Commit Graph

1382 Commits

Author SHA1 Message Date
rafaelw@chromium.org
bdf78a7ad3 Reland [Object.observe] Don't force normalization of elements for observed objects
Original Issue: https://codereview.chromium.org/29353003/

Note that this version of the patch includes logic for bailing out of compiled ArrayPush/ArrayPop calls if the array is observed (see stub-cache-*)

R=danno@chromium.org
BUG=v8:2946
LOG=N

Review URL: https://codereview.chromium.org/68343016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 21:47:39 +00:00
rafaelw@chromium.org
161cc3cd2a Handlify JSObject::SetElement & brethren
Because SetElement & co are interdependent, this patch handlfies all of JSObject::
-SetElement
-SetFastElement
-SetDictionaryElement
-SetFastDoubleElement
-SetElementWithInterceptor
-SetElementWithoutInterceptor
-SetElementWithCallbackSetterInPrototype

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/66803002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 17:30:48 +00:00
verwaest@chromium.org
6befb8d5cd Also support smi in load-ICs.
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/68523009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 16:37:36 +00:00
verwaest@chromium.org
93f2ed48d9 Handle all object types (minus smi) in load/store ICs
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/62953007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 16:25:31 +00:00
mvstanton@chromium.org
3cf157b43b Inline zero argument array constructor.
patch from issue 54583003 (dependent code).

Zero arguments - very easy

1 argument - three special cases:
  a) If length is a constant in valid array length range,
     no need to check it at runtime.
  b) respect DoNotInline feedback on the AllocationSite for
     cases that the argument is not a smi or is an integer
     with a length that should create a dictionary.
  c) if kind feedback is non-holey, and length is non-constant,
     we'd have to generate a lot of code to be correct.
     Don't inline this case.

N arguments - one special case:
  a) If a deopt ever occurs because an input argument isn't
     compatible with the elements kind, then set the
     DoNotInline flag.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/55933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 12:05:09 +00:00
rossberg@chromium.org
cec8383cff Provide private symbols through internal APIs
Adds a notion of private symbols, mainly intended for internal use, especially, self-hosting of built-in types that would otherwise require new C++ classes.

On the JS side (i.e., in built-ins), private properties can be created and accessed through a set of macros:

  NEW_PRIVATE(print_name)
  HAS_PRIVATE(obj, sym)
  GET_PRIVATE(obj, sym)
  SET_PRIVATE(obj, sym, val)
  DELETE_PRIVATE(obj, sym)

In the V8 API, they are accessible via a new class Private, and respective HasPrivate/Get/Private/SetPrivate/DeletePrivate methods on calss Object.

These APIs are designed and restricted such that their implementation can later be replaced by whatever ES7+ will officially provide.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/48923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-13 10:34:06 +00:00
yangguo@chromium.org
e83fd01ce6 Reland "Implement Math.sin, cos and tan using table lookup and spline interpolation."
This relands r17594 with necessary fixes.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/70003004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-12 14:43:18 +00:00
yangguo@chromium.org
7fd7bbdcad Fix potential assertion failure.
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/68913002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17621 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-11 15:28:47 +00:00
rafaelw@chromium.org
4bc568b77a Revert "Reland [Object.observe] Don't force normalization of elements for observed objects"
TBR=danno
BUG=

Review URL: https://codereview.chromium.org/67233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 19:33:05 +00:00
rafaelw@chromium.org
ca8f947664 Reland [Object.observe] Don't force normalization of elements for observed objects
Original Issue: https://codereview.chromium.org/29353003/

TBR=danno
BUG=v8:2946

Review URL: https://codereview.chromium.org/66933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17607 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 19:12:43 +00:00
rafaelw@chromium.org
c824bfb44a Revert "[Object.observe] Don't force normalization of elements for observed objects"
Broke ARM build

TBR=danno
BUG=

Review URL: https://codereview.chromium.org/66603004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 15:36:22 +00:00
rafaelw@chromium.org
d462dca64a [Object.observe] Don't force normalization of elements for observed objects
BUG=v8:2946
R=danno@chromium.org

Review URL: https://codereview.chromium.org/29353003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 14:55:13 +00:00
yangguo@chromium.org
9f104a1a3e Revert "Implement Math.sin, cos and tan using table lookup and spline interpolation."
This reverts commit r17594.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59153007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 13:44:27 +00:00
yangguo@chromium.org
063b7c4ebb Implement Math.sin, cos and tan using table lookup and spline interpolation.
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50563003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 13:10:39 +00:00
bmeurer@chromium.org
3f1fc2385a Remove unused ValueInfo struct
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/46673004

Patch from Adrian Perez de Castro <aperez@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17577 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 07:45:15 +00:00
vegorov@chromium.org
adae3f77ec Allow redirecting disassembly and deoptimization traces into a file.
This is controlled by two flags:

--redirect_code_traces
--redirect_code_traces_to=<filename>

When redirection is enabled but --redirect_code_traces_to is not specified traces are written to a file code-<pid>-<isolate>.asm. This mangling scheme matches hydrogen.cfg and allows easy discovery of compilation artifacts in a multi-V8 environment (e.g. when compilation is traced from inside Chromium).

D8 defines --redirect_code_traces_to=code.asm similar to hydrogen.cfg redirection.

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/43273004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-07 16:35:27 +00:00
rafaelw@chromium.org
1a74e27994 Handlify ForceSetObjectProperty
Note that I've left the layering as is to make the diffs clear. Is it worth moving ForceSetObjectProperty to objects.cc? This code is clearly implementing part of the DefineOrRedefine steps from the spec, but it's still odd that it lives in Runtime. Note that handles.cc exposes a ForceSetProperty which just performs a CALL_HEAP_FUNCTION on the Runtime::ForceSetObjectProperty -- which is exposed to the api as v8::Object::ForceSet

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 16:32:47 +00:00
mvstanton@chromium.org
cec8548d0e Correct handling of arrays with callbacks in the prototype chain.
Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 15:45:43 +00:00
mstarzinger@chromium.org
88be0606cf Add support for tracking NotExectuted/ExecutedOnceCodeAge's when --track_gc_object_stats flag is set.
BUG=None
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/40003002

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-06 09:29:09 +00:00
yangguo@chromium.org
371265eec4 Revert "Handlify concat string and substring."
This reverts r17490.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/59973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 15:36:15 +00:00
rafaelw@chromium.org
b9883beaba Remove SetLocalPropertiesIgnoreAttributesTrampoline
BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/59343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 15:33:14 +00:00
yangguo@chromium.org
23d085c691 Handlify concat string and substring.
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50073005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 14:07:07 +00:00
mstarzinger@chromium.org
5267d7b884 Introduce JSFunction::EnsureHasInitialMap method.
This change enforces explicit allocation of the initial map for each
JSFunction to introduce a proper layering between the JSFunction class
and the Heap class. A follow-up change will then handlify the two
functions AllocateInitialMap and AllocateFunctionPrototype.

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/32323013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 12:11:27 +00:00
rafaelw@chromium.org
ada13dfc3f Remove calls to JSObject::SetLocalPropertyIgnoreAttributesTrampoline within objects.cc
This includes handlifing:
-SetHiddenPropertiesHashTable
-ObjectHashSet::Add/Remove
-ObjectHashTable::Put

And splitting the following methods which previously took "allow creation" enum arguments to into side-effect-free getters and GetOrCreate*-handlfied getters.

-GetHash (now GetHash & handlified GetOrCreateHash)
-GetIdentityHash (now GetIdentityHash & handlified GetOrCreateIdentityHash)
-GetHiddenPropertiesHashTable (now GetHiddenPropertiesHashTable & handlified GetOrCreateaHiddenPropertiesHashTable)

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/48913008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 11:47:11 +00:00
jkummerow@chromium.org
d0c5614f9d Proper fix for the issue exposed by r17459
This reverts r17462 and instead fixes StubCache::ComputeLoadNonexistent by replacing s/IsGlobalObject/IsJSGlobalObject/ there.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59103005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 11:01:31 +00:00
svenpanne@chromium.org
dc8c314084 Make snapshots reproducible.
To keep the structure of the serializer more or less untouched, we use
some ingenious Corry-approved(TM) 3-step technology (a.k.a. "hack"):

   * Create copies of code objects.
   * Wipe out all absolute addresses in these copies.
   * Write out the cleaned copies instead of the originals.

In conjunction with --random-seed, our snapshots are reproducible now.

BUG=v8:2885
R=bmeurer@chromium.org, erik.corry@gmail.com

Review URL: https://codereview.chromium.org/54823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 10:14:48 +00:00
svenpanne@chromium.org
82b8e23bc1 Introduce raw accessors for type_feedback_info.
This pure refactoring is needed for another upcoming CL.

Note that the actual names are still a bit confusing, because this is
still a kind of swiss-army-knife-field. :-/

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/52633003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 10:05:03 +00:00
mvstanton@chromium.org
31865699ac Function ElementsAreSafeToExamine was undefined in release heap verify.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/48963006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-29 07:56:47 +00:00
rafaelw@chromium.org
523851b337 Handlify JSObject::PrepareElementsForSort
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/32523008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 20:42:51 +00:00
mvstanton@chromium.org
a85c825bb9 The Elements pointer in a JSObject can have a filler map instead of a
valid fixed array, iff a gc occurred while allocating a fixed array as
part of array construction. Heap verification needs protection against
examining the elements object in this case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/43383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 12:26:47 +00:00
hpayer@chromium.org
2dfaf2aab5 Add code age subtype tracking to --track-gc-object-stats
Adds counters which track the age of code in the heap during a gc if
--track-gc-object-stats is enabled.

