TBR=ager@chromium.org
Review URL: http://codereview.chromium.org/2073018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reapplication of r4685 (reviewed http://codereview.chromium.org/2101002) with minor modifications:

- Fix compilation problems on Win64.
- Improve heap verification pass: search for garbage pointers to new space not only in dirty regions but in all regions.

Review URL: http://codereview.chromium.org/2114015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=ager@chromium.org
Review URL: http://codereview.chromium.org/2071020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

-- layout change for FixedArrays: length is stored as a smis (initial patch by Kevin Millikin)
-- layout change for SharedFunctionInfo: integer fields are stored as smi on arm, ia32 and rearranged on x64.
-- layout change for String: meaning of LSB bit is fliped (1 now means hash not computed); on x64 padding is added.
-- layout of maps is _not_ changed. Map space is currently iterated in a special way.
- Cardmarking write barrier. New barrier handles large objects and normal objects in a similar fashion (no more additional space for pointer tracking is required, no conditional branches in WB code).

Review URL: http://codereview.chromium.org/2101002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Bailout to JS Array builtins if array's prototype is different from
Array.prototype.  Otherwise there might be inherited elements coming
from this prototype.

Review URL: http://codereview.chromium.org/2037008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

That makes it easier to maintain the code---one should care less
about releasing the memory as smart pointers would take care of
this.

Switch to ScopedVector instead Vector for the same semantics in
src/builtins.cc

Review URL: http://codereview.chromium.org/1737023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4593 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1701008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1770001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1118007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If 'shell' is compiled with 'cppprofilesprocessor=on' and run
with '--prof' flag, top-down and bottom-up call trees are printed
on shell exit.

Review URL: http://codereview.chromium.org/1582004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4343 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1562001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

CopyWords cannot actually copy zero words---it'd clobber destiantion with
the first word of source.

Add an ASSERT to check this condition plus update array builtins to verify
for amount of copied data when necessary.

TBR=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/1559004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1530005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1310002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For now this trick is only done to objects in new space, see comments
for reasons.

Review URL: http://codereview.chromium.org/1076010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

index d545c34..91cb151 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -738,7 +738,7 @@ BUILTIN(ArrayConcat) {
   int result_len = 0;
   for (int i = 0; i < n_arguments; i++) {
     Object* arg = args[i];
-    if (!arg->IsJSArray() || JSArray::cast(arg)->HasFastElements()) {
+    if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements()) {
       return CallJsBuiltin("ArrayConcat", args);
     }
This reverts 4153.
    # Please enter the commit message for your changes. Lines starting

Review URL: http://codereview.chromium.org/1055003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1058003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4153 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/1036002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/954001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Now builtins only process fast case when there is no need to lift elements from
the prototypes.

TBR=ager@chromium.org

Review URL: http://codereview.chromium.org/890004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4121 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/669061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4108 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/857002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It causes regressions on test shell tests.

TBR=antonm@chromium.org
Review URL: http://codereview.chromium.org/819001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Now this builtin checks if it should go into fast case or resort to JS ArrayPush builtin.

Review URL: http://codereview.chromium.org/660298

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/669164

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=sgjesse@chromium.org

Review URL: http://codereview.chromium.org/669162

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/668149

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4034 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/669101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/669075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/669060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/660245

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/647013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/601092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/618002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3885 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/604059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3871 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/600124

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/606017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/603028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

function instead of baking in the address of the first one that we see
in code.

This removes the need for fixups processing and makes the