AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
14,695 Commits 1 Branch 0 Tags 839 MiB
a26bd05be3
Commit Graph

12680 Commits

Author SHA1 Message Date
machenbach@chromium.org
33ebd4fdb2 Prepare push to trunk. Now working on version 3.24.28. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/149943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 01:05:08 +00:00
palfia@homejinni.com
8eb39f2aeb MIPS: Remove the HValueOf instruction. 
Port r18905 (88f14cd3)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/130803012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 21:51:08 +00:00
hpayer@chromium.org
e5d9803c17 Make eager allocation site pretenuring decisions. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/149393005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 17:03:57 +00:00
alph@chromium.org
c911ec3322 Do not overwrite builtin code names in heap profiler 
Make sure builtin code objects get their builtin tags
first. Otherwise a particular JSFunction object could set
its custom name to a generic builtin.

LOG=N
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/145973006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 17:03:13 +00:00
jarin@chromium.org
ec51f26b9e Revert "Captured arguments object materialization" 
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/130803009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 15:49:48 +00:00
jarin@chromium.org
868ad01ecb This is a preview of the captured arguments object materialization, 
mostly to make sure that it is going in the right direction. The current
version is passing all the existing test + a bunch of new tests
(packaged in the change list, too).

The patch extends the SlotRef object to describe captured and duplicated
objects. Since the SlotRefs are not independent of each other anymore,
there is a new SlotRefValueBuilder class that stores the SlotRefs and
later materializes the objects from the SlotRefs.

Note that unlike the previous implementation of SlotRefs, we now build
the SlotRef entries for the entire frame, not just the particular
function.  This is because duplicate objects might refer to previous
captured objects (that might live inside other inlined function's part
of the frame).

We also need to store the materialized objects between other potential
invocations of the same arguments object so that we materialize each
captured object at most once.  The materialized objects of frames live
in the new MaterielizedObjectStore object (contained in Isolate),
indexed by the frame's FP address.  Each argument materialization (and
deoptimization) tries to lookup its captured objects in the store before
building new ones.  Deoptimization also removes the materialized objects
from the store. We also schedule a lazy deopt to be sure that we always
get rid of the materialized objects and that the optmized function
adopts the materialized objects (instead of happily computing with its
captured representations).

Concerns:

- Is there a simpler/more correct way to store the already-materialized
objects? (At the moment there is a custom root reference to JSArray
containing frames' FixedArrays with their captured objects.)

- Is the FP address the right key for a frame? (Note that deoptimizer's
representation of frame is different from the argument object
materializer's one - it is not easy to find common ground.)

- Performance is suboptimal in several places, but a quick local run of
benchmarks does not seem to show a perf hit. Examples of possible
improvements: smarter generation of SlotRefs (build other functions'
SlotRefs only for captured objects and only if necessary), smarter
lookup of stored materialized objects.

- Ideally, we would like to share the code for argument materialization
with deoptimizer's materializer.  However, the supporting data structures
(mainly the frame descriptor) are quite different in each case, so it
looks more like a separate project.

Thanks for any feedback.

R=mstarzinger@chromium.org, danno@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/103243005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 15:14:15 +00:00
ulan@chromium.org
405e8eaf7a Generalize internalization of substrings. 
Make a template version of SubStringKey, which allows internalization of substrings of sequential and external strings.

R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/143223004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:31:34 +00:00
ulan@chromium.org
979cd4b0f3 Disable tracking of double fields during snapshot creation. 
Follow-up to r18298.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/101123004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:18:55 +00:00
bmeurer@chromium.org
4a0959e360 Replace HThrow with HCallRuntime. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131103021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:03:32 +00:00
alph@chromium.org
5a2fe0a670 Mark next_code_link as weak in heap profiler. 
LOG=N
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/136113007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:45:41 +00:00
bmeurer@chromium.org
f80e76cd58 Remove the unused HElementsKind instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/136093004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:44:50 +00:00
bmeurer@chromium.org
87a3951c11 Remove the HValueOf instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/139233004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:41:00 +00:00
svenpanne@chromium.org
a5af872994 Exit mksnapshot cleanly, making LSAN happy. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/137823009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:30:38 +00:00
bmeurer@chromium.org
3ba2f104c9 Turn RegExpConstructResultStub into a HydrogenCodeStub. 
This has the additional benefit that it is now possible to
inline the RegExpResult construction code into Hydrogen
builtins.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141703018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 13:10:35 +00:00
verwaest@chromium.org
0537955a89 Extend ArrayPop hydrogen support to COW arrays and popping from empty arrays. 
R=mvstanton@chromium.org

BUG=

Review URL: https://codereview.chromium.org/148093009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 12:53:40 +00:00
bmeurer@chromium.org
1e6606849a Don't create dummy uses for control dependencies. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/149513002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 12:48:32 +00:00
bmeurer@chromium.org
5bf5849f9f Use IfBuilder instead of handcrafted basic blocks in GenerateSetValueOf(). 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/130563009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 09:59:16 +00:00
bmeurer@chromium.org
d6458eb9a5 Add dependency operand to HLoadNamedField. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148523011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 09:48:35 +00:00
machenbach@chromium.org
3456047248 Prepare push to trunk. Now working on version 3.24.27. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/145973003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 08:13:05 +00:00
bmeurer@chromium.org
c12593cf2b Kill obsolete HLoadExternalArrayPointer instruction. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/141583011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18893 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:27:35 +00:00
svenpanne@chromium.org
abe807db7f ES6: Map and Set needs to normalize minus zero 
BUG=v8:3069
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/147143003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18892 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:27:05 +00:00
bmeurer@chromium.org
1e7bbbc921 Both HGlobalObject and HGlobalReceiver can be replaced with HLoadNamedField. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148453009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 07:26:52 +00:00
palfia@homejinni.com
8a2d18bb88 MIPS: Fix global object loading in DoWrapReceiver. 
This commit fixes the global object loading to load the result into the "result" register instead of the "receiver" register.

