AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
16,712 Commits 1 Branch 0 Tags 839 MiB
9244429707
Commit Graph

1277 Commits

Author SHA1 Message Date
yangguo@chromium.org
9be61ddb8a Hide some runtime functions. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/212163004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 15:51:48 +00:00
dslomov@chromium.org
76b8f25edb This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 12:50:13 +00:00
hpayer@chromium.org
b90beee7f5 Always initialize elements pointer in fast literals. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/211103003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 08:01:20 +00:00
dslomov@chromium.org
f66af4feb4 Refactor optimized in hydrogen only runtime functions. 
This splits all runtime function into 3 categories:
1) RUNTIME: implemented in runtime and called from both full and optimized code.
2) RUNTIME_HIDDEN: implemented in runtime, never called directly from JS builtins.
3) INLINE: inlined in both full and optimized code
4) INLINE_OPTIMIZED: inlined in optimized code, implemented in runtime for full code.

R=yangguo@chromium.org, yannguo@chromium.org

Review URL: https://codereview.chromium.org/209353006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:26:55 +00:00
dslomov@chromium.org
cdc9812756 Revert "This implements allocating small typed arrays in heap." 
This reverts commit r20244 for breaking Win64 build and webkit tests.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/208503007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:12:58 +00:00
dslomov@chromium.org
654b6a27d1 This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=20240

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 13:21:58 +00:00
dslomov@chromium.org
727bc2153e Revert "This implements allocating small typed arrays in heap." 
This reverts commit r20240 for breaking Windows build.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/211003003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 12:58:22 +00:00
dslomov@chromium.org
322a474bf2 This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20240 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 12:51:49 +00:00
titzer@chromium.org
3c31102025 First implementation of store elimination. 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/100253004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 09:06:16 +00:00
dslomov@chromium.org
5fd9ddbcbb Use HType::Tagged when allocating elements. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/201573010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 14:41:01 +00:00
yangguo@chromium.org
15951521cc Refactor inlined typed array runtime functions. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/203443002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 08:22:24 +00:00
ulan@chromium.org
fc2563f108 Visit return statement of inlined function in value context. 
BUG=354357
LOG=N
TEST=mjsunit/regress/regress-354357.js
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/206413005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 12:14:44 +00:00
jochen@chromium.org
2ce0bebba1 Rename A64 port to ARM64 port 
BUG=354405
R=ulan@chromium.org, rodolph.perfetta@arm.com
LOG=y

Review URL: https://codereview.chromium.org/207823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20148 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 09:28:26 +00:00
jkummerow@chromium.org
2b722b663e Fix polymorphic hydrogen handling of SLOPPY_ARGUMENTS_ELEMENTS 
BUG=chromium:354391
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/206073008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20137 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 16:25:24 +00:00
yangguo@chromium.org
00170e434b Use HBoundsCheck to check string length. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/206183003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 12:34:44 +00:00
yangguo@chromium.org
238f12e618 Make max size and max length of strings consistent. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/196133030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20099 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 08:33:06 +00:00
mvstanton@chromium.org
535f3427ca Pretenure call new support. 
When FLAG_pretenure_call_new is on, we emit mementos on new object creation
in full code, and consume the feedback in crankshaft. A key difference in the
generated code for stubs is the allocation of an additional type vector slot for the
CallNew AST node, which simplifies the CallConstructStub and CallFunctionStub
considerably.

Some performance tuning still needs to be addressed, therefore the flag is off at
this moment, though fully functional. The goal is to remove the flag as soon as
possible, which allows much code deletion (yay).

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/132963012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 13:39:09 +00:00
rossberg@chromium.org
9b28aed3f6 Introduce representation types 
Also:
- improve type pretty-printing,
- update doc comments,
- some renamings for consistency.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/176843006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-18 11:50:18 +00:00
mvstanton@chromium.org
3daaba09b6 Pretenure code generation corner case with new space COW arrays. 
When advised to pretenure in crankshaft, and the boilerplate is a cow
array, move the elements to old space if it's not already there to avoid
overflowing the store buffer.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/197473004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 13:42:37 +00:00
mvstanton@chromium.org
e3f3f6d98b Revert "Continued fix for 351257. Reusing the feedback vector is too complex." 
This reverts commit r19919.

