AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
21,064 Commits 1 Branch 0 Tags 839 MiB
bf49be39f3
Commit Graph

1131 Commits

Author SHA1 Message Date
ulan@chromium.org
a7d1b658fc Reland r19897 "Fix memory leak caused by treating Code::next_code_link as strong in marker. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/212553003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20282 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 15:14:51 +00:00
dslomov@chromium.org
76b8f25edb This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-26 12:50:13 +00:00
dslomov@chromium.org
cdc9812756 Revert "This implements allocating small typed arrays in heap." 
This reverts commit r20244 for breaking Win64 build and webkit tests.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/208503007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 14:12:58 +00:00
dslomov@chromium.org
654b6a27d1 This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=20240

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 13:21:58 +00:00
dslomov@chromium.org
727bc2153e Revert "This implements allocating small typed arrays in heap." 
This reverts commit r20240 for breaking Windows build.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/211003003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 12:58:22 +00:00
dslomov@chromium.org
322a474bf2 This implements allocating small typed arrays in heap. 
R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/150813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20240 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 12:51:49 +00:00
yangguo@chromium.org
4ca46f3c3f Handlify GetElementWithReceiver and GetElementWithInterceptor. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/210763003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 10:15:12 +00:00
ishell@chromium.org
0d7bdc0fd6 Callers of ElementsAccessor::SetCapacityAndLength() handlified. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/210063004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-25 09:51:13 +00:00
yangguo@chromium.org
8b8fb30e7f Reland "Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException." 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/209903003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20184 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 10:07:15 +00:00
yangguo@chromium.org
03866841aa Revert "Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException." 
This reverts r20179.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/201573007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 09:17:18 +00:00
yangguo@chromium.org
62f65d8697 Remove Failure::OutOfMemory propagation and V8::IgnoreOutOfMemoryException. 
R=dcarney@chromium.org
BUG=v8:3060
LOG=Y

Review URL: https://codereview.chromium.org/208263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-24 08:47:45 +00:00
ishell@chromium.org
deca3f3677 JSObject::EnsureCanContainElements() handlified. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/198053013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 14:29:27 +00:00
ishell@chromium.org
e9a315c978 JSArray::SetContent() handlified. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/206223003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-21 08:30:42 +00:00
rossberg@chromium.org
b3b6987b27 Reland "Implement ES6 symbol registry and predefined symbols" 
Only change relative to original CL is the updated assertion condition at objects-inl.h:2119

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/204913006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 16:13:09 +00:00
yangguo@chromium.org
77a28b731d Handlify callers to GetElementNoException. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/204693002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-20 12:22:13 +00:00
ishell@chromium.org
158269c132 ElementsAccessor::SetLength() handlified. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/204603003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20090 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 16:29:19 +00:00
mvstanton@chromium.org
535f3427ca Pretenure call new support. 
When FLAG_pretenure_call_new is on, we emit mementos on new object creation
in full code, and consume the feedback in crankshaft. A key difference in the
generated code for stubs is the allocation of an additional type vector slot for the
CallNew AST node, which simplifies the CallConstructStub and CallFunctionStub
considerably.

Some performance tuning still needs to be addressed, therefore the flag is off at
this moment, though fully functional. The goal is to remove the flag as soon as
possible, which allows much code deletion (yay).

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/132963012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 13:39:09 +00:00
hpayer@chromium.org
0f1f071751 Access old space marking bits from runtime only when incremental marking is in MARKING state. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/203523009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-19 10:48:54 +00:00
ulan@chromium.org
18104111f4 Refactor GetCodeCopyFromTemplate to get a single point where objects are replaced in code. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/197283017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-18 14:15:09 +00:00
yangguo@chromium.org
c76a97159f Handlify callers of Object::GetElement. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/200363002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20028 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-18 12:34:02 +00:00
mvstanton@chromium.org
e3f3f6d98b Revert "Continued fix for 351257. Reusing the feedback vector is too complex." 
This reverts commit r19919.

TBR=bmeuer@chromium.org

Review URL: https://codereview.chromium.org/196343021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-17 08:31:21 +00:00
mvstanton@chromium.org
dd28969c1c Continued fix for 351257. Reusing the feedback vector is too complex. 
Attempting to re-use the type feedback vector stored in the
SharedFunctionInfo turns out to be difficult among the various cases.
It will be much easier to do this when deferred type feedback processing
is removed, as is in the works.

Created bug v8:3212 to track re-introducing the optimization of reusing
the type vector on recompile before optimization.

The CL also brings back the type vector on the SharedFunctionInfo.

BUG=351257
LOG=Y
R=bmeurer@chromium.org, bmeuer@chromium.org

Review URL: https://codereview.chromium.org/199973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-14 09:28:37 +00:00
hpayer@chromium.org
7b810f4593 Revert "Moved type feedback vector to SharedFunctionInfo." 
This reverts commit 828f1d563a3f0972135886888fd26526e04da07f.

Conflicts:
	src/compiler.cc
	test/cctest/test-compiler.cc

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/196283015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 17:47:12 +00:00
ulan@chromium.org
81a5cfb0e0 Revert r19897, r19898 for breaking mac-64 debug. 
TBR=dslomov@chromium.org

Review URL: https://codereview.chromium.org/199203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 15:10:35 +00:00
ulan@chromium.org
2f26700885 Fix memory leak caused by treating Code::next_code_link as strong in marker. 
BUG=
TEST=test/cctest/NextCodeLinkIsWeak
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/181833004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 14:09:18 +00:00
yangguo@chromium.org
6f6356a248 Handlify PropertyAttribute lookups. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/197813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-13 11:55:31 +00:00
rmcilroy@chromium.org
f9288fca53 Update serializer to be able to deal with ool constant pool. 
This CL depends on CL https://codereview.chromium.org/179813005/ landing first.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/190883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 20:52:00 +00:00
ulan@chromium.org
5b5cd79a79 Fix kraken/oscillator performance regression after r19635. 
Evict previously optimized code after new optimization.

BUG=v8:3202
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/189263009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 15:50:41 +00:00
rossberg@chromium.org
8e3f3cee9e Eliminate extended mode, and other modes clean-up 
- Merge LanguageMode and StrictModeFlag enums
- Make harmony-scoping depend only on strict mode
- Free some bits on the way
- Plus additional clean-up and renaming

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/181543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:41:22 +00:00
rossberg@chromium.org
3f702d4bf9 Mode clean-up pt 1: rename classic/non-strict mode to sloppy mode 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/177683002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-11 14:39:08 +00:00
rmcilroy@chromium.org
a199ba80ef Differentate between code target pointers and heap pointers in constant pools. 
Separate out code target pointers from normal heap pointer entries in constant
pool arrays so that the GC can correctly relocate these pointers using the
appropriate mechanism.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/183883011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 19:05:43 +00:00
yangguo@chromium.org
78d23e5662 Implement KnownSuccessor method to some control instructions. 
R=jkummerow@chromium.org
BUG=v8:3118
LOG=N

Review URL: https://codereview.chromium.org/174863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 14:50:01 +00:00
verwaest@chromium.org
1180803953 Reland and fix "Allow ICs to be generated for own global proxy." 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/176793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-10 12:23:05 +00:00
mvstanton@chromium.org
1812f63fd2 Moved type feedback vector to SharedFunctionInfo. 
Type Vector followup: the type vector currently lives off the code object. This CL moves it to the SharedFunctionInfo, facilitating re-use and continued use in crankshafted code if desired.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/178463007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 10:12:17 +00:00
mvstanton@chromium.org
1d3652ebe6 Symbols for type cells. We can make more efficient code to check against type cells in the future if we use symbols, guaranteed not to conflict with user code. Currently, the "symbols" are the hole and undefined. Undefined may come in from the outside. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/181283003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 09:10:18 +00:00
marja@chromium.org
bd1fb97d5c Remove Script::SetData and the script_data parameter from Script::(Compile|New). 
This feature makes it possible to associate data with a script and get it back
when the script is compiled or when an event is handled. It was historically
used by Chromium Dev Tools, but not any more. It is not used by node.js.

Note: this has nothing to do with the preparse data, despite the confusing name.
The preparse data is passed as ScriptData*.

Note 2: This is the same as r19616 ( https://codereview.chromium.org/184403002/ )
with a unused variable fix in bootstrapper.cc.

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/185533014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-07 08:43:54 +00:00
verwaest@chromium.org
9b8021ad29 Remove all uses of field-tracking flags that do not make decisions but are subject to existing information. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/173963002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-04 12:48:17 +00:00
ulan@chromium.org
b9e0b87a5a Clear optimized code cache in shared function info when code gets deoptimized. 
This adds a pointer to the shared function info into deoptimization data of an optimized code. Whenever the code is deoptimized, it clears the cache in the shared function info.

This fixes the problem when the optimized function dies in new space GC before the code is deoptimized due to code dependency and before the optimized code cache is cleared in old space GC (see mjsunit/regress/regress-343609.js).

This partially reverts r19603 because we need to be able to evict specific code from the optimized code cache.

BUG=343609
LOG=Y
TEST=mjsunit/regress/regress-343609.js
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/184923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-03-03 11:11:39 +00:00
marja@chromium.org
40ffba58a4 Revert "Remove Script::SetData and the script_data parameter from Script::(Compile|New)." 
This reverts revision 19616.

BUG=
TBR=marja@chromium.org,svenpanne@chromium.org

Review URL: https://codereview.chromium.org/181113008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19618 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 14:09:52 +00:00
marja@chromium.org
55750b1c62 Remove Script::SetData and the script_data parameter from Script::(Compile|New). 
This feature makes it possible to associate data with a script and get it back
when the script is compiled or when an event is handled. It was historically
used by Chromium Dev Tools, but not any more. It is not used by node.js.

Note: this has nothing to do with the preparse data, despite the confusing name.
The preparse data is passed as ScriptData*.

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/184403002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19616 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 13:54:14 +00:00
yangguo@chromium.org
5c186bb197 Evict from optimized code map in sync with removing from optimized functions list. 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/184443002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19603 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-28 12:27:31 +00:00
mvstanton@chromium.org
e664f42a5a Revert r19430, r19459: 
"Reland "Allow ICs to be generated for own global proxy.""

Causing ClusterFuzz crash (issue 343928)

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/179643003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-25 12:18:30 +00:00
ulan@chromium.org
db60894687 Clean up weak objects in optimized code. 
This prepares for weak objects in IC stubs.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/172233003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 14:03:48 +00:00
mvstanton@chromium.org
73b679cbee Revert "Second attempt at introducing a premonomorphic state in the call" 
This reverts commits r19463 and r19457 (includes MIPS port), there was a
Sunspider perf issue and on reflection we can achieve the necessary
result in a new way.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/172383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-19 13:55:25 +00:00
mvstanton@chromium.org
5224c3d0f0 Second attempt at introducing a premonomorphic state in the call 
target caches.

