@chromium.org
BUG=chromium:527364
LOG=n

Review URL: https://codereview.chromium.org/1322203005

Cr-Commit-Position: refs/heads/master@{#30651}
2015-09-09 10:24:31 +00:00
mstarzinger
c87bd340af [turbofan] Remove obsolete unique.h includes in TurboFan.
Now that it is no longer needed, this also removes the invalid inclusion
of "object-inl.h" within the "unique.h" header file.

Note that this change still leaves 2 violations of that rule in the
code, checked with the "tools/check-inline-includes.sh" tool.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1321223002

Cr-Commit-Position: refs/heads/master@{#30503}
2015-09-01 10:30:57 +00:00
mstarzinger
6e65e6db6c [turbofan] Remove usage of Unique<T> from graph.
The usage of Unique<T> throughout the TurboFan IR does not have any
advantage. There is no single point in time when they are initialized
and most use-sites looked through to the underlying Handle<T> anyways.
Also there already was a mixture of Handle<T> versus Unique<T> in the
graph and this unifies the situation to use Handle<T> everywhere.

R=bmeurer@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/1314473007

Cr-Commit-Position: refs/heads/master@{#30458}
2015-08-31 08:25:05 +00:00
yangguo
3be39a24bf Move Full-codegen into its own folder.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1248443003

Cr-Commit-Position: refs/heads/master@{#29840}
2015-07-24 10:11:57 +00:00
danno
cca5e74a58 [turbofan]: Add a context relaxation Reducer
In many cases, the context that TurboFan's ASTGraphBuilder or subsequent
reduction operations attaches to nodes does not need to be that exact
context, but rather only needs to be one with the same native context,
because it is used internally only to fetch the native context, e.g. for
creating and throwing exceptions.

This reducer recognizes common cases where the context that is specified
for a node can be relaxed to a canonical, less specific one. This
relaxed context can either be the enclosing function's context or a specific
Module or Script context that is explicitly created within the function.

This optimization is especially important for TurboFan-generated code stubs
which use context specialization and inlining to generate optimal code.
Without context relaxation, many extraneous moves are generated to pass
exactly the right context to internal functions like ToNumber and
AllocateHeapNumber, which only need the native context. By turning context
relaxation on, these moves disappear because all these common internal
context uses are unified to the context passed into the stub function, which
is typically already in the correct context register and remains there for
short stubs. It also eliminates the explicit use of a specialized context
constant in the code stub in these cases, which could cause memory leaks.

Review URL: https://codereview.chromium.org/1244583003

Cr-Commit-Position: refs/heads/master@{#29763}
2015-07-20 17:16:14 +00:00
yangguo
35c28ce0a7 Debugger: prepare code for debugging on a per-function basis.
Prior to this patch, we enter a global debug mode whenever a break point
is set. By entering this mode, all code is deoptimized and activated
frames are recompiled and redirected to newly compiled debug code.

After this patch, we only deoptimize/redirect for functions we want to
debug. Trigger for this is Debug::EnsureDebugInfo, and having DebugInfo
object attached to the SFI prevents optimization/inlining.

The result is that we can have optimized code for functions without break
points alongside functions that do have break points, which are not
optimized.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=v8:4132
LOG=Y

Review URL: https://codereview.chromium.org/1233073005

Cr-Commit-Position: refs/heads/master@{#29758}
2015-07-20 14:53:37 +00:00
bmeurer
069a47f6e5 [turbofan] Context specialization is the job of the JSContextSpecialization.
Remove the context specialization hack from the AstGraphBuilder, and
properly specialize to the function context in the context specialization.
And replace the correct context in the JSInliner.

R=mstarzinger@chromium.org
BUG=v8:4273
LOG=n

Review URL: https://codereview.chromium.org/1218873005

Cr-Commit-Position: refs/heads/master@{#29493}
2015-07-06 12:56:28 +00:00
bmeurer
44ea5fbf95 [turbofan] Disallow cross native context inlining.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1213383002

Cr-Commit-Position: refs/heads/master@{#29376}
2015-06-30 11:38:36 +00:00
bmeurer
9dccfea020 [turbofan] Disable recursive inlining for now.
The deoptimizer (and probably various other places) cannot deal properly
with recursive function inlining, so we disallow it in TurboFan as well.
We might want to reconsider that decision at some point in the future.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1211243007

Cr-Commit-Position: refs/heads/master@{#29374}
2015-06-30 11:05:16 +00:00
bmeurer
57267fef14 [turbofan] Remove explicit context specialization from inlining.
Ideally inliner itself should not deal with context specialization at
all, since this is all handled in the pipeline instead (actually
inlining already runs together with context specialization), and the
inlining logic should not care about the specialization mode.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1217973003

Cr-Commit-Position: refs/heads/master@{#29366}
2015-06-30 07:37:38 +00:00
jarin
de62b486e3 [turbofan] Factor out the function specific part from the frame state operator.
This also threads through the parameter count and local count to the instruction selector. This will be later used to allow merging of various StateValues vector (and prepare for differential encoding which will not distinguish between parameters, locals and expression stack).