 - Splits RecordObjectStats into RecordObjectStats, RecordCodeSubTypeStats and
   RecordFixedArraySubTypeStats.
 - Renames kNoAge to kNoAgeCodeAge to follow other code age enums and enable
   the name to be used in Macro based initialization of the counters.

BUG=None
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/26179004

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 10:50:35 +00:00
rafaelw@chromium.org
f719a45f18 Handlify Map::CopyInstallDescriptors
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/34603008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 22:02:14 +00:00
rafaelw@chromium.org
91fa96bf6b Handlify Map::CopyNormalized
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/32483006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17349 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 19:47:38 +00:00
danno@chromium.org
bdeaf7514a Enable preaging of code objects when --optimize-for-size.
This change means that code which is never executed is garbage collected immediately, and code which is only executed once is collected more quickly (limiting heap growth), however, code which is re-executed is  reset to the young age, thus being kept around for the same number of GC generations as currently.

BUG=280984
R=danno@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/23480031

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17343 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 13:48:04 +00:00
mstarzinger@chromium.org
701749c4ec Simplify ObjectVisitor for external references.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/36853003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17336 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 10:47:51 +00:00
rafaelw@chromium.org
146eb9e0ee Handlify Map::CopyForObserved
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/34023002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 17:41:08 +00:00
mstarzinger@chromium.org
be3ed75ff3 Fix materialization of captured objects with field tracking.
R=titzer@chromium.org
BUG=chromium:298990
TEST=mjsunit/compiler/escape-analysis-representation

Review URL: https://codereview.chromium.org/35133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 13:48:54 +00:00
mstarzinger@chromium.org
b47dd2b58c Make PropertyCell::UpdatedType return a handle.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/31933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 08:24:35 +00:00
mstarzinger@chromium.org
19b2ee1c40 Handlify PropertyCell::SetValueInferType and friends.
This finally gets rid of the pesky trampoline in SetValueInferType and
enforces the layering between PropertyCell and Heap. It requires full
handlification of NewGlobalObject as well, which is only used when the
snapshot is created at compile-time.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/28783002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-21 13:55:24 +00:00
yangguo@chromium.org
a428465819 Handlify JSObject::HasReal*Property.
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/27518002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-18 12:52:07 +00:00
yangguo@chromium.org
1eeebd2b6b Handlify GetPropertyWithCallback.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/27335002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-16 09:13:31 +00:00
mvstanton@chromium.org
8f9f192f6e AllocationSites for all literals
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/24250005


Review URL: https://codereview.chromium.org/27366003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-16 08:10:36 +00:00
rafaelw@chromium.org
2268defb84 Handlify JSObject::SetObserved
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/27070002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 19:28:11 +00:00
mvstanton@chromium.org
f4edc076d8 Revert "AllocationSites for all literals"
This reverts commit r17219 due to WebKit failures.

R=mstarzinger@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/26539010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 15:35:23 +00:00
mvstanton@chromium.org
362c0cfbca AllocationSites for all literals
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/24250005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 14:52:58 +00:00
ulan@chromium.org
83c63cf555 Out-of-line constant pool on Arm: Stage 2 - Introduce ConstantPoolArray object.
Second stage of implementing an out-of-line constant pool on Arm.  This CL
Introduces the ConstantPoolArray object which will be used as the backing
store of out-of-line constant pools.  Nothing uses this object yet.

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22601003

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17197 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 13:35:06 +00:00
verwaest@chromium.org
04e1462f9e Centralize handler caching and probing in ic.cc.
Also purge invalid POLYMORPHIC stubs. In a next step the compilers should probably be merged and the "Compute*" on the stub-cache removed.

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25548009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-11 13:48:14 +00:00
yangguo@chromium.org
907f079d25 Handlify GetPropertyWithFailedAccessCheck.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/25732002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17146 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 15:38:52 +00:00
yangguo@chromium.org
995ea2bd82 Handlify JSObject::GetProperty????Interceptor.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/25669004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 15:27:02 +00:00
ulan@chromium.org
f9fbe4fcfb Enable weak embedded objects in optimized code with a fix for heap verifier.
BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25702008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17141 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 13:14:37 +00:00
olivf@chromium.org
66c610398f Reland "Hydrogenisation of binops"
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/25494007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-04 08:17:11 +00:00
ulan@chromium.org
52c421956a Make objects embedded in optimized code weak.
This introduces a global weak hash table that maps objects embedded in
optimized code to dependent code lists. Using this table we can deoptimize
optimized code whenever a weak object embedded in the code dies.

BUG=v8:2073
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23477061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17102 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-04 07:25:24 +00:00
hpayer@chromium.org
9d732d6594 Print out how many AllocationMementos were found during mark-sweep.
Moreover use the right memory boundary for AllocationMemento lookup during gc.

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/25655004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-02 11:04:54 +00:00
yangguo@chromium.org
72f93382bc Correctly handlify CopyContextLocalsToScopeObject.
Handlified functions that expect allocation must be static, i.e. not allow to
use 'this', since 'this' is not relocated by potential GC.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/25704002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-02 10:51:10 +00:00
mstarzinger@chromium.org
3ee9b84609 Remove deprecated JSObject::GetLocalPropertyType method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/25453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-02 08:27:33 +00:00
olivf@chromium.org
9459ed3ab4 Revert "Hydrogenisation of binops"
This reverts r17052-17054 for various build breaks.

TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/25571002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 18:00:02 +00:00
olivf@chromium.org
7873f35eb2 Hydrogenisation of binops
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/24072013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17052 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 15:24:56 +00:00
mstarzinger@chromium.org
d67ffdaa52 Handlify JSObject::LookupAccessor method.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/25508002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17048 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 14:26:15 +00:00
verwaest@chromium.org
d4cbf02afc Allow code to be cached in shared maps.
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25486002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 13:13:39 +00:00
mstarzinger@chromium.org
b9b528e030 Defer allocation of native function literals.
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/25473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 09:47:37 +00:00
verwaest@chromium.org
14422a698f Cleanup in IC patching.
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25001005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 09:44:35 +00:00
verwaest@chromium.org
63b584474f Reduce code duplication in IC updating.
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25033003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17034 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 09:30:07 +00:00
yangguo@chromium.org
62e4d0671d Fixed debuggersupport=off build after r16521
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/25108007

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-01 07:53:37 +00:00
jkummerow@chromium.org
85ae341b09 Revert "Defer allocation of native function literals."
This reverts r17017 for breaking LayoutTests.

R=mstarzinger@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/25315002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 17:42:58 +00:00
verwaest@chromium.org
aa4eaeebee Revert "Allow code to be cached in shared maps." due to GC stress crashes.
TBR=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25084005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 16:34:37 +00:00
verwaest@chromium.org
fa742f84a4 Allow code to be cached in shared maps.
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25058004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 15:28:52 +00:00
mstarzinger@chromium.org
c624141bf3 Defer allocation of native function literals.
R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/25164003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 14:49:11 +00:00
verwaest@chromium.org
f1fe1f95f5 Tag normal as handlers, and make code handler-specific.
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25049003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17013 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 13:58:44 +00:00
verwaest@chromium.org
0f715540a2 Tag handlers as HANDLER rather than STUB.
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25044002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-30 13:53:21 +00:00
yangguo@chromium.org
6eb8691846 Remove unused kFirstMathFunctionId
Review URL: https://codereview.chromium.org/24537002

Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-25 09:10:45 +00:00
mvstanton@chromium.org
f26bcd9fef Add field nested_sites to AllocationSite. This field is used to maintain
allocation site information for nested array and object literals.
It's not used productively in this CL, merely maintained in a minimal
way. (that comes next :)).

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/23463047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-24 10:30:41 +00:00
mstarzinger@chromium.org
8cbb4dcb49 Handlify JSObject::MigrateInstance and friends.
This relands the original change from r16899 together with a bugfix for
two unhandlified values which became stale.

R=verwaest@chromium.org
TEST=mjsunit/debug-evaluate-locals-optimized (in GC stress mode)

Review URL: https://codereview.chromium.org/24210011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-23 19:56:36 +00:00
mstarzinger@chromium.org
40decafa84 Revert "Handlify JSObject::MigrateInstance and friends."
This is reverted due to mozilla/ecma/Date/15.9.5.9 failing on Windows.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/24374002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-23 16:53:59 +00:00
mstarzinger@chromium.org
1279103806 Handlify JSObject::MigrateInstance and friends.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23583052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-23 15:02:25 +00:00
mstarzinger@chromium.org
4d64bf9737 Handlify JSObject::AllocateStorageForMap method.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23464089

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-23 11:57:34 +00:00
mstarzinger@chromium.org
d87c0679dd Hanldify JSObject::PreventExtensions method.
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/24200005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-20 12:54:02 +00:00
mstarzinger@chromium.org
35142b817f Handlify JSObject::NormalizeProperties method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23976010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-20 11:37:02 +00:00
verwaest@chromium.org
0bff3fa74b Remove duplicate way of encoding the holder in the flags.
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/24316002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-20 11:22:23 +00:00
mstarzinger@chromium.org
220c40542b Handlify JSObject::Freeze method.
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/24256004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-19 21:26:01 +00:00
mstarzinger@chromium.org
cd4dba243c Handlify JSReceiver::SetPropertyWithDefinedSetter method.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/24176002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-19 17:03:32 +00:00
mvstanton@chromium.org
137b43c9a3 Added a DependentCode field to AllocationSite. It's not currently used,
this initial CL is just to get the object layout correct.