TEST=mjsunit/compiler/regress-arguments
BUG=
R=plind44@gmail.com, verwaest@chromium.org

Review URL: https://codereview.chromium.org/132633005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18890 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 20:26:53 +00:00
palfia@homejinni.com
bea3014d9e ARM: Fix global object loading in DoWrapReceiver. 
This commit fixes the global object loading to load the result into the "result" register instead of the "receiver" register.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/134903004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 20:25:38 +00:00
bmeurer@chromium.org
215da5eca3 v8config.h: introduce V8_LIBC_MSVCRT 
Use this for detecting MSVCRT library features instead of
V8_CC_MSVC.

One use case for this is when compiling with Clang together with the
MSVC library. In that case, V8_CC_MSVC will be false, but V8_LIBC_MSVCRT
will be true.

BUG=82385
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/145593003

Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 19:11:13 +00:00
ishell@chromium.org
9070615980 Fix for potential issue related to replacing CheckMaps with values. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/134733007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 17:49:13 +00:00
ishell@chromium.org
5dafb426b3 Flow engine fixes: unreachable block processing, state merging. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/144013003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 16:57:39 +00:00
ishell@chromium.org
d330d4801d Load elimination fix with a test case. 
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/143413019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 16:45:04 +00:00
hpayer@chromium.org
a09a5a86b7 Allocation site pretenuring for StringAdd on all platforms. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/147763005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 15:43:28 +00:00
bmeurer@chromium.org
a2d1f8b8f6 Drop the native FastNewBlockContextStub. 
This code is almost never executed in real world and benchmarks,
and there's obviously absolutely no need to have this native code
hanging around for no benefit.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/148873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 13:43:04 +00:00
mvstanton@chromium.org
371d6f6a98 We shouldn't throw under FLAG_debug_code, rather abort. 
Throwing under FLAG_debug_code confuses the rest of our infrastructure
which expects a safe point at the site of call into the runtime
for throw. We were doing that to make a clusterfuzz test happy, but
the better solution is to assert/abort under debug_code, and prevent
clusterfuzz from fuzzing on internal APIs that crash on incorrect
values.

We'll need to alter the fuzzer to turn off fuzzing for:

string-natives.js
lithium/SeqStringSetChar.js
regress/regress-seqstrsetchar-ex3.js
regress/regress-seqstrsetchar-ex1.js
regress/regress-crbug-320922.js

So as to prevent the fuzzer from running
%_OneByteSeqStringSetChar() and
%_TwoByteSeqStringSetChar().

BUG=
R=hpayer@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/139903005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 11:53:11 +00:00
ishell@chromium.org
1776dffa56 Make String.prototype.{starts,ends}With throw when passing a regular expression 
Contributed by Mathias Bynens <mathiasb@opera.com>.

TEST=mjsunit/harmony
BUG=v8:3070
LOG=Y
R=arv@chromium.org, ishell@chromium.org

Review URL: https://codereview.chromium.org/120683002

Patch from Mathias Bynens <mathiasb@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18870 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 10:31:05 +00:00
hpayer@chromium.org
9e462504fb Turn off global pretenuring when allocation site pretenuring is in use. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/133803002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18868 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 09:47:03 +00:00
bmeurer@chromium.org
f9575fb82a Remove obsolete instruction HOuterContext. 
HOuterContext can be expressed in terms of HLoadNamedField.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/131513015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 09:42:24 +00:00
machenbach@chromium.org
577b2de28b Prepare push to trunk. Now working on version 3.24.26. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/148173008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18864 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 07:51:20 +00:00
palfia@homejinni.com
e5a534f389 MIPS: stub fast api calls 
Port r18847 (c920fc50)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/145583012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-28 01:35:20 +00:00
hpayer@chromium.org
86cf9ca690 Enable concurrent sweeping. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/146833012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 14:37:22 +00:00
ishell@chromium.org
7c4594650b Hydrogen filter now supports trailing wildcard in negative filter. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/145663008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 12:05:47 +00:00
dcarney@chromium.org
2c5c08170f fix windows after r18847 
TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/145353005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 11:13:50 +00:00
dcarney@chromium.org
d1a10c6e37 stub fast api calls 
R=verwaest@chromium.org, vervaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/140613004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 09:57:54 +00:00
alph@chromium.org
89ffd30537 Allow arbitrary names for weak references in heap snapshots. 
LOG=N
BUG=
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/146843003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 09:37:02 +00:00
dcarney@chromium.org
1b30de8b55 Fix issue with context not being saved on x64 introduced in 144543004 
TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/143333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 08:12:59 +00:00
bmeurer@chromium.org
361095d397 Revert "Allow arbitrary names for weak references in heap snapshots." 
This reverts commit r18838 for breaking build with clang. Errors are:

../../src/heap-snapshot-generator.cc:1217:53: error: empty macro arguments were standardized in C99 [-Werror,-pedantic]
    EXTRACT_CONTEXT_FIELD(OPTIMIZED_FUNCTIONS_LIST, , optimized_functions_list);
../../src/heap-snapshot-generator.cc:1218:48: error: empty macro arguments were standardized in C99 [-Werror,-pedantic]
    EXTRACT_CONTEXT_FIELD(OPTIMIZED_CODE_LIST, , optimized_code_list);
../../src/heap-snapshot-generator.cc:1219:50: error: empty macro arguments were standardized in C99 [-Werror,-pedantic]
    EXTRACT_CONTEXT_FIELD(DEOPTIMIZED_CODE_LIST, , deoptimized_code_list);
../../src/heap-snapshot-generator.cc:1220:46: error: empty macro arguments were standardized in C99 [-Werror,-pedantic]
    EXTRACT_CONTEXT_FIELD(NEXT_CONTEXT_LINK, , next_context_link);

TBR=alph@chromium.org

Review URL: https://codereview.chromium.org/145583003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 06:47:42 +00:00
bmeurer@chromium.org
fd8b380299 Fix minor typos in platform-*.cc 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/146793002

Patch from Cosmin Truta <ctruta@blackberry.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 06:36:10 +00:00
machenbach@chromium.org
5740ebda76 Prepare push to trunk. Now working on version 3.24.25. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/135533005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-27 01:05:11 +00:00
plind44@gmail.com
387e6cc35a MIPS: Reduce the stack requirements of GetNoCodeAgeSequence. 
Port r18815 (f93582a)

Original commit message:
Allocate the patcher object on the heap, to avoid occasional stack
overflows on QNX/ARM when entering GetNoCodeAgeSequence.

BUG=v8:3111
LOG=y
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/146993002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 18:44:47 +00:00
alph@chromium.org
f4a470d5bb Allow arbitrary names for weak references in heap snapshots. 
LOG=N
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/145353003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 17:18:34 +00:00
dslomov@chromium.org
1a67b7f86a External Array renaming and boilerplate scrapping 
Replaced symbolic names with correct JS name (byte -> int8, unsigned int -> uint32 etc).
Using macros to scrap the boilerplate
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145133013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18835 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 16:01:15 +00:00
alph@chromium.org
01a6c8ae35 Mark weak fields of JSArrayBuffer and JSArrayBufferView as weak in heap snapshot. 
BUG=337144
LOG=N
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/138443009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 15:10:09 +00:00
svenpanne@chromium.org
13395a8392 Simplify HUnaryMathOperation::Canonicalize. 
Made the logic architecture-independent, although we should really have some kind of instruction selection instead of trying to handle some weird cases at the hydrogen level.

Some tiny related cleanups on the way.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141653015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 14:05:11 +00:00
vegorov@chromium.org
c86da7e5dc Fix HGraphBuilder::AddSimulate to pass removable down correctly 
It was passed as a position argument previously making all simulates added with it conservatively FIXED_SIMULATE.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/146013002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18822 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 12:22:13 +00:00
svenpanne@chromium.org
c19d55f801 ARM: Reduce the stack requirements of GetNoCodeAgeSequence. 
Allocate the patcher object on the heap, to avoid occasional stack
overflows on QNX/ARM when entering GetNoCodeAgeSequence.

BUG=v8:3111
LOG=y

Patch from Cosmin Truta <ctruta@blackberry.com>.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/144933002

Patch from Cosmin Truta <ctruta@blackberry.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 11:48:09 +00:00
verwaest@chromium.org
21532ddfdc Reland ArrayPop / ArrayPush. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138443012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 11:47:53 +00:00
rossberg@chromium.org
2311b678ae Type representation converter 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/145083007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 11:47:47 +00:00
jkummerow@chromium.org
ee4e034d70 Revert broken ArrayPop changes 
This reverts:
r18749 "Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs."",
r18790 "Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft.", and
r18798 "MIPS: Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft."

For causing crashes on Canary.

BUG=chromium:337686
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/146003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18805 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 08:32:50 +00:00
haitao.feng@intel.com
1a122359f7 Revert some movq->movp changes under the _WIN64 macro for X64 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/132233027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 01:59:00 +00:00
haitao.feng@intel.com
10e04142d1 Introduce Assembler::RelocInfoNone function for X64 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/140553004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18802 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 01:45:53 +00:00
machenbach@chromium.org
ae98a70be6 Prepare push to trunk. Now working on version 3.24.24. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/146013006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 01:04:58 +00:00
palfia@homejinni.com
b570073d24 MIPS: Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft. 
Port r18790 (0d675eeb)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/132773005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 19:33:42 +00:00
verwaest@chromium.org
6b60546b16 Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137693003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 16:20:25 +00:00
machenbach@chromium.org
033174ab9b Fix syntax check for SetAllocationTimeout. 
This is missing in r18787.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/140413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 16:16:26 +00:00
machenbach@chromium.org
e89c7095af Allow to enable/disable inline allocation via runtime function. 
This will allow to artificially trigger GCs on all allocations for testing purposes.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/144543005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 15:57:14 +00:00
plind44@gmail.com
2786e990fb MIPS: Turn FastNewContextStub into a HydrogenCodeStub. 
Port r18764 (c40563f)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/145013010

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 15:42:02 +00:00
plind44@gmail.com
8ba36e8a98 MIPS: Reland r18714 'Unify calling to GenerateFastApiCallBody before stubbing it'. 
Port r18762 (e8954e8)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/142573003

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 15:38:12 +00:00
vegorov@chromium.org
b7f26cf06d In HObjectAccess::ForField pass property name down into HObjectAccess for in-object fields. 
This makes hydrogen.cfg more readable (property name becomes visible in addition to offset).