TBR=bmeuer@chromium.org

Review URL: https://codereview.chromium.org/196343021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 08:31:21 +00:00
mvstanton@chromium.org
dd28969c1c Continued fix for 351257. Reusing the feedback vector is too complex. 
Attempting to re-use the type feedback vector stored in the
SharedFunctionInfo turns out to be difficult among the various cases.
It will be much easier to do this when deferred type feedback processing
is removed, as is in the works.

Created bug v8:3212 to track re-introducing the optimization of reusing
the type vector on recompile before optimization.

The CL also brings back the type vector on the SharedFunctionInfo.

BUG=351257
LOG=Y
R=bmeurer@chromium.org, bmeuer@chromium.org

Review URL: https://codereview.chromium.org/199973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-14 09:28:37 +00:00
hpayer@chromium.org
7b810f4593 Revert "Moved type feedback vector to SharedFunctionInfo." 
This reverts commit 828f1d563a3f0972135886888fd26526e04da07f.

Conflicts:
	src/compiler.cc
	test/cctest/test-compiler.cc

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/196283015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 17:47:12 +00:00
ulan@chromium.org
c64b78f6da Check that constant is an integer before getting its value in HGraphBuilder::MatchRotateRight. 
BUG=351263
LOG=N
TEST=mjsunit/regress/regress-351263
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/197803005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19890 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 11:50:50 +00:00
svenpanne@chromium.org
390d3a0b15 Make translation of modulus operation '--stress-opt'-proof. 
Note that we unconditionally deopt later, anyway, but our compilation
pipeline has to survive long enough to reach that place. :-/

LOG=y
BUG=352059
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/198833002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 09:37:16 +00:00
rossberg@chromium.org
8e3f3cee9e Eliminate extended mode, and other modes clean-up 
- Merge LanguageMode and StrictModeFlag enums
- Make harmony-scoping depend only on strict mode
- Free some bits on the way
- Plus additional clean-up and renaming

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/181543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:41:22 +00:00
rossberg@chromium.org
3f702d4bf9 Mode clean-up pt 1: rename classic/non-strict mode to sloppy mode 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/177683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:39:08 +00:00
yangguo@chromium.org
78d23e5662 Implement KnownSuccessor method to some control instructions. 
R=jkummerow@chromium.org
BUG=v8:3118
LOG=N

Review URL: https://codereview.chromium.org/174863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 14:50:01 +00:00
bmeurer@chromium.org
48fea83dad Merge the "Compute Minus Zero Checks" phase into the range analysis. 
It is not safe to access the range for an SSA value
after range analysis.

BUG=v8:3204
LOG=y
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/192673002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 11:49:29 +00:00
yangguo@chromium.org
4f15fd2977 Reland "Introduce intrinsics for double values in Javascript." 
This relands r19704 with a fix to the test case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/189823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 14:58:41 +00:00
mvstanton@chromium.org
1812f63fd2 Moved type feedback vector to SharedFunctionInfo. 
Type Vector followup: the type vector currently lives off the code object. This CL moves it to the SharedFunctionInfo, facilitating re-use and continued use in crankshafted code if desired.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/178463007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 10:12:17 +00:00
yangguo@chromium.org
143902bebf Revert "Introduce intrinsics for double values in Javascript." 
This reverts r19704.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/189533008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:49:28 +00:00
verwaest@chromium.org
8a3d715250 Revert "Use Representation::Integer32() for smi types on 32-bit-tagged systems." 
Due to performance regression.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/189843006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:29:07 +00:00
yangguo@chromium.org
2aefde4443 Introduce intrinsics for double values in Javascript. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/178583006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:05:10 +00:00
yangguo@chromium.org
8472e0f02b Remove duplicates in runtime macros. 
Each item in INLINE_RUNTIME_FUNCTION_LIST had to have a duplicate
entry in RUNTIME_FUNCTION_LIST in order to match the comment.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/177313005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 08:49:02 +00:00
verwaest@chromium.org
7bf33c53eb Use Representation::Integer32() for smi types on 32-bit-tagged systems. 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/187353005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-06 09:49:10 +00:00
jarin@chromium.org
7ac668f753 Deoptimization fix for HPushArgument. 
HPushArgument should never be used in a simulation environment
because the slot addresses for the arguments can be off (e.g.,
due to on-stack arguments object of an inlined caller).