BUG=
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23567003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-19 14:13:34 +00:00
mstarzinger@chromium.org
137029a756 Handlify JSObject::AddFastPropertyUsingMap method.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/24195003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-18 16:41:12 +00:00
mstarzinger@chromium.org
83cb6a6351 Handlify JSObject::SetNormalizedProperty methods.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/24096017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-18 16:25:52 +00:00
mstarzinger@chromium.org
4c85efb597 Handlify JSReceiver::HasProperty and friends.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23496058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-17 11:34:20 +00:00
mstarzinger@chromium.org
16a22a96c3 Handlify JSReceiver::SetProperty and friends.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23601031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-17 11:01:43 +00:00
verwaest@chromium.org
223ac69ff6 Rename StubType MAP_TRANSITION to TRANSITION.
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/24120007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-16 09:30:43 +00:00
dcarney@chromium.org
564a9a68b8 remove getcurrent from stubs
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23756009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-13 10:23:04 +00:00
mstarzinger@chromium.org
50b0567640 Handlify JSObject::DeepCopy method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/22934006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-13 09:51:11 +00:00
verwaest@chromium.org
e9c4a49866 Reland Handle non-JSObject heap objects using slow-path IC stub guarded by the map.
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23578030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 22:04:04 +00:00
mvstanton@chromium.org
5521e2e825 Bugfix: array constructors that expect a type feedback cell that points
to an AllocationSite were being passed the undefined object in some
cases. Clearly separate the cases where we have an AllocationSite and
where we don't in the general ArrayConstructorStub.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23477071

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 17:59:41 +00:00
verwaest@chromium.org
ff412d8c37 Revert "Handle non-JSObject heap objects using slow-path IC stub guarded by the map."
TBR=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23475039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 16:57:37 +00:00
verwaest@chromium.org
f375e0514b Handle non-JSObject heap objects using slow-path IC stub guarded by the map.
BUG=chromium:280632
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23691056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 16:12:04 +00:00
mstarzinger@chromium.org
6c18fbc229 Use trampoline or handlified JSObject::SetLocalPropertyIgnoreAttributes.
R=verwaest@chromium.org

Committed: http://code.google.com/p/v8/source/detail?r=16642

Review URL: https://codereview.chromium.org/24093002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 13:27:42 +00:00
yangguo@chromium.org
151e514930 Simplify installing concurrently recompiled code.
Instead of overwriting the code entry of the function, we trigger
an interrupt to install the code on the main thread.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23542029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 11:30:56 +00:00
ulan@chromium.org
0e8e003077 Implement in-place rehashing of HashTable.
The algorithm puts elements into correct positions in  multiple iterations.
On the first iteration it tries to put elements at entries specified by
their first hash probe. On the second iteration -- by the second
hash probe, and so on. Overall it does O(k*n) memory accesses, where
k is the maximum number of probes required for an element and n is the
capacity of the hash table. The expectation is that k will be small.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23658031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 11:03:27 +00:00
mstarzinger@chromium.org
8bf91ffe71 Revert "Use trampoline or handlified JSObject::SetLocalPropertyIgnoreAttributes".
This was reverted due to performance regressions on Sunspider and other
benchmarks due to double GCs caused by the trampoline.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23435006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 15:16:56 +00:00
mstarzinger@chromium.org
5dc202d274 Revert "Handlify JSObject::AddProperty method" for performance.
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23464069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 13:42:57 +00:00
mstarzinger@chromium.org
c570640334 Handlify JSObject::AddProperty method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23883007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 11:00:36 +00:00
mstarzinger@chromium.org
ae7813cacf Use trampoline or handlified JSObject::SetLocalPropertyIgnoreAttributes.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/24093002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 10:46:49 +00:00
dcarney@chromium.org
cc2257b92a move HEAP to /test
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23468021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 07:14:41 +00:00
mstarzinger@chromium.org
448d98e19d Use raw-to-handle trampoline in [Get/Set]HiddenPropertiesHashTable.
R=danno@chromium.org

Review URL: https://codereview.chromium.org/23629040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-10 14:33:06 +00:00
titzer@chromium.org
49d9555a97 Generate a custom OSR entrypoint for OSR compiles on all platforms, and transition to optimized code using the special entrypoint, instead of through the deoptimizer. Do not install the OSR compiled code as _the_ optimized code for a function.
Remove OSR-related stuff from deoptimizer.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21340002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 16:34:40 +00:00
mstarzinger@chromium.org
1a26455d22 Handlify JSObject::EnsureCanContainHeapObjectElements method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23818005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 14:29:47 +00:00
dcarney@chromium.org
c20f87a654 add uncached Function::New
TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/24071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 07:52:52 +00:00
dcarney@chromium.org
5b0a281604 revert 16584 for breaking build
TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23680014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 07:16:24 +00:00
dcarney@chromium.org
ddc5d437bb add uncached Function::New
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23561007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 07:08:34 +00:00
loislo@chromium.org
bbd26abedb Functions may not be optimized and we would like to know in cpu profiler what was the reason.
Current v8 implementation may disable optimization for a particular function or block it with help of dont_optimize flag.
The patch propagates the reason of that to the SharedFunctionInfo where cpu profiler can get it.

SharedFunctionInfo is a heap object so I extracted 8 bits from OptsCount for handling bailout reason code.

BUG=none
TEST=test-profile-generator/BailoutReason
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23817003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16555 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 13:20:51 +00:00
dcarney@chromium.org
d208d048ac remove most Isolate::Current asserts
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23493019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 11:27:22 +00:00
titzer@chromium.org
35490d82a9 Add OptimizedCodeList and DeoptimizedCodeList to native contexts. Both lists are weak. This makes it possible to find optimized code that is not referred to by any function, but still needs to be deoptimized. It obsoletes the weak deoptimizing code list in the deoptimizer data and generally simplifies the process of deoptimizing code.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23444029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 13:53:24 +00:00
yangguo@chromium.org
070e3b0af4 Introduce concurrent on-stack replacement.
Currently disabled behind --concurrent-osr.

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23710014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 12:55:59 +00:00
dcarney@chromium.org
7dcc12abf6 build fix for 16520
TBR=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23874010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 11:09:55 +00:00
dcarney@chromium.org
2b7efe05ae remove Isolate::Current from most files starting with 'j' through 'o'
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23578012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 10:34:42 +00:00
dcarney@chromium.org
615c34869c Push SetAccessor to Template
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23182003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16515 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 07:45:36 +00:00
dcarney@chromium.org
3e76d8b870 remove Isolate::Current from most files starting with 'o' through 'r'
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23757017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 07:05:11 +00:00
verwaest@chromium.org
3f70c3b07b Allow uncacheable identifiers to go generic.
BUG=v8:2867
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23453019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 16:32:11 +00:00
jkummerow@chromium.org
6e4bec8f88 Bump MaxRegularSpaceAllocationSize to InitialSemiSpaceSize() * 4/5
to allow allocation of large packed arrays in paged spaces.

BUG=v8:2790
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23604023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16475 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 13:36:49 +00:00
titzer@chromium.org
7bd61f8ca4 Remove OptimizedCodeEntry *sigh*.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23584004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16465 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 10:35:34 +00:00
mstarzinger@chromium.org
28fbc630d3 Handlify JSObject::SetAccessor method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23819003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 14:08:15 +00:00
mstarzinger@chromium.org
756a99bdba Handlify JSObject::SetIdentityHash method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23495011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 13:42:16 +00:00
mstarzinger@chromium.org
5d87a6c8e0 Handlify JSObject::DeleteHiddenProperty method.
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23600011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 13:28:52 +00:00
verwaest@chromium.org
8b97a1c5d2 Handlify JSProxy::Fix
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23707007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16452 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 12:52:25 +00:00
mstarzinger@chromium.org
25d86eacbd Handlify JSReceiver::SetElement method.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/23541006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16448 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 11:44:39 +00:00
mstarzinger@chromium.org
72826fc892 Simplify object printer declarations.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/23619010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16439 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 07:41:24 +00:00
mstarzinger@chromium.org
5e5ea8d494 Handlify JSObject::DeleteElement method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23766003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16438 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-29 18:01:45 +00:00
titzer@chromium.org
22b70b0508 Add OptimizedCodeEntry as a new heap object type. An optimized code entry represents an association between the native context, a function, optimized code, and the literals. Such associations are needed by the deoptimizer and optimized code cache to efficiently find related optimized code and functions for a given context or shared function info.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23691002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 16:48:40 +00:00
mstarzinger@chromium.org
3fb53cf83a Remove obsolete Oddball setters in FixedArray.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/23705002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 14:26:22 +00:00
hpayer@chromium.org
4d7375ca98 Clear next map word when folding allocations into js arrays.
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/22915007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 08:39:43 +00:00
mstarzinger@chromium.org
fc68cb74e5 Add RemovePrototype to FunctionTemplate
This allows functions created from a FunctionTemplate to not have a
prototype property, which is required by DOM methods.