BUG=

Review URL: https://codereview.chromium.org/1191243003

Cr-Commit-Position: refs/heads/master@{#29214}
2015-06-23 07:17:25 +00:00
bmeurer
1021ed85cb [ubsan] Fix HeapObjectMatcher to avoid invalid casts.
BUG=v8:3809
LOG=n
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1196623002

Cr-Commit-Position: refs/heads/master@{#29147}
2015-06-19 12:49:13 +00:00
bmeurer
733a246386 [turbofan] Proper dead code elimination as regular reducer.
The three different concerns that the ControlReducer used to deal with
are now properly separated into

  a.) DeadCodeElimination, which is a regular AdvancedReducer, that
      propagates Dead via control edges,
  b.) CommonOperatorReducer, which does strength reduction on common
      operators (i.e. Branch, Phi, and friends), and
  c.) GraphTrimming, which removes dead->live edges from the graph.

This will make it possible to run the DeadCodeElimination together with
other passes that actually introduce Dead nodes, i.e. typed lowering;
and it opens the door for general inlining without two stage fix point
iteration.

To make the DeadCodeElimination easier and more uniform, we basically
reverted the introduction of DeadValue and DeadEffect, and changed the
Dead operator to produce control, value and effect. Note however that
this is not a requirement, but merely a way to make dead propagation
easier and more uniform. We could always go back and decide to have
different Dead operators if some other change requires that.

Note that there are several additional opportunities for cleanup now,
i.e. OSR deconstruction could be a regular reducer now, and we don't
need to use TheHole as dead value marker in the GraphReducer. And we can
actually run the dead code elimination together with the other passes
instead of using separate passes over the graph.  We will do this in
follow up CLs.

R=jarin@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1193833002

Cr-Commit-Position: refs/heads/master@{#29146}
2015-06-19 12:07:26 +00:00
mstarzinger
eb0e7437d3 [turbofan] Introduce DeadValue and DeadEffect operators.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186033006

Cr-Commit-Position: refs/heads/master@{#29104}
2015-06-18 08:17:17 +00:00
bmeurer
c5c27dd5d9 [turbofan] Record the SharedFunctionInfo of ALL inlined functions.
Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Committed: ffa0b4007c

Review URL: https://codereview.chromium.org/1175953002

Cr-Commit-Position: refs/heads/master@{#28922}
2015-06-11 05:23:11 +00:00
bmeurer
1c49127d3e Revert of [turbofan] Record the SharedFunctionInfo of ALL inlined functions. (patchset #2 id:20001 of https://codereview.chromium.org/1175953002/)
Reason for revert:
Breaks Windows debug.

Original issue's description:
> [turbofan] Record the SharedFunctionInfo of ALL inlined functions.
>
> Previously we only recorded the SharedFunctionInfo of inlined functions
> that had at least one (lazy) deopt point left at code generation time.
>
> R=mstarzinger@chromium.org
>
> Committed: ffa0b4007c

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1178683004

Cr-Commit-Position: refs/heads/master@{#28920}
2015-06-11 04:47:47 +00:00
Benedikt Meurer
ffa0b4007c [turbofan] Record the SharedFunctionInfo of ALL inlined functions.
Previously we only recorded the SharedFunctionInfo of inlined functions
that had at least one (lazy) deopt point left at code generation time.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1175953002.

Cr-Commit-Position: refs/heads/master@{#28919}
2015-06-11 04:34:30 +00:00
bmeurer
cf21da7e48 [deoptimizer] Basic support inlining based on SharedFunctionInfo.
Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1169103004

Cr-Commit-Position: refs/heads/master@{#28906}
2015-06-10 11:52:49 +00:00
mstarzinger
ed13ea1e32 [turbofan] Turn JSContextSpecializer into an AdvancedReducer.
This in turn allows usage of AdvancedReducer::ReplaceWithValue which
has access to the underlying graph reducer.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1162903006

Cr-Commit-Position: refs/heads/master@{#28838}
2015-06-08 12:10:10 +00:00
mstarzinger
8f4d9a0a1e [turbofan] Allow ReplaceWithValue to kill control.
This allows any AdvancedReducer to remove exception projections from
graphs. This is the common case when JS-operators are being replaced
with pure values. The old NodeProperties::ReplaceWithValue is being
deprecated in favor of AdvancedReducer::ReplaceWithValue.

