Commit Graph

402 Commits

Author SHA1 Message Date
mstarzinger@chromium.org
82cde7c832 Remove write-barriers for stores to new-space objects.
This change allows hydrogen instructions to keep track of instructions
that dominate certain side-effects (GVN flags) in the hydrogen graph. We
use the GVN pass to keep track of side-effects because accurate flags
are already in place.

It also adds a new side-effect (kChangesNewSpacePromotion) indicating
whether an instruction can cause a GC and have objects be promoted to
old-space. An object allocated in new-space is sure to stay on paths not
having said side-effect.

R=erik.corry@gmail.com
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/10031031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-11 10:56:16 +00:00
vegorov@chromium.org
e831ec2c4e Bailout on possible direct eval calls.
Environment structure for such calls is different from normal global calls.

R=fschneider@chromium.org
BUG=chromium:122681

Review URL: https://chromiumcodereview.appspot.com/10024060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-10 13:41:00 +00:00
mstarzinger@chromium.org
78226352b7 Ensure HAllocateObject always allocates in new-space.
This is needed so that we can start removing write-barriers in optimized
code if we can prove that the receiver object is always in new-space.

TEST=cctest/test-heap/OptimizedAllocationAlwaysInNewSpace

Review URL: https://chromiumcodereview.appspot.com/10008007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 15:36:31 +00:00
ulan@chromium.org
3861063018 Check for NaN in inlined versions of Math.min, Math.max.
R=danno@chromium.org
BUG=V8:2056
TEST=mjsunit/regress/regress-2056.js

Review URL: https://chromiumcodereview.appspot.com/10006008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-05 13:24:52 +00:00
vegorov@chromium.org
8360ec877e Ensure that arguments object is materialized when deoptimizing from inlined function.
Lithium translation rebuilds hydrogen environments from scratch so we have to ensure that arguments object is correctly bound on function entry otherwise deoptimization will not materialize it.

This fix was implemented as part of r11109 and then reverted.

R=danno@chromium.org
BUG=v8:2045
TEST=test/mjsunit/regress/regress-2045.js

Review URL: https://chromiumcodereview.appspot.com/9963008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-30 13:22:39 +00:00
mstarzinger@chromium.org
057371da13 Fix polymorphic load on named fields.
This fixes polymorphic loads to correctly compare in-object offsets
instead of indices, because indices might coincide even though the
actual slot is different because of different instance sizes.

R=danno@chromium.org
BUG=v8:2030
TEST=mjsunit/regress/regress-2030,mjsunit/mirror-array

Review URL: https://chromiumcodereview.appspot.com/9864028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-27 10:42:38 +00:00
mstarzinger@chromium.org
ab4e4cd917 Improve polymorphic loads on single slots.
If all property lookups for a polymorphic load actually result in the
same field index under all maps, we can actually emit a monomorphic load
that is guarded by a map check that verifies that the actual map is in
the set of handled maps. This also allows GVN to get rid of redundant
such map checks.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9616014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-23 16:37:54 +00:00
vegorov@chromium.org
3ccc885c78 Revert arguments access support for inlined functions (r11109,r11118).
We are inserting HPushArgument instructions after HEnterInlined based on the environment at the point of the first arguments access. Which might create use before def if there are redundant phis in the environment. 
Review URL: https://chromiumcodereview.appspot.com/9837041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-23 15:39:34 +00:00
mmassi@chromium.org
c39c2089a7 First implementation of fast path for instantiation of array literals composed of doubles.
Review URL: https://chromiumcodereview.appspot.com/9814006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11114 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-23 10:14:51 +00:00
vegorov@chromium.org
b7dca5d5a7 Support arguments object access from inlined functions.
R=fschneider@chromium.org
TEST=test/mjsunit/compiler/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9837002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-22 13:53:28 +00:00
fschneider@chromium.org
30a2f2c4ef When running with --always-opt, don't deoptimize named loads with uninitialized type feedback.
This avoids tests taking too long because of repeated deoptimizations.
Review URL: https://chromiumcodereview.appspot.com/9812004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11100 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-21 09:23:09 +00:00
vegorov@chromium.org
790219ec55 Use correct arguments adaptation environment when inlining function containing arguments.
R=mstarzinger@google.com
BUG=V8:2014
TEST=test/mjsunit/compile/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9750007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-20 18:15:31 +00:00
fschneider@chromium.org
e081a3bfba Insert explicit deoptimization for named loads that have "uninitialized" type feedback.
We already do this for binary-ops, unary-ops and comparisons. Typefeedback for named loads can now also
be in "uninitialized" state which means that the corresponding load IC was never executed.
Review URL: https://chromiumcodereview.appspot.com/9722041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-19 15:54:37 +00:00
fschneider@chromium.org
1c99c90be7 Re-enable constructor inlining and inline === comparison with boolean constants.
This change reverts r10974 which disabled those two optimizations.
They were not responsible for the problem in earley-boyer.

