Commit Graph

25248 Commits

Author SHA1 Message Date
paul.lind
b4f9a95e6c MIPS64: Fix unittests (to not use invalid load representation).
Same as https://codereview.chromium.org/1340303002/

BUG=

Review URL: https://codereview.chromium.org/1339763005

Cr-Commit-Position: refs/heads/master@{#30756}
2015-09-15 21:28:30 +00:00
binji
f5bec4bcd4 [Atomics] Remove support for atomic accesses on floating-point values.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1318713007

Cr-Commit-Position: refs/heads/master@{#30755}
2015-09-15 21:25:14 +00:00
adamk
f44efd6b31 Fix spread operator in ArrayLiterals when nested in other literals
Mark ArrayLiterals utilizing the spread operator as non-simple.
This causes them to return false for IsCompileTimeValue, and thus
causes spread to work as expected in nested literals.

BUG=v8:4417
LOG=y

Review URL: https://codereview.chromium.org/1336123002

Cr-Commit-Position: refs/heads/master@{#30754}
2015-09-15 16:43:39 +00:00
jarin
edf6d2adbd [mips] Fix mips unittests (to not use invalid load representation).
Review URL: https://codereview.chromium.org/1340303002

Cr-Commit-Position: refs/heads/master@{#30753}
2015-09-15 15:50:44 +00:00
mlippautz
0db34dbe81 Revert of [heap] Concurrency support for heap book-keeping info (patchset #4 id:60001 of https://codereview.chromium.org/1340923004/ )
Reason for revert:
crashing: http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug%20-%203/builds/4716

Original issue's description:
> [heap] Concurrency support for heap book-keeping info.
>
> Adds concurrency support for:
> - MemoryChunk: Fragmentation counters
> - MemoryChunk: High-water mark
> - MemoryAllocator: Lowest and highest ever allocated addresses, size, and
>   capacity
>
> R=hpayer@chromium.org
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/63190721cda4966e01d71e92a730ce48ea789fbc
> Cr-Commit-Position: refs/heads/master@{#30749}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1340323002

Cr-Commit-Position: refs/heads/master@{#30752}
2015-09-15 15:11:50 +00:00
mlippautz
4d6c4a3e22 Add barriers to atomic utils.
Loads get an acquire, store/cas a release. Increment gets a full barrier.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1343883004

Cr-Commit-Position: refs/heads/master@{#30751}
2015-09-15 14:58:54 +00:00
bmeurer
e2f1c26982 [es6] Move builtin constructors for primitives to strict mode.
The ES6 specification says that "Built-in functions that are ECMAScript
function objects must be strict mode functions", which in particular
means that you can never test for them using the "caller" field of a
sloppy mode function.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:105
LOG=n

Review URL: https://codereview.chromium.org/1347663002

Cr-Commit-Position: refs/heads/master@{#30750}
2015-09-15 14:32:39 +00:00
mlippautz
63190721cd [heap] Concurrency support for heap book-keeping info.
Adds concurrency support for:
- MemoryChunk: Fragmentation counters
- MemoryChunk: High-water mark
- MemoryAllocator: Lowest and highest ever allocated addresses, size, and
  capacity

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1340923004

Cr-Commit-Position: refs/heads/master@{#30749}
2015-09-15 13:50:45 +00:00
mlippautz
2c17f1580b [heap] Extend mutex guards for CodeRange.
Previously the mutex only guarded free_list_. The extension covers also
allocation_list_.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1341293002

Cr-Commit-Position: refs/heads/master@{#30748}
2015-09-15 13:45:28 +00:00
bmeurer
54bab695f5 [runtime] Replace the EQUALS builtin with proper Object::Equals.
Move the implementation of the Abstract Equality Comparison to the
runtime and thereby remove the EQUALS dispatcher builtin. Also remove
the various runtime entry points that were only used to support the
EQUALS builtin.

Now the Abstract Equality Comparison is also using the correct
ToPrimitive implementation, which properly supports @@toPrimitive.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1337993005

Cr-Commit-Position: refs/heads/master@{#30747}
2015-09-15 13:14:44 +00:00
hpayer
064be4c296 [heap] Move slots buffer into a separate file.
BUG=

Review URL: https://codereview.chromium.org/1343043002

Cr-Commit-Position: refs/heads/master@{#30746}
2015-09-15 12:35:20 +00:00
chunyang.dai
2b476800e1 X87: [Interpreter] Add support for JS calls.
port e7fb233946 (r30710).

original commit message:

    Adds support for JS calls to the interpreter. In order to support
    calls from the interpreter, the PushArgsAndCall builtin is added
    which pushes a sequence of arguments onto the stack and calls
    builtin::Call.