R=titzer@chromium.org
TEST=unittests/AdvancedReducerTest

Review URL: https://codereview.chromium.org/1168693002

Cr-Commit-Position: refs/heads/master@{#28810}
2015-06-05 12:02:09 +00:00
bmeurer
7483dbd5fc [turbofan] Use Start as sentinel for frame states.
This simplifies inlining, in that we only need to update uses of Start
and inputs of End instead of walking the whole inlinee to update all
outer frame states.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1146403008

Cr-Commit-Position: refs/heads/master@{#28649}
2015-05-27 11:02:01 +00:00
bmeurer
f6fb5eb197 [turbofan] Connect loops to end via Terminate during graph building.
This way we don't need to connect (potentially) non-terminating loops
later during control reduction, which saves one forward pass over the
control graph.  Long term we will move the trimming functionality of
the control reducer to the GraphReducer, and get rid of the Finish
method again.

As a bonus, this change also properly rewires Terminate, Throw and
Deoptimize during inlining.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1155683004

Cr-Commit-Position: refs/heads/master@{#28625}
2015-05-26 12:18:07 +00:00
bmeurer
2b93b8aa41 [turbofan] Change End to take a variable number of inputs.
This simplifies the handling of the End node. Based on this CL we will
finally fix terminating every loop from the beginning (via Terminate
nodes) and fix inlining of Throw, Deoptimize and Terminate.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1157023002

Cr-Commit-Position: refs/heads/master@{#28620}
2015-05-26 10:32:10 +00:00
bmeurer
1dbe83d9fb [turbofan] Fix UnifyReturn magic in the inliner.
The inliner previously assumed that there will only be returns reaching
the end node, but that's not true.  This refactoring will make it
possible to also hook up Deoptimize, Throw and Terminate nodes reaching
end properly.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1146393002

Cr-Commit-Position: refs/heads/master@{#28550}
2015-05-21 13:01:55 +00:00
bmeurer
c9a49da0d8 [turbofan] Enable deoptimization for non-asm.js TurboFan code.
Replace the --turbo-deoptimization flag with --turbo-asm-deoptimization
and enable deoptimization for non-asm.js TurboFan code unconditionally.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1153483002

Cr-Commit-Position: refs/heads/master@{#28543}
2015-05-21 11:33:25 +00:00
danno
218e101297 Generalize builtins inlining flag to allow forced inlining of any function
Review URL: https://codereview.chromium.org/1140743004

Cr-Commit-Position: refs/heads/master@{#28510}
2015-05-20 12:47:43 +00:00
bmeurer
fe690c3e82 [turbofan] Carefully update frame states during inlining.
During inlining we should pay attention to only rewire the outer frame
states of the inlinee, but leave any inner frame states of the inlinee
untouched.  Otherwise we might run into trouble once we start caching
graphs, or do getter/setter inlining.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134973006

Cr-Commit-Position: refs/heads/master@{#28466}
2015-05-19 09:11:12 +00:00
bmeurer
1643671f1b [turbofan] Pass closure as node to FrameState.
First step towards support for inlining based on SharedFunctionInfo
instead of JSFunction.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1134713004

Cr-Commit-Position: refs/heads/master@{#28419}
2015-05-15 12:17:05 +00:00
titzer
e5d5cac7d9 [turbofan] Add AdvancedReducer::ReplaceWithValue() method and convert JSInlining to an AdvancedReducer.
Note that this is just a duplication for now. We'll want to get rid of the
NodeProperties::ReplaceWithValue() method in the long run.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1135483004

Cr-Commit-Position: refs/heads/master@{#28363}
2015-05-12 12:41:36 +00:00
arv
3226e98020 [strong] Check arity of functions
In strong mode it is an error to call a function with too few
arguments.

This is enforced inside the ArgumentsAdaptorTrampoline.