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/132923004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 14:20:48 +00:00
hpayer@chromium.org
83a1df2354 Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141653016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 13:02:27 +00:00
hpayer@chromium.org
a92e87e100 Make the full object memory size of a page available for a single allocation. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/145493004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 12:13:20 +00:00
machenbach@chromium.org
2a4118ef65 Prepare push to trunk. Now working on version 3.24.23. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/131973014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 09:38:00 +00:00
bmeurer@chromium.org
5e0f020d3a Turn FastNewContextStub into a HydrogenCodeStub. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145513002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 08:36:22 +00:00
dcarney@chromium.org
02c02fe567 Reland r18714 'Unify calling to GenerateFastApiCallBody before stubbing it' 
TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/144543004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 08:14:00 +00:00
bmeurer@chromium.org
0999eec017 Fix compilation on x64 architectures 
Contributed by Mathias Bynens <mathiasb@opera.com>.

BUG=v8:3110
LOG=Y
R=bmeurer@chromium.org, jarin@chromium.org

Review URL: https://codereview.chromium.org/143003007

Patch from Mathias Bynens <mathiasb@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 06:31:05 +00:00
verwaest@chromium.org
c478b6dc60 Ensure we don't overwrite transitions in SetPropertyIgnoreAttributes. 
BUG=326155
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/134733011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 14:02:00 +00:00
jochen@chromium.org
9ba4b74e1d Fix invalid memory access when initializing the command line in d8 
BUG=none
R=dcarney@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143983012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:59:05 +00:00
bmeurer@chromium.org
e5f1ac1ded Get rid of the unused native code StringAddStub. 
BUG=v8:2990
LOG=n
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/144023009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:48:05 +00:00
palfia@homejinni.com
787aa693e3 MIPS: Add missing cctests of DoubleToIStub (r16322). 
BUG=
R=jkummerow@chromium.org, plind44@gmail.com

Review URL: https://codereview.chromium.org/143453003

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:44:00 +00:00
verwaest@chromium.org
f30330325e Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/144913003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 13:22:58 +00:00
bmeurer@chromium.org
c06d248248 Refactor fast path for empty constant strings in BinaryOp. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/143003005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18742 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 12:30:00 +00:00
dslomov@chromium.org
33d7e64b51 ES6: Implement Object.setPrototypeOf 
This reverts commit bdc89ae76c15f3ef2626f8849744500248aec3ba.

This is a revert of the revert with test/webkit updated as needed.

Original CL Description:

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-object.setprototypeof

This just exposes the internal %SetPrototype and adds all the required
type checks as specified.

BUG=v8:2675
LOG=Y
R=dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/144193005

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 12:15:57 +00:00
hpayer@chromium.org
b704d49176 Remove globale pretenuring mode from runtime. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/132003002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18738 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 12:07:14 +00:00
svenpanne@chromium.org
b4949cfd62 Fixed floor-of-div optimization. 
We removed an HDiv by hand which was still used by an HChange. The
solution is letting dead code removal do the cleanup.

Removed a fragile "optimization" (looking through an HChange), too,
this obviously never triggered and is hard to get right given all our
global invariants and state/type/... changes.

The repro is a bit tricky, because you need inlining to make our
representations and types disagree in this case.

LOG=y
BUG=334708
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/143903016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 11:54:51 +00:00
machenbach@chromium.org
83f9562393 Prepare push to trunk. Now working on version 3.24.22. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/144023007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18732 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 10:50:37 +00:00
mvstanton@chromium.org
1b3280c491 Revert "Add hydrogen support for ArrayPop, and remove the handwritten call stubs." 
This reverts commit r18709, due to deopt fuzzer issue.
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/143983010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 10:41:23 +00:00
mvstanton@chromium.org
717161a0e1 Disable concurrent sweeping, pending investigation of failures. 
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/141653013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 09:14:44 +00:00
hpayer@chromium.org
66a7fc78b8 ResetAllAllocationSitesDependentCode is not changing dependent code, assert removed. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138163014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 08:46:39 +00:00
palfia@homejinni.com
87b7fdf46b MIPS: Zonify types in compiler frontend 
Port r18719 (13303b7a)

Original commit message:
Clean up some zone/isolate handling in AST and its visitors on the way.

(Based on https://codereview.chromium.org/103743004/)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/143873005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 22:31:31 +00:00
hpayer@chromium.org
3271acd764 Fix x64 breakage. 
BUG=

Review URL: https://codereview.chromium.org/144263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 19:40:25 +00:00
hpayer@chromium.org
1d8c83e7ab Enable concurrent sweeping. Added some extra debugging checks for concurrent sweeping. 
BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/138903009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 19:30:27 +00:00
plind44@gmail.com
ae65c83822 MIPS: Stay in fast enum case if the empty_slow_element_dictionary is used. 
Port r18705 (78b4ea3)

Original commit message:
This fixes slow for-in over frozen objects.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/144023002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 17:48:57 +00:00
mvstanton@chromium.org
796a244bea Revert "Unify calling to GenerateFastApiCallBody before stubbing it" 
This reverts commit r18714 for breaking webkit tests with an assert.

TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/144143002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 17:04:17 +00:00
rossberg@chromium.org
0d906a8bdb Zonify types in compiler frontend 
Clean up some zone/isolate handling in AST and its visitors on the way.

(Based on https://codereview.chromium.org/103743004/)

R=jkummerow@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/102563004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:22:52 +00:00
jochen@chromium.org
fb0c43f0ca Only refill free lists for spaces that are being swept 
BUG=v8:3104
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143953005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18718 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:19:04 +00:00
mvstanton@chromium.org
c472ee85f8 Array constructor shouldn't require a Cell, just an AllocationSite. 
The Array constructor has a needless dependency on an input argument
that is a Cell. It uses this to walk through to an AllocationSite.
The dependency hampers future work. Instead, pass the AllocationSite
as input to the Array constructor.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/140963004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 16:04:39 +00:00
dcarney@chromium.org
058c5c9f40 Unify calling to GenerateFastApiCallBody before stubbing it 
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/142973005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 15:06:46 +00:00
rossberg@chromium.org
80195df5d8 Silence another VS warning 
R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/143973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 14:41:48 +00:00
rossberg@chromium.org
928d71f83b Retry landing "Implement zone-allocated types" 
Works around apparent scoping bug in VS, the only change to before being a method rename in the test suite:

--- a/test/cctest/test-types.cc
+++ b/test/cctest/test-types.cc
@@ -153,7 +153,7 @@ struct ZoneRep {
     return reinterpret_cast<ZoneList<ZoneType*>*>(AsTagged(t));
   }

-  static Zone* Region(Zone* zone, Isolate* isolate) { return zone; }
+  static Zone* ToRegion(Zone* zone, Isolate* isolate) { return zone; }
 };

@@ -168,7 +168,7 @@ struct HeapRep {
   static Object* AsConstant(Handle<Type> t) { return Box::cast(*t)->value(); }
   static FixedArray* AsUnion(Handle<Type> t) { return FixedArray::cast(*t); }

-  static Isolate* Region(Zone* zone, Isolate* isolate) { return isolate; }
+  static Isolate* ToRegion(Zone* zone, Isolate* isolate) { return isolate; }
 };

@@ -183,7 +183,7 @@ struct Tests : Rep {
       isolate(CcTest::i_isolate()),
       scope(isolate),
       zone(isolate),
-      T(Rep::Region(&zone, isolate), isolate) {
+      T(Rep::ToRegion(&zone, isolate), isolate) {
   }

   static void CheckEqual(TypeHandle type1, TypeHandle type2) {

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/143693003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 14:14:12 +00:00
jochen@chromium.org
c3383698ee Rename MarkCompactCollector::StealMemoryFromSweeperThreads to RefillFreeLists 
The swept memory is now collected on the foreground thread, so it's not
stealing the memory from the threads anymore

BUG=v8:3104
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143463005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 12:48:10 +00:00
verwaest@chromium.org
2d9a4eb355 Add hydrogen support for ArrayPop, and remove the handwritten call stubs. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/137783023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 12:42:24 +00:00
jochen@chromium.org
7b3b9bd316 Move the temporary private freelist closer to where it's used 
BUG=v8:3104
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 11:48:51 +00:00
jochen@chromium.org
6b1ae170b9 Move the management of the already swept pages to MarkCompactCollector 
That way, MCC doesn't need to know about the state the threads are in to
steal free memory from them.

BUG=v8:3104
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143283002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 11:41:18 +00:00
verwaest@chromium.org
342b534e7e Stay in fast enum case if the empty_slow_element_dictionary is used. 
This fixes slow for-in over frozen objects.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/135903014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 11:20:11 +00:00
bmeurer@chromium.org
4bae658948 Fix invalid type assumption in GenerateNumberToString(). 
We don't have any type feedback in %_NumberToString(), so it's
a bug to assume Type::Number here.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/143893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 10:35:20 +00:00
machenbach@chromium.org
5a272e8659 Prepare push to trunk. Now working on version 3.24.21. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/134733005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-21 09:01:39 +00:00
palfia@homejinni.com
e1d9313ce8 MIPS: Turn ArrayPush into a stub specialized on the elements kind and argc. 
Port r18696 (6e4b51b4)

BUG=
R=gergely@homejinni.com

Review URL: https://codereview.chromium.org/143663002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 23:08:52 +00:00
titzer@chromium.org
5771b0975a Fix representation requirement in HReturn. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/143523002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 19:00:11 +00:00
verwaest@chromium.org
9f64f43a1c Turn ArrayPush into a stub specialized on the elements kind and argc. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/143213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 17:09:24 +00:00
jochen@chromium.org
c970c1cb6f Update Isolate::RequestGarbageCollection after r18691 
BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143403002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 15:44:03 +00:00
hpayer@chromium.org
62ef558ddb Enable incremental marking when --expose-gc is turned on. 
BUG=
R=mstarzinger@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/139343007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 14:14:07 +00:00
jochen@chromium.org
e06d47307d Explicitly initialize MarkCompactCollector and ExternalStringTable 
BUG=none
R=dcarney@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/143063003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 11:57:56 +00:00
rmcilroy@chromium.org
6eb9e02b00 DoubleToIStub can't use ip on armv6, because the ubfx impl will clobber it 
This previous change broke DoubleToIStub on armv6:
https://code.google.com/p/v8/source/detail?r=16322

The problem is that DoubleToIStub::Generate assumed that it could safely use the ip register, but on armv6 the ubfx implementation will clobber any previous value stored there.  So instead, pick another register.