    Adds the Call bytecode.

BUG=

Review URL: https://codereview.chromium.org/1334153004

Cr-Commit-Position: refs/heads/master@{#30745}
2015-09-15 12:24:57 +00:00
chunyang.dai
353db40970 X87: [builtins] Simplify String constructor code.
port eadfd66631 (r30706).

original commit message:

    The String constructor was somewhat complex with a lot of micro
    optimizations that are not relevant or even misguided. It would be
    really hard to port that code to ES6, which requires String to be
    subclassable. So as a first step we reduced the necessary complexity
    to the bare minimum (also removing the last user of the fairly complex
    MacroAssembler::LookupNumberStringCache method).

    This also removes the counters for the String constructor, which
    were not properly exposed anymore (and not kept in sync with inlined
    versions of the String constructor anyway).

BUG=

Review URL: https://codereview.chromium.org/1336133003

Cr-Commit-Position: refs/heads/master@{#30744}
2015-09-15 12:16:52 +00:00
chunyang.dai
8c8c7523c2 X87: Make FlushICache part of Assembler(Base) and take Isolate as parameter.
port 9fc4fc141f (r30695).

BUG=

Review URL: https://codereview.chromium.org/1339293002

Cr-Commit-Position: refs/heads/master@{#30743}
2015-09-15 11:51:49 +00:00
mlippautz
7611c3b98b [heap] Let caller figure out target space for evacuation when compacting.
R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1340253004

Cr-Commit-Position: refs/heads/master@{#30742}
2015-09-15 11:45:01 +00:00
chunyang.dai
ee86a749bf X87: [builtins] Remove the weird STACK_OVERFLOW builtin.
port 39604dda56 (r30693).

original commit message:

    Just use a %ThrowStackOverflow runtime function instead, which
    does the trick, especially since the Isolate already has a
    preallocated StackOverflow error for that.

BUG=

Review URL: https://codereview.chromium.org/1344793002

Cr-Commit-Position: refs/heads/master@{#30741}
2015-09-15 11:31:29 +00:00
chunyang.dai
ec2f11c577 X87: [stubs] Simplify the non-function case of CallConstructStub.
port 622fa0ea21 (r30691).

original commit message:

    Currently we do this dance between the CallConstructStub, the
    CALL_* builtins and the %GetConstructorDelegate, %GetProxyTrap,
    and %Apply runtime functions for every [[Construct]] operation on
    non-function callables. This is complexity is unnecessary, and can
    be simplified to work without any JS builtin. This will also make it
    a lot easier to implement ES6 compliant [[Construct]] for proxies.

    Also sanitize the invariant for CallConstructStub, which up until now
    always restored the context itself, but that force us to always create
    another copy of all arguments in case of proxies and other callables,
    so we can relax that constraint by making the caller restore the context
    (this only affects fullcodegen, since the optimizing compilers already
    properly restore the context anyway).

BUG=

Review URL: https://codereview.chromium.org/1341233002

Cr-Commit-Position: refs/heads/master@{#30740}
2015-09-15 11:27:06 +00:00
chunyang.dai
1b8610088c X87: Vector ICs: The Oracle needs to report feedback for the object literals and the count operation.
port 752b0308df (r30686).

original commit message:

    The refactoring is because it's awkward and error-prone to deterimine which IC slot an
    ObjectLiteralProperty uses for feedback. The fix is for each one to know it's own slot. In the
    numbering pass, we allocate slots for the ObjectLiteral, then hand out those slots into the
    properties.

    It adds one word to the ObjectLiteralProperty expression - I'm investigating if thats a
    problem.

    This changes makes compiling the object literal cleaner across the three compilers. Also, the
    slot allocation logic in ObjectLiteral::ComputeFeedbackRequirements() was refactoring to mimic
    the style in full-codegen. This is useful since it must remain in sync with
    FullCodegen::VisitObjectLiteral().