R=mstarzinger@chromium.org
BUG=chromium:272440

Review URL: https://codereview.chromium.org/22990003

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 17:40:03 +00:00
verwaest@chromium.org
67b6605c5e Get rid of ConvertFieldToDescriptor.
This CL additionally fixes up the attributes for FIELD and CONSTANT in SetLocalPropertyIgnoreAttributes.

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23252008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 15:30:30 +00:00
jkummerow@chromium.org
11fd577261 Lower kInitialMaxFastElementArray constant to 95K
to work around erroneous "illegal access" error on x64.

BUG=v8:2790
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/22877039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16324 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 13:04:05 +00:00
dcarney@chromium.org
ad9cc8e716 js accessor creation on Template
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/22903012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 11:59:14 +00:00
jkummerow@chromium.org
7557ca80ba Add --trace-hydrogen-filter flag.
The flag restricts hydrogen.cfg output to functions passing the filter,
similar to what --hydrogen-filter does for optimization in general.

This is useful for investigating large repro cases where tracing all
functions would lead to an impractically large hydrogen.cfg file, but
restricting optimization using --hydrogen-filter is undesirable
(e.g. because it might cause the issue to no longer reproduce).

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22926025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 13:30:02 +00:00
verwaest@chromium.org
cd9be4139c Revert "Get rid of ConvertFieldToDescriptor and simplify related code."
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22999048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 13:21:01 +00:00
verwaest@chromium.org
f457809c08 Get rid of ConvertFieldToDescriptor and simplify related code.
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22861025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 11:52:59 +00:00
yangguo@chromium.org
be48c5ae26 Rename "parallel recompilation" to "concurrent recompilation".
Also introduced macros for flag aliases for temporary backwards compatibility.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23014007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 16:14:37 +00:00
mstarzinger@chromium.org
0ecd03ab4c Fix hidden properties on object with frozen prototype.
This fixes a corner-case where a frozen prototype with existing hidden
properties might prevent setting hidden properties on another object.

R=rossberg@chromium.org
BUG=v8:2829

Review URL: https://codereview.chromium.org/22799021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16276 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 13:51:32 +00:00
verwaest@chromium.org
22942716db Remove special case code for generalizing constants to fields.
R=bmeurer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22911018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 13:43:06 +00:00
verwaest@chromium.org
eb6cbe1486 Never clear debug-stub call ICs. Make a clear distinction between is_debug_stub
used everywhere but the debugger, and IsDebugBreak, used by the debugger.

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23361014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 12:16:00 +00:00
bmeurer@chromium.org
60e7d4b1e3 Revert "Use V8_FINAL and V8_OVERRIDE in various places, fixing bugs revealed by them."
This reverts commit r16232 for breaking the
tools/gen-postmortem-metadata.py script. Will reland without the
objects.{cc,h} changes.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/23143007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-20 10:52:23 +00:00
bmeurer@chromium.org
9929a9cd12 Use V8_FINAL and V8_OVERRIDE in various places, fixing bugs revealed by them.
- Use V8_FINAL and V8_OVERRIDE in objects.
- Use V8_FINAL and V8_OVERRIDE in Ast classes.
- Use V8_FINAL and V8_OVERRIDE in Lithium mips backend.
- Use V8_FINAL and V8_OVERRIDE in Lithium arm backend.
- Use V8_FINAL and V8_OVERRIDE in Lithium x64 backend.
- Use V8_FINAL and V8_OVERRIDE in Lithium ia32 backend.
- Use V8_FINAL and V8_OVERRIDE in Lithium classes.
- Use V8_FINAL and V8_OVERRIDE in Hydrogen classes.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/23064017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-20 07:27:06 +00:00
verwaest@chromium.org
20ca26f494 Improve generalization / migration tracing.
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23047002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-19 12:32:50 +00:00
yangguo@chromium.org
c52b7bba05 Fix regressions triggered by map invalidation during graph creation.
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/22807003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-12 14:10:25 +00:00
svenpanne@chromium.org
f0305bd83e Instance-type-related fixes and cleanup.
Things got quite a bit out of sync (don't we all love copy-n-paste?):

   * TypeToString didn't handle SLICED_STRING_TYPE,
     SLICED_ASCII_STRING_TYPE, FIXED_DOUBLE_ARRAY_TYPE,
     JS_FUNCTION_PROXY_TYPE and JS_DATE_TYPE.

   * INSTANCE_TYPE_LIST was missing entries for
     SLICED_ASCII_STRING_TYPE, JS_SET_TYPE, and JS_MAP_TYPE.

To improve this maintenance nightmare a little bit, the missing
instance types were added to the INSTANCE_TYPE_LIST macro and this
list is now used via our beloved 2nd order macro technique in
TypeToString. As a side-effect, the strings returned by TypeToString
have a "_TYPE" suffix now, but this doesn't really matter and is a
small price to pay for consistency.

Removed INVALID_TYPE on the way, it had no real use.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 08:22:46 +00:00
svenpanne@chromium.org
bc6fe88030 Desugar bitwise negation into XOR and kill all UnaryOp stuff.
R=mstarzinger@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/22184004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 13:34:51 +00:00
verwaest@chromium.org
9d9930ce99 Migrate instance of deprecated maps in HCheckMaps.
Currently only direct map checks are supported. Otherwise only polymorphic cases with a generic fallback behave properly, regular polymorphic cases still need to be adapted.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21536003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 16:42:39 +00:00
verwaest@chromium.org
04b5e7fa63 Replace HCheckPrototypeMaps by explicit map checks of constant values.
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21065006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 13:45:16 +00:00
dcarney@chromium.org
207396101f introduce eternal handles
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/21133006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 09:46:23 +00:00
loislo@chromium.org
d2c443b774 Extract hardcoded error strings into a single place and replace them with enum.
I'd like to propagate bailout reason to cpu profiler.
So I need to save it into heap object SharedFunctionInfo.
But:
1) all bailout reason strings spread across all the sources.
2) they are native strings and if I convert them into String then I may have a performance issue.
3) one byte is enough for 184 bailout reasons. Otherwise we need 8 bytes for the pointer.

Also I think it would be nice to have error strings collected in one place.
In that case we will get additional benefits:

It allows us to keep this set of messages under control.
It gives us a chance to internationalize them.
It slightly reduces the binary footprint.

From the other hand the developers have to add new strings into that enum.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/20843012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-02 09:53:11 +00:00
mstarzinger@chromium.org
96fc677d25 Pipe a script's CORS status through V8 during compilation.
In order to properly sanitize exception data during a 'window.onerror'
handler, we need to know whether a script was served with proper CORS
headers at the time it was loaded into V8. This patch adds a single bool
to ScriptOrigin, and pipes that through the compiler to land on the
Script object. We can then retrieve the parameter when calling the
embedder's exception callback.

BUG=crbug.com/159566
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20646006

Patch from Mike West <mkwst@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 17:05:50 +00:00
mstarzinger@chromium.org
8a019050ff Reland "Compilation type and state allocate an unnecessary Smi on v8::Script" (r15940).
It turns out that this change is not related to the test failures.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/21256003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 17:00:05 +00:00
verwaest@chromium.org
2af164f4d9 Mark maps as unstable if their instances potentially transition away.
Use this as a prerequisite for adding code dependencies.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21095005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 16:33:58 +00:00
danno@chromium.org
f3fff3c2f4 Revert 15940: "Compilation type and state allocate an unnecessary Smi on v8::Script."
Due to Mozilla test failures on Win32 debug

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21062004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15957 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 11:24:11 +00:00
mstarzinger@chromium.org
9f4fc77e1e Compilation type and state allocate an unnecessary Smi on v8::Script.
This patch combines them into a single field, and adjusts the accessors
and setters to take the enum type directly, rather than converting to and
from a Smi value.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20758002

Patch from Mike West <mkwst@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-29 17:59:02 +00:00
verwaest@chromium.org
6b83c868f0 Convert CONSTANT_FUNCTION to CONSTANT
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19485008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-24 12:34:50 +00:00
titzer@chromium.org
f612a29f8c Factor out common code from platform-specific deoptimization. Fix Deoptimizer not to need to partition functions, but revoke their code before patching, allowing deoptimizing_code_list to be removed from Code; Add DeoptimizeCodeList API to deoptimizer, which works on a ZoneList<Code*>.
BUG=
R=mstarzinger@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/19638014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-24 11:12:17 +00:00
hpayer@chromium.org
3c0483af52 Fix TargetSpace() method for box type.
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/19978003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-23 19:05:00 +00:00
verwaest@chromium.org
babce318d1 Eliminate map checks of constant values.
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19954005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-23 09:18:42 +00:00
mstarzinger@chromium.org
ce81b0d3a8 ES6: Implement WeakSet
WeakSets work similar to ordinary Sets but the value (which must be an
object) is held weakly.