Test case:
for (var i=0; i<2; i++) {
	v = 4294967295;
	v &= -2;
	print(v)
	}

This should print -2 twice, but on armv6 without this patch, it prints -2 followed by 2046.

This problem causes sunspider's bitops-nsieve-bit, crypto-md5 and crypto-sha1 tests to generate incorrect results (but the results are not checked for validity in sunspider-1.0 as available in chromium, but are checked and reported as incorrect in sunspider-1.0.2).

Thanks to Tomasz Kilarski for helping out with this.

R=bmeurer@chromium.org, rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/131823004

Patch from Mostyn Bramley-Moore <mostynb@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 11:30:48 +00:00
dslomov@chromium.org
5b7b4b99b7 Revert "ES6: Implement Object.setPrototypeOf" 
This reverts commit r18685 for breaking WebKit tests.

TBR=arv@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 10:59:07 +00:00
dslomov@chromium.org
1e3a14da44 ES6: Implement Object.setPrototypeOf 
http://people.mozilla.org/~jorendorff/es6-draft.html#sec-object.setprototypeof

This just exposes the internal %SetPrototype and adds all the required
type checks as specified.

BUG=v8:2675
LOG=Y
R=dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/141913002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 10:38:01 +00:00
dcarney@chromium.org
f93f8ded96 String:WriteUtf8: Add REPLACE_INVALID_UTF8 option 
This patch makes String::WriteUtf8 replace invalid code points (i.e. unmatched
surrogates) with the unicode replacement character when REPLACE_INVALID_UTF8 is
set.  This is done to avoid creating invalid UTF-8 output which can lead to
compatibility issues with software requiring valid UTF-8 inputs (e.g. the
WebSocket protocol requires valid UTF-8 and terminates connections when invalid
UTF-8 is encountered).

R=dcarney@chromium.org

BUG=

Review URL: https://codereview.chromium.org/121173009

Patch from Felix Geisendörfer <haimuiba@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 09:52:54 +00:00
mvstanton@chromium.org
04b1baa4c4 We no longer need to recover type cells from the oracle. 
We only need the values within them. Function calls to Array from optimized code needed the cell in the past, but no longer.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141893002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 09:48:05 +00:00
machenbach@chromium.org
8dd7dec8c5 Prepare push to trunk. Now working on version 3.24.20. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/143093002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 07:57:07 +00:00
svenpanne@chromium.org
0757d56057 De-virtualize GenerateNameCheck. 
Currently there are two kinds of "vtables" used in the load/store stub
compilers: kind() and C++'s own vtables. This is a bit confusing, and
this is a step towards simplifying things.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/141763002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18676 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 07:05:23 +00:00
haitao.feng@intel.com
de72001f6b Replace movq with movp for X64 when the operand size is kPointerSize 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/105503006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 04:59:40 +00:00
haitao.feng@intel.com
5c122cd477 Use kRegisterSize when passing arguments to the C++ runtime for X64 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/137443004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18674 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-20 01:52:21 +00:00
bmeurer@chromium.org
23842bbc0a Fix compilation with latest Xcode toolchain. 
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/142563002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-19 12:24:25 +00:00
verwaest@chromium.org
db3bc1ee85 Remove special String.fromCharCode call IC support. 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/141773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 16:08:54 +00:00
ishell@chromium.org
b5119090db --trace-hydrogen fix 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/141333006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 15:44:40 +00:00
verwaest@chromium.org
5b5feaa92d Remove the special MathFloor / MathAbs call handlers. 
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/141733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 14:21:01 +00:00
mvstanton@chromium.org
431dcc9342 Moving logic to AstNode to determine how many type cells are required. 
With this change, we'll be able to discover how many type cells we
need at parse time, enabling future optimizations.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141533004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 14:08:50 +00:00
mvstanton@chromium.org
b2bea46245 Minor bugfix in building inlined Array: bad argument to JSArrayBuilder. 
An HConstant pointing to a Cell rather than an AllocationSite
was passed. The argument wasn't used because of fortuitous
flags. An assert was added to protect the argument.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/141533003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 12:18:57 +00:00
svenpanne@chromium.org
83d02a8ad0 Fixed Windows build. 
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/140983005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:52:50 +00:00
verwaest@chromium.org
e9f957ce2c Remove special charAt and charCodeAt handling in the ICs. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/136443006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:28:22 +00:00
verwaest@chromium.org
ef52aeb701 Remove special ArrayCode CallIC. 
Once Call ICs are replaced by LoadIC + CallFunctionStub, we'll need a new way
of tracking this information.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141073006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18662 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:24:36 +00:00
mvstanton@chromium.org
155ef100e9 Fix logic error in assert in IsUndeclaredGlobal() 
Recent changes in IC logic meant that CallStubs no longer use the Contextual bit. IsUndeclaredGlobal() needed to adjust for that.

In fact, now the CL has morphed to remove the notion of storing contextual state in the IC at all, it just becomes some extra ic state of the load ic. This took some adjustment in harmony code to use the global receiver for certain stores.

Now it's clearer that only LoadICs actually record any information about contextual or not.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/140943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 11:08:24 +00:00
svenpanne@chromium.org
e8f935a630 Various extension-related cleanup and simplifications. 
Removes the embarrassing "static"s, shuffles some code around, doing various cleanups on the way.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/130213009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 10:52:00 +00:00
dcarney@chromium.org
7cee52948f Fix stub-invoked setter callback handling. 
When invoking a setter callback for a property using
JSObject::SetPropertyWithCallback(),the callback arguments includes
a correct pair of receiver and holder objects.