This time we don't go through the premonomorphic state for
the Array call target caches to avoid losing information from
allocation sites that aren't only used once, but where the
resulting array is used heavily.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/169683003

Patch from Kasper Lund <kasperl@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19457 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 15:33:34 +00:00
verwaest@chromium.org
60c08a8bf2 Directly store the transition target on LookupResult in TransitionResult. 
BUG=chromium:343964
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/170343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 12:19:32 +00:00
bmeurer@chromium.org
a7c82c49f4 Consistent use of const for LookupResult. 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/170073003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19438 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 11:30:51 +00:00
verwaest@chromium.org
2f9f49798a Reland "Allow ICs to be generated for own global proxy." 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/170343002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19430 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 10:10:06 +00:00
danno@chromium.org
438db990a0 Revert r19409: "Allow ICs to be generated for own global proxy." 
Causing Layout test crashes

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/170253002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19423 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-18 08:34:56 +00:00
mvstanton@chromium.org
8bcdbc354f Revert "Add a premonomorphic state to the call target cache." 
This reverts commit r19402

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/169713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19412 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 14:22:18 +00:00
verwaest@chromium.org
1984ebad50 Allow ICs to be generated for own global proxy. 
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/166233004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 13:12:56 +00:00
hpayer@chromium.org
22602980c0 Added a special stack guard to deopt marked allocation sites. 
BUG=
R=mvstanton@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/169563002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 12:15:16 +00:00
mvstanton@chromium.org
be731e6c95 Add a premonomorphic state to the call target cache. 
From a CL by kasperl: https://codereview.chromium.org/162903004/

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/163413003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-17 11:59:45 +00:00
verwaest@chromium.org
ed9bbc7051 Remove HandlerKindField and just encode the handlerkind as the only extra-ic-state. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/166883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:17:26 +00:00
verwaest@chromium.org
209b17ac31 Don't mix handler flags into regular flag computation. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/163363003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19384 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:15:08 +00:00
verwaest@chromium.org
fe0fe20e8f Pass in the handler kind to IC computation rather than extracting it from the handler. 
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/163463002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19383 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-14 15:14:34 +00:00
verwaest@chromium.org
78f568d69c Remove extended_extra_ic_state and extend extra_ic_state instead. 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/159013003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19287 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 15:01:44 +00:00
yangguo@chromium.org
1f7feb9696 Remove obsolete stack trace string in a message object. 
The stack trace string is an ancient relic that is no longer being used.
We use the structured stack trace object instead.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/159013002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-11 09:29:51 +00:00
mvstanton@chromium.org
516ed9fa90 Adding a type vector to replace type cells. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/137403009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-10 21:38:17 +00:00
hpayer@chromium.org
88b45eef17 Just calculate pretenuring ratio when needed. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/153863005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 11:27:08 +00:00
hpayer@chromium.org
9b61008f27 Cleanup allocation site pretenuring tracing, added new flag --trace-pretenuring-statistics. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/153273003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19141 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-06 10:30:13 +00:00
yangguo@chromium.org
f6d1a4fef1 Allow externalizing strings in old pointer space. 
This is what I think is a better solution to the "external strings in
old pointer space" problem. Basically, it is an issue because GC scans
all fields of objects in old pointer space and if the cached address
of the backing store is unaligned, it looks like a heap object, boom.

The solution here is to use short external strings when we externalize
a string in old pointer space, and when the address is unaligned.
Short external strings don't cache the address, so GC has no issues.

BUG=268686
LOG=Y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/146183006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-05 09:29:04 +00:00
ishell@chromium.org
05270212c3 Remake of the load elimination fix made earlier (r18884). 
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/149063010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-02-04 10:48:49 +00:00
verwaest@chromium.org
ae7a209e71 Remove CallICs 
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/148223002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 16:52:17 +00:00
verwaest@chromium.org
c7b91cd494 Don't unmark dictionary mode maps as unstable. 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/148493007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18983 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-31 11:38:43 +00:00
plind44@gmail.com
02d8dc57c1 MIPS: Specialize FixedTypedArray<> set and get functions to solve unaligned double access. 
BUG=
TEST=test-api/FixedFloat64Array
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/136333011

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-30 20:05:11 +00:00
ulan@chromium.org
405e8eaf7a Generalize internalization of substrings. 
Make a template version of SubStringKey, which allows internalization of substrings of sequential and external strings.

R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/143223004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-29 14:31:34 +00:00
dslomov@chromium.org
1a67b7f86a External Array renaming and boilerplate scrapping 
Replaced symbolic names with correct JS name (byte -> int8, unsigned int -> uint32 etc).
Using macros to scrap the boilerplate
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/145133013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18835 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-24 16:01:15 +00:00
hpayer@chromium.org
83a1df2354 Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141653016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-23 13:02:27 +00:00
verwaest@chromium.org
c478b6dc60 Ensure we don't overwrite transitions in SetPropertyIgnoreAttributes. 
BUG=326155
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/134733011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-22 14:02:00 +00:00
ulan@chromium.org
0575396a4c Refactor string internalization. 
Remove duplicate code in StringTable and Heap. Instead of having many InternalizeXXXString methods, add a general InternalizeStringWithKey that takes a string table key.

BUG=
R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/140953002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-17 10:27:57 +00:00
dslomov@chromium.org
5da41be7b8 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 17:08:45 +00:00
dslomov@chromium.org
34eeeb8953 Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18649 for breaking Linux/nosnap and Win64 tests.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/140793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 16:00:36 +00:00
dslomov@chromium.org
97040ce67b Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18646

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 15:01:27 +00:00
dslomov@chromium.org
95f572389e Revert "Implement in-heap backing store for typed arrays." 
This reverts commit r18646 for breaking Win32 build.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/132233012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:26:15 +00:00
dslomov@chromium.org
0c960c2e96 Implement in-heap backing store for typed arrays. 
This adds a fixed array sub-type that will represent a backing store for
typed arrays allocated with TypedArray(length) construtor.

R=mvstanton@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 14:18:37 +00:00
hpayer@chromium.org
76284bdcad Deopt marked code at safe deoptimization point when pretenuring. 
BUG=
R=bmeurer@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138033012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18641 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-16 11:54:12 +00:00
mvstanton@chromium.org
854d085996 More efficient use of space in AllocationSite. 
We can eliminate one word from the object by sharing the pretenuring decision and the found memento count.

R=bmeurer@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/132063004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-13 10:28:01 +00:00
hpayer@chromium.org
4ef951cf43 Allocation site pretenuring. 
Pretenuring decisions are made based on allocation site lifetime statistics.

BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/96783002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-10 12:11:54 +00:00
mvstanton@chromium.org
fc5834343f Remove flag track-allocation-sites. 
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.

R=verwaest@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=18385

Review URL: https://codereview.chromium.org/104923010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 15:58:25 +00:00
mvstanton@chromium.org
d8e9893c59 Fix for issue 3071: A zombie AlloctionSite must clear pointer fields. 
BUG=v8:3071
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/125873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18469 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-07 14:27:31 +00:00
bmeurer@chromium.org
ad4231c495 Reland "Allocation site support for monomorphic StringAdds in BinaryOps". 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/106313003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 15:31:27 +00:00
bmeurer@chromium.org
4d88b0b4be Revert "Fix compilation with C++11." and "Allocation site support for monomorphic StringAdds in BinaryOps.". 
This reverts commit r18431 and r18432 for breaking
the Linux nosnapshot build.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/122463004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 10:38:45 +00:00
bmeurer@chromium.org
a91499fec7 Allocation site support for monomorphic StringAdds in BinaryOps. 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/106453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-01-02 09:17:52 +00:00
rmcilroy@chromium.org
78ab4379d3 Out-of-line constant pool on Arm: Stage 3 - Set Constant Pool Pointer on Function Entry 
Third stage of implementing an out-of-line constant pool for Arm.  This CL adds
a ConstantPool field to Code objects and initializes the pp register on
function entry, and saves the pp register on the stack frame. The ConstantPool
object is always empty and is unused currently.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/88043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18425 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-30 11:23:59 +00:00
ulan@chromium.org
7ac7a7ea99 Fix a race between concurrent recompilation and OSR. 
If concurrent recompilation finishes before OSR, then OSR replaces
the old optimized code without evicting it from the optimized code map.

New functions can get the old optimized code from the optimized code map,
but the old code could be already deoptimized.

BUG=330046
TEST=test/mjsunit/regress-330046.js
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/109033003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18420 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-27 09:22:56 +00:00
yangguo@chromium.org
6ba6d0b4fe Cache optimized code for OSR. 
BUG=v8:2637
LOG=N
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/101853003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18410 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-23 14:42:42 +00:00
yangguo@chromium.org
2a4be7067c Refactor the compiling pipeline. 
Goals:
 - easier to read, more suitable identifiers.
 - better distinction between compiling optimized/unoptimized code
 - compiler does not install code on the function.
 - easier to add features (e.g. caching optimized code for osr).
 - remove unnecessary code.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/110203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-23 14:30:35 +00:00
hpayer@chromium.org
f583b73b70 Revert "Remove flag track-allocation-sites." 
This reverts commit 6c430da40efe388035504d3603756aa8c46ed1dc.

BUG=

Review URL: https://codereview.chromium.org/109303006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-20 12:04:34 +00:00
mvstanton@chromium.org
e654c88fab Remove flag track-allocation-sites. 
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/104923010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-20 11:46:31 +00:00
hpayer@chromium.org
7305592638 Use an allocation site scratchpad to speed up allocaton site processing during gc. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/99133017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18367 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 21:23:56 +00:00
ishell@chromium.org
8c159ed4ec HStoreNamedField for Smis optimized for x64 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/108413003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 17:53:50 +00:00
hpayer@chromium.org
7be4945c2b Removed unused ShouldTrackAllocationInfo method. 
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/111723004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-18 10:30:31 +00:00
jkummerow@chromium.org
28cab36838 Ensure that Code objects' kind specific flags are initialized properly. 
Also, have the stub cache set a valid MajorKey on stubs it creates.
Getting weird random bits frightens and confuses the poor simple type feedback oracle.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/108443004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-13 10:27:19 +00:00
verwaest@chromium.org
d5787278bc Fixed global object leak caused by overwriting the global receiver (the global proxy) in the global object with the global object itself. 
This CL additionally removes the API function to reattach a global proxy to a
global object.

BUG=324812
LOG=y
R=dcarney@chromium.org, titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/101733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-11 13:51:48 +00:00
bmeurer@chromium.org
46fbeec7ab Remove the obsolete Code::IsPregenerated flag. 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96753003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18172 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-12-02 09:46:35 +00:00
mvstanton@chromium.org
e066a3667d Move responsibility for definition of ExtraICState bits into the ICs. 
Currently it's in the Code object for some ICs and in ICs for other ICs.
This should make it easier to alter bits as needed.

2) Recover an extra bit in the code object to give us 6 bits for the extra ic state. We'll need it soon to store contextual state.

3) Cleanup code that treated StrictMode enum and ExtraICState enum as interchangeble.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/91803003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-28 15:32:55 +00:00
mvstanton@chromium.org
f3a22f965e The goal is to discover the appropriate heap space for objects created in full 
code. By the time we optimize the code, we'll be able to decide on new or old
space based on the number of surviving objects after one or more gcs.

The mechanism is a "memento" placed behind objects in the heap. It's currently
done for array and object literals, with plans to use mementos for constructed
objects as well (in a later CL).

The feature is behind the flag allocation_site_pretenuring, currently off.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/40063002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-27 14:03:40 +00:00
svenpanne@chromium.org
b6b84c02b2 Reland "Implement Math.random() purely in JavaScript" plus fixes. 
The main change is that a bit has been added to array buffers to
signal that the backing store has to be freed when the buffer dies.