R=mstarzinger@chromium.org
BUG=v8:3183
LOG=N

Review URL: https://codereview.chromium.org/178193026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-05 12:45:46 +00:00
mvstanton@chromium.org
df988c7f6b The Array function must be looked up in the native context. 
Platforms x64, a64, arm and mips had the bug that the array function was looked
up in the global context instead of the native context. Fix this, restoring a
weakened assert in hydrogen along the way (by the fix for crbug 347528, which
helped find this case).

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/184383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 10:39:36 +00:00
dcarney@chromium.org
98d1cedac4 Get array_function from NativeContext 
R=mvstanton@chromium.org
LOG=N
BUG=347528

Review URL: https://codereview.chromium.org/184173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 10:01:27 +00:00
bmeurer@chromium.org
5945f9ebb9 Fix handling of constant global variable assignments. 
BUG=347904
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/184303003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 09:40:12 +00:00
verwaest@chromium.org
d5caecccc5 Revert "Use stability to only conditionally flush information from the CheckMaps table." 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/180023002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-25 16:11:58 +00:00
ishell@chromium.org
6c1659becf Fix for a smi stores optimization on x64 with a regression test. 
BUG=345715
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/178833002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-25 09:55:02 +00:00
yangguo@chromium.org
139134acc2 Harmony: optimize Math.clz32. 
R=svenpanne@chromium.org
BUG=v8:2938
LOG=N

Review URL: https://codereview.chromium.org/172133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 13:51:49 +00:00
verwaest@chromium.org
60c08a8bf2 Directly store the transition target on LookupResult in TransitionResult. 
BUG=chromium:343964
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/170343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 12:19:32 +00:00
bmeurer@chromium.org
eaab533fd8 Cleanup the double field tracking in Hydrogen. 
Use a dedicated BuildLoadNamedField() with PropertyAccessInfo,
similar to BuildStoreNamedField() for optimized graph building,
and a dedicated BuildLoadNamedField() for the code stubs, and
don't depend on FLAG_track_double_fields during code generation.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/168583006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19411 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 13:23:04 +00:00
jarin@chromium.org
4c7ed144e1 Comparison in effect context lazy deopt fix. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/163623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-16 05:51:10 +00:00
ulan@chromium.org
6744ff61ae Fix dictionary element load to pass correct elements kind. 
Using FAST_SMI_ELEMENTS triggers optimization on 64-bit architectures that load
only the higher 32 bits of the element. If the element is a pointer to undefined
that has 0 in the higher half than it is erroneously treated as SMI 0.

BUG=v8:3158
LOG=N
TEST=mjsunit/sparse-array-reverse,mjsunit/regress/regress-3158.js
R=danno@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/166653005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:52:24 +00:00
dcarney@chromium.org
0c844cc590 api accessor store ics should return passed value 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/166653003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19380 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 14:13:06 +00:00
jarin@chromium.org
8acefb33fe Test and fix for polymorphic named call deoptimization. 
The fix removes wrong simulates from the number branch of polymorphic
call/field access handling.

The change also fixes the same thing for polymorphic named field
access even thourgh the field access is probably safe in practice
(because it cannot deoptimize). It is better to keep all our simulates
in sync with full codegen.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/166503002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 12:02:39 +00:00
verwaest@chromium.org
e0960e19aa Fix polymorphic inlining of accessors in a test-context. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/164003002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-13 16:55:38 +00:00
vegorov@chromium.org
8f170a66e7 Improve positions tracking inside the HGraphBuilder. 
Instead of tracking simple absolute offset from the start of the script like other places do, track a pair of (inlining id, offset from the start of inlined function).

This enables us to pinpoint with inlining path an instruction came from. Previously in multi-script environments we emitted positions that made very little sense because inside a single optimized function they would point to different scripts without a way to distinguish them.

Start dumping the source of every inlined function to make possible IR viewing tools with integrated source views as there was previously no way to acquire this information from IR dumps. We also dump source position at which each inlining occured.

Tracked positions are written into hydrogen.cfg as pos:<inlining-id>_<offset>.

Flag --emit-opt-code-positions is renamed by this change into --hydrogen-track-positions to better convey it's meaning.