BUG=

Review URL: https://codereview.chromium.org/1341223002

Cr-Commit-Position: refs/heads/master@{#30739}
2015-09-15 11:20:45 +00:00
mstarzinger
9e47ec6eda [turbofan] Fix JSInliner to handle non-returning bodies.
The assumption that every function body produces a value does not hold
for functions that e.g. unconditionally throw or endlessly loop. This
fixes the inlining logic to handle such cases.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-530598
BUG=chromium:530598
LOG=n

Review URL: https://codereview.chromium.org/1333193005

Cr-Commit-Position: refs/heads/master@{#30738}
2015-09-15 11:19:23 +00:00
mvstanton
1e00bb57a2 Reland VectorICs: ia32 store ics need a virtual register.
(reason for revert/reland: patch incorrectly left --vector-stores flag
 on, helpfully revealing some gcstress issues to look at, but they
 don't need to block this CL).

Some pretty hacky code was used to carry out the tail-call
handler dispatch on ia32 vector stores due to a lack
of free registers. It really tanks performance. A better
approach is to use a virtual register on the isolate.

BUG=
TBR=jkummerow@chromium.org, vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1346573002

Cr-Commit-Position: refs/heads/master@{#30737}
2015-09-15 10:14:30 +00:00
cbruni
053d7f49e5 builtins.cc return PackedElementsKind where applicable
Returning a result array with holey elements kind in where we actually have a packed kind causes performance regressions.

LOG=N
BUG=chromium:531357

Review URL: https://codereview.chromium.org/1340033002

Cr-Commit-Position: refs/heads/master@{#30736}
2015-09-15 09:08:43 +00:00
mstarzinger
887f876058 [turbofan] Model arguments object materialization in graph.
This models the materialization of arguments objects in the prologue
within the IR graph. It will in turn allow us to optimize access to
these objects and also correctly handle them with inlining.

R=bmeurer@chromium.org,mvstanton@chromium.org
TEST=cctest/test-run-jsobjects/Arguments*

Review URL: https://codereview.chromium.org/1344553003

Cr-Commit-Position: refs/heads/master@{#30735}
2015-09-15 09:07:34 +00:00
machenbach
81121b4049 Port cfi blacklist from chromium.
BUG=chromium:515782
LOG=n

Review URL: https://codereview.chromium.org/1333133003

Cr-Commit-Position: refs/heads/master@{#30734}
2015-09-15 08:45:51 +00:00
brettw
7ec3be731f Remove transitional GN code.
The conditionals were added to facilitate a two-sided build GN config update
where the default optimization config was renamed. This is complete so the
transitional code can be removed.

Review URL: https://codereview.chromium.org/1338163003

Cr-Commit-Position: refs/heads/master@{#30733}
2015-09-15 08:43:35 +00:00
oth
f71bc57aa5 [Interpreter] Avoid shadowing variables in the bytecode graph builder.
Reported by Bruce Dawson.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1346453002

Cr-Commit-Position: refs/heads/master@{#30732}
2015-09-15 08:18:35 +00:00
machenbach
18d2c58cfd [test] More robust perf runner with profiler option.
NOTRY=true

Review URL: https://codereview.chromium.org/1341213002

Cr-Commit-Position: refs/heads/master@{#30731}
2015-09-15 08:16:10 +00:00
hablich
8d77f788e7 [Docs] Add information on how to contribute to the README
I noticed after reading a few GitHub comments that the information
about contributing to V8 is hard to find. I think it makes sense
to add this information to the README.

NOTRY=true
R=jochen@chromium.org, seththompson@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1342803004

Cr-Commit-Position: refs/heads/master@{#30730}
2015-09-15 07:53:13 +00:00
Ilija.Pavlovic
863ff3e3dd MIPS: Fix testcases r6_beqzc and mov.
Remove incorrect usage of callee-saved FPU regs (f20 and above).
Also remove unnecessary push/pop which were occasionally unpaired,
and caused crash.

TEST=cctest/test-assembler-mips[64]
BUG=

Review URL: https://codereview.chromium.org/1338713004

Cr-Commit-Position: refs/heads/master@{#30729}
2015-09-15 07:37:16 +00:00
neis
76ad8ffa00 Fix printing of types and do some cleanups.
R=jarin
BUG=

Review URL: https://codereview.chromium.org/1340023003

Cr-Commit-Position: refs/heads/master@{#30728}
2015-09-15 06:42:02 +00:00
machenbach
c5a4c39873 Revert of [crankshaft] Re-add fast-case for string add left/right. (patchset #1 id:1 of https://codereview.chromium.org/1339053002/ )
Reason for revert:
[Sheriff] Fails mozilla with deadcode:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20deadcode/builds/5357