This is available under --harmony-collections

BUG=v8:2785
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19678023

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 08:32:24 +00:00
mvstanton@chromium.org
ec8c6f4692 Rename AllocationSiteInfo to AllocationMemento
This is just a rename change with the exception of a bug found along the way in
CodeStubGraphBuilder<FastCloneShallowArrayStub>::BuildCodeStub(). There, the
intent is to get the boilerplate object from an AllocationSite. But the wrong
HObjectAccess was used. It only succeeds because it happened to be the same
offset :).

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19595004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 13:30:49 +00:00
mvstanton@chromium.org
3761e0388d With >= 64 non-string instance types, I removed an optimization that allowed us to detect internalized strings with a single bit test. (https://code.google.com/p/v8/source/detail?r=15358) But that change caused a regression, so here is an improvement:
Put the internalized string types in the lower 64 entries of
INSTANCE_TYPE, and non-internalized string types in the next 64 entries.
This way we can restore the single bit check.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19749004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 11:29:11 +00:00
svenpanne@chromium.org
607a531435 Do not inline printing functions typically used via GDB.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/19722005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 14:40:59 +00:00
danno@chromium.org
05ec5921be Fix --track_gc_object_stats option.
- Update ObjectStatsVisitTracker::Visit function to check if CodeCache is of
   CodeCache type, and extract the FixedArray from the struct if so
 - Fix typo in v8-counters.h where count_of_FIXED_ARRAY_XXX fields weren't being
   initialized.

BUG=v8:2780
R=danno@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/19257002

Patch from Ross McIlroy <mcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 13:00:40 +00:00
machenbach@chromium.org
f24997c1c7 Make deoptimization stress count global.
Store the deopt stress counter per isolate instead of per shared function info. The old field is removed.

Enable output of the counter value with a new flag.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 08:12:01 +00:00
mstarzinger@chromium.org
13f7c56e05 Handlify JSFunction::SetPrototype method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/19594002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15738 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 07:59:48 +00:00
mstarzinger@chromium.org
dfc945d594 Handlify JSReceiver/JSObject::DeleteProperty method.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18774002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 16:38:49 +00:00
mvstanton@chromium.org
b9f0c06ab2 The gc should be able to traverse all AllocationSites for decision making. The sites are threaded into a weak list. Special problems include:
* Allocations of AllocationSites occur in generated code, so generated code needs to be able to add to the list. For now I have a special hydrogen instruction, though it would be nice to use general purpose instructions.
* The snapshot contains AllocationSites, and these need to be re-threaded into the list on deserialization.

Something nice is that the AllocationSites are only created in old space, so a special new space visitor isn't required.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18173013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 11:50:24 +00:00
mstarzinger@chromium.org
35052bc2ea Reland deprecation of HAllocateObject in favor of HAllocate.
This essentially relands r14930 and r14935 with adaptions to the current
code base. It models the instantiation of an implicit receiver for
CallNew nodes in hydrogen using HAllocate together with generic stores
instead of one specialized HAllocateObject instruction, hence creating a
single choking point for inlined allocation in optimized code.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/19207002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-15 15:12:16 +00:00
adamk@chromium.org
625a0e9759 Add map transition for observed objects
This patch enables objects to undergo a single transition when they become observed, avoiding the need to create a new map for every observed objects.

Observed objects which become unobserved does not cause another map transition and unobserved does not clear the observed bit on the map. The unobserved object.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18221006

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-13 00:20:40 +00:00
yangguo@chromium.org
bd04a838a7 Check for scheduled exceptions after a failed-access-check callback.
R=verwaest@chromium.org
BUG=v8:2524

Review URL: https://codereview.chromium.org/18298012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15643 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-12 11:42:07 +00:00
olivf@chromium.org
bdf4fc96b0 Encapsulate compare nil ic_state.
BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18602003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-11 17:20:57 +00:00
mvstanton@chromium.org
23695eb86e Rename AllocationSite::payload to AllocationSite::transition_info
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/18749004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-08 15:00:12 +00:00
mvstanton@chromium.org
67d9051bcd Create AllocationSite objects, pointed to by AllocationSiteInfo.
This creates a platform where we can do additional things with allocation sites,
other than just aid in reducing array transitions.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/15094018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-08 10:02:16 +00:00
danno@chromium.org
345cc98a25 Generate StoreGlobal stubs with Hydrogen
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.

R=rossberg@chromium.org, ulan@chromium.org

Committed: http://code.google.com/p/v8/source/detail?r=15419

Review URL: https://codereview.chromium.org/16925008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:34:02 +00:00
dslomov@chromium.org
7e0ee5301e Add internal fields to JSArrayBufferViews (JSTypedArray and JSDataView)
In Blink, JSTypedArray and JSDataView objects act as "wrappers" for C++
objects. Wrapping protocol in Blink requires all wrapper JavaScript objects
to have a certain amount of internal fields that Blink uses for
book-keeping (essentially a pointer to C++ object and some type
information). This change adds those internal fields to JSTypedArray and
JSDataView, in a similiar way to how it is done for JSArrayBuffer.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/18695004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:12:36 +00:00
mstarzinger@chromium.org
328191d093 Handlify GlobalObject::EnsurePropertyCell method.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18348013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 09:38:29 +00:00
olivf@chromium.org
240c7aced9 Convert UnaryOpStub to a HydrogenCodeStub
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/18712002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 09:26:22 +00:00
olivf@chromium.org
950a372834 Revert "Convert UnaryOpStub to a HydrogenCodeStub"
The problem is the HCallConstantFunction which is not context sensitive, so we leak the builtin. We first need a Hydrogen version of __ IvokeBuiltin.

BUG=
R=danno@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/18650003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-03 19:57:25 +00:00
yurys@chromium.org
678c9dc940 Remove #include "cpu-profiler-inl.h" from v8.h
This significantly reduces amount of files to be recompiled after changes in cpu-profiler.h and its dependencies.

BUG=None
R=loislo@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/18522004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-03 15:39:18 +00:00
olivf@chromium.org
0d2fed8f26 Convert UnaryOpStub to a HydrogenCodeStub
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/17229005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-03 14:56:53 +00:00
mstarzinger@chromium.org
e67fb1e1fe Handlify JSObject::DefineAccessor method.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18497003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15458 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-02 16:24:23 +00:00
mstarzinger@chromium.org
6bde251534 Handlify JSObject::SetPrototype method.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18089024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-02 15:32:46 +00:00
ulan@chromium.org
74d147a25d Enable weak embedded maps in optimized code.
If the top optimized code in call stack is at the point that does not support
deoptimization, then treat the maps in the code as strong pointers.

Note that other optimized code in call stack must support deoptimization
because of the call instruction with side-effects.

BUG=217858,v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16955008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15452 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-02 15:15:58 +00:00
danno@chromium.org
77c20c30a3 Revert r15419: "Generate StoreGlobal stubs with Hydrogen"
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18357004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 15:12:21 +00:00
danno@chromium.org
a3bce19868 Generate StoreGlobal stubs with Hydrogen
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/16925008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15419 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 13:22:13 +00:00
mvstanton@chromium.org
6aed526733 The check for internalized strings relied on the fact that we had less
than 64 distinct InstanceTypes. We are hitting that boundary, so this
check needs to be more comprehensive. In fact, two bits need to be
tested: verify that kNotStringTag isn't set, and that kInternalizedTag
is set.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/17895002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-27 13:39:44 +00:00
danno@chromium.org
c35dbc30cb Generalize utilities to allow code templatization
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/17853004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15357 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-27 13:36:15 +00:00
danno@chromium.org
00709075ea Add DependentCode to PropertyCells
R=mstarzinger@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/17895004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-26 16:17:12 +00:00
mstarzinger@chromium.org
bd0deb9443 Remove obsolete unchecked accessors in JSFunction.
R=hpayer@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/17833002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-26 14:04:25 +00:00
svenpanne@chromium.org
a92d237948 Allow users of the V8 API to distinguish between unset and undefined HiddenValues
BUG=v8:2746
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/17781002

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15329 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-26 08:00:05 +00:00
loislo@chromium.org
53eb53f4af CPUProfiler: It is not clear why we are using Handle<Object> for scriptId. Lets flip it into Smi/int.
By the nature it is integer. So we can work with it as with Smi internaly and use int in the external API.

BUG=none
TEST=existing tests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/17600006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-25 14:57:47 +00:00
bmeurer@chromium.org
477f872c34 Fix GCC error about comma at end of enumerator list.
TBR=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/17612007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15316 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-25 09:34:22 +00:00
bmeurer@chromium.org
66efb96621 Fix compilation error introduced with r15287.
REGEXP was added to Code::Kind after TO_BOOLEAN_IC, but NUMBER_OF_KINDS,
which is used as array size for table[] in ReportCodeKindStatistics, was
still TO_BOOLEAN_IC + 1 (indirectly via LAST_IC_KIND).

BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/17636003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-25 09:09:25 +00:00
loislo@chromium.org
1a15f8f768 CPUProfiler: Simplify logging part of CreateCodeEvent functions.
We have 5 overloaded functions with name CreateCodeEvent.
All these functions have many common parts. I'd like to eliminate the difference between them.

TEST=existing tests
R=yangguo@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/16901014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15287 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-24 12:55:19 +00:00
dslomov@chromium.org
91eb5f8d25 DataView implementation.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/17153011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-21 13:02:38 +00:00
rossberg@chromium.org
0977c60984 Use AST's type field and merge types for unary, binary & compare ICs
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/17468003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-21 11:10:06 +00:00
mstarzinger@chromium.org
ea87d08557 Revert r14930 and r14935 temporarily.
This is a temporary revert to track down a potential perf regression
introduced in r14930. The following two changes were reverted:
- "Deprecate HAllocateObject in favor of HAllocate."
- "Added pretenuring support for call new."