BUG=v8:2009
Review URL: https://chromiumcodereview.appspot.com/9699117

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-19 07:51:37 +00:00
vegorov@chromium.org
211a867943 Improve representation inference for HUnknownOSRValue.
Use corresponding phi from the loop entry as a hint to infer proper representation for HUnkownOSRValue and dependent phis.

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9704012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-15 12:21:29 +00:00
mstarzinger@chromium.org
fe1440f339 Remove unused local variable after r11023.
R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9699023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 14:08:36 +00:00
vegorov@chromium.org
966ebf8f55 Don't take UnkownOSRValues into account when infering Phi's representation.
For DIV with uninitialized result assume double result representation.

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9664070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11041 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-14 12:59:49 +00:00
vegorov@chromium.org
262c8bddd5 Always create HArgumentsObject on function entry.
We do not know if we are going to need it and creating it lazyly might cause us to insert it at the block that does not dominate all uses.

R=mstarzinger@chromium.org
TEST=mjsunit/compiler/inline-arguments.js

Review URL: https://chromiumcodereview.appspot.com/9692046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-13 14:45:03 +00:00
mstarzinger@chromium.org
0ab3fb8b00 Implement non-generic stores for object literals.
This uses the type feedback already present for computed value stores
into object literals to generate optimized stores in Crankshaft, thus
avoiding unnecessary generic stores with side effects.

R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9692036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-13 12:11:46 +00:00
vegorov@chromium.org
da03f56b1f Inline functions that use arguments object in f.apply(o, arguments) pattern.
Support arguments materialization after deoptimization in all frames (not only in topmost one).

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9643001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-12 12:49:41 +00:00
ulan@chromium.org
1767fef60b Implement date library functions in C++.
Developed together with Andreas Rossberg based on:
  https://chromiumcodereview.appspot.com/9117034/
  https://chromiumcodereview.appspot.com/9307083/

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9572008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10983 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-09 12:07:29 +00:00
rossberg@chromium.org
8604da7f06 New class for Date objects: caches individual date components.
First step, cache slots not used yet.

R=ulan@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9117034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-09 11:11:55 +00:00
ulan@chromium.org
e6576f0938 Revert r10435 and r10923 because of failures.
r10435 CL: http://codereview.chromium.org/9195005
r10923 CL: https://chromiumcodereview.appspot.com/9601010

R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9653025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-09 09:04:39 +00:00
fschneider@chromium.org
886a1c6469 Avoid starting a new basic block when inlining a function.
Instead of creating a fresh basic block for the inlined body,
I just simulate the outer environment in the middle of the current
block before updating the current environment to the inlined environment and
emitting the enter-inlined instruction.
Review URL: https://chromiumcodereview.appspot.com/9618052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10954 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-07 12:04:28 +00:00
mstarzinger@chromium.org
30305150fe Blocks that contain soft deopts have no side effects.
R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9188005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-06 10:57:54 +00:00
fschneider@chromium.org
dfe0101cad Fix column formatting of --hydrogen-stats output by shortening a line.
TBR=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9578013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-05 13:07:32 +00:00
mstarzinger@chromium.org
240e818f0c Fix inlining of strict mode constructors.
Inlined strict mode functions (that are not called as methods) will get
their receiver reset to undefined. This should not happen when inlining
constructors.

This change also simplifies the test suite to reuse the same closures
into which constructors get inlined and use gc() to force V8 to forget
collected type feedback.

R=vegorov@chromium.org
TEST=mjsunit/compiler/inline-construct

Review URL: https://chromiumcodereview.appspot.com/9597017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-05 12:46:50 +00:00
yangguo@chromium.org
5ce562cda8 Reland r10908 (Ensure consistent result of transcendental function0.)
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9583037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-05 08:17:16 +00:00
yangguo@chromium.org
f2699b66cf Revert r10908 due to flakiness and crashes.
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9580007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 15:00:52 +00:00
yangguo@chromium.org
12f2099993 Ensure consistent result of transcendental functions.
BUG=
TEST=regress-transcendental.js

Review URL: https://chromiumcodereview.appspot.com/9572009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 14:33:15 +00:00
fschneider@chromium.org
751d53d9d2 Make trace-hydrogen output more visualizer-friendly.
Review URL: https://chromiumcodereview.appspot.com/9580005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10904 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 13:05:59 +00:00
vegorov@chromium.org
ff6ebf7dff Introduce basic type feedback for for-in statements to avoid deopts.
R=fschneider@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9571001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-02 11:33:33 +00:00
fschneider@chromium.org
1e40f7ac2c Fix a register assignment bug in typed array stores without SSE3 available.
The old code used a separate HToInt32 instruction which had a wrong register
constraint for the input register which caused wrong result when the stored value
is used after a typed array store. (UseRegister instead of UseTempRegister) when no
SSE3 is available.

This change fixes it by replacing HToInt32 with the corresponding HChange
instruction which has correct register contraints.