This does not yet handle rest parameters

BUG=v8:3956
LOG=N
R=rossberg@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1115263004

Cr-Commit-Position: refs/heads/master@{#28346}
2015-05-11 17:20:45 +00:00
bmeurer
4940c0bd42 [turbofan] Unify frame state inputs.
Now all nodes that care about deoptimization always take frame state
inputs no matter whether deoptimization is enabled for a particular
function. In case that deoptimization is off, the AstGraphBuilder just
inserts the empty frame state. This greatly simplifies the logic in
various places and makes testing easier as well, and is probably the
first step towards enabling --turbo-deoptimization by default.

There seems to be no noticable performance impact on asm.js programs.

Also fix the graph replay in order to regenerate the scheduler unittests.

Review URL: https://codereview.chromium.org/1106613003

Cr-Commit-Position: refs/heads/master@{#28026}
2015-04-23 09:04:19 +00:00
titzer
ab49ec14e3 [turbofan] Add a debug_name to Parameter operators.
R=bmeurer@chromium.org, mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1090303004

Cr-Commit-Position: refs/heads/master@{#28002}
2015-04-22 11:34:29 +00:00
mstarzinger
1fefa31df6 Remove CompilationInfoWithZone from public API.
This removes the CompilationInfoWithZone class from the header file
because it is more than a pure convenience class and shouldn't be used
outside of the compiler at all.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1000353004

Cr-Commit-Position: refs/heads/master@{#27411}
2015-03-24 14:17:17 +00:00
titzer
e62f754de7 [turbofan] Rename Node::RemoveAllInputs() to Node::NullAllInputs().
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032553006

Cr-Commit-Position: refs/heads/master@{#27401}
2015-03-24 12:40:13 +00:00
titzer
c6004a3211 [turbofan] Clean up TRACE macros and use variadic macros.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1014853002

Cr-Commit-Position: refs/heads/master@{#27248}
2015-03-17 18:51:19 +00:00
bmeurer
a556a104c0 [turbofan] Context specialize during inlining.
Context specialization enables inlining (at least currently it is the
only enabler for inlining), but inlining enables more possibilities for
context specialization. So we really need to run them together.

This is especially important with the "module based builtins" that we're
working towards.

BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/988423004

Cr-Commit-Position: refs/heads/master@{#27085}
2015-03-10 08:37:26 +00:00
titzer
0f6702562e Extract ParseInfo from CompilationInfo.
Rationale: separate the inputs and outputs of parsing + analysis from the business of compiling (i.e. generating machine code).

BUG=

Review URL: https://codereview.chromium.org/974213002

Cr-Commit-Position: refs/heads/master@{#27078}
2015-03-09 14:51:24 +00:00
Benedikt Meurer
eacd6d8b7d [turbofan] Make inlining independent of typing.
The JSInliner used to load the context from the JSFunction node at
runtime, which introduced a HeapConstant (because we had to materialize
the JSFunction after context specialization) and a LoadField operation,
independent whether the inlinee actually uses the context. This is
rather cumbersome currently, and therefore this is now changed to just
embed the context constant instead. Once we do inlining based on
SharedFunctionInfo rather than JSFunction, we should reconsider this
decision and come up with a proper heuristic.

BUG=v8:3952
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/994523002

Cr-Commit-Position: refs/heads/master@{#27069}
2015-03-09 13:01:44 +00:00
Jaroslav Sevcik
02e318517f [turbofan] Add an extra frame state for deoptimization before binary op.
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/983153002

Cr-Commit-Position: refs/heads/master@{#27060}
2015-03-09 08:37:17 +00:00
Benedikt Meurer
25895aeeaf [turbofan] Add support for inlining of builtins.
We mark certain builtins for inlining, and those should always be
inlined into optimized code (CrankShaft already handles it this way), so
we should support that in TurboFan as well. Currently this mainly
affects a certain set of Math functions, but once have the basics in
place we can extend this to any kind of builtin/code stub/accessor.

This adds a new flag --turbo_builtin_inlining (enabled by default), that
forces the inliner to always inline builtins marked for inlining, but
does not affect inlining of other functions (this is still controlled by
the --turbo-inlining flag).

BUG=v8:3952
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/993473002

Cr-Commit-Position: refs/heads/master@{#27059}
2015-03-09 08:05:45 +00:00
Benedikt Meurer
4b6afb8432 [turbofan] Skip function entry stack check for inlinee.
This is currently the cleanest approach to avoid the useless stack check
during inlining. We might be able to just remove the useless stack
checks later when we have a phase that also takes care of removing
redundant stack checks on loop back edges (which we do not generate
currently).