R=danno@chromium.org
BUG=chromium:247504

Review URL: https://codereview.chromium.org/17491002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-20 10:48:14 +00:00
mstarzinger@chromium.org
a527f451bc Deprecate old code aging mechanism.
The old code aging mechanism is too agressive with flushing as it leads
to many functions being flushed and recompiled over and over again. By
now the new code aging mechanism has stabilized enough to deprecate the
old fallback mechanism.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/17061004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 17:00:01 +00:00
mvstanton@chromium.org
c70b41684d Use type feedback for Array (non-constructor) call sites.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/17155010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15201 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 09:25:24 +00:00
danno@chromium.org
61a23ceb4d Refactor only: Rename JSGlobaPropertyCell to PropertyCell
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/17064002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-14 16:06:12 +00:00
mstarzinger@chromium.org
fede5231bc Deprecate several unchecked accessors.
R=hpayer@google.com
BUG=v8:1490

Review URL: https://codereview.chromium.org/16663009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15123 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-13 15:00:30 +00:00
rossberg@chromium.org
94f651bc1b Migrate Compare ICs to new type rep
(Does not yet use common AST expression type field.)

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16361015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 17:20:37 +00:00
danno@chromium.org
1b89cbf817 Separate Cell and PropertyCell spaces
This makes it possible to store additional information on property cells, for example Type and optimized Code dependencies.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/16631002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 15:03:44 +00:00
mstarzinger@chromium.org
643350c5d2 Deprecate obsolete JSFunction::unchecked_shared accessor.
R=hpayer@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/16813005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 14:05:56 +00:00
hpayer@chromium.org
7ff046c3fd Implemented function that returns code age.
This may be used to display debugging information.

BUG=
R=danno@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/16509005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 12:39:15 +00:00
yangguo@chromium.org
74556569d1 Reland "Enable map dependency to in-flight compilation info."
BUG=248076
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16782004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 09:43:22 +00:00
yangguo@chromium.org
6da97b1d4a Revert "Enable map dependency to in-flight compilation info."
This includes r15032, r15030 and r15005.

R=ulan@chromium.org
BUG=248076

Review URL: https://chromiumcodereview.appspot.com/16482004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:55:56 +00:00
yangguo@chromium.org
5cf0cba71a Fix compilation with gdbjit=on.
r14919 forgot three AssertNoAllocation -> DisallowHeapAllocation replacements.

BUG=v8:2719
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16093041

Patch from Kang-Hao (Kenny) Lu <kennyluck@csail.mit.edu>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-10 16:31:55 +00:00
wingo@igalia.com
f88bca9576 Generator object "next" method takes optional send value
Update the generators implementation to make "next" also do the job of
what was previously called "send" by taking an optional argument.
Remove send, and do a bunch of renamings.

R=rossberg@chromium.org
BUG=v8:2355, v8:2715

Review URL: https://codereview.chromium.org/16136011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15028 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-10 09:26:18 +00:00
dslomov@chromium.org
cbb11dbe6c Neutering API for v8::ArrayBuffer
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/16562005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 15:02:20 +00:00
yangguo@chromium.org
17cfe68015 Enable map dependency to in-flight compilation info.
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/16542003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 13:27:03 +00:00
dslomov@chromium.org
b3282c290e Recording array buffer views.
R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15562008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 10:52:11 +00:00
rossberg@chromium.org
372457a793 Allow smis for singleton types
To that end, introduce a generic Box struct.

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16562003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-06 15:40:28 +00:00
verwaest@chromium.org
16199c63d8 Initialized representations of computed values to None.
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14721009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14982 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-06 14:21:35 +00:00
rossberg@chromium.org
919d64adce Add type field to AST expression nodes
More importantly, do a bunch of renamings of incidental existing "types" to avoid actual and potential name clashes (and also to improve consistency).

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16549002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-06 13:28:22 +00:00
verwaest@chromium.org
5e8679beea Remove the optimized construct stub.
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15993016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-05 08:43:25 +00:00
mstarzinger@chromium.org
d7975dfdab Deprecate HAllocateObject in favor of HAllocate.
This models the instantiation of an implicit receiver for CallNew nodes
in hydrogen using HAllocate together with generic stores instead of one
specialized HAllocateObject instruction, hence creating a single choking
point for inlined allocation in optimized code.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/15714005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-04 08:28:33 +00:00
svenpanne@chromium.org
b9e025a8dc Collect type feedback for power-of-2 right operands in BinaryOps.
Improved --trace-ic output for unary/binary ops a bit on the way. Moved int32_t/uint32_t conversion helpers around.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/15735005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14928 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-04 07:49:45 +00:00
yangguo@chromium.org
7f8a3d803c Make assertion scopes thread safe.
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/15691017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-03 15:32:22 +00:00
olivf@chromium.org
88755fb22a Convert ToBooleanStub to a HydrogenStub. Currently just using the existing HBranch instruction, which is still fully implemented in Lithium. Will refactor HBranch in a next CL.
[
CL breaks mips, since the deoptimizer in Deoptimizer::DoTranslateCommand(...) does not convert smis passed to the stub via a0.
]

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15302004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-29 14:49:28 +00:00
verwaest@chromium.org
af4516847a Don't use fast literal if the boilerplate map is still deprecated.
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15660005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 11:30:24 +00:00
dslomov@chromium.org
fc73052dc2 Externalization API for ArrayBuffer
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15001041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 10:01:42 +00:00
verwaest@chromium.org
06b7bf60e1 Always require exact maps.
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/13923003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 09:19:18 +00:00
verwaest@chromium.org
36e91242fd Make Object.freeze fast
This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

Relanding r14758 and r14759 with fix for Test262: only mark properties
and elements READ_ONLY if they are not JS setter/getters. Tightened up
tests to assert frozen-ness, and added targeted tests for the new code
(covering accessors).

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15691007

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 07:05:58 +00:00
adamk@chromium.org
4d48bb832f Revert "Make Object.freeze fast"
and "Fix Object.freeze on dictionary-backed arrays to properly freeze elements"

This reverts r14758 and r14759 due to introducing failures in Test262

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 21:27:00 +00:00
adamk@chromium.org
648e99e308 Make Object.freeze fast
This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/14888005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 18:53:58 +00:00
mstarzinger@chromium.org
d259e1cebd Fix corner case in optimized code map zapping.
R=jkummerow@chromium.org
TEST=mjsunit/math-floor-part2

Review URL: https://codereview.chromium.org/15743005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 15:29:02 +00:00
verwaest@chromium.org
8db3014974 Keep representations while overwriting transitions.
BUG=chromium:241477
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15718002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14745 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 10:46:33 +00:00
verwaest@chromium.org
9f32d94cb3 Don't create new maps in CurrentMapForDeprecated.
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15358005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-21 11:20:24 +00:00
olivf@chromium.org
c3dde4bd9d Encapsulating Type information in the CompareICStub
Encapsulate type information in a convenient wrapper instead of storing it in a naked bitfield. This especially facilitates transitioning to a new state and converting from/to the extraICState representation. Additionally cleaning up ToBooleanICStub::Types for consistency.

BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/14862009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-16 10:59:17 +00:00
mstarzinger@chromium.org
365b2eb91e Preserve optimized code map during GCs weakly.
This change preserves the contents of optimized code maps during GCs but
treats the references in this cache weakly. It uses infrastructure from
code flushing to maintain a list of all caches.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/14794007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-15 16:09:25 +00:00
svenpanne@chromium.org
483a2958fa Fixed linkage for Is template.
With static linkage, clang 3.3 is unhappy about unused functions

   template <> inline bool Is<JSFunction>(Object* obj)
   template <> inline bool Is<JSArray>(Object* obj)

in any compilation unit apart from acessors.cc.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/14836014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-14 11:02:20 +00:00
danno@chromium.org
ddd72aa14f Only flush SharedFunctionInfo optimized code cache when necessary
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/14604007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 19:22:18 +00:00
danno@chromium.org
cf1b80703f Improve trace_opt output to help find compilation problems
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/14978003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14636 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 11:10:31 +00:00
mstarzinger@chromium.org
883d9c4b1c Prevent flushing of code that was set with %SetCode.
This makes sure that shared function infos that break the one-to-one
mapping to code are marked as un-flushable. Otherwise enqueuing through
the GC meta-data field in the code object doesn't work.

R=rossberg@chromium.org
TEST=cctest/test-api/Threading4

Review URL: https://codereview.chromium.org/14710015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 10:59:00 +00:00
danno@chromium.org
05e8e0e7b4 Elide hole checks on KeyedLoads of holey double arrays
Improves NavierStokes by about 5%

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/15014020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14630 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 07:35:26 +00:00
verwaest@chromium.org
df57747fc4 Track heap objects.
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14996004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14625 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-10 17:17:50 +00:00
verwaest@chromium.org
52008429b7 Use mutable heapnumbers to store doubles in fields.
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14850006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 15:02:08 +00:00
wingo@igalia.com
75d939aceb Generators save and restore stack handlers
This CL adds machinery to unwind stack handlers from the stack and store
them into a generator's operand array.  It also includes routines to
reinstate them.  Together this allows generators to yield within
try/catch and try/finally blocks.

