Commit Graph

386 Commits

Author SHA1 Message Date
bmeurer@chromium.org
c0e047d53f Improve write barriers in optimized code.
Use a cheaper RecordWriteForMap() to update the
write barrier for maps. And skip the value check
in RecordWriteField() when we statically know that
the value is in new space (and therefore has "pointers
to here are interesting" flag set).

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/297763006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21630 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 10:59:11 +00:00
jochen@chromium.org
56a486c322 Use full include paths everywhere
- this avoids using relative include paths which are forbidden by the style guide
- makes the code more readable since it's clear which header is meant
- allows for starting to use checkdeps

BUG=none
R=jkummerow@chromium.org, danno@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/304153016

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21625 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-03 08:12:43 +00:00
verwaest@chromium.org
f4aa3ab03d Don't push eax/rax before calling Runtime_Abort
Additionally delete the unused Throw(BailoutReason)

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/308083006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21582 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-30 14:27:19 +00:00
danno@chromium.org
6fa616ad73 Convert String array index/length hash to BitField
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/300023011

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-27 14:55:29 +00:00
danno@chromium.org
621c7eb673 Convert ElementsKind into a BitField
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/306513002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21515 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-27 09:38:01 +00:00
bmeurer@chromium.org
7e8678bbaa Avoid HeapObject check in HStoreNamedField.
This way an HStoreNamedField instruction can never deoptimize
itself, which is another important step towards a working
store elimination.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/299373005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-27 07:17:08 +00:00
hpayer@chromium.org
6ed0102b1d Remove high promotion mode.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/296413004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-26 12:58:55 +00:00
bmeurer@chromium.org
cdcee29ef7 LoadUint32() doesn't need a scratch register.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/293363005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-26 06:41:21 +00:00
yangguo@chromium.org
fe243379f8 Decouple CpuFeatures from serializer state.
Traditionally, we cross compile a snapshot iff the serializer is enabled.
This will change in the future.

Changes:
 - CpuFeatures probing is done once per process, depending on whether we
   cross compile.
 - CpuFeatures are consolidated into the platform-independent assembler.h
   as much as possible.
 - FLAG_enable_<feature> will only be checked at probing time (already the
   case for ARM).
 - The serializer state is cached by the MacroAssembler.
 - PlatformFeatureScope is no longer necessary.
 - CPUFeature enum values no longer map to CPUID bit fields.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/285233010

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-16 15:18:24 +00:00
yangguo@chromium.org
7a5207803c Refactor MacroAssembler::Prologue.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/288213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21329 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-15 12:10:00 +00:00
yangguo@chromium.org
abeb747c92 Simplify DoubleRegister for the ia32 port.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/284503002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21284 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-13 09:05:00 +00:00
yangguo@chromium.org
a7a6abbde6 Require CMOV support for the ia32 port.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/275253004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-13 08:16:26 +00:00
yangguo@chromium.org
3ccedf8952 Clean up debugger flags.
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/261253005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-12 13:47:01 +00:00
verwaest@chromium.org
ed64101bc7 Reland and fix r21225 and r21226
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/272203002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 16:18:58 +00:00
ishell@chromium.org
cb1a32885c [Sheriff] This reverts commits r21225 and r21226 for breaking Linux64 build.
Revert "Make BitField3 a raw uint32 field, and move to the start of the map."
Revert "Make space available in bf3 by moving FunctionWithPrototype to bf1"

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/278883002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 14:28:59 +00:00
verwaest@chromium.org
ec195cd929 Make BitField3 a raw uint32 field, and move to the start of the map.
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/272163002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 13:18:25 +00:00
yangguo@chromium.org
3fa6100ed3 Require SSE2 support for the ia32 port.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/275433004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 13:01:50 +00:00
mstarzinger@chromium.org
55c077f96e Remove broken %_Log functionality.
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/265283007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-06 09:28:08 +00:00
svenpanne@chromium.org
4dca23f825 Added a Isolate* parameter to Serializer::enabled().
This parameter will soon be used when a few pseudo-classes like
Serializer are turned into real classes. The current CL is already big
enough, untying our Gordian knot called "startup" will continue...

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/260003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 09:50:58 +00:00
bmeurer@chromium.org
d4b533d41b Bulk update of Google copyright headers in source files.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/259183002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-29 06:42:26 +00:00
ulan@chromium.org
60b14ea631 Convert function.name to API-style accessor and make CallApiGetterStub serializable.
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/254783003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-28 08:26:35 +00:00
yangguo@chromium.org
cb2f43cb14 Always include debugger support.
Motivation: we do not have test coverage for debuggersupport=off.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/256653004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-25 11:00:37 +00:00
svenpanne@chromium.org
b8d27f9d38 CodeStubs contain their corresponding Isolate* now. (part 2)
This CL mechanically removes all useless Isolate* parameters from code
stub functions, making things quite a bit simpler.

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/255543003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20940 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-24 12:07:40 +00:00
svenpanne@chromium.org
dd30db9021 CodeStubs contain their corresponding Isolate* now. (part 1)
This is a purely mechanical change, adding an Isolate* to the CodeStub
constructor and a corresponding field plus a getter. A few methods in
CodeStub and its subclasses can be simplified now, but this is done in
a separate CL.