On the other hand, the flag introduced here might be useful when
building code stubs/builtins/dom stubs using JS based DSL, because you
certainly don't want a JS-level stack check in a code stub.

R=jarin@chromium.org
BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/994433002

Cr-Commit-Position: refs/heads/master@{#27058}
2015-03-09 07:31:00 +00:00
bmeurer
a19cfb0ea5 [turbofan] Support inlining of unguarded loops.
Also allow inlining of native functions.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/962963006

Cr-Commit-Position: refs/heads/master@{#26959}
2015-03-03 13:09:53 +00:00
Benedikt Meurer
9e6181d5c3 [turbofan] Finally get rid of the generic algorithm.
R=svenpanne@chromium.org

Committed: https://crrev.com/5bbe693e4817011b6a496c638c9f09026fd3dac9
Cr-Commit-Position: refs/heads/master@{#26760}

Review URL: https://codereview.chromium.org/944803002

Cr-Commit-Position: refs/heads/master@{#26767}
2015-02-20 10:12:00 +00:00
machenbach
c7810004bb Revert of [turbofan] Finally get rid of the generic algorithm. (patchset #2 id:20001 of https://codereview.chromium.org/944803002/)
Reason for revert:
Breaks dbg builds.

Original issue's description:
> [turbofan] Finally get rid of the generic algorithm.
>
> R=svenpanne@chromium.org
>
> Committed: https://crrev.com/5bbe693e4817011b6a496c638c9f09026fd3dac9
> Cr-Commit-Position: refs/heads/master@{#26760}

TBR=svenpanne@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/941963003

Cr-Commit-Position: refs/heads/master@{#26763}
2015-02-20 09:14:44 +00:00
Benedikt Meurer
5bbe693e48 [turbofan] Finally get rid of the generic algorithm.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/944803002

Cr-Commit-Position: refs/heads/master@{#26760}
2015-02-20 08:42:51 +00:00
titzer
d050c331eb [turbofan] Simplify context specialization and fix for OSR.
AstGraphBuilder puts a constant context in from the beginning.
Also fix bug in merging contexts in environment.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/934293002

Cr-Commit-Position: refs/heads/master@{#26745}
2015-02-19 11:36:50 +00:00
titzer
07599f3565 [turbofan] Refactor JSInliner to be a Reducer.
Next step: fix copying of the graph in inlining.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/934723002

Cr-Commit-Position: refs/heads/master@{#26682}
2015-02-17 10:31:08 +00:00
bmeurer
3336d2e11e [turbofan] Merge node-aux-data-inl.h into node-aux-data.h.
Google style guide forbids -inl.h headers.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/922633002

Cr-Commit-Position: refs/heads/master@{#26611}
2015-02-12 13:01:29 +00:00
marja
c7851da4ae Introduce LanguageMode, drop StrictMode.
This enables adding more language modes in the future.

For maximum flexibility, LanguageMode is a bitmask, so we're not restricted to
use a sequence of language modes which are progressively stricter, but we can
express the language mode as combination of features.

For now, LanguageMode can only be "sloppy" or "strict", and there are
STATIC_ASSERTS in places which need to change when more modes are added.

LanguageMode is a bit like the old LanguageMode when "extended" mode was still
around (see https://codereview.chromium.org/8417035 and
https://codereview.chromium.org/181543002 ) except that it's transmitted through
all the layers (there's no StrictModeFlag).

BUG=

Review URL: https://codereview.chromium.org/894683003

Cr-Commit-Position: refs/heads/master@{#26419}
2015-02-04 09:34:26 +00:00
bmeurer
c65ae4f10c Reland "Initial switch to Chromium-style CHECK_* and DCHECK_* macros.".
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/877753007

Cr-Commit-Position: refs/heads/master@{#26346}
2015-01-30 09:29:41 +00:00
Benedikt Meurer
883852293a Revert "Make GCC happy again." and "Initial switch to Chromium-style CHECK_* and DCHECK_* macros.".
This reverts commit 6a4c0a3bae and commit
0deaa4b629 for breaking GCC bots.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/893533003

Cr-Commit-Position: refs/heads/master@{#26342}
2015-01-30 07:19:57 +00:00
bmeurer
0deaa4b629 Initial switch to Chromium-style CHECK_* and DCHECK_* macros.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/888613002

Cr-Commit-Position: refs/heads/master@{#26340}
2015-01-30 06:25:36 +00:00
bmeurer
1df5fed50a [turbofan] Cleanup the NodeProperties.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/883613006

Cr-Commit-Position: refs/heads/master@{#26316}
2015-01-29 09:18:09 +00:00
bmeurer
4f1597a92d [turbofan] Add new JSIntrinsicsLowering reducer.
The lowering of intrinsics is therefore now decoupled from the general
inlining logic.