BUG=v8:2355
R=mstarzinger@chromium.org
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14031028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 08:08:23 +00:00
dslomov@chromium.org
b15bbfbe39 Implement TypedArray.set function.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/14581005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-07 14:42:17 +00:00
wingo@igalia.com
3cd73ebc2f Generators return boxed values
Generators now box their return values in object literals of the form

  { value: VAL, done: DONE }

where DONE is false for yield expressions, and true for return
statements.

BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/13870007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14563 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-07 08:46:42 +00:00
verwaest@chromium.org
84fd96e4d1 Cleanup IC heuristics.
Review URL: https://chromiumcodereview.appspot.com/14611006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-02 15:42:22 +00:00
verwaest@chromium.org
063ada2050 Adding fast path for generalizing maps.
Review URL: https://chromiumcodereview.appspot.com/14629005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-02 15:41:02 +00:00
verwaest@chromium.org
fd9c82a618 Update deprecated maps before generating optimized code.
Review URL: https://chromiumcodereview.appspot.com/14847008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-02 15:40:07 +00:00
dslomov@chromium.org
3fd6bb51f0 First cut at API for native Typed Arrays.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/14195034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-29 11:09:03 +00:00
verwaest@chromium.org
99e17bb12a Track storage types of instance variables.
Review URL: https://chromiumcodereview.appspot.com/14146005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-26 15:30:41 +00:00
dcarney@chromium.org
c50304209a remove IsOneByteConvertible
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14298021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-26 14:08:18 +00:00
dcarney@chromium.org
0a32b57594 HasOnlyAsciiChars can return incorrect results. Fixup usages and rename.
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14509012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-26 11:34:44 +00:00
mvstanton@chromium.org
c247ac4e51 Bootstrapper code for constructed arrays needs to be handlefied
BUG=

Review URL: https://codereview.chromium.org/14008004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14451 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-26 10:10:36 +00:00
mstarzinger@chromium.org
bb2d8a51da Implement support for Math.imul in Crankshaft.
R=jkummerow@chromium.org
TEST=mjsunit/math-imul

Review URL: https://codereview.chromium.org/14471041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14450 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-26 08:52:35 +00:00
mvstanton@chromium.org
e751ad06d9 Constructed arrays can be created with Hydrogen code stubs. The feature is still off by default (--optimize-constructed-arrays).
BUG=

Review URL: https://codereview.chromium.org/12385014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-25 16:00:32 +00:00
mstarzinger@chromium.org
71dc9e165f Capture receiver in generator object
Previously there has been no reason to context-allocate the receiver, so
access to the receiver always goes through the stack.  This was failing
with generators, which assumed that forcing context allocation would
relieve the need of storing anything but the context and the function on
the stack.

This CL adds a slot in generator objects to capture the receiver, and
restores it when resuming a generator.

BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14158006

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-25 10:59:09 +00:00
mstarzinger@chromium.org
23f39546b9 Generators can resume
The generator object methods "next", "send", and "throw" now
include some inline assembly to set up a resumed stack frame.  In some
common cases, we can just jump back into the frame to resume it.
Otherwise the resume code calls out to a runtime to fill in the operand
stack, rewind the handlers, and possibly to throw an exception.

BUG=v8:2355
TESTS=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14066016

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14415 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-24 13:00:16 +00:00
danno@chromium.org
f8ddf3a262 Add monomorphic CompareNilICs and Crankshaft support
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/14367018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-24 11:32:17 +00:00
dslomov@chromium.org
852f90339a Adds EXTERNAL_DOUBLE_ARRAY to a list of instance types
BUG=v8:2646

Patch by Andrei Kashcha <anvaka@gmail.com>

Review URL: https://codereview.chromium.org/14042008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 17:02:09 +00:00
rossberg@chromium.org
3cd9f6a40e Add d8 functionality for switching between realms (a.k.a. contexts), 2nd try
The only difference to the previous implementation (https://codereview.chromium.org/14295011/) is in patch set 2.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14404005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14373 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-22 11:29:52 +00:00
mstarzinger@chromium.org
0f348e5592 Generator objects can suspend
* src/ast.h:
* src/parser.cc: Differentiate between the different kinds of yields, in
  anticipation of boxing return values.  Parse `return' into `yield' in
  a generator.

* src/runtime.h:
* src/runtime.cc (Runtime_SuspendJSGeneratorObject): New horrible
  runtime function: saves continuation, context, and operands into the
  generator object.

* src/arm/full-codegen-arm.cc (VisitYield):
* src/ia32/full-codegen-ia32.cc (VisitYield):
* src/x64/full-codegen-x64.cc (VisitYield): Arrange to call
  SuspendJSGeneratorObject.  If the call returns the hole, we suspend.
  Otherwise we resume.

BUG=v8:2355
TEST=These codepaths are tested when the generator is first invoked, and so
are covered by mjsunit/harmony/generators-objects.js.

Review URL: https://codereview.chromium.org/13704010

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-19 14:11:23 +00:00
ulan@chromium.org
1938b1de3b Handle retry-after-gc failures within LoadIC::Load and StoreIC::Store.
Follow-up for r14321, makes the remaining unsafe calls to runtime functions during ic computation safe.

R=verwaest@chromium.org
BUG=222301

Review URL: https://chromiumcodereview.appspot.com/13976015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-19 08:30:49 +00:00
yangguo@chromium.org
72a05845ec Revert r14310 due to isolate tests failure.
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/14021004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-18 14:41:24 +00:00
danno@chromium.org
244fa50a80 Make it possible to Crankshaft all kinds of stubs.
Review URL: https://codereview.chromium.org/14307006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-18 09:50:46 +00:00
rossberg@chromium.org
2458a801f7 Add d8 functionality for switching between realms (a.k.a. contexts)
R=mstarzinger@chromium.org,yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14295011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-17 15:07:31 +00:00
dslomov@chromium.org
c1a19275d3 First cut at impementing ES6 TypedArrays in V8.
BUG=

Review URL: https://codereview.chromium.org/13975012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-16 14:16:30 +00:00
mstarzinger@chromium.org
591a8ec86c Calling a generator function returns a generator object
* src/heap.h:
* src/heap.cc:
* src/objects-debug.cc:
* src/objects-inl.h:
* src/objects-printer.cc:
* src/objects-visiting.cc:
* src/objects.cc:
* src/objects.h: Define a new object type, JSGeneratorObject.

* src/factory.h:
* src/factory.cc (NewFunctionFromSharedFunctionInfo): Generator function
  inital maps construct the new JS_GENERATOR_OBJECT_TYPE objects, not
  generic JSObjects.

* src/runtime.h:
* src/runtime.cc (Runtime_CreateJSGeneratorObject):
* src/arm/full-codegen-arm.cc (Generate):
* src/ia32/full-codegen-ia32.cc (Generate):
* src/x64/full-codegen-x64.cc (Generate): Before visiting generator
  bodies, arrange to construct and return a generator object.

* test/mjsunit/harmony/generators-objects.js: Add tests for the
  properties and prototype of generator objects.

BUG=v8:2355
TEST=mjsunit/harmony/generators-objects

Review URL: https://codereview.chromium.org/13542002

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-15 12:29:44 +00:00
yangguo@chromium.org
996a80df45 Fix OSR for nested loops.
R=jkummerow@chromium.org
BUG=v8:2618

Review URL: https://chromiumcodereview.appspot.com/13811014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-10 09:24:31 +00:00
verwaest@chromium.org
64f34cb761 Eagerly parse expected transitions in JSON.
Review URL: https://chromiumcodereview.appspot.com/13741010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 16:49:28 +00:00
mvstanton@chromium.org
b7022fd2be Improvements for x87 stack handling
BUG=

Review URL: https://codereview.chromium.org/13426006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 08:42:57 +00:00
adamk@chromium.org
759f4b37ce Remove code duplication in JSObject::HasRealElementProperty
Review URL: https://codereview.chromium.org/13540003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 19:12:59 +00:00
ulan@chromium.org
eee5884f8d Add extra flag for load-ic stubs in code cache.
This allows to distinguish between stubs compiled for the current object from
stubs compiled for objects that have the current object as a prototype.

BUG=v8:2593
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/13552003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 08:29:25 +00:00
hpayer@chromium.org
2545774232 Move DeepCopy of JSObject from runtime to object.
BUG=

Review URL: https://codereview.chromium.org/13527005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14121 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-03 11:42:03 +00:00
mstarzinger@chromium.org
2816f19680 Add parser support for generators.
This patchset begins by adding support for "yield", which is unlike other tokens
in JS. In a generator, whether strict or classic, it is a syntactic keyword.
In classic mode it is an identifier. In strict mode it is reserved.

This patch adds YIELD as a token to the scanner, and adapts the preparser and
parser appropriately. It also parses "function*", indicating that a function is
actually a generator, for both eagerly and lazily parsed functions.

Currently "yield" just compiles as "return".