BUG=316359
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/82763005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18003 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-22 11:35:39 +00:00
mvstanton@chromium.org
3c95790f32 Pretenuring calculation fields in AllocationSite. 
AllocationSite-based pretenuring needs additional fields to carry out
calculations.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/43603002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17986 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-22 07:34:21 +00:00
ishell@chromium.org
8537e167f2 Code object now prints its major_key when applicable. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/81043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-21 16:55:16 +00:00
verwaest@chromium.org
40d255ec82 Move template instance check from Object to FunctionTemplateInfo::IsTemplateFor 
BUG=
R=dcarney@chromium.org

Review URL: https://chromiumcodereview.appspot.com/67613005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17876 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-19 13:38:15 +00:00
verwaest@chromium.org
341d405301 Reland and fix "Add support for keyed-call on arrays of fast elements" 
BUG=
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/71783003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-15 10:52:05 +00:00
rafaelw@chromium.org
bdf78a7ad3 Reland [Object.observe] Don't force normalization of elements for observed objects 
Original Issue: https://codereview.chromium.org/29353003/

Note that this version of the patch includes logic for bailing out of compiled ArrayPush/ArrayPop calls if the array is observed (see stub-cache-*)

R=danno@chromium.org
BUG=v8:2946
LOG=N

Review URL: https://codereview.chromium.org/68343016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-14 21:47:39 +00:00
verwaest@chromium.org
93f2ed48d9 Handle all object types (minus smi) in load/store ICs 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/62953007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-14 16:25:31 +00:00
machenbach@chromium.org
eef8694a7e [Sheriff] Revert "Add support for keyed-call on arrays of fast elements" 
This reverts commit r17746 for breaking layout tests.

TBR=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/72753002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-14 15:00:13 +00:00
verwaest@chromium.org
607a175cbc Add support for keyed-call on arrays of fast elements 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23537067

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-14 13:46:18 +00:00
mvstanton@chromium.org
3cf157b43b Inline zero argument array constructor. 
patch from issue 54583003 (dependent code).

Zero arguments - very easy

1 argument - three special cases:
  a) If length is a constant in valid array length range,
     no need to check it at runtime.
  b) respect DoNotInline feedback on the AllocationSite for
     cases that the argument is not a smi or is an integer
     with a length that should create a dictionary.
  c) if kind feedback is non-holey, and length is non-constant,
     we'd have to generate a lot of code to be correct.
     Don't inline this case.

N arguments - one special case:
  a) If a deopt ever occurs because an input argument isn't
     compatible with the elements kind, then set the
     DoNotInline flag.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/55933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-14 12:05:09 +00:00
rossberg@chromium.org
cec8383cff Provide private symbols through internal APIs 
Adds a notion of private symbols, mainly intended for internal use, especially, self-hosting of built-in types that would otherwise require new C++ classes.

On the JS side (i.e., in built-ins), private properties can be created and accessed through a set of macros:

  NEW_PRIVATE(print_name)
  HAS_PRIVATE(obj, sym)
  GET_PRIVATE(obj, sym)
  SET_PRIVATE(obj, sym, val)
  DELETE_PRIVATE(obj, sym)

In the V8 API, they are accessible via a new class Private, and respective HasPrivate/Get/Private/SetPrivate/DeletePrivate methods on calss Object.

These APIs are designed and restricted such that their implementation can later be replaced by whatever ES7+ will officially provide.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/48923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-13 10:34:06 +00:00
yangguo@chromium.org
e83fd01ce6 Reland "Implement Math.sin, cos and tan using table lookup and spline interpolation." 
This relands r17594 with necessary fixes.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/70003004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-12 14:43:18 +00:00
rafaelw@chromium.org
4bc568b77a Revert "Reland [Object.observe] Don't force normalization of elements for observed objects" 
TBR=danno
BUG=

Review URL: https://codereview.chromium.org/67233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 19:33:05 +00:00
rafaelw@chromium.org
ca8f947664 Reland [Object.observe] Don't force normalization of elements for observed objects 
Original Issue: https://codereview.chromium.org/29353003/

TBR=danno
BUG=v8:2946

Review URL: https://codereview.chromium.org/66933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17607 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 19:12:43 +00:00
rafaelw@chromium.org
c824bfb44a Revert "[Object.observe] Don't force normalization of elements for observed objects" 
Broke ARM build

TBR=danno
BUG=

Review URL: https://codereview.chromium.org/66603004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 15:36:22 +00:00
rafaelw@chromium.org
d462dca64a [Object.observe] Don't force normalization of elements for observed objects 
BUG=v8:2946
R=danno@chromium.org

Review URL: https://codereview.chromium.org/29353003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 14:55:13 +00:00
yangguo@chromium.org
9f104a1a3e Revert "Implement Math.sin, cos and tan using table lookup and spline interpolation." 
This reverts commit r17594.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59153007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 13:44:27 +00:00
yangguo@chromium.org
063b7c4ebb Implement Math.sin, cos and tan using table lookup and spline interpolation. 
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50563003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-08 13:10:39 +00:00
rafaelw@chromium.org
ada13dfc3f Remove calls to JSObject::SetLocalPropertyIgnoreAttributesTrampoline within objects.cc 
This includes handlifing:
-SetHiddenPropertiesHashTable
-ObjectHashSet::Add/Remove
-ObjectHashTable::Put

And splitting the following methods which previously took "allow creation" enum arguments to into side-effect-free getters and GetOrCreate*-handlfied getters.

-GetHash (now GetHash & handlified GetOrCreateHash)
-GetIdentityHash (now GetIdentityHash & handlified GetOrCreateIdentityHash)
-GetHiddenPropertiesHashTable (now GetHiddenPropertiesHashTable & handlified GetOrCreateaHiddenPropertiesHashTable)

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/48913008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 11:47:11 +00:00
svenpanne@chromium.org
dc8c314084 Make snapshots reproducible. 
To keep the structure of the serializer more or less untouched, we use
some ingenious Corry-approved(TM) 3-step technology (a.k.a. "hack"):

   * Create copies of code objects.
   * Wipe out all absolute addresses in these copies.
   * Write out the cleaned copies instead of the originals.

In conjunction with --random-seed, our snapshots are reproducible now.

BUG=v8:2885
R=bmeurer@chromium.org, erik.corry@gmail.com

Review URL: https://codereview.chromium.org/54823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 10:14:48 +00:00
svenpanne@chromium.org
82b8e23bc1 Introduce raw accessors for type_feedback_info. 
This pure refactoring is needed for another upcoming CL.

Note that the actual names are still a bit confusing, because this is
still a kind of swiss-army-knife-field. :-/

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/52633003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-11-05 10:05:03 +00:00
jkummerow@chromium.org
ec50a6f33c Work around two ASSERTs that we're hitting now that DEBUG is #defined again 
R=danno@chromium.org

Review URL: https://codereview.chromium.org/49433002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17418 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-28 17:54:43 +00:00
mvstanton@chromium.org
a85c825bb9 The Elements pointer in a JSObject can have a filler map instead of a 
valid fixed array, iff a gc occurred while allocating a fixed array as
part of array construction. Heap verification needs protection against
examining the elements object in this case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/43383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-25 12:26:47 +00:00
danno@chromium.org
7339d45a9f Define DEBUG for v8_optimized_debug=2 
Thereby ensuring there is only a minimal performance regression vs. NDEBUG (now it's only about 10% slower rather than ~2x).

R=jkummerow@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/39183004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17392 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-25 11:10:28 +00:00
ulan@chromium.org
83c63cf555 Out-of-line constant pool on Arm: Stage 2 - Introduce ConstantPoolArray object. 
Second stage of implementing an out-of-line constant pool on Arm.  This CL
Introduces the ConstantPoolArray object which will be used as the backing
store of out-of-line constant pools.  Nothing uses this object yet.

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22601003

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17197 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-14 13:35:06 +00:00
ulan@chromium.org
52c421956a Make objects embedded in optimized code weak. 
This introduces a global weak hash table that maps objects embedded in
optimized code to dependent code lists. Using this table we can deoptimize
optimized code whenever a weak object embedded in the code dies.

BUG=v8:2073
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23477061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17102 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-04 07:25:24 +00:00
mstarzinger@chromium.org
3ee9b84609 Remove deprecated JSObject::GetLocalPropertyType method. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/25453003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-02 08:27:33 +00:00
verwaest@chromium.org
14422a698f Cleanup in IC patching. 
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25001005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-01 09:44:35 +00:00
verwaest@chromium.org
63b584474f Reduce code duplication in IC updating. 
BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25033003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17034 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-10-01 09:30:07 +00:00
verwaest@chromium.org
0f715540a2 Tag handlers as HANDLER rather than STUB. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/25044002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-30 13:53:21 +00:00
verwaest@chromium.org
344e1d9003 Internalize names before using them in slow-mode objects. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/24566005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16944 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-25 15:11:48 +00:00
mvstanton@chromium.org
f26bcd9fef Add field nested_sites to AllocationSite. This field is used to maintain 
allocation site information for nested array and object literals.
It's not used productively in this CL, merely maintained in a minimal
way. (that comes next :)).

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/23463047

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-24 10:30:41 +00:00
mstarzinger@chromium.org
8cbb4dcb49 Handlify JSObject::MigrateInstance and friends. 
This relands the original change from r16899 together with a bugfix for
two unhandlified values which became stale.

R=verwaest@chromium.org
TEST=mjsunit/debug-evaluate-locals-optimized (in GC stress mode)

Review URL: https://codereview.chromium.org/24210011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16905 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-23 19:56:36 +00:00
mstarzinger@chromium.org
40decafa84 Revert "Handlify JSObject::MigrateInstance and friends." 
This is reverted due to mozilla/ecma/Date/15.9.5.9 failing on Windows.

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/24374002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-23 16:53:59 +00:00
mstarzinger@chromium.org
1279103806 Handlify JSObject::MigrateInstance and friends. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23583052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-23 15:02:25 +00:00
mstarzinger@chromium.org
4d64bf9737 Handlify JSObject::AllocateStorageForMap method. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23464089

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-23 11:57:34 +00:00
mvstanton@chromium.org
137b43c9a3 Added a DependentCode field to AllocationSite. It's not currently used, 
this initial CL is just to get the object layout correct.

BUG=
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23567003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16833 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-19 14:13:34 +00:00
mstarzinger@chromium.org
4c85efb597 Handlify JSReceiver::HasProperty and friends. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23496058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-17 11:34:20 +00:00
mstarzinger@chromium.org
16a22a96c3 Handlify JSReceiver::SetProperty and friends. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23601031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-17 11:01:43 +00:00
yangguo@chromium.org
151e514930 Simplify installing concurrently recompiled code. 
Instead of overwriting the code entry of the function, we trigger
an interrupt to install the code on the main thread.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23542029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-12 11:30:56 +00:00
dcarney@chromium.org
cc2257b92a move HEAP to /test 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23468021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-11 07:14:41 +00:00
mstarzinger@chromium.org
1a26455d22 Handlify JSObject::EnsureCanContainHeapObjectElements method. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23818005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-09 14:29:47 +00:00
dcarney@chromium.org
c20f87a654 add uncached Function::New 
TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/24071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-09 07:52:52 +00:00
dcarney@chromium.org
5b0a281604 revert 16584 for breaking build 
TBR=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23680014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-09 07:16:24 +00:00
dcarney@chromium.org
ddc5d437bb add uncached Function::New 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23561007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-09 07:08:34 +00:00
loislo@chromium.org
bbd26abedb Functions may not be optimized and we would like to know in cpu profiler what was the reason. 
Current v8 implementation may disable optimization for a particular function or block it with help of dont_optimize flag.
The patch propagates the reason of that to the SharedFunctionInfo where cpu profiler can get it.