TEST=cctest,unittests
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/872363002

Cr-Commit-Position: refs/heads/master@{#26263}
2015-01-26 09:06:03 +00:00
danno
c7b09aac31 Remove the dependency of Zone on Isolate
Along the way:
- Thread isolate parameter explicitly through code that used to
  rely on getting it from the zone.
- Canonicalize the parameter position of isolate and zone for
  affected code
- Change Hydrogen New<> instruction templates to automatically
  pass isolate

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/868883002

Cr-Commit-Position: refs/heads/master@{#26252}
2015-01-23 15:20:00 +00:00
bmeurer
835cc463a8 [turbofan] Initial attempt to cleanup Node and related classes.
- Make Node::Inputs and Node::Uses mostly STL compliant.
- Get rid of some pre-C++11 crappiness.
- Start moving unit tests from cctest to unittests.
- TrimInputCount() now tries to reserve inputs slots for
  later appending.
- Fix numerous style guide violations.

TEST=cctest,unittests
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/851263002

Cr-Commit-Position: refs/heads/master@{#26098}
2015-01-16 11:04:22 +00:00
danno
f6e5bc1642 Clean up node iteration
- Create a first-class Edge type.
- Separate node and edge iterators
- Make iterators only responsible for iteration
- Make it possible to modify the use edge iterator while iterating.
- Add the ability to update inputs to Edges directly.

Review URL: https://codereview.chromium.org/765983002

Cr-Commit-Position: refs/heads/master@{#25616}
2014-12-02 14:38:58 +00:00
mstarzinger
70093d719c De-generify the GenericNode.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/756073004

Cr-Commit-Position: refs/heads/master@{#25572}
2014-11-28 15:21:44 +00:00
mstarzinger
bbf4858849 Remove ambiguous getter for operator value counts.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/735583003

Cr-Commit-Position: refs/heads/master@{#25401}
2014-11-18 15:45:36 +00:00
Michael Starzinger
20df102b20 Make TurboFan inlining work without deoptimization.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/726823002

Cr-Commit-Position: refs/heads/master@{#25354}
2014-11-14 10:34:51 +00:00
mstarzinger@chromium.org
5712592331 Fix bug in graph copy while inlining loops.
R=titzer@chromium.org
TEST=cctest/test-run-inlining/InlineLoop

Review URL: https://codereview.chromium.org/712403003

Cr-Commit-Position: refs/heads/master@{#25285}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-12 09:47:17 +00:00
mstarzinger@chromium.org
c63deb9b56 Make generic algorithm less generic.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/701473002

Cr-Commit-Position: refs/heads/master@{#25064}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-03 10:31:11 +00:00
titzer@chromium.org
5c25fdb65e Inline trivial OperatorProperties methods.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/686213002

Cr-Commit-Position: refs/heads/master@{#24995}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-29 18:47:14 +00:00
titzer@chromium.org
6c6a71b3f7 Move input/output counts directly into Operators, simplying OperatorProperties.
This is a first step to refactoring OperatorProperties out of existence.
The next step is to inline OperatorProperties::GetXXXCount into the callers.

R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/680313003

Cr-Commit-Position: refs/heads/master@{#24983}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24983 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-29 14:41:18 +00:00
wingo@igalia.com
d518d3bce7 Move AST node counting to post-pass
R=mstarzinger@chromium.org, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/683023002

Cr-Commit-Position: refs/heads/master@{#24937}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24937 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-28 13:24:18 +00:00
jarin@chromium.org
167fa99716 Revert "[turbofan] Merge GenericNode with Node."
This reverts commit a238443c00 (r24915)
for tanking benchmarks.

TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/684693002

Cr-Commit-Position: refs/heads/master@{#24916}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24916 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-27 22:34:44 +00:00
jarin@chromium.org
a238443c00 [turbofan] Merge GenericNode with Node.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/676353002

Cr-Commit-Position: refs/heads/master@{#24915}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-27 20:37:47 +00:00
wingo@igalia.com
0755160e28 Revert "Move AST node counting to post-pass"
This reverts commit 698356720824559a6bd81c24be707b44ac277526 for
breaking regress-96526-002 among other things.

TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/678033002

Cr-Commit-Position: refs/heads/master@{#24910}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-27 16:25:40 +00:00