Such a pair of _possibly different_ arguments (receiver, holder) must
also be supplied when invoking the same setter callback from JITed
code, when the setter is invoked through the StoreCallbackProperty
stub.

An example where this matters are the accessor properties kept on the
global scope of Worker (i.e., properties kept on the global object
itself, and not on its prototype.) Conflating the receiver with the
holder leads to general confusion when attempting to fetch out the
wrapper object.

LOG=N
R=dcarney@chromium.org, dcarney
BUG=239669

Review URL: https://codereview.chromium.org/139263008

Patch from Sigbjorn Finne <sigbjornf@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 10:34:43 +00:00
ulan@chromium.org
0575396a4c Refactor string internalization. 
Remove duplicate code in StringTable and Heap. Instead of having many InternalizeXXXString methods, add a general InternalizeStringWithKey that takes a string table key.

BUG=
R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/140953002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 10:27:57 +00:00
jochen@chromium.org
3a954aa52d Introduce a setting to control the toolset for which d8 is compiled 
BUG=v8:1775
R=machenbach@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/138273016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 09:11:22 +00:00
machenbach@chromium.org
0675b4ae78 Prepare push to trunk. Now working on version 3.24.19. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/141603003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18653 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 08:10:15 +00:00
palfia@homejinni.com
87c7d63084 MIPS: Implement in-heap backing store for typed arrays. 
Port r18651 (49744859)

Original commit message:
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/141143003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 22:45:11 +00:00
dslomov@chromium.org
5da41be7b8 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 17:08:45 +00:00
dslomov@chromium.org
34eeeb8953 Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18649 for breaking Linux/nosnap and Win64 tests.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 16:00:36 +00:00
dslomov@chromium.org
97040ce67b Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18646

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 15:01:27 +00:00
dslomov@chromium.org
95f572389e Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18646 for breaking Win32 build.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/132233012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:26:15 +00:00
dslomov@chromium.org
0c960c2e96 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:18:37 +00:00
svenpanne@chromium.org
c8475cf1b1 Robustified extension installation a bit. 
Removed ADDRESS_SANITIZER #ifdefs, the extension is so tiny that it's
not worth the clutter.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/138143014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 13:18:28 +00:00
hpayer@chromium.org
83e27375ca Enable allocation site pretenuring. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/133703015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18643 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 11:59:34 +00:00
titzer@chromium.org
ff885a1114 Fix handling of last position for lazy deopt on X64, ARM and MIPS. 
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 11:58:06 +00:00
hpayer@chromium.org
76284bdcad Deopt marked code at safe deoptimization point when pretenuring. 
BUG=
R=bmeurer@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138033012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18641 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 11:54:12 +00:00
haitao.feng@intel.com
95b0c6ebcf Update load_rax and store_rax to support X32 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/103843002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18640 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 11:35:30 +00:00
hpayer@chromium.org
e3fdf3f4e7 Refactor DeoptimizeDependentCodeGroup. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/137783016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 10:00:03 +00:00
machenbach@chromium.org
2ac16b0955 Prepare push to trunk. Now working on version 3.24.18. 
R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18633 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 08:22:37 +00:00
svenpanne@chromium.org
b25bb230cd Removed apiutils.h and related cleanup. 
ExtensionConfiguration is just a simple container for extension names
(in a perfect world we would use vector<string> and range-based for
loops), and HandleScopeData was in the totally wrong place. Some
additional cleanup on the way, e.g. using the null pattern behind our
external API.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/139393002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 08:17:40 +00:00
palfia@homejinni.com
fbf0fe177e MIPS: Fix Win32 buildbreak (caused by overriden methods that have disappeared while having the patch out for code review). 
Port r18627 (c2ba7b25)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/140203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 00:06:45 +00:00
palfia@homejinni.com
185829c6dd MIPS: This is a preview of a first step towards unification of the hydrogen call machinery. 
Port r18626 (d3368a4c)

Original commit message:
The change replaces CallNamed, CallKeyed, CallConstantFunction and CallKnownGlobal hydrogen instructions with two new instructions with a more lower level semantics:

1. CallJSFunction for direct calls of JSFunction objects (no
   argument adaptation)

2. CallWithDescriptor for calls of a given Code object according to
   the supplied calling convention.

Details:

CallJSFunction should be straightforward, the main difference from the
existing InvokeFunction instruction is the absence of argument adaptor
handling. (As a next step, we will replace InvokeFunction with an
equivalent hydrogen code.)

For CallWithDescriptor, the calling conventions are represented by a
tweaked version of CallStubInterfaceDescriptor. In addition to the
parameter-register mapping, we also define parameter-representation
mapping there. The CallWithDescriptor instruction has variable number of
parameters now - this required some simple tweaks in Lithium, which
assumed fixed number of arguments in some places.

The calling conventions used in the calls are initialized in the
CallDescriptors class (code-stubs.h, <arch>/code-stubs-<arch>.cc), and
they live in a new table in the Isolate class. I should say I am not
quite sure about Representation::Integer32() representation for some of
the params of ArgumentAdaptorCall - it is not clear to me wether the
params could not end up on the stack and thus confuse the GC.