In addition this change assigned global unique identifier to each optimization performed inside isolate. This allows to precisely match compilation artifacts (e.g. IR and disassembly) and deoptimizations.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/140683011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-13 16:09:28 +00:00
verwaest@chromium.org
386bc4c2fa Return on the polymorphic hard deopt case to ensure we don't polute phis with fake type information. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/163403003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19359 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-13 15:54:19 +00:00
verwaest@chromium.org
161b2f689a Reland: "Use stability to only conditionally flush information from the CheckMaps table." 
BUG=
R=ishell@chromium.org

Original CL: https://codereview.chromium.org/153823003

Review URL: https://codereview.chromium.org/153653007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 18:48:12 +00:00
verwaest@chromium.org
75432b7696 Revert "Use stability to only conditionally flush information from the CheckMaps table." 
R=ishell@chromium.org

BUG=

Review URL: https://codereview.chromium.org/137863005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 15:38:42 +00:00
verwaest@chromium.org
2b7d33572a Use stability to only conditionally flush information from the CheckMaps table. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/153823003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 15:07:41 +00:00
jarin@chromium.org
af29e31a11 Fix for (One|Two)ByteSeqStringSetChar evaluation order/deopt. 
This makes the evaluation order consistent between full codegen
and Hydrogen (so that deopt does not screw up stack).

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/159983008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 13:31:24 +00:00
ulan@chromium.org
e95bc7eec8 Merge experimental/a64 to bleeding_edge. 
BUG=v8:3113
LOG=Y
R=jochen@chromium.org, rmcilroy@chromium.org, rodolph.perfetta@arm.com

Review URL: https://codereview.chromium.org/148293020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-12 09:19:30 +00:00
ishell@chromium.org
b446674c85 More check elimination improvements including partial learning on false branches of CompareMap and better handling of unreachable blocks. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/159963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 19:18:06 +00:00
jarin@chromium.org
21bf99e53e Fix environment of the optimized version of the _SetValueOf intrinsic. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/158723006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 16:11:53 +00:00
ishell@chromium.org
994f0f6dda Fix for a smi stores optimization on x64 with a test case. 
BUG=338425
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/152923006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19288 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 16:02:18 +00:00
bmeurer@chromium.org
9a0a86fd4c Get rid of the function sorting in for polymorphic calls. 
The idea of this code was to sort functions according to
ticks spend executing them, but now these ticks are always
zero and therefore we fall back to sorting by AST length (or
even worse by source length) all the time, which is a bad,
arbitrary measure.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/159653003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 10:48:37 +00:00
bmeurer@chromium.org
a5ef6e5eec Improve inobject field tracking during GVN. 
Now stores to inobject fields do no longer prevent hoisting
and combining of loads from other inobject fields.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/144423010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 06:53:14 +00:00
bmeurer@chromium.org
40f3b1ba87 Revert "Improve inobject field tracking during GVN." 
This reverts commit r19427 for breaking the build. Will reland with
fix.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/143203005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19248 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 06:46:14 +00:00
bmeurer@chromium.org
cd1b7df638 Improve inobject field tracking during GVN. 
Now stores to inobject fields do no longer prevent hoisting
and combining of loads from other inobject fields.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/144423010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19247 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 06:41:06 +00:00
verwaest@chromium.org
c1a08679dc Merge BuildLoadKeyedGeneric and BuildStoreKeyedGeneric, switch on AccessType 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/146623007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-10 14:58:25 +00:00
verwaest@chromium.org
d2d3fc0e4d Use PropertyAccessType for keyed accesses rather than "bool is_store" 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/137883008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-10 11:43:34 +00:00
verwaest@chromium.org
f19aeae06b Unify BuildLoad/StoreNamedGeneric 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/155513008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-10 10:23:59 +00:00
verwaest@chromium.org
43c0a419ed Remove special ArrayLength handling already covered by JSObjectFieldAccessors 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/153743005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19152 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 13:01:38 +00:00
jarin@chromium.org
476881ce5b Test and fix for _CallFunction intrinsic deoptimization. 
I have also cleaned up HOptimizedGraphBuilder::GenerateCallFunction
to use IfBuilder.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/131343013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 12:42:26 +00:00
jarin@chromium.org
eb502fe599 Binary operation deoptimization fix. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/132453009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 09:36:55 +00:00
dcarney@chromium.org
6df537d631 inline api setters in crankshaft 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/155913002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 07:31:08 +00:00
dcarney@chromium.org
5028ebaa8b inline api getters in crankshaft 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/146023004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 15:52:31 +00:00
verwaest@chromium.org
5949fe1679 Merge named part of BuildLoad and BuildStore 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/149803007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 15:44:20 +00:00
verwaest@chromium.org
d985948c7a Merge BuildLoad/StoreMonomorphic 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/137263021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19108 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 15:43:33 +00:00
verwaest@chromium.org
cb044fa2d8 Merge polymorphic load/store handling 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/150573010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 15:28:57 +00:00
verwaest@chromium.org
fb306f9811 Explicitly disallow stores to JSObjectAccessors (for now). 
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/154873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 22:46:53 +00:00
verwaest@chromium.org
2c3e6b41ff Use PropertyAccessInfo to compute stores in crankshaft. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/153933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 22:23:26 +00:00
verwaest@chromium.org
8ac80c5308 Use Type* in crankshaft rather than HeapType. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/152863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 12:44:15 +00:00
ishell@chromium.org
0f89c8b91d Fix in array instance type initialization. 
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/134713004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 10:59:40 +00:00
ishell@chromium.org
05270212c3 Remake of the load elimination fix made earlier (r18884). 
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/149063010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 10:48:49 +00:00
hpayer@chromium.org
8d1504b238 Just initialize elements pointer in fast literal when pre-tenuring. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/148253004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 10:41:16 +00:00
yangguo@chromium.org
9e70f6a4e7 Fix short-circuiting logical and/or in HOptimizedGraphBuilder. 
R=jkummerow@chromium.org
BUG=336148
LOG=Y