TEST=mjsunit/compiler/regress-toint32.js
Review URL: https://chromiumcodereview.appspot.com/9565007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-01 12:45:46 +00:00
mstarzinger@chromium.org
4eaaced657 Improve constructor inlining backout.
This improves the generated hydrogen graph by also removing the obsolete
HCheckFunction instruction if we backout of inlining constructors.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9537004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-01 11:50:11 +00:00
fschneider@chromium.org
a8980079a0 Add flag --trace-phase to selectively produce IR trace output.
By default --trace-hydrogen only generates the final IR (before
code generation). The other phases can be printed by specifying
them by their first letter. Currently H=HIR, L=LIR or Z=final IR (default)
are recognized.
Review URL: https://chromiumcodereview.appspot.com/9535009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-01 11:33:37 +00:00
mstarzinger@chromium.org
fd5640cf7a Implement inlined object allocation in Crankshaft.
Generates inlined code for object allocation specific to the initial map
of the given constructor function. Also forces completion of inobject
slack tracking while crankshafting to finalize instance size of these
objects.

R=vegorov@chromium.org
TEST=mjsunit/compiler/alloc-object

Review URL: https://chromiumcodereview.appspot.com/9370019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-03-01 11:10:28 +00:00
fschneider@chromium.org
b854d09721 Eliminate overflow check after integer add and sub operation if result is truncated to int32.
Review URL: https://chromiumcodereview.appspot.com/9286002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10870 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-29 13:41:18 +00:00
rossberg@chromium.org
b89c0a962c AST extensions and parsing for import & export declarations.
R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9496003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-29 12:12:52 +00:00
svenpanne@chromium.org
f9cdb0e18c Explicitly use a Zone when allocating Range.
This CL is a step towards removing ZoneObject's new operator without a Zone
parameter, which uses Isolate::Current. For e.g. the bulletben benchmark, this
CL reduces the number of calls to this new operator by roughly 120k, but we are
still left with 780k calls from other sites...

Review URL: https://chromiumcodereview.appspot.com/9487010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-28 15:32:58 +00:00
rossberg@chromium.org
d809d17f5d Further refactoring of declarations in the AST:
Define modules as module declarations.
Separate function declarations from var declarations.

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9460064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-28 10:12:39 +00:00
mstarzinger@chromium.org
fb8eb04bfd Implement inlining of constructor calls.
R=vegorov@chromium.org,kmillikin@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9304001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-28 09:05:55 +00:00
vegorov@chromium.org
9b55ebaa3a When compiling for-in pass correct context value to the increment instruction.
Additionally force increment instruction to use int32 representation.

R=fschneider@google.com
BUG=http://crbug.com/115646
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9463052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-27 14:37:27 +00:00
vegorov@chromium.org
53622335e3 Disable for-in support in Crankshaft while crashes and regressions are being investigated.
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9463049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-27 10:43:57 +00:00
yangguo@chromium.org
7a98cb62c3 Speed up removing phi nodes.
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9452022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-24 08:46:10 +00:00
vegorov@chromium.org
5bb6a8399d Support OSR in for-in loops.
Modify PreProcessOsrEntry to work with OSR entries that have non-empty expression stack.

Modify graph builder to take for-in state from environment instead of directly referencing emitted instructions.

Extend %OptimizeFunctionOnNextCall with an argument to force OSR to make writing OSR tests easier: %OptimizeFunctionOnNextCall(f, "osr").

R=fschneider@chromium.org
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9431030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-22 16:45:35 +00:00
vegorov@chromium.org
6703dddac4 Support fast case for-in in Crankshaft.
Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.

HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).

New hydrogen instructions:

- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;

Changed hydrogen instructions:

- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9425045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-22 12:47:42 +00:00
fschneider@chromium.org
7de6be06cf Eliminate use of ZONE macro in BitVector class and pass a zone explicitly.
Review URL: https://chromiumcodereview.appspot.com/9416092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-22 11:40:28 +00:00
fschneider@chromium.org
c3297c8d2e Use placement-new operator in the register allocator.
Pass the zone explicitly to avoid calling Isolate::Current()->zone().
Review URL: https://chromiumcodereview.appspot.com/9430002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10785 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-21 16:47:02 +00:00
yangguo@chromium.org
30bcc481e1 Enable inlining for Math.min/max in more cases.
Review URL: https://chromiumcodereview.appspot.com/9372021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-20 13:21:15 +00:00
mstarzinger@chromium.org
1dd2b094a5 Implement fast literal support in Crankshaft.
This extends the current support for nested object literals we already
have in Crankshaft, to also support nested array literals and mixed
nested literals containing arrays and objects. All three types are
generated by the unified HFastLiteral instruction.

All previous upper bounds on nested literal graphs remain unchanged,
keeping the size of generated code in check.

The main intention is to boost performance of two-dimensional array
literals containing constant elements (aka. matrices).

R=danno@chromium.org
TEST=mjsunit/compiler/literals-optimized

Review URL: https://chromiumcodereview.appspot.com/9403018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-16 17:32:30 +00:00