The change also includes an earlier small change to argument adaptor
(https://codereview.chromium.org/98463007) that avoids passing a naked
pointer to the code entry as a parameter. I am sorry for packaging that
with an already biggish change.

Performance implications:

Locally, I see a small regression (.2% or so). It is hard to say where
exactly it comes from, but I do see inefficient call sequences to the
adaptor trampoline. For example:

;;; <@78,#24> constant-t
bf85aa515a     mov edi,0x5a51aa85          ;; debug: position 29
;;; <@72,#53> load-named-field
8b7717         mov esi,[edi+0x17]          ;; debug: position 195
;;; <@80,#51> constant-s
b902000000     mov ecx,0x2                 ;; debug: position 195
;;; <@81,#51> gap
894df0         mov [ebp+0xf0],ecx
;;; <@82,#103> constant-i
bb01000000     mov ebx,0x1
;;; <@84,#102> constant-i
b902000000     mov ecx,0x2
;;; <@85,#102> gap
89d8           mov eax,ebx
89cb           mov ebx,ecx
8b4df0         mov ecx,[ebp+0xf0]
;;; <@86,#58> call-with-descriptor
e8ef57fcff     call ArgumentsAdaptorTrampoline  (0x2d80e6e0)    ;; code: BUILTIN

Note the silly handling of ecx; the hydrogen for this code is:

0 4 s27 Constant 1  range:1_1 <|@
0 3 t30 Constant 0x5bc1aa85 <JS Function xyz (SharedFunctionInfo 0x5bc1a919)> type:object <|@
0 1 t36 LoadNamedField t30.[in-object]@24 <|@
0 1 t38 Constant 0x2300e6a1 <Code> <|@
0 1 i102 Constant 2  range:2_2 <|@
0 1 i103 Constant 1  range:1_1 <|@
0 2 t41 CallWithDescriptor t38 t30 t36 s27 i103 i102 #2 changes[*] <|@

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/137663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18630 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 23:37:49 +00:00
jarin@chromium.org
33b3f5639b Fix Win32 buildbreak (caused by overriden methods that have disappeared 
while having the patch out for code review).

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/136303004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 17:51:09 +00:00
jarin@chromium.org
19d832719e This is a preview of a first step towards unification of the hydrogen 
call machinery.  The change replaces CallNamed, CallKeyed,
CallConstantFunction and CallKnownGlobal hydrogen instructions with two
new instructions with a more lower level semantics:

1. CallJSFunction for direct calls of JSFunction objects (no
   argument adaptation)

2. CallWithDescriptor for calls of a given Code object according to
   the supplied calling convention.

Details:

CallJSFunction should be straightforward, the main difference from the
existing InvokeFunction instruction is the absence of argument adaptor
handling. (As a next step, we will replace InvokeFunction with an
equivalent hydrogen code.)

For CallWithDescriptor, the calling conventions are represented by a
tweaked version of CallStubInterfaceDescriptor. In addition to the
parameter-register mapping, we also define parameter-representation
mapping there. The CallWithDescriptor instruction has variable number of
parameters now - this required some simple tweaks in Lithium, which
assumed fixed number of arguments in some places.

The calling conventions used in the calls are initialized in the
CallDescriptors class (code-stubs.h, <arch>/code-stubs-<arch>.cc), and
they live in a new table in the Isolate class. I should say I am not
quite sure about Representation::Integer32() representation for some of
the params of ArgumentAdaptorCall - it is not clear to me wether the
params could not end up on the stack and thus confuse the GC.

The change also includes an earlier small change to argument adaptor
(https://codereview.chromium.org/98463007) that avoids passing a naked
pointer to the code entry as a parameter. I am sorry for packaging that
with an already biggish change.

Performance implications:

Locally, I see a small regression (.2% or so). It is hard to say where
exactly it comes from, but I do see inefficient call sequences to the
adaptor trampoline. For example:

;;; <@78,#24> constant-t
bf85aa515a     mov edi,0x5a51aa85          ;; debug: position 29
;;; <@72,#53> load-named-field
8b7717         mov esi,[edi+0x17]          ;; debug: position 195
;;; <@80,#51> constant-s
b902000000     mov ecx,0x2                 ;; debug: position 195
;;; <@81,#51> gap
894df0         mov [ebp+0xf0],ecx
;;; <@82,#103> constant-i
bb01000000     mov ebx,0x1
;;; <@84,#102> constant-i
b902000000     mov ecx,0x2
;;; <@85,#102> gap
89d8           mov eax,ebx
89cb           mov ebx,ecx
8b4df0         mov ecx,[ebp+0xf0]
;;; <@86,#58> call-with-descriptor
e8ef57fcff     call ArgumentsAdaptorTrampoline  (0x2d80e6e0)    ;; code: BUILTIN

Note the silly handling of ecx; the hydrogen for this code is:

0 4 s27 Constant 1  range:1_1 <|@
0 3 t30 Constant 0x5bc1aa85 <JS Function xyz (SharedFunctionInfo 0x5bc1a919)> type:object <|@
0 1 t36 LoadNamedField t30.[in-object]@24 <|@
0 1 t38 Constant 0x2300e6a1 <Code> <|@
0 1 i102 Constant 2  range:2_2 <|@
0 1 i103 Constant 1  range:1_1 <|@
0 2 t41 CallWithDescriptor t38 t30 t36 s27 i103 i102 #2 changes[*] <|@

BUG=
R=verwaest@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/104663004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-15 17:00:35 +00:00