Original issue's description:
> [crankshaft] Re-add fast-case for string add left/right.
>
> Now the StringAddStub can optionally convert it's parameters to strings
> (following the rules for the addition operator). This could be further
> optimized once we have a ToPrimitiveStub, but it should be sufficient
> for the moment.
>
> Also removed the unused Strength parameter to the HStringAdd operator,
> because string addition does not depend on language mode.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel,v8_linux_nosnap_dbg
> R=mstarzinger@chromium.org
> BUG=v8:4307
> LOG=n
>
> Committed: https://crrev.com/d261849e53fbf8c36efae42d478271f87acff70f
> Cr-Commit-Position: refs/heads/master@{#30726}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4307

Review URL: https://codereview.chromium.org/1347473003

Cr-Commit-Position: refs/heads/master@{#30727}
2015-09-15 06:40:52 +00:00
bmeurer
d261849e53 [crankshaft] Re-add fast-case for string add left/right.
Now the StringAddStub can optionally convert it's parameters to strings
(following the rules for the addition operator). This could be further
optimized once we have a ToPrimitiveStub, but it should be sufficient
for the moment.

Also removed the unused Strength parameter to the HStringAdd operator,
because string addition does not depend on language mode.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel,v8_linux_nosnap_dbg
R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1339053002

Cr-Commit-Position: refs/heads/master@{#30726}
2015-09-15 06:00:49 +00:00
jarin
a86db19e0a [turbofan] Limit the load/store machine types to the ones we actually use.
Review URL: https://codereview.chromium.org/1333353005

Cr-Commit-Position: refs/heads/master@{#30725}
2015-09-15 05:45:30 +00:00
v8-autoroll
3ee9a0e14b Update V8 DEPS.
Rolling v8/buildtools to f7310ee61725e68b1c8921e381830362cf4f0999

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1342063002

Cr-Commit-Position: refs/heads/master@{#30724}
2015-09-15 03:26:05 +00:00
alph
32dffda625 Removing function filtering from the v8 sampling
Filtering out functions does not allow sample processor
to figure out if a sample hit a non-frame region of a function.

The filtering should be done in the frontend.

BUG=chromium:529931
LOG=N

Review URL: https://codereview.chromium.org/1337743002

Cr-Commit-Position: refs/heads/master@{#30723}
2015-09-15 01:21:59 +00:00
mbrandy
4ca74e4f80 PPC: [builtins] Simplify String constructor code.
Port eadfd66631

Original commit message:
    The String constructor was somewhat complex with a lot of micro
    optimizations that are not relevant or even misguided. It would be
    really hard to port that code to ES6, which requires String to be
    subclassable. So as a first step we reduced the necessary complexity
    to the bare minimum (also removing the last user of the fairly complex
    MacroAssembler::LookupNumberStringCache method).

    This also removes the counters for the String constructor, which
    were not properly exposed anymore (and not kept in sync with inlined
    versions of the String constructor anyway).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1339143002

Cr-Commit-Position: refs/heads/master@{#30722}
2015-09-14 23:16:53 +00:00
mbrandy
b6f673987f PPC: [Interpreter] Add support for JS calls.
Port e7fb233946

Original commit message:
    Adds support for JS calls to the interpreter. In order to support
    calls from the interpreter, the PushArgsAndCall builtin is added
    which pushes a sequence of arguments onto the stack and calls
    builtin::Call.

    Adds the Call bytecode.

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1345543002

Cr-Commit-Position: refs/heads/master@{#30721}
2015-09-14 23:15:43 +00:00
gdeepti
b571b83bcd [test] Add an option to the perf runner to support running with the internal profiler.
Enhance the perf runner to run with the profiler and print the summary for each d8 run. This automates running the profiler with multiple benchmarks.

BUG=None
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1327033003

Cr-Commit-Position: refs/heads/master@{#30720}
2015-09-14 23:14:33 +00:00
machenbach
a7a34b068c Revert of VectorICs: ia32 store ics need a virtual register. (patchset #3 id:40001 of https://codereview.chromium.org/1336313002/ )
Reason for revert:
[Sheriff] Breaks GC stress on mac:
http://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/2536

Original issue's description:
> VectorICs: ia32 store ics need a virtual register.
>
> Some pretty hacky code was used to carry out the tail-call
> handler dispatch on ia32 vector stores due to a lack
> of free registers. It really tanks performance. A better
> approach is to use a virtual register on the isolate.
>
> BUG=
>
> Committed: https://crrev.com/b26e98f19b5e77df50cb4a259f099ee6afa335e3
> Cr-Commit-Position: refs/heads/master@{#30718}

TBR=jkummerow@chromium.org,vogelheim@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1340123002

Cr-Commit-Position: refs/heads/master@{#30719}
2015-09-14 18:59:01 +00:00
mvstanton
b26e98f19b VectorICs: ia32 store ics need a virtual register.
Some pretty hacky code was used to carry out the tail-call
handler dispatch on ia32 vector stores due to a lack
of free registers. It really tanks performance. A better
approach is to use a virtual register on the isolate.