Review URL: https://codereview.chromium.org/143263022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-03 14:29:34 +00:00
ishell@chromium.org
b98637ce5e Elements field of newly allocated JSArray could be left uninitialized in some cases (fast literal case). 
BUG=340124
LOG=Y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/152673004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-03 13:33:26 +00:00
verwaest@chromium.org
ae7a209e71 Remove CallICs 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/148223002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 16:52:17 +00:00
jochen@chromium.org
253edf246f Remove IsRegExpEquivalent. 
It's not used anywhere.

BUG=none
R=ulan@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/141563013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 14:17:02 +00:00
ishell@chromium.org
2aa17c6e62 Load elimination fix: load should not be replaced with another load if the former is not dominated by the latter. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/151333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18985 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 12:03:32 +00:00
verwaest@chromium.org
bef13f739c Fix regression caused by supporting inlining accesses to non-JSObjects 
TBR=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/150983002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 00:29:04 +00:00
verwaest@chromium.org
1280edd4e5 Fix polymorphic load handling. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/150453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18954 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 16:44:32 +00:00
dcarney@chromium.org
5c589640bf crankshaft support for api method calls 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/148333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 13:18:41 +00:00
verwaest@chromium.org
b73101d539 Optimize HWrapReceiver 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/135593006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 12:52:49 +00:00
verwaest@chromium.org
73529a7d14 Support loads from primitive values. 
This also changes load computation to use HeapTypes rather than Maps.
TODO: move conversion between maps and heaptypes earlier in the process, already in the oracle.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/147763006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 11:30:38 +00:00
bmeurer@chromium.org
4a0959e360 Replace HThrow with HCallRuntime. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131103021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:03:32 +00:00
bmeurer@chromium.org
87a3951c11 Remove the HValueOf instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/139233004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:41:00 +00:00
bmeurer@chromium.org
3ba2f104c9 Turn RegExpConstructResultStub into a HydrogenCodeStub. 
This has the additional benefit that it is now possible to
inline the RegExpResult construction code into Hydrogen
builtins.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141703018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:10:35 +00:00
verwaest@chromium.org
0537955a89 Extend ArrayPop hydrogen support to COW arrays and popping from empty arrays. 
R=mvstanton@chromium.org