The underlying reason apart from simplicity is that deep down in the
call chain we need to detect if the serializer is active or not. This
information will be part of the Isolate, not a global variable with
funky synchronization primitives around it (which is fundamentally
wrong and the underlying cause for race conditions and a catch-22
during initialization).

BUG=359977
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/246643014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20919 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-24 06:25:42 +00:00
yangguo@chromium.org
9be61ddb8a Hide some runtime functions.
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/212163004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-26 15:51:48 +00:00
titzer@chromium.org
df25d21dee IA32: Rename MacroAssembler::Set() and MacroAssembler::SafeSet() to Move() and SafeMove().
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/208073003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20192 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-24 13:00:05 +00:00
jkummerow@chromium.org
b7c3cd5e37 [ia32/x64] Smaller instruction to check NaN
substract 1 and test for overflow

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/202083002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-24 10:18:27 +00:00
titzer@chromium.org
a428b0d588 Add a utility method to the ia32 macro assembler to move a double immediate into an XMM register.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/197233011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-21 12:16:37 +00:00
svenpanne@chromium.org
1a6f977d6a Tweaked FlooringDiv back to TruncatingDiv again.
This is a first step towards getting the flooring division by a
constant working again (which will be a separate CL).

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/197873029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20048 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-19 07:01:08 +00:00
mvstanton@chromium.org
6a4a934d8d Utility functions for pretenure call new. These functions aren't yet called in the tree but will be in the next days. AssertUndefinedOrAllocationSite is to be used in several places where AllocationSite feedback is optional.
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/197643008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-17 13:55:22 +00:00
titzer@chromium.org
91a2aa6a2c Add MacroAssembler::Move(reg, immediate) on IA32.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/188463003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-11 08:52:48 +00:00
bmeurer@chromium.org
bf86e624d4 Reland "Handle non-power-of-2 divisors in division-like operations".
Fixed the flooring div bug and added a test case.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/191293012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-10 10:39:17 +00:00
svenpanne@chromium.org
fa6d25a602 Revert "Handle non-power-of-2 divisors in division-like operations", "A64 tweaks for division-like operations." and "Windows build fix.".
This reverts commit 19719, 19720 and 19721 because
mozilla/ecma/Date/15.9.3.1-1 fails (in release mode only?).

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/189963005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-07 13:11:56 +00:00
svenpanne@chromium.org
94c450fcb9 Handle non-power-of-2 divisors in division-like operations
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/190383002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19719 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-07 11:44:04 +00:00
mvstanton@chromium.org
df988c7f6b The Array function must be looked up in the native context.
Platforms x64, a64, arm and mips had the bug that the array function was looked
up in the global context instead of the native context. Fix this, restoring a
weakened assert in hydrogen along the way (by the fix for crbug 347528, which
helped find this case).

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/184383003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-28 10:39:36 +00:00
jacob.bramley@arm.com
baf2614853 Remove the unused LoadInitialArrayMap.
BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/173883003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-20 16:36:53 +00:00
jacob.bramley@arm.com
847aad8059 Pass a BailoutReason to Runtime::kAbort.
BUG=
R=rmcilroy@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/168903004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-18 13:03:24 +00:00
mvstanton@chromium.org
371d6f6a98 We shouldn't throw under FLAG_debug_code, rather abort.
Throwing under FLAG_debug_code confuses the rest of our infrastructure
which expects a safe point at the site of call into the runtime
for throw. We were doing that to make a clusterfuzz test happy, but
the better solution is to assert/abort under debug_code, and prevent
clusterfuzz from fuzzing on internal APIs that crash on incorrect
values.

We'll need to alter the fuzzer to turn off fuzzing for:

string-natives.js
lithium/SeqStringSetChar.js
regress/regress-seqstrsetchar-ex3.js
regress/regress-seqstrsetchar-ex1.js
regress/regress-crbug-320922.js

So as to prevent the fuzzer from running
%_OneByteSeqStringSetChar() and
%_TwoByteSeqStringSetChar().

BUG=
R=hpayer@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/139903005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-28 11:53:11 +00:00
dcarney@chromium.org
d1a10c6e37 stub fast api calls
R=verwaest@chromium.org, vervaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/140613004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-27 09:57:54 +00:00
hpayer@chromium.org
83a1df2354 Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead.
BUG=
R=mstarzinger@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/141653016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-23 13:02:27 +00:00
verwaest@chromium.org
342b534e7e Stay in fast enum case if the empty_slow_element_dictionary is used.
This fixes slow for-in over frozen objects.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/135903014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-21 11:20:11 +00:00
jarin@chromium.org
19d832719e This is a preview of a first step towards unification of the hydrogen
call machinery.  The change replaces CallNamed, CallKeyed,
CallConstantFunction and CallKnownGlobal hydrogen instructions with two
new instructions with a more lower level semantics:

1. CallJSFunction for direct calls of JSFunction objects (no
   argument adaptation)

2. CallWithDescriptor for calls of a given Code object according to
   the supplied calling convention.

Details:

CallJSFunction should be straightforward, the main difference from the
existing InvokeFunction instruction is the absence of argument adaptor
handling. (As a next step, we will replace InvokeFunction with an
equivalent hydrogen code.)