BUG=

Review URL: https://codereview.chromium.org/1336313002

Cr-Commit-Position: refs/heads/master@{#30718}
2015-09-14 14:49:39 +00:00
cbruni
43a04030b8 elements.cc CopyDoubleToObjectElements: avoid excessive HandleScopes
BUG=

Review URL: https://codereview.chromium.org/1341763002

Cr-Commit-Position: refs/heads/master@{#30717}
2015-09-14 14:30:00 +00:00
mstarzinger
a0bc7651ab [heap] No leakage of objects-visiting.h outside of heap.
This prevents the internal objects-visiting.h to be usable outisde of
the "heap" directory. The static object visitation is only usefull
within the GC and is now properly encapsulated.

R=hpayer@chromium.org,mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1328003002

Cr-Commit-Position: refs/heads/master@{#30716}
2015-09-14 12:28:48 +00:00
cbruni
28235e94cf Using GetMoreGeneralElementsKind in more places
BUG=

Review URL: https://codereview.chromium.org/1338983003

Cr-Commit-Position: refs/heads/master@{#30715}
2015-09-14 12:17:12 +00:00
mlippautz
8f40327067 [loggers] Guard object/code move events using mutexes.
Parallel compaction, i.e., concurrently moving of objects (and code) requires
proper synchronization in the logger.

R=hpayer@chromium.org
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1338253002

Cr-Commit-Position: refs/heads/master@{#30714}
2015-09-14 12:06:51 +00:00
mlippautz
cb621e2e2c Fix initialization order (setup) for JSArrayBuffer objects.
BUG=chromium:531322
LOG=N
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1337943005

Cr-Commit-Position: refs/heads/master@{#30713}
2015-09-14 11:59:24 +00:00
mstarzinger
ea25bf05f8 [heap] Separate scavenger functionality into own file.
This moves scavenging functionality into a separate component so that
neither the scavenger nor objects-visiting need to be exposed outside
the heap.

R=hpayer@chromium.org,mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1323993004

Cr-Commit-Position: refs/heads/master@{#30712}
2015-09-14 11:44:30 +00:00
cbruni
5ee2ea3cae Preserve the ElementsKind in builtin.cc Slice early return
LOG=N

BUG=chromium:531348

Review URL: https://codereview.chromium.org/1344493004

Cr-Commit-Position: refs/heads/master@{#30711}
2015-09-14 10:32:50 +00:00
rmcilroy
e7fb233946 [Interpreter] Add support for JS calls.
Adds support for JS calls to the interpreter. In order to support
calls from the interpreter, the PushArgsAndCall builtin is added
which pushes a sequence of arguments onto the stack and calls
builtin::Call.

Adds the Call bytecode.

MIPS port contributed by akos.palfi@imgtec.com in https://codereview.chromium.org/1334873002/

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1323463005

Cr-Commit-Position: refs/heads/master@{#30710}
2015-09-14 10:05:35 +00:00
neis
d3df2b0584 Make --turbo-stats output more self-explanatory.
BUG=

Review URL: https://codereview.chromium.org/1331553002

Cr-Commit-Position: refs/heads/master@{#30709}
2015-09-14 09:25:31 +00:00
neis
08dc43947d Construct Range rather than Constant when typing integers.
Also clarify some comments.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1328193003

Cr-Commit-Position: refs/heads/master@{#30708}
2015-09-14 09:23:34 +00:00
bmeurer
d90a404747 [builtins] Remove STRING_ADD_LEFT and STRING_ADD_RIGHT builtins.
These builtins present an optimization for the general addition case,
where one side is already known to be a string. Unfortunately this
optimization is wrong in the presence of @@toPrimitive (there are some
ideas how to implement a similar optimization using the prototype
backpointer mechanism that jkummerow@ introduced earlier). So this
also removes the broken %_IsStringWrapperSafeForDefaultValueOf, which is
the key part of the optimization mentioned above.

R=mstarzinger@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1336273002

Cr-Commit-Position: refs/heads/master@{#30707}
2015-09-14 08:41:35 +00:00