BUG=

Review URL: https://codereview.chromium.org/148093009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 12:53:40 +00:00
bmeurer@chromium.org
5bf5849f9f Use IfBuilder instead of handcrafted basic blocks in GenerateSetValueOf(). 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/130563009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 09:59:16 +00:00
bmeurer@chromium.org
d6458eb9a5 Add dependency operand to HLoadNamedField. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148523011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 09:48:35 +00:00
bmeurer@chromium.org
c12593cf2b Kill obsolete HLoadExternalArrayPointer instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/141583011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:27:35 +00:00
bmeurer@chromium.org
1e7bbbc921 Both HGlobalObject and HGlobalReceiver can be replaced with HLoadNamedField. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148453009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:26:52 +00:00
ishell@chromium.org
9070615980 Fix for potential issue related to replacing CheckMaps with values. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/134733007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 17:49:13 +00:00
ishell@chromium.org
d330d4801d Load elimination fix with a test case. 
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/143413019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 16:45:04 +00:00
hpayer@chromium.org
9e462504fb Turn off global pretenuring when allocation site pretenuring is in use. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/133803002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18868 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 09:47:03 +00:00
bmeurer@chromium.org
f9575fb82a Remove obsolete instruction HOuterContext. 
HOuterContext can be expressed in terms of HLoadNamedField.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131513015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 09:42:24 +00:00
dslomov@chromium.org
1a67b7f86a External Array renaming and boilerplate scrapping 
Replaced symbolic names with correct JS name (byte -> int8, unsigned int -> uint32 etc).
Using macros to scrap the boilerplate
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145133013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18835 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 16:01:15 +00:00
vegorov@chromium.org
c86da7e5dc Fix HGraphBuilder::AddSimulate to pass removable down correctly 
It was passed as a position argument previously making all simulates added with it conservatively FIXED_SIMULATE.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/146013002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18822 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 12:22:13 +00:00
verwaest@chromium.org
21532ddfdc Reland ArrayPop / ArrayPush. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138443012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 11:47:53 +00:00
jkummerow@chromium.org
ee4e034d70 Revert broken ArrayPop changes 
This reverts:
r18749 "Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs."",
r18790 "Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft.", and
r18798 "MIPS: Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft."

For causing crashes on Canary.

BUG=chromium:337686
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/146003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18805 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 08:32:50 +00:00
verwaest@chromium.org
6b60546b16 Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137693003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 16:20:25 +00:00
hpayer@chromium.org
83a1df2354 Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141653016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 13:02:27 +00:00
verwaest@chromium.org
f30330325e Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/144913003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:22:58 +00:00
bmeurer@chromium.org
c06d248248 Refactor fast path for empty constant strings in BinaryOp. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/143003005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18742 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 12:30:00 +00:00
mvstanton@chromium.org
1b3280c491 Revert "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
This reverts commit r18709, due to deopt fuzzer issue.
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/143983010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 10:41:23 +00:00
rossberg@chromium.org
0d906a8bdb Zonify types in compiler frontend 
Clean up some zone/isolate handling in AST and its visitors on the way.

(Based on https://codereview.chromium.org/103743004/)

R=jkummerow@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/102563004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:22:52 +00:00
verwaest@chromium.org
2d9a4eb355 Add hydrogen support for ArrayPop, and remove the handwritten call stubs. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137783023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 12:42:24 +00:00
bmeurer@chromium.org
4bae658948 Fix invalid type assumption in GenerateNumberToString(). 
We don't have any type feedback in %_NumberToString(), so it's
a bug to assume Type::Number here.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/143893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 10:35:20 +00:00
mvstanton@chromium.org
04b1baa4c4 We no longer need to recover type cells from the oracle. 
We only need the values within them. Function calls to Array from optimized code needed the cell in the past, but no longer.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 09:48:05 +00:00
mvstanton@chromium.org
b2bea46245 Minor bugfix in building inlined Array: bad argument to JSArrayBuilder. 
An HConstant pointing to a Cell rather than an AllocationSite
was passed. The argument wasn't used because of fortuitous
flags. An assert was added to protect the argument.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141533003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 12:18:57 +00:00
mvstanton@chromium.org
155ef100e9 Fix logic error in assert in IsUndeclaredGlobal() 
Recent changes in IC logic meant that CallStubs no longer use the Contextual bit. IsUndeclaredGlobal() needed to adjust for that.

In fact, now the CL has morphed to remove the notion of storing contextual state in the IC at all, it just becomes some extra ic state of the load ic. This took some adjustment in harmony code to use the global receiver for certain stores.

Now it's clearer that only LoadICs actually record any information about contextual or not.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/140943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:08:24 +00:00
dslomov@chromium.org
5da41be7b8 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 17:08:45 +00:00
dslomov@chromium.org
34eeeb8953 Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18649 for breaking Linux/nosnap and Win64 tests.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 16:00:36 +00:00
dslomov@chromium.org
97040ce67b Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18646

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 15:01:27 +00:00
dslomov@chromium.org
95f572389e Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18646 for breaking Win32 build.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/132233012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:26:15 +00:00
dslomov@chromium.org
0c960c2e96 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:18:37 +00:00
jarin@chromium.org
19d832719e This is a preview of a first step towards unification of the hydrogen 
call machinery.  The change replaces CallNamed, CallKeyed,
CallConstantFunction and CallKnownGlobal hydrogen instructions with two
new instructions with a more lower level semantics:

1. CallJSFunction for direct calls of JSFunction objects (no
   argument adaptation)

2. CallWithDescriptor for calls of a given Code object according to
   the supplied calling convention.

Details:

CallJSFunction should be straightforward, the main difference from the
existing InvokeFunction instruction is the absence of argument adaptor
handling. (As a next step, we will replace InvokeFunction with an
equivalent hydrogen code.)