SharedFunctionInfo is a heap object so I extracted 8 bits from OptsCount for handling bailout reason code.

BUG=none
TEST=test-profile-generator/BailoutReason
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23817003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16555 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-05 13:20:51 +00:00
dcarney@chromium.org
d208d048ac remove most Isolate::Current asserts 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23493019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-05 11:27:22 +00:00
titzer@chromium.org
35490d82a9 Add OptimizedCodeList and DeoptimizedCodeList to native contexts. Both lists are weak. This makes it possible to find optimized code that is not referred to by any function, but still needs to be deoptimized. It obsoletes the weak deoptimizing code list in the deoptimizer data and generally simplifies the process of deoptimizing code. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23444029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-04 13:53:24 +00:00
dcarney@chromium.org
615c34869c Push SetAccessor to Template 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23182003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16515 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-04 07:45:36 +00:00
dcarney@chromium.org
3e76d8b870 remove Isolate::Current from most files starting with 'o' through 'r' 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23757017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-04 07:05:11 +00:00
dcarney@chromium.org
bb01557abf remove Isolate::Current from most files starting with 's' through 'v' 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23549011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16507 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-03 11:54:08 +00:00
titzer@chromium.org
7bd61f8ca4 Remove OptimizedCodeEntry *sigh*. 
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/23584004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16465 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-09-02 10:35:34 +00:00
titzer@chromium.org
22b70b0508 Add OptimizedCodeEntry as a new heap object type. An optimized code entry represents an association between the native context, a function, optimized code, and the literals. Such associations are needed by the deoptimizer and optimized code cache to efficiently find related optimized code and functions for a given context or shared function info. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23691002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-28 16:48:40 +00:00
mstarzinger@chromium.org
3fb53cf83a Remove obsolete Oddball setters in FixedArray. 
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/23705002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-28 14:26:22 +00:00
hpayer@chromium.org
4d7375ca98 Clear next map word when folding allocations into js arrays. 
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/22915007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-28 08:39:43 +00:00
mstarzinger@chromium.org
fc68cb74e5 Add RemovePrototype to FunctionTemplate 
This allows functions created from a FunctionTemplate to not have a
prototype property, which is required by DOM methods.

R=mstarzinger@chromium.org
BUG=chromium:272440

Review URL: https://codereview.chromium.org/22990003

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-26 17:40:03 +00:00
verwaest@chromium.org
67b6605c5e Get rid of ConvertFieldToDescriptor. 
This CL additionally fixes up the attributes for FIELD and CONSTANT in SetLocalPropertyIgnoreAttributes.

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23252008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-26 15:30:30 +00:00
dcarney@chromium.org
ad9cc8e716 js accessor creation on Template 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/22903012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-26 11:59:14 +00:00
verwaest@chromium.org
cd9be4139c Revert "Get rid of ConvertFieldToDescriptor and simplify related code." 
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22999048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-23 13:21:01 +00:00
verwaest@chromium.org
f457809c08 Get rid of ConvertFieldToDescriptor and simplify related code. 
R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22861025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-23 11:52:59 +00:00
yangguo@chromium.org
be48c5ae26 Rename "parallel recompilation" to "concurrent recompilation". 
Also introduced macros for flag aliases for temporary backwards compatibility.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23014007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-22 16:14:37 +00:00
verwaest@chromium.org
22942716db Remove special case code for generalizing constants to fields. 
R=bmeurer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22911018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-22 13:43:06 +00:00
verwaest@chromium.org
eb6cbe1486 Never clear debug-stub call ICs. Make a clear distinction between is_debug_stub 
used everywhere but the debugger, and IsDebugBreak, used by the debugger.

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23361014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-22 12:16:00 +00:00
verwaest@chromium.org
20ca26f494 Improve generalization / migration tracing. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23047002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-19 12:32:50 +00:00
svenpanne@chromium.org
bc6fe88030 Desugar bitwise negation into XOR and kill all UnaryOp stuff. 
R=mstarzinger@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/22184004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-06 13:34:51 +00:00
verwaest@chromium.org
9d9930ce99 Migrate instance of deprecated maps in HCheckMaps. 
Currently only direct map checks are supported. Otherwise only polymorphic cases with a generic fallback behave properly, regular polymorphic cases still need to be adapted.

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21536003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-05 16:42:39 +00:00
verwaest@chromium.org
04b5e7fa63 Replace HCheckPrototypeMaps by explicit map checks of constant values. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21065006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-08-05 13:45:16 +00:00
verwaest@chromium.org
e53471dbaa Remove elements transitions from the transition array. 
This is preparatory work for reordering the transition tree. Since elements transitions will be at the root of the transition tree, runtime access to them is slow since we have to walk the transition tree backwards first. Hence remove the optimization that promoted them to a special field, requiring a pointer (mostly NULL) in every non-simple transition array.

R=titzer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21228002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-31 17:08:50 +00:00
mstarzinger@chromium.org
96fc677d25 Pipe a script's CORS status through V8 during compilation. 
In order to properly sanitize exception data during a 'window.onerror'
handler, we need to know whether a script was served with proper CORS
headers at the time it was loaded into V8. This patch adds a single bool
to ScriptOrigin, and pipes that through the compiler to land on the
Script object. We can then retrieve the parameter when calling the
embedder's exception callback.

BUG=crbug.com/159566
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20646006

Patch from Mike West <mkwst@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 17:05:50 +00:00
mstarzinger@chromium.org
8a019050ff Reland "Compilation type and state allocate an unnecessary Smi on v8::Script" (r15940). 
It turns out that this change is not related to the test failures.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/21256003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 17:00:05 +00:00
verwaest@chromium.org
2af164f4d9 Mark maps as unstable if their instances potentially transition away. 
Use this as a prerequisite for adding code dependencies.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/21095005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 16:33:58 +00:00
danno@chromium.org
f3fff3c2f4 Revert 15940: "Compilation type and state allocate an unnecessary Smi on v8::Script." 
Due to Mozilla test failures on Win32 debug

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21062004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15957 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-30 11:24:11 +00:00
mstarzinger@chromium.org
9f4fc77e1e Compilation type and state allocate an unnecessary Smi on v8::Script. 
This patch combines them into a single field, and adjusts the accessors
and setters to take the enum type directly, rather than converting to and
from a Smi value.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/20758002

Patch from Mike West <mkwst@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-29 17:59:02 +00:00
verwaest@chromium.org
6b83c868f0 Convert CONSTANT_FUNCTION to CONSTANT 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19485008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 12:34:50 +00:00
titzer@chromium.org
f612a29f8c Factor out common code from platform-specific deoptimization. Fix Deoptimizer not to need to partition functions, but revoke their code before patching, allowing deoptimizing_code_list to be removed from Code; Add DeoptimizeCodeList API to deoptimizer, which works on a ZoneList<Code*>. 
BUG=
R=mstarzinger@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/19638014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-24 11:12:17 +00:00
verwaest@chromium.org
babce318d1 Eliminate map checks of constant values. 
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19954005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-23 09:18:42 +00:00
mstarzinger@chromium.org
ce81b0d3a8 ES6: Implement WeakSet 
WeakSets work similar to ordinary Sets but the value (which must be an
object) is held weakly.

This is available under --harmony-collections

BUG=v8:2785
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19678023

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-22 08:32:24 +00:00
mvstanton@chromium.org
ec8c6f4692 Rename AllocationSiteInfo to AllocationMemento 
This is just a rename change with the exception of a bug found along the way in
CodeStubGraphBuilder<FastCloneShallowArrayStub>::BuildCodeStub(). There, the
intent is to get the boilerplate object from an AllocationSite. But the wrong
HObjectAccess was used. It only succeeds because it happened to be the same
offset :).

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19595004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 13:30:49 +00:00
mvstanton@chromium.org
3761e0388d With >= 64 non-string instance types, I removed an optimization that allowed us to detect internalized strings with a single bit test. (https://code.google.com/p/v8/source/detail?r=15358) But that change caused a regression, so here is an improvement: 
Put the internalized string types in the lower 64 entries of
INSTANCE_TYPE, and non-internalized string types in the next 64 entries.
This way we can restore the single bit check.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19749004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-19 11:29:11 +00:00
danno@chromium.org
05ec5921be Fix --track_gc_object_stats option. 
- Update ObjectStatsVisitTracker::Visit function to check if CodeCache is of
   CodeCache type, and extract the FixedArray from the struct if so
 - Fix typo in v8-counters.h where count_of_FIXED_ARRAY_XXX fields weren't being
   initialized.

BUG=v8:2780
R=danno@chromium.org, hpayer@chromium.org

Review URL: https://codereview.chromium.org/19257002

Patch from Ross McIlroy <mcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-18 13:00:40 +00:00
machenbach@chromium.org
f24997c1c7 Make deoptimization stress count global. 
Store the deopt stress counter per isolate instead of per shared function info. The old field is removed.

Enable output of the counter value with a new flag.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-18 08:12:01 +00:00
mvstanton@chromium.org
b9f0c06ab2 The gc should be able to traverse all AllocationSites for decision making. The sites are threaded into a weak list. Special problems include: 
* Allocations of AllocationSites occur in generated code, so generated code needs to be able to add to the list. For now I have a special hydrogen instruction, though it would be nice to use general purpose instructions.
* The snapshot contains AllocationSites, and these need to be re-threaded into the list on deserialization.

Something nice is that the AllocationSites are only created in old space, so a special new space visitor isn't required.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18173013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-17 11:50:24 +00:00
mvstanton@chromium.org
b61dfd4a82 A bug in AllocationSite::GetMode(from, to) meant that we didn't update 
boilerplates for SMI to SMI_HOLEY transitions.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18917003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-11 09:39:22 +00:00
olivf@chromium.org
e84649d85e Fix unary op type feedback. 
BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/18526003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15605 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-10 16:03:00 +00:00
mvstanton@chromium.org
23695eb86e Rename AllocationSite::payload to AllocationSite::transition_info 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/18749004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-08 15:00:12 +00:00
mvstanton@chromium.org
67d9051bcd Create AllocationSite objects, pointed to by AllocationSiteInfo. 
This creates a platform where we can do additional things with allocation sites,
other than just aid in reducing array transitions.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/15094018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-08 10:02:16 +00:00
danno@chromium.org
345cc98a25 Generate StoreGlobal stubs with Hydrogen 
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.

R=rossberg@chromium.org, ulan@chromium.org

Committed: http://code.google.com/p/v8/source/detail?r=15419

Review URL: https://codereview.chromium.org/16925008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-05 10:34:02 +00:00
mstarzinger@chromium.org
6bde251534 Handlify JSObject::SetPrototype method. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18089024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-02 15:32:46 +00:00
danno@chromium.org
77c20c30a3 Revert r15419: "Generate StoreGlobal stubs with Hydrogen" 
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18357004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-01 15:12:21 +00:00
danno@chromium.org
a3bce19868 Generate StoreGlobal stubs with Hydrogen 
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/16925008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15419 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-07-01 13:22:13 +00:00
mvstanton@chromium.org
6aed526733 The check for internalized strings relied on the fact that we had less 
than 64 distinct InstanceTypes. We are hitting that boundary, so this
check needs to be more comprehensive. In fact, two bits need to be
tested: verify that kNotStringTag isn't set, and that kInternalizedTag
is set.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/17895002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15358 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-27 13:39:44 +00:00
danno@chromium.org
00709075ea Add DependentCode to PropertyCells 
R=mstarzinger@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/17895004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-26 16:17:12 +00:00
mstarzinger@chromium.org
bd0deb9443 Remove obsolete unchecked accessors in JSFunction. 
R=hpayer@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/17833002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-26 14:04:25 +00:00
loislo@chromium.org
53eb53f4af CPUProfiler: It is not clear why we are using Handle<Object> for scriptId. Lets flip it into Smi/int. 
By the nature it is integer. So we can work with it as with Smi internaly and use int in the external API.