BUG=v8:2355
TEST=mjsunit/harmony/generators-parsing

Review URL: https://codereview.chromium.org/12646003
Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-02 17:34:59 +00:00
dslomov@chromium.org
944c577c7b First steps towards implementing ArrayBuffer &co in V8
BUG=

Review URL: https://codereview.chromium.org/13064003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 12:50:18 +00:00
yangguo@chromium.org
bdc903b086 Improve SeqString::Truncate for latest allocated strings.
R=hpayer@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12440061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14088 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 11:19:38 +00:00
rossberg@chromium.org
52aec4722d ES6 symbols: prevent reflection, proxy, and observe APIs from leaking symbols
R=svenpanne@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12422019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 17:27:44 +00:00
rossberg@chromium.org
2657e432e4 ES6 symbols: implement name property
Adds string-valued name property to symbols, and uses it for pretty-printing.

Requires allocating symbols in pointer space, with a custom iterator to skip the unboxed hash.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12459026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 16:51:28 +00:00
rossberg@chromium.org
83d4a41dec ES6 symbols: turn symbols into a proper primitive type
(qua last week's TC39)

Specifically:
- Install Symbol constructor function on the global object.
- Adjust code generation for typeof.
- Remove IsSymbol built-in, IS_SYMBOL macro now defined using typeof.
- Remove hack that allowed symbols as constructor results, and some other special cases.
- Remove symbol_delegate and GetDelegate function.
- Extend ToBoolean stub to handle symbols.
- Extend ToNumber to return NaN on symbols.
- Poison symbol's toString function, and thereby ToString on symbols.

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12957004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 16:33:50 +00:00
verwaest@chromium.org
002ba9c76d Turn Flags into a uint32_t typedef.
We cannot rely on C++ compilers inferring the int-type from the enum
value range. Whereas Linux/OSX find uint32_t as type for [0,MaxUInt32],
Windows insists it's int.

Update the test to execute its original intent on all platforms: 1 value
larger than max arguments, 1 smaller than max arguments (on all
platforms). This makes the test run a lot faster.

BUG=chromium:194749

Review URL: https://chromiumcodereview.appspot.com/12507010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-19 13:11:49 +00:00
svenpanne@chromium.org
e4e4447305 Pass Isolates explicitly in Deoptimizer-related code.
Removed a few ancient useless ASSERTs on the way. Reduced the number of train wrecks.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12917002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 13:57:49 +00:00
verwaest@chromium.org
37a2e32496 Unify kMaxArguments with number of bits used to encode it.
Increase the number of bits by 1 by making Flags unsigned.

BUG=chromium:211741

Review URL: https://chromiumcodereview.appspot.com/12886008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 13:35:17 +00:00
dcarney@chromium.org
fbe34d4ba5 remove latin-1 flag
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12700008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-13 20:04:50 +00:00
yangguo@chromium.org
479e39a058 Parallel recompilation: remove interrupt for code generation.
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12488006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-12 18:03:18 +00:00
svenpanne@chromium.org
1a2454d752 Consistently pass a Heap* to HashTable-related AsObject methods.
This is basically a follow-up CL to https://code.google.com/p/v8/source/detail?r=13908.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12546024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-12 10:05:42 +00:00
svenpanne@chromium.org
e02315ef77 Added an Isolate parameter to some HashTable/Dictionary methods. TypeFeedbackOracle tweaks.
BUG=v8:2487

Review URL: https://codereview.chromium.org/12764003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-12 07:06:36 +00:00
yangguo@chromium.org
5afa1a0d3a Avoid bool to Oddball conversions by being lazy.
R=svenpanne@chromium.org
BUG=v8:2491

Review URL: https://chromiumcodereview.appspot.com/12459011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 16:22:19 +00:00
dcarney@chromium.org
25058ddd85 Runtime version of declarative native accessors.
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12297012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 11:42:58 +00:00
danno@chromium.org
bbc599f334 Unify grow mode and stub kind
In the process, ensure that transition-causing element stores handle all cases of the transitioned receiver map.

Review URL: https://codereview.chromium.org/12390031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-06 21:51:07 +00:00
dcarney@chromium.org
07e2494735 Added back some utf8 optimizations
R=yangguo@chromium.org
BUG=https://code.google.com/p/v8/issues/detail?id=2551

Review URL: https://codereview.chromium.org/12390057

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-06 15:39:57 +00:00
verwaest@chromium.org
34697f5b12 Make IC patching resilient to flushing of the original target() ic.
Review URL: https://chromiumcodereview.appspot.com/12451003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-05 17:38:35 +00:00
mstarzinger@chromium.org
0ca02ee48d Make sure builtin functions don't rely on __proto__.
This makes sure that none of the builtin functions rely on the __proto__
accessor which can now be monkey-patched by applications. Instead use a
separate %SetPrototype() intrinsic or object literals to do the job.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/12385082

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 16:05:12 +00:00
rossberg@chromium.org
5c93b18eb2 ES6 symbols: Allow symbols as property names
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).

Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.

(Baseline CL: https://codereview.chromium.org/12296026/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12330012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 15:00:57 +00:00
verwaest@chromium.org
590a3f8811 Polymorphism support for load IC.
Review URL: https://chromiumcodereview.appspot.com/12340112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 14:03:27 +00:00
mvstanton@chromium.org
c4caf766bf Allocation Info Tracking, continued.
Addresses missing cases for array literals.
Adds support for "new Array()" call sites. This isn't complete yet, I have to run with --noinline_new.

BUG=

Review URL: https://codereview.chromium.org/11818021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 16:06:34 +00:00
rossberg@chromium.org
090d09d685 ES6 symbols: Implement Symbol intrinsic and basic functionality
- Add --harmony-symbols flag.
- Add Symbol constructor; allow symbols as (unreplaced) return value from constructors.
- Introduce %CreateSymbol and %_IsSymbol natives and respective instructions.
- Extend 'typeof' code generation to handle symbols.
- Extend CompareIC with a UNIQUE_NAMES state that (uniformly) handles internalized strings and symbols.
- Property lookup delegates to SymbolDelegate object for symbols, which only carries the toString method.
- Extend Object.prototype.toString to recognise symbols.

Per the current draft spec, symbols are actually pseudo objects that are frozen with a null prototype and only one property (toString). For simplicity, we do not treat them as proper objects for now, although typeof will return "object". Only property access works as if they were (frozen) objects (via the internal delegate object).

(Baseline CL: https://codereview.chromium.org/12223071/)

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12296026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 13:28:55 +00:00
rossberg@chromium.org
764e1a0fcf ES6 symbols: Introduce Symbol class, along with abstract Name class
The new instance type 'Symbol' represents ES6 symbols (a.k.a. private/unique names). Currently, symbols are simple data objects that only carry a hash code, random-generated upon allocation.

The new type 'Name' now serves as the common super class for strings and symbols, and is supposed to represent property names. We will eventually migrate APIs from String to Name for the standard key type.

Strings and symbols share the same hash field representation, via the Name class. This way, we should be able to use the same code paths for symbols and internalized strings in most cases. Also, Symbol's instance type code is allocated adjacent to internalized string codes in the enum, allowing a simple range check for the common case.

Baseline CL: https://codereview.chromium.org/12210083/

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12223071

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 10:34:31 +00:00
rossberg@chromium.org
55f93b5532 Renamed "symbols" to "internalized strings" throughout the code base,
in preparation of the introduction of ES6 'symbols' (aka private/unique names).

The SymbolTable became the StringTable. I also made sure to adapt all comments. The only remaining use of the term "symbol" (other than unrelated uses in the parser and such) is now 'NewSymbol' in the API and the 'V8.KeyedLoadGenericSymbol' counter, changing which might break embedders.

The one functional change in this CL is that I removed the former 'empty_string' constant, since it is redundant given the 'empty_symbol' constant that we also had (and both were used inconsistently).

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12210083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-28 17:03:34 +00:00
verwaest@chromium.org
5a543d683a Order arguments of ComputeMonomorphicFlags to match ComputeFlags.
Review URL: https://chromiumcodereview.appspot.com/12226090

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 15:33:37 +00:00
svenpanne@chromium.org
bfaf38d2fd Miscellaneous profile-driven Isolate plumbing.
While doing this, it became clear that quite a few functions should not be
static and should better live in various classes as instance methods, but I'll
leave this for a later CL.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12314152

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:45:59 +00:00
svenpanne@chromium.org
c26d100b10 Avoid TLS accesses in Object::Lookup and Object::GetPrototype.
Both methods were among the top causes for TLS accesses.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12319144

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 13:22:29 +00:00
yangguo@chromium.org
72b802f27a Refactor RegExpStub to check lazily.
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12210143

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 09:53:07 +00:00
ulan@chromium.org
cb5c8554c0 Debugger: ScopeMirror has N^2 algorithm when building closure mirrors. (take 2).
Review URL: https://chromiumcodereview.appspot.com/12326103
Patch from Pavel Feldman <pfeldman@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13724 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-25 16:46:54 +00:00
ulan@chromium.org
82a7ce63dc Revert r13699 "Debugger: ScopeMirror has N^2 algorithm when building closure mirrors." because of WebKit crashes.
BUG=v8:2554
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12321108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-25 11:56:37 +00:00
yangguo@chromium.org
b62de7c04e Debugger: ScopeMirror has N^2 algorithm when building closure mirrors.
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12326009
Patch from Pavel Feldman <pfeldman@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-20 14:12:31 +00:00