For CallWithDescriptor, the calling conventions are represented by a
tweaked version of CallStubInterfaceDescriptor. In addition to the
parameter-register mapping, we also define parameter-representation
mapping there. The CallWithDescriptor instruction has variable number of
parameters now - this required some simple tweaks in Lithium, which
assumed fixed number of arguments in some places.

The calling conventions used in the calls are initialized in the
CallDescriptors class (code-stubs.h, <arch>/code-stubs-<arch>.cc), and
they live in a new table in the Isolate class. I should say I am not
quite sure about Representation::Integer32() representation for some of
the params of ArgumentAdaptorCall - it is not clear to me wether the
params could not end up on the stack and thus confuse the GC.

The change also includes an earlier small change to argument adaptor
(https://codereview.chromium.org/98463007) that avoids passing a naked
pointer to the code entry as a parameter. I am sorry for packaging that
with an already biggish change.

Performance implications:

Locally, I see a small regression (.2% or so). It is hard to say where
exactly it comes from, but I do see inefficient call sequences to the
adaptor trampoline. For example:

;;; <@78,#24> constant-t
bf85aa515a     mov edi,0x5a51aa85          ;; debug: position 29
;;; <@72,#53> load-named-field
8b7717         mov esi,[edi+0x17]          ;; debug: position 195
;;; <@80,#51> constant-s
b902000000     mov ecx,0x2                 ;; debug: position 195
;;; <@81,#51> gap
894df0         mov [ebp+0xf0],ecx
;;; <@82,#103> constant-i
bb01000000     mov ebx,0x1
;;; <@84,#102> constant-i
b902000000     mov ecx,0x2
;;; <@85,#102> gap
89d8           mov eax,ebx
89cb           mov ebx,ecx
8b4df0         mov ecx,[ebp+0xf0]
;;; <@86,#58> call-with-descriptor
e8ef57fcff     call ArgumentsAdaptorTrampoline  (0x2d80e6e0)    ;; code: BUILTIN

Note the silly handling of ecx; the hydrogen for this code is:

0 4 s27 Constant 1  range:1_1 <|@
0 3 t30 Constant 0x5bc1aa85 <JS Function xyz (SharedFunctionInfo 0x5bc1a919)> type:object <|@
0 1 t36 LoadNamedField t30.[in-object]@24 <|@
0 1 t38 Constant 0x2300e6a1 <Code> <|@
0 1 i102 Constant 2  range:2_2 <|@
0 1 i103 Constant 1  range:1_1 <|@
0 2 t41 CallWithDescriptor t38 t30 t36 s27 i103 i102 #2 changes[*] <|@

BUG=
R=verwaest@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/104663004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 17:00:35 +00:00
jkummerow@chromium.org
5298a078c6 Revert "Eliminatable CheckMaps replaced with if(true) or if(false)." 
This reverts r18592 for breaking the GC stress bots.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/137783011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18611 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 09:53:54 +00:00
ishell@chromium.org
6b389902e1 Revert "Polymorphic named calls optimized for the case of repetitive call targets." for now because it prevents better results for checkmap elimination. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/138453002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 16:37:09 +00:00
verwaest@chromium.org
72125bafcc Remove HCallGlobal and merge uses with HCallNamed. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/134333007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 16:15:52 +00:00
ishell@chromium.org
952fbe475f Eliminatable CheckMaps replaced with if(true) or if(false). 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/130613003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 16:06:40 +00:00
verwaest@chromium.org
1257ba358c Remove CALL_AS_FUNCTION and CALL_AS_METHOD. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/136403005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 14:36:24 +00:00
verwaest@chromium.org
f2245a9cf9 Make the strict-mode calling convention for contextual calls the default one. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/131663003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-14 12:04:10 +00:00
hpayer@chromium.org
f01dc250dc Handlify AllocationSite AddDependentCompilationInfo. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/136703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18570 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-13 14:54:33 +00:00
mvstanton@chromium.org
854d085996 More efficient use of space in AllocationSite. 
We can eliminate one word from the object by sharing the pretenuring decision and the found memento count.