For CallWithDescriptor, the calling conventions are represented by a
tweaked version of CallStubInterfaceDescriptor. In addition to the
parameter-register mapping, we also define parameter-representation
mapping there. The CallWithDescriptor instruction has variable number of
parameters now - this required some simple tweaks in Lithium, which
assumed fixed number of arguments in some places.

The calling conventions used in the calls are initialized in the
CallDescriptors class (code-stubs.h, <arch>/code-stubs-<arch>.cc), and
they live in a new table in the Isolate class. I should say I am not
quite sure about Representation::Integer32() representation for some of
the params of ArgumentAdaptorCall - it is not clear to me wether the
params could not end up on the stack and thus confuse the GC.

The change also includes an earlier small change to argument adaptor
(https://codereview.chromium.org/98463007) that avoids passing a naked
pointer to the code entry as a parameter. I am sorry for packaging that
with an already biggish change.

Performance implications:

Locally, I see a small regression (.2% or so). It is hard to say where
exactly it comes from, but I do see inefficient call sequences to the
adaptor trampoline. For example:

;;; <@78,#24> constant-t
bf85aa515a     mov edi,0x5a51aa85          ;; debug: position 29
;;; <@72,#53> load-named-field
8b7717         mov esi,[edi+0x17]          ;; debug: position 195
;;; <@80,#51> constant-s
b902000000     mov ecx,0x2                 ;; debug: position 195
;;; <@81,#51> gap
894df0         mov [ebp+0xf0],ecx
;;; <@82,#103> constant-i
bb01000000     mov ebx,0x1
;;; <@84,#102> constant-i
b902000000     mov ecx,0x2
;;; <@85,#102> gap
89d8           mov eax,ebx
89cb           mov ebx,ecx
8b4df0         mov ecx,[ebp+0xf0]
;;; <@86,#58> call-with-descriptor
e8ef57fcff     call ArgumentsAdaptorTrampoline  (0x2d80e6e0)    ;; code: BUILTIN

Note the silly handling of ecx; the hydrogen for this code is:

0 4 s27 Constant 1  range:1_1 <|@
0 3 t30 Constant 0x5bc1aa85 <JS Function xyz (SharedFunctionInfo 0x5bc1a919)> type:object <|@
0 1 t36 LoadNamedField t30.[in-object]@24 <|@
0 1 t38 Constant 0x2300e6a1 <Code> <|@
0 1 i102 Constant 2  range:2_2 <|@
0 1 i103 Constant 1  range:1_1 <|@
0 2 t41 CallWithDescriptor t38 t30 t36 s27 i103 i102 #2 changes[*] <|@

BUG=
R=verwaest@chromium.org, danno@chromium.org

Review URL: https://codereview.chromium.org/104663004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-15 17:00:35 +00:00
verwaest@chromium.org
1257ba358c Remove CALL_AS_FUNCTION and CALL_AS_METHOD.
BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/136403005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18590 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-14 14:36:24 +00:00
bmeurer@chromium.org
6e373493aa Drop IsPregenerated() and allow_stub_calls flag.
This also removes the fixed register hack that was required to support RecordWriteStub in the snapshot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/96853003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18167 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 20:49:15 +00:00
verwaest@chromium.org
4d5ec5e656 Reupload CallIC changes.
Relands https://codereview.chromium.org/91963003/ with fix for the invalid receiver patching in case of the global object / interceptor.
BUG=
R=ishell@chromium.org

Review URL: https://chromiumcodereview.appspot.com/96763002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 12:57:47 +00:00
mstarzinger@chromium.org
c8bfa60c0f Fix context register allocation in LTransitionElementsKind.
R=yangguo@chromium.org
BUG=chromium:324306
LOG=N

Review URL: https://codereview.chromium.org/95293003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 09:47:40 +00:00
yangguo@chromium.org
09c63bc961 Revert r18131 and r18139 "Clean up in the CallStubCompiler".
and "Fix register usage."

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/96573002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18146 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 09:02:00 +00:00
verwaest@chromium.org
bb86f02462 Cleanup in the CallStubCompiler.
BUG=
R=ishell@chromium.org

Review URL: https://chromiumcodereview.appspot.com/91963003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18131 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:26:04 +00:00
mstarzinger@chromium.org
8982971213 Add counters for write barriers in generated code.
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/78953003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 17:37:34 +00:00
danno@chromium.org
06c7620302 Fixed crashes exposed though fuzzing.
The %_OneByteSeqStringSetChar intrinsic expects its arguments to be checked before being called for efficiency reasons, but the fuzzer provided no such checks. Now the intrinsic is robust to bad input if FLAG_debug_code is set.

R=yangguo@chromium.org
TEST=test/mjsunit/regress/regress-320948.js
BUG=chromium:320948
LOG=Y

Review URL: https://codereview.chromium.org/72813004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 16:41:07 +00:00