BUG=none
TEST=existing tests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/17600006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-25 14:57:47 +00:00
bmeurer@chromium.org
66efb96621 Fix compilation error introduced with r15287. 
REGEXP was added to Code::Kind after TO_BOOLEAN_IC, but NUMBER_OF_KINDS,
which is used as array size for table[] in ReportCodeKindStatistics, was
still TO_BOOLEAN_IC + 1 (indirectly via LAST_IC_KIND).

BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/17636003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15315 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-25 09:09:25 +00:00
dslomov@chromium.org
91eb5f8d25 DataView implementation. 
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/17153011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-21 13:02:38 +00:00
mstarzinger@chromium.org
a527f451bc Deprecate old code aging mechanism. 
The old code aging mechanism is too agressive with flushing as it leads
to many functions being flushed and recompiled over and over again. By
now the new code aging mechanism has stabilized enough to deprecate the
old fallback mechanism.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/17061004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15209 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-19 17:00:01 +00:00
verwaest@chromium.org
7a229ccf39 Emit deprecated check for constant function transitions. 
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/17287003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-17 16:10:01 +00:00
danno@chromium.org
61a23ceb4d Refactor only: Rename JSGlobaPropertyCell to PropertyCell 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/17064002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15165 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-14 16:06:12 +00:00
mstarzinger@chromium.org
fede5231bc Deprecate several unchecked accessors. 
R=hpayer@google.com
BUG=v8:1490

Review URL: https://codereview.chromium.org/16663009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15123 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-13 15:00:30 +00:00
danno@chromium.org
1b89cbf817 Separate Cell and PropertyCell spaces 
This makes it possible to store additional information on property cells, for example Type and optimized Code dependencies.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/16631002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-12 15:03:44 +00:00
mstarzinger@chromium.org
643350c5d2 Deprecate obsolete JSFunction::unchecked_shared accessor. 
R=hpayer@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/16813005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-12 14:05:56 +00:00
yangguo@chromium.org
74556569d1 Reland "Enable map dependency to in-flight compilation info." 
BUG=248076
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16782004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-12 09:43:22 +00:00
yangguo@chromium.org
6da97b1d4a Revert "Enable map dependency to in-flight compilation info." 
This includes r15032, r15030 and r15005.

R=ulan@chromium.org
BUG=248076

Review URL: https://chromiumcodereview.appspot.com/16482004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-11 11:55:56 +00:00
yangguo@chromium.org
17cfe68015 Enable map dependency to in-flight compilation info. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/16542003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-07 13:27:03 +00:00
dslomov@chromium.org
b3282c290e Recording array buffer views. 
R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15562008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-07 10:52:11 +00:00
rossberg@chromium.org
372457a793 Allow smis for singleton types 
To that end, introduce a generic Box struct.

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/16562003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-06 15:40:28 +00:00
verwaest@chromium.org
16199c63d8 Initialized representations of computed values to None. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14721009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14982 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-06 14:21:35 +00:00
verwaest@chromium.org
5e8679beea Remove the optimized construct stub. 
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15993016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-05 08:43:25 +00:00
yangguo@chromium.org
7f8a3d803c Make assertion scopes thread safe. 
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/15691017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-06-03 15:32:22 +00:00
verwaest@chromium.org
6f5d9f9af2 Move field index into property details, freeing up the value slot of fields. 
BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15941016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-31 19:11:09 +00:00
olivf@chromium.org
88755fb22a Convert ToBooleanStub to a HydrogenStub. Currently just using the existing HBranch instruction, which is still fully implemented in Lithium. Will refactor HBranch in a next CL. 
[
CL breaks mips, since the deoptimizer in Deoptimizer::DoTranslateCommand(...) does not convert smis passed to the stub via a0.
]

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15302004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-29 14:49:28 +00:00
verwaest@chromium.org
af4516847a Don't use fast literal if the boilerplate map is still deprecated. 
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15660005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-23 11:30:24 +00:00
dslomov@chromium.org
fc73052dc2 Externalization API for ArrayBuffer 
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15001041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-23 10:01:42 +00:00
verwaest@chromium.org
36e91242fd Make Object.freeze fast 
This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

Relanding r14758 and r14759 with fix for Test262: only mark properties
and elements READ_ONLY if they are not JS setter/getters. Tightened up
tests to assert frozen-ness, and added targeted tests for the new code
(covering accessors).

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15691007

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-23 07:05:58 +00:00
adamk@chromium.org
4d48bb832f Revert "Make Object.freeze fast" 
and "Fix Object.freeze on dictionary-backed arrays to properly freeze elements"

This reverts r14758 and r14759 due to introducing failures in Test262

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-22 21:27:00 +00:00
adamk@chromium.org
648e99e308 Make Object.freeze fast 
This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/14888005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-22 18:53:58 +00:00
yangguo@chromium.org
9960b24694 Fix unexpected elements transition in JSON.parse 
R=verwaest@chromium.org
BUG=241344

Review URL: https://chromiumcodereview.appspot.com/15739003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-22 13:24:18 +00:00
dcarney@chromium.org
1045d62733 implement fast ReturnValue setters 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15398008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14738 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-22 06:35:38 +00:00
verwaest@chromium.org
9f32d94cb3 Don't create new maps in CurrentMapForDeprecated. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15358005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-21 11:20:24 +00:00
dslomov@chromium.org
2ff3e2e0f4 Preallocate transitioned maps for TypedArrays. 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/15172003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-15 15:23:53 +00:00
danno@chromium.org
cf1b80703f Improve trace_opt output to help find compilation problems 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/14978003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14636 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-13 11:10:31 +00:00
mstarzinger@chromium.org
883d9c4b1c Prevent flushing of code that was set with %SetCode. 
This makes sure that shared function infos that break the one-to-one
mapping to code are marked as un-flushable. Otherwise enqueuing through
the GC meta-data field in the code object doesn't work.

R=rossberg@chromium.org
TEST=cctest/test-api/Threading4

Review URL: https://codereview.chromium.org/14710015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-13 10:59:00 +00:00
verwaest@chromium.org
df57747fc4 Track heap objects. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14996004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14625 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-10 17:17:50 +00:00
verwaest@chromium.org
52008429b7 Use mutable heapnumbers to store doubles in fields. 
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14850006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-08 15:02:08 +00:00
wingo@igalia.com
75d939aceb Generators save and restore stack handlers 
This CL adds machinery to unwind stack handlers from the stack and store
them into a generator's operand array.  It also includes routines to
reinstate them.  Together this allows generators to yield within
try/catch and try/finally blocks.

BUG=v8:2355
R=mstarzinger@chromium.org
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14031028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-08 08:08:23 +00:00
verwaest@chromium.org
0b1a9c9e3d Free up 11 bits in fast-mode PropertyDetails by removing the enumeration-index. 
The descriptors are nowadays ordered in order of addition, so that info was
duplicated.

Review URL: https://chromiumcodereview.appspot.com/14622005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-07 13:09:23 +00:00
verwaest@chromium.org
fd9c82a618 Update deprecated maps before generating optimized code. 
Review URL: https://chromiumcodereview.appspot.com/14847008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-05-02 15:40:07 +00:00
verwaest@chromium.org
99e17bb12a Track storage types of instance variables. 
Review URL: https://chromiumcodereview.appspot.com/14146005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 15:30:41 +00:00
dcarney@chromium.org
c50304209a remove IsOneByteConvertible 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14298021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 14:08:18 +00:00
dcarney@chromium.org
0a32b57594 HasOnlyAsciiChars can return incorrect results. Fixup usages and rename. 
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/14509012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-26 11:34:44 +00:00
mvstanton@chromium.org
e751ad06d9 Constructed arrays can be created with Hydrogen code stubs. The feature is still off by default (--optimize-constructed-arrays). 
BUG=

Review URL: https://codereview.chromium.org/12385014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-25 16:00:32 +00:00
mstarzinger@chromium.org
71dc9e165f Capture receiver in generator object 
Previously there has been no reason to context-allocate the receiver, so
access to the receiver always goes through the stack.  This was failing
with generators, which assumed that forcing context allocation would
relieve the need of storing anything but the context and the function on
the stack.

This CL adds a slot in generator objects to capture the receiver, and
restores it when resuming a generator.

BUG=v8:2355
TEST=mjsunit/harmony/generators-iteration

Review URL: https://codereview.chromium.org/14158006

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14434 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-25 10:59:09 +00:00
danno@chromium.org
f8ddf3a262 Add monomorphic CompareNilICs and Crankshaft support 
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/14367018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-24 11:32:17 +00:00
mstarzinger@chromium.org
0f348e5592 Generator objects can suspend 
* src/ast.h:
* src/parser.cc: Differentiate between the different kinds of yields, in
  anticipation of boxing return values.  Parse `return' into `yield' in
  a generator.

* src/runtime.h:
* src/runtime.cc (Runtime_SuspendJSGeneratorObject): New horrible
  runtime function: saves continuation, context, and operands into the
  generator object.

* src/arm/full-codegen-arm.cc (VisitYield):
* src/ia32/full-codegen-ia32.cc (VisitYield):
* src/x64/full-codegen-x64.cc (VisitYield): Arrange to call
  SuspendJSGeneratorObject.  If the call returns the hole, we suspend.
  Otherwise we resume.

BUG=v8:2355
TEST=These codepaths are tested when the generator is first invoked, and so
are covered by mjsunit/harmony/generators-objects.js.

Review URL: https://codereview.chromium.org/13704010

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-19 14:11:23 +00:00
danno@chromium.org
bc04544f02 Replace math.h with cmath 
This will make it easier to use other STL headers in the future

Review URL: https://codereview.chromium.org/14362023

Patch from Jochen Eisinger <jochen@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14352 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-19 13:26:47 +00:00
danno@chromium.org
244fa50a80 Make it possible to Crankshaft all kinds of stubs. 
Review URL: https://codereview.chromium.org/14307006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-18 09:50:46 +00:00
dslomov@chromium.org
c1a19275d3 First cut at impementing ES6 TypedArrays in V8. 
BUG=

Review URL: https://codereview.chromium.org/13975012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-16 14:16:30 +00:00
mstarzinger@chromium.org
591a8ec86c Calling a generator function returns a generator object 
* src/heap.h:
* src/heap.cc:
* src/objects-debug.cc:
* src/objects-inl.h:
* src/objects-printer.cc:
* src/objects-visiting.cc:
* src/objects.cc:
* src/objects.h: Define a new object type, JSGeneratorObject.

* src/factory.h:
* src/factory.cc (NewFunctionFromSharedFunctionInfo): Generator function
  inital maps construct the new JS_GENERATOR_OBJECT_TYPE objects, not
  generic JSObjects.

* src/runtime.h:
* src/runtime.cc (Runtime_CreateJSGeneratorObject):
* src/arm/full-codegen-arm.cc (Generate):
* src/ia32/full-codegen-ia32.cc (Generate):
* src/x64/full-codegen-x64.cc (Generate): Before visiting generator
  bodies, arrange to construct and return a generator object.

* test/mjsunit/harmony/generators-objects.js: Add tests for the
  properties and prototype of generator objects.

BUG=v8:2355
TEST=mjsunit/harmony/generators-objects

Review URL: https://codereview.chromium.org/13542002

Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-15 12:29:44 +00:00
rossberg@chromium.org
a96ea2faa1 Put common case first 
This might fix a 2% regression that we might be observing for CL 14128.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13811021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-10 09:53:43 +00:00
yangguo@chromium.org
996a80df45 Fix OSR for nested loops. 
R=jkummerow@chromium.org
BUG=v8:2618

Review URL: https://chromiumcodereview.appspot.com/13811014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-10 09:24:31 +00:00
verwaest@chromium.org
64f34cb761 Eagerly parse expected transitions in JSON. 
Review URL: https://chromiumcodereview.appspot.com/13741010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 16:49:28 +00:00
rossberg@chromium.org
b449691db2 ES6 symbols: fix corner cases of equality operators 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13552002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 17:06:22 +00:00
mstarzinger@chromium.org
2816f19680 Add parser support for generators. 
This patchset begins by adding support for "yield", which is unlike other tokens
in JS. In a generator, whether strict or classic, it is a syntactic keyword.
In classic mode it is an identifier. In strict mode it is reserved.

This patch adds YIELD as a token to the scanner, and adapts the preparser and
parser appropriately. It also parses "function*", indicating that a function is
actually a generator, for both eagerly and lazily parsed functions.

Currently "yield" just compiles as "return".

BUG=v8:2355
TEST=mjsunit/harmony/generators-parsing

Review URL: https://codereview.chromium.org/12646003
Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-02 17:34:59 +00:00
dslomov@chromium.org
944c577c7b First steps towards implementing ArrayBuffer &co in V8 
BUG=

Review URL: https://codereview.chromium.org/13064003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 12:50:18 +00:00
verwaest@chromium.org
2541f2507f Add AssertNoAllocation to ensure TransitionArray* transitions is safe. 
Review URL: https://chromiumcodereview.appspot.com/12583013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 15:59:08 +00:00
jkummerow@chromium.org
2159b470d7 Fix crash involving zombie maps escaping from the JSON parser's underground lab 
Zapping is required since transition arrays contain weak references to maps: At the end of a GC cycle, ClearNonLiveTransitions removes references to dead maps from transition arrays. If a marked transition array with weak (dead) references is replaced by another transition array before the end of the GC cycle, dead references are not removed from the replaced transition array. If the replaced transition array is kept alive by a handle, marking will crash when trying to mark the first reference to a dead map.

Review URL: https://codereview.chromium.org/12987013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 15:18:52 +00:00
rossberg@chromium.org
2657e432e4 ES6 symbols: implement name property 
Adds string-valued name property to symbols, and uses it for pretty-printing.

Requires allocating symbols in pointer space, with a custom iterator to skip the unboxed hash.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12459026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 16:51:28 +00:00
svenpanne@chromium.org
e4e4447305 Pass Isolates explicitly in Deoptimizer-related code. 
Removed a few ancient useless ASSERTs on the way. Reduced the number of train wrecks.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12917002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 13:57:49 +00:00
verwaest@chromium.org
37a2e32496 Unify kMaxArguments with number of bits used to encode it. 
Increase the number of bits by 1 by making Flags unsigned.

BUG=chromium:211741

Review URL: https://chromiumcodereview.appspot.com/12886008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 13:35:17 +00:00
dcarney@chromium.org
fbe34d4ba5 remove latin-1 flag 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12700008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-13 20:04:50 +00:00
yangguo@chromium.org
479e39a058 Parallel recompilation: remove interrupt for code generation. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12488006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 18:03:18 +00:00
svenpanne@chromium.org
1a2454d752 Consistently pass a Heap* to HashTable-related AsObject methods. 
This is basically a follow-up CL to https://code.google.com/p/v8/source/detail?r=13908.

BUG=v8:2487

Review URL: https://codereview.chromium.org/12546024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 10:05:42 +00:00
svenpanne@chromium.org
e02315ef77 Added an Isolate parameter to some HashTable/Dictionary methods. TypeFeedbackOracle tweaks. 
BUG=v8:2487

Review URL: https://codereview.chromium.org/12764003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 07:06:36 +00:00
mstarzinger@chromium.org
bbc9f5362a Fix heap snapshot creation for Harmony collections. 
R=yangguo@chromium.org
BUG=v8:2535
TEST=cctest/test-api/Regress2535

Review URL: https://codereview.chromium.org/12615005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 11:31:53 +00:00
dcarney@chromium.org
25058ddd85 Runtime version of declarative native accessors. 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12297012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 11:42:58 +00:00
dcarney@chromium.org
07e2494735 Added back some utf8 optimizations 
R=yangguo@chromium.org
BUG=https://code.google.com/p/v8/issues/detail?id=2551

Review URL: https://codereview.chromium.org/12390057

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-06 15:39:57 +00:00
verwaest@chromium.org
34697f5b12 Make IC patching resilient to flushing of the original target() ic. 
Review URL: https://chromiumcodereview.appspot.com/12451003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 17:38:35 +00:00
rossberg@chromium.org
5c93b18eb2 ES6 symbols: Allow symbols as property names 
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).

Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.

(Baseline CL: https://codereview.chromium.org/12296026/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12330012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 15:00:57 +00:00
verwaest@chromium.org
590a3f8811 Polymorphism support for load IC. 
Review URL: https://chromiumcodereview.appspot.com/12340112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 14:03:27 +00:00
mvstanton@chromium.org
c4caf766bf Allocation Info Tracking, continued. 
Addresses missing cases for array literals.
Adds support for "new Array()" call sites. This isn't complete yet, I have to run with --noinline_new.

BUG=

Review URL: https://codereview.chromium.org/11818021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 16:06:34 +00:00
rossberg@chromium.org
090d09d685 ES6 symbols: Implement Symbol intrinsic and basic functionality 
- Add --harmony-symbols flag.
- Add Symbol constructor; allow symbols as (unreplaced) return value from constructors.
- Introduce %CreateSymbol and %_IsSymbol natives and respective instructions.
- Extend 'typeof' code generation to handle symbols.
- Extend CompareIC with a UNIQUE_NAMES state that (uniformly) handles internalized strings and symbols.
- Property lookup delegates to SymbolDelegate object for symbols, which only carries the toString method.
- Extend Object.prototype.toString to recognise symbols.

Per the current draft spec, symbols are actually pseudo objects that are frozen with a null prototype and only one property (toString). For simplicity, we do not treat them as proper objects for now, although typeof will return "object". Only property access works as if they were (frozen) objects (via the internal delegate object).

(Baseline CL: https://codereview.chromium.org/12223071/)

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12296026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 13:28:55 +00:00
rossberg@chromium.org
764e1a0fcf ES6 symbols: Introduce Symbol class, along with abstract Name class 
The new instance type 'Symbol' represents ES6 symbols (a.k.a. private/unique names). Currently, symbols are simple data objects that only carry a hash code, random-generated upon allocation.

The new type 'Name' now serves as the common super class for strings and symbols, and is supposed to represent property names. We will eventually migrate APIs from String to Name for the standard key type.

Strings and symbols share the same hash field representation, via the Name class. This way, we should be able to use the same code paths for symbols and internalized strings in most cases. Also, Symbol's instance type code is allocated adjacent to internalized string codes in the enum, allowing a simple range check for the common case.

Baseline CL: https://codereview.chromium.org/12210083/

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12223071

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 10:34:31 +00:00
rossberg@chromium.org
55f93b5532 Renamed "symbols" to "internalized strings" throughout the code base, 
in preparation of the introduction of ES6 'symbols' (aka private/unique names).

The SymbolTable became the StringTable. I also made sure to adapt all comments. The only remaining use of the term "symbol" (other than unrelated uses in the parser and such) is now 'NewSymbol' in the API and the 'V8.KeyedLoadGenericSymbol' counter, changing which might break embedders.

The one functional change in this CL is that I removed the former 'empty_string' constant, since it is redundant given the 'empty_symbol' constant that we also had (and both were used inconsistently).

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12210083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-28 17:03:34 +00:00
verwaest@chromium.org
5a543d683a Order arguments of ComputeMonomorphicFlags to match ComputeFlags. 
Review URL: https://chromiumcodereview.appspot.com/12226090

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 15:33:37 +00:00
ulan@chromium.org
3a1eca4242 Remove prototype checks for leaf maps in optimized code. 
Review URL: https://chromiumcodereview.appspot.com/12225099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-20 11:49:54 +00:00
dcarney@chromium.org
0da6e525b7 Split AccessorInfo into DeclaredAccessorInfo and ExecutableAccessorInfo 
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12213012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-12 14:33:08 +00:00
verwaest@chromium.org
672056ac88 Only mark the descriptor that is valid for the map in question. If this map 
transitioned from a map with a different descriptor array (or has no back
pointer), mark all valid descriptors from the start.

This fixes the following memory leak: Map A shares a descriptor array
with map B. Map B adds constant function c that in its scope holds on to
an instance of B. If the descriptor array of A would keep all the shared
descriptors alive, including c, this keeps alive both A and c
indefinitely.

This CL also fixes a bug in descriptor array trimming. When trimming
descriptor arrays we need to trim off the slack as well (thus the entire
storage); and since we are trimming a descriptor array, we need to trim
* kDescriptorSize.

Review URL: https://chromiumcodereview.appspot.com/12084066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-31 10:50:42 +00:00
verwaest@chromium.org
09d6eccaff Replace store array length builtin with codestub. 
Also includes some other minor cleanup to make Keyed related IC code
more uniform.

Review URL: https://chromiumcodereview.appspot.com/11896091

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-25 11:55:29 +00:00
yangguo@chromium.org
24ec13cbd2 Fix additional spec violations wrt RegExp.lastIndex. 
R=svenpanne@chromium.org
BUG=v8:2437

Review URL: https://chromiumcodereview.appspot.com/12033099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-25 10:53:26 +00:00
ulan@chromium.org
e6224d275f Make embedded maps in optimized code weak. 
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-24 11:55:05 +00:00
yangguo@chromium.org
9296975c04 Correctly reset lastIndex in an RegExp object. 
R=svenpanne@chromium.org
BUG=170856

Review URL: https://chromiumcodereview.appspot.com/11896060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-23 12:28:16 +00:00
verwaest@chromium.org
c3d45451f0 Replace special IC builtins and stubs in the map's cache by codestubs. 
Review URL: https://chromiumcodereview.appspot.com/11973008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13453 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 14:53:29 +00:00
mvstanton@chromium.org
7884216804 Additional work to get array literal allocation tracking working, even with --always-opt 
BUG=

Review URL: https://codereview.chromium.org/11817017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-17 08:41:27 +00:00
yangguo@chromium.org
89bef51aca Remove move ascii data hint for one byte strings 
This is mostly a rollback of r12966
[Make kAsciiDataHintTag have correct semantics for all both 1 and 2 byte string types.]

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11857015
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-14 15:17:56 +00:00
mstarzinger@chromium.org
b93b2b98b8 Fix shared function info code replacement. 
This fixes a corner case when the unoptimized code for a shared function
info is replaced while the function is enqueued as a flushing candidate.
Since the link field is stored within the code object, the candidates
list got destroyed.

R=hpayer@chromium.org
BUG=v8:169209
TEST=cctest/test-heap/Regress169209

Review URL: https://codereview.chromium.org/11818052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-11 13:13:11 +00:00
verwaest@chromium.org
7cb764b780 Combine DEBUG_BREAK and DEBUG_PREPARE_STEP_IN into one IC stub kind DEBUG_STUB, encoding DEBUG_BREAK and DEBUG_PREPARE_STEP_IN as extra ic state. 
Review URL: https://chromiumcodereview.appspot.com/11821049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13352 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-10 14:15:12 +00:00
yangguo@chromium.org
e41c17084f Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag. 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 15:47:53 +00:00
jkummerow@chromium.org
aee9febccc Some more instrumentation to narrow down Failure leaks. 
The basic idea is to tag OOM-Failure objects with an ID indicating where they were created. This requires changes to equality comparisons.

Note to MIPS folks: I'm planning to revert this CL in a couple of days, so feel free to skip porting the platform-specific changes.

BUG=chromium:156010

Review URL: https://codereview.chromium.org/11818023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 12:29:06 +00:00
yangguo@chromium.org
45f20e366a Introduce ENABLE_LATIN_1 compile flag 
Mostly a bunch of renaming when flag is disabled.

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 10:30:54 +00:00
mvstanton@chromium.org
529f801fde Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array, 
we store an AllocationSiteInfo object right after the JSArray, with a pointer to the
boilerplate object. Later, if the array transitions we check for the continued existence
of the temporary AllocationSiteInfo object (has no roots). If found, we'll use it to
transition the boilerplate array as well.

Danno's original changeset: https://codereview.chromium.org/10615002/

Review URL: https://codereview.chromium.org/11663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-08 09:03:16 +00:00
yangguo@chromium.org
61f4012989 Use C++ style type casts. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11644097

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-07 15:02:56 +00:00
yangguo@chromium.org
bccef0c712 Reland r13275 and 13276 (Remove most uses of StringInputBuffer). 
R=dcarney@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11727003
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13291 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-31 11:13:50 +00:00
yangguo@chromium.org
121f3f6020 Revert r13275 and 13276 (Remove most uses of StringInputBuffer). 
This is due to test failures in test-mark-compact/BootUpMemoryUse.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11688003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-27 10:03:17 +00:00
yangguo@chromium.org
7f074acd8d Remove most uses of StringInputBuffer 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11638037
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-24 08:29:48 +00:00
yangguo@chromium.org
17a54b61fe Fix compile warning. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11642020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 13:38:00 +00:00
yangguo@chromium.org
9569b20db2 Replace the use CharacterStreams in Heap::AllocateSymbolInternal and String::ComputeHash 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11593007
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 13:27:20 +00:00
rossberg@chromium.org
b25c040c2c Extend API to allow setting length property for function templates. 
R=yangguo@chromium.org
BUG=125308

Review URL: https://codereview.chromium.org/11631002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13240 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 10:28:36 +00:00
danno@chromium.org
1f4b4625ff Re-land Crankshaft-generated KeyedLoad stubs. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11528003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-18 16:25:45 +00:00
ulan@chromium.org
6e12a16aac Use a filter instead of a visitor to deoptimize selected functions in a context. 
This makes the DeoptimizeAll function O(n) instead of O(n^2) where n in the number of optimized functions.

Before this change, DeoptimizeAll iterated over the optimized function list and called DeoptimizingVisitor for each function. The visitor iterated over the optimized function list again to remove the functions that share the same optimized code.

This change partitions the optimized function list into one or more lists of related functions in one pass over the optimized function list.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11547015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13226 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-17 10:23:52 +00:00
rossberg@chromium.org
1080d2aade Object.oberve: assertions to narrow down flaky crashes with array length mutation. 
R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11566027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-14 14:19:18 +00:00
rossberg@chromium.org
76375de29d Object.observe: prevent observed objects from using fast elements. 
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.

R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11477006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-12 11:38:24 +00:00
mstarzinger@chromium.org
4e42a3295a Clear optimized code map during incremental marking. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11458011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 17:28:40 +00:00
yangguo@chromium.org
f02af74575 Cleanup StringCharacterStream and add initial test cases. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11438046
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 10:22:15 +00:00
jkummerow@chromium.org
d1cbd1a98c Flush out potential leaks of Failure objects 
Review URL: https://codereview.chromium.org/11475027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 12:18:54 +00:00
danno@chromium.org
64fc1f99cb Revert 13157, 13145 and 13140: Crankshaft code stubs. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11498006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 11:09:12 +00:00
yangguo@chromium.org
a2d0b05a11 Add StringBufferStream 
add a class StringBufferStream which will replace
StringInputBuffer and SafeStringInputBuffer and requires no
ascii/two byte encoding scheme

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11428106
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-06 11:49:15 +00:00
yangguo@chromium.org
6c92aba643 Fix spec violations related to regexp.lastIndex 
BUG=v8:2437, v8:2438

Review URL: https://chromiumcodereview.appspot.com/11451005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 12:32:25 +00:00
danno@chromium.org
f19959cd22 Enable stub generation using Hydrogen/Lithium (again) 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Committed: https://code.google.com/p/v8/source/detail?r=13105

Committed: https://code.google.com/p/v8/source/detail?r=13117

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 11:04:10 +00:00
danno@chromium.org
66f6a8182c Revert 13117: "Enable stub generation using Hydrogen/Lithium (again)" 
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/11415261

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-03 17:16:51 +00:00
danno@chromium.org
78b09625d5 Enable stub generation using Hydrogen/Lithium (again) 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Committed: https://code.google.com/p/v8/source/detail?r=13105

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-03 15:51:05 +00:00
danno@chromium.org
0a3bcc8c05 Revert 13105: "Enable stub generation using Hydrogen/Lithium." 
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11414262

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-30 17:45:45 +00:00
danno@chromium.org
c115ff4e33 Enable stub generation using Hydrogen/Lithium. 
This initial implementation generates only KeyedLoadICs using the new Hydrogen stub infrastructure.

Review URL: https://codereview.chromium.org/10701054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13105 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-30 17:31:30 +00:00
verwaest@chromium.org
cfd4a240ef Pass FixedArrayBase in elements.cc. 
This avoids casting problems in case of empty_fixed_array as
FixedDoubleArray with size 0. This avoids prematurely shortcutting in
case of 0 all over the place, which in turn leads to errors.

Review URL: https://chromiumcodereview.appspot.com/11299226

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-29 15:58:16 +00:00
svenpanne@chromium.org
5a4e0f1c79 Simplify and fix code aging. 
Making the code size predictable is hard, and to make things even more
complicated, the start of a function can contain various stuff like calls to a
profiling hook, receiver adjustment or dynamic frame alignment. Instead of
tackling all these problems separately, we now simply record the offset where
patching should happen later in the Code object itself.

Review URL: https://codereview.chromium.org/11316218

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13081 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-29 07:38:00 +00:00
mmassi@chromium.org
a0582112f8 Revert r13025 and r13026 (they introduced a bug on arm and regressed octane crypto). 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11316151

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-23 10:53:03 +00:00
mmassi@chromium.org
5e7f30a596 Use the property load IC for accessing the array length. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11299004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-21 11:49:15 +00:00
yangguo@chromium.org
36f5b6d41f Rename IsAsciiRepresentation 
This is a straight rename:

IsAsciiRepresentation -> IsOneByteRepresentation
IsAsciiRepresentationUnderneath -> IsOneByteRepresentationUnderneath
AllocateRawAsciiString -> AllocateRawOneByteString
AllocateStringFromAscii -> AllocateStringFromOneByte

R=yangguo@chromium.org,
BUG=

Review URL: https://chromiumcodereview.appspot.com/11308066
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-21 10:01:05 +00:00
verwaest@chromium.org
67c9e9d065 MIPS: Support all fast elements kinds in the major array operations. Currently missing support for unshift. 
Port r12969 (b10320d7)

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/11412120

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-21 09:54:53 +00:00
verwaest@chromium.org
08cfda49f2 Ensure CopyElementsImpl is always executed so it fills in holes even if from_size is 0. Allow FixedDoubleArray::cast to also support FixedArray with size 0. 
Review URL: https://chromiumcodereview.appspot.com/11280054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-19 15:00:34 +00:00
rossberg@chromium.org
8d79ff46d0 Clean-up refactoring to eliminate GetLocalElementKind. 
Eliminates substantial amounts of fragile code duplication and special casing.

Also fixes "a".propertyIsEnumerable(0) to correctly return true.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11420011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12990 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-16 13:28:34 +00:00
yangguo@chromium.org
3699616609 Rename SeqAsciiString 
This is a straight rename:

NewRawAsciiString -> NewRawOneByteString
SeqAscii -> SeqOneByte

SeqOneByteString cannot yet take non-ascii data.

R=yangguo@chromium.org,
BUG=

Review URL: https://chromiumcodereview.appspot.com/11411005
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 13:31:27 +00:00
verwaest@chromium.org
a08194c83a Support all fast elements kinds in the major array operations. 
Currently missing support for unshift.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11377132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 12:19:14 +00:00
yangguo@chromium.org
7fc1751821 Make kAsciiDataHintTag have correct semantics for all both 1 and 2 byte string types. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11360251
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-15 10:29:11 +00:00
jkummerow@chromium.org
1c086d1202 Lattice-based representation inference, powered by left/right specific type feedback for BinaryOps and comparisons 
Review URL: https://chromiumcodereview.appspot.com/10837165

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-14 15:59:45 +00:00
svenpanne@chromium.org
673924413f Re-land rev. 12849 and 12868 (Heavy cleanup of the external pointer API + related fix). 
Review URL: https://codereview.chromium.org/11365224

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 12:27:03 +00:00
yangguo@chromium.org
827f8919f4 Reverting r12937. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11293246

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12942 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-13 10:36:20 +00:00
yangguo@chromium.org
ce884e13e3 Make kAsciiDataHintTag have correct semantics for all both 1 and 2 byte string types. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11361171

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12937 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 14:57:59 +00:00
rossberg@chromium.org
92e783bc28 Minor cleanup and optimisation of element methods. 
R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11365175

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-12 11:08:34 +00:00
svenpanne@chromium.org
09666b60b8 Rollback of r12868, r12849 on bleeding_edge. 
Fixed visibility attribute for GetPointerFromInternalField

Heavy cleanup of the external pointer API.

Review URL: https://codereview.chromium.org/11359125

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-09 10:07:54 +00:00
rossberg@chromium.org
fbc6e0d883 Object.observe: generate change records for indexed properties. 
Details:
- Extend ElementAccessors with GetAttributes method.
- Add HasLocalElement, Get[Local]ElementAttribute methods to JSReceiver/JSObject.
- Otherwise, mirror implementation for named properties.

Cannot correctly handle the cases yet where an accessor is redefined or deleted.

Also fixed handling of object info table.

(Based on CL https://codereview.chromium.org/11362115/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11365111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 12:58:08 +00:00
yangguo@chromium.org
943c10bb87 Rename kAsciiStringTag to kOneByteStringTag 
This is just a rename. After commit, I'll begin with the semantic changes.
Until those are complete, kOneByteStringTag will have the same meaning as
kAsciiStringTag.

BUG=

Review URL: https://chromiumcodereview.appspot.com/11293168
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12897 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 12:14:29 +00:00
mstarzinger@chromium.org
a31889e2de Fix slack tracking when instance prototype changes. 
This fixes a corner case when the instance prototype of a function is
changed while inobject slack tracking is still in progress. This caused
the intial map to be unrelated for functions with the same shared info
and hence the shared construct stub is no longer generic enough to work
for all those functions.

R=danno@chromium.org
BUG=chromium:157019
TEST=mjsunit/regress/regress-crbug-157019

Review URL: https://codereview.chromium.org/11293059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-08 11:56:44 +00:00
rossberg@chromium.org
e059e64c98 Object.observe: include oldValue in change records, 
plus more accurate distinction of different change types.

Required handlifying more code.

Also fixed a handlification bug in JSProxy::GetElementAttributeWithHandler.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11362115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12888 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-07 14:14:50 +00:00
mstarzinger@chromium.org
c54fc70f13 Store Object.observe state per-isolate rather than per-context 
This requires adding a new JSObject to the strong root list and populating it from
object-observe.js. The main other change is that we now directly use ObjectHashTable
from JS rather than using WeakMap, since using the latter would end up leaking whichever
Context initialized that observation state.

Added a test via the API showing that different contexts all end up working on the same state.

Review URL: https://codereview.chromium.org/11274014
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 16:47:15 +00:00
rossberg@chromium.org
beaccd74cb Object.observe: implement map bit and functions to access it. 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11276028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-06 12:30:22 +00:00
svenpanne@chromium.org
f3807ca17b Heavy cleanup of the external pointer API. 
Added highly efficient Object::SetAlignedPointerInInternalField and
Object::GetAlignedPointerFromInternalField functions for 2-byte-aligned
pointers. Their non-aligned counterparts Object::GetPointerFromInternalField and
Object::SetPointerInInternalField are now deprecated utility functions.

External is now a true Value again, with New/Value/Cast using a JSObject with an
internal field containing a Foreign. External::Wrap, and External::Unwrap are now
deprecated utility functions.

Added Context::GetEmbedderData and Context::SetEmbedderData. Deprecated
Context::GetData and Context::SetData, these are now only wrappers to access
internal field 0.

Added highly efficient Context::SetAlignedPointerInEmbedderData and
Context::GetAlignedPointerFromEmbedderData functions for 2-byte-aligned
pointers.

Review URL: https://codereview.chromium.org/11190050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-11-05 10:25:32 +00:00
mstarzinger@chromium.org
8133d85955 Fix test failures in r12813. 
R=yangguo@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/11264035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 13:54:10 +00:00
mstarzinger@chromium.org
b55988625d Get rid of obsolete unchecked accessors. 
R=yangguo@chromium.org
BUG=v8:1490

Review URL: https://codereview.chromium.org/11271020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-25 11:52:37 +00:00
yangguo@chromium.org
3c5e899378 Fix two-char hash to use correct fallback for zero hashes. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11228004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-22 10:38:40 +00:00
verwaest@chromium.org
a0c9856bce Get the target field index when transitioning. 
Review URL: https://chromiumcodereview.appspot.com/11194080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-19 10:48:18 +00:00
verwaest@chromium.org
b61933ba10 Eagerly follow transitions to existing maps while json parsing. 
Review URL: https://chromiumcodereview.appspot.com/11184006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-17 14:09:42 +00:00
verwaest@chromium.org
72424b3987 Move DescriptorArray into the map. 
Review URL: https://chromiumcodereview.appspot.com/11188031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-17 13:04:49 +00:00
mvstanton@chromium.org
b3c0ed8245 Enable --verify-heap in release mode 
R=mstarzinger@chromium.org
BUG=v8:2120

Review URL: https://codereview.chromium.org/11118018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-12 11:41:14 +00:00
verwaest@chromium.org
ad6a21c0d0 Remove descriptors pointer. 
Secondary changes:
- don't transfer ownership back on CNLT
- turned debugging checks back into ASSERT

Review URL: https://chromiumcodereview.appspot.com/11099064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-11 12:01:19 +00:00
verwaest@chromium.org
e5620d5a58 Also use binary search to search through valid entries. 
Review URL: https://chromiumcodereview.appspot.com/11028056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-10-10 14:48:07 +00:00
yangguo@chromium.org
681eda652d Fast path for symbol lookup in JSON.parse. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10969069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12598 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-24 14:23:46 +00:00
verwaest@chromium.org
8b57f2694b Reduce space usage of simple transitions and descriptors holders. 
Review URL: https://chromiumcodereview.appspot.com/10915260

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12544 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-19 09:54:10 +00:00
verwaest@chromium.org
5bf15c5d6c Preallocate space in descriptor arrays. 
Review URL: https://chromiumcodereview.appspot.com/10916336

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12538 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-18 13:25:12 +00:00
verwaest@chromium.org
204d22a583 Moving the WhitenessWitness back to DescriptorArray. 
TransitionArrays never allocate while being created.

Review URL: https://chromiumcodereview.appspot.com/10908237

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-14 15:10:31 +00:00
verwaest@chromium.org
ebd3241b05 Sharing of descriptor arrays. 
This CL adds multiple things:
Transition arrays do not directly point at their descriptor array anymore, but rather do so via an indirect pointer (a JSGlobalPropertyCell).

An ownership bit is added to maps indicating whether it owns its own descriptor array or not.

Maps owning a descriptor array can pass on ownership if a transition from that map is generated; but only if the descriptor array stays exactly the same; or if a descriptor is added.

Maps that don't have ownership get ownership back if their direct child to which ownership was passed is cleared in ClearNonLiveTransitions.

To detect which descriptors in an array are valid, each map knows its own NumberOfOwnDescriptors. Since the descriptors are sorted in order of addition, if we search and find a descriptor with index bigger than this number, it is not valid for the given map.

We currently still build up an enumeration cache (although this may disappear). The enumeration cache is always built for the entire descriptor array, even if not all descriptors are owned by the map. Once a descriptor array has an enumeration cache for a given map; this invariant will always be true, even if the descriptor array was extended. The extended array will inherit the enumeration cache from the smaller descriptor array. If a map with more descriptors needs an enumeration cache, it's EnumLength will still be set to invalid, so it will have to recompute the enumeration cache. This new cache will also be valid for smaller maps since they have their own enumlength; and use this to loop over the cache. If the EnumLength is still invalid, but there is already a cache present that is big enough; we just initialize the EnumLength field for the map.

When we apply ClearNonLiveTransitions and descriptor ownership is passed back to a parent map, the descriptor array is trimmed in-place and resorted. At the same time, the enumeration cache is trimmed in-place.

Only transition arrays contain descriptor arrays. If we transition to a map and pass ownership of the descriptor array along, the child map will not store the descriptor array it owns. Rather its parent will keep the pointer. So for every leaf-map, we find the descriptor array by following the back pointer, reading out the transition array, and fetching the descriptor array from the JSGlobalPropertyCell. If a map has a transition array, we fetch it from there. If a map has undefined as its back-pointer and has no transition array; it is considered to have an empty descriptor array.

When we modify properties, we cannot share the descriptor array. To accommodate this, the child map will get its own transition array; even if there are not necessarily any transitions leaving from the child map. This is necessary since it's the only way to store its own descriptor array.

Review URL: https://chromiumcodereview.appspot.com/10909007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 16:43:57 +00:00
yangguo@chromium.org
6a9e4048aa Introduce new API to expose external string resource regardless of encoding. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/10917211

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-12 11:29:50 +00:00
yangguo@chromium.org
266cca47fc Add more checks for native callback results. 
R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10928083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-09-10 13:38:21 +00:00
rossberg@chromium.org
ccc827a6f8 Allocate block-scoped global bindings to global context. 
- The global object has a reference to the current global scope chain.
  Running a script adds to the chain if it contains global lexical declarations.
- Scripts are executed relative to a global, not a native context.
- Harmony let and const bindings are allocated to the innermost global context;
  var and function still live on the global object.
  (Lexical bindings are not reflected on the global object at all,
  but that will probably change later using accessors, as for modules.)
- Compilation of scripts now needs a (global) context (previously only eval did).
- The global scope chain represents one logical scope, so collision tests take
  the chain into account.

R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10872084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-28 11:25:08 +00:00
ulan@chromium.org
b588b0949f Disallow updates to ic_with_type_info_count with negative values. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/10883064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-27 15:17:14 +00:00
verwaest@chromium.org
efb53e1499 Make order of addition the primary order of descriptor arrays. 
The order by name is maintained as secondary order by using unused bits in the property details.

This is preliminary work towards sharing descriptors arrays.

The change allows us
- to get rid of the LastAdded bits in the map, binding it to the number of valid descriptors for the given map
- to avoid resorting by enumeration index to create the cache
- (maybe in the future, depending on performance) to get rid of the enumeration cache altogether.

Although generally the number_of_descriptors equals the NumberOfOwnDescriptors in the current version, this is preliminary work towards sharing    descriptors, where maps may have more descriptors than are valid for the map.

Review URL: https://chromiumcodereview.appspot.com/10879013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-27 13:47:34 +00:00
rossberg@chromium.org
cd585f26ab Introduce global contexts to represent lexical global scope(s). 
They are yet unused; actual allocation of global lexical bindings in these contexts is implemented in a separate follow-up CL.

R=svenpanne@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/10876067

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12384 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-27 09:40:26 +00:00
danno@chromium.org
3544e2e875 Disable speculative LICM when it may lead to unnecessary deopts 
BUG=v8:2250
R=vegorov@chromium.org
TEST=tests/mjsunit/regress/regress-2250.js

Review URL: https://chromiumcodereview.appspot.com/10867033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-23 21:08:58 +00:00
rossberg@chromium.org
55e6227817 Rename JSGlobalProxy::context to native_context, 
for clarity and consistency with GlobalObject::native_context.

R=svenpanne@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10861007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-20 11:35:50 +00:00
rossberg@chromium.org
984d0b0925 Rename Context::global to Context::global_object, 
in preparation for global lexical scope.

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10832365

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 12:59:00 +00:00
rossberg@chromium.org
42552808ab Rename "global context" to "native context", 
in anticipation of the upcoming lexical global scope.

Mostly automatised as:

for FILE in `egrep -ril "global[ _]?context" src test/cctest`
do
  echo $FILE
  sed "s/Global context/Native context/g" <$FILE >$FILE.0
  sed "s/global context/native context/g" <$FILE.0 >$FILE.1
  sed "s/global_context/native_context/g" <$FILE.1 >$FILE.2
  sed "s/GLOBAL_CONTEXT/NATIVE_CONTEXT/g" <$FILE.2 >$FILE.3
  sed "s/GlobalContext/NativeContext/g" <$FILE.3 >$FILE
  rm $FILE.[0-9]
done

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/10832342

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-17 09:03:08 +00:00
verwaest@chromium.org
d53de0590a Swapped transition array and descriptor array. 
Now a map points to a transition array which contains the descriptor array. The descriptor array is now immutable. The next step is to share the descriptor array with all back-pointed maps as long as there is a single line of extension. Maps that require a descriptor array but don't need transitions will still need a pseudo-empty transition array to contain the descriptor array.

Review URL: https://chromiumcodereview.appspot.com/10816005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-08-13 08:43:16 +00:00