R=bmeurer@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/132063004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-13 10:28:01 +00:00
ishell@chromium.org
5c65572dd2 "dead" and "osr" block flags added to trace output for unreachable and osr entry blocks respectively. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/135943004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18550 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-13 08:45:26 +00:00
jarin@chromium.org
c0f622a45b Fix of Hydrogen environment building for function "apply" calls. 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/133773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-11 13:59:04 +00:00
rossberg@chromium.org
cb28b7f837 Retry "Templatise type representation" after making clang happy 
The only thing different now is line types.h:208/236, which had a static_cast<Type*> before.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/133683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-10 12:19:01 +00:00
hpayer@chromium.org
4ef951cf43 Allocation site pretenuring. 
Pretenuring decisions are made based on allocation site lifetime statistics.

BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/96783002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-10 12:11:54 +00:00
machenbach@chromium.org
8ffcd2a281 [Sheriff] Revert "Templatise type representation" and "Fix Mac warnings". 
This reverts commit r18521 and r18522 for breaking mac and win builders.

BUG=
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/132493002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 19:52:15 +00:00
rossberg@chromium.org
1c33a2d840 Templatise type representation 
This is to support both heap- and zone-allocated types in the future (the latter not yet implemented).

Also, handlify the type API some more.

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/107933005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 17:12:48 +00:00
jkummerow@chromium.org
839297487f Skip back edge creation for "do ... while(false)" loops 
Drive-by fix: Fix disassembling "prefetch" instruction on ia32

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/131733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 15:20:25 +00:00
mvstanton@chromium.org
380aa6dc8d Array constructor can be simplified by loading context from JSFunction. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/128683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 15:07:23 +00:00
mvstanton@chromium.org
7baadbfac1 FunctionLiteral has work to do in the typing phase. 
In crankshaft, we searched un-optimized code for a SharedFunctionInfo
that matches the FunctionLiteral we are processing. Ideally, this
work should be done in the typing phase.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/104883006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-09 09:00:19 +00:00
ishell@chromium.org
b2616f415b Polymorphic named calls optimized for the case of repetitive call targets. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/118483003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 16:59:42 +00:00
verwaest@chromium.org
4615e9edac Reland v8:18458 "Load the global proxy from the context of the target function." 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/104013008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 10:46:39 +00:00
rossberg@chromium.org
2879f2104c Revert "Load the global proxy from the context of the target function." 
This reverts commit https://code.google.com/p/v8/source/detail?r=18458, since it exhibits a bug that breaks some tests.

TBR=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/93863006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 09:55:25 +00:00
verwaest@chromium.org
5b40c38679 Load the global proxy from the context of the target function. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/111613003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 08:21:17 +00:00
bmeurer@chromium.org
ad4231c495 Reland "Allocation site support for monomorphic StringAdds in BinaryOps". 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/106313003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 15:31:27 +00:00
bmeurer@chromium.org
4d88b0b4be Revert "Fix compilation with C++11." and "Allocation site support for monomorphic StringAdds in BinaryOps.". 
This reverts commit r18431 and r18432 for breaking
the Linux nosnapshot build.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/122463004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 10:38:45 +00:00
bmeurer@chromium.org
a91499fec7 Allocation site support for monomorphic StringAdds in BinaryOps. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/106453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 09:17:52 +00:00
bmeurer@chromium.org
a53dcc9da1 Make it possible to assert that certain instance types are compatible wrt HAllocate. 
Turns clear_next_map_word_ into a flag and adds a new method
CompatibleInstanceTypes(). This is used in BuildUncheckedStringAdd()
to ASSERT that there's no difference wrt. HAllocate in using
CONS_STRING_TYPE vs CONS_ASCII_STRING_TYPE.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/110443003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 06:26:44 +00:00
jkummerow@chromium.org
3c76ecd732 Fix switch statements with non-Smi integer labels and no type feedback 
BUG=chromium:329709
LOG=Y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/98643010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-19 14:25:58 +00:00
ishell@chromium.org
e3752b63c0 HStoreKeyed for Smis optimized for x64 + related redundant moves of elements removed 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/108503004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 18:05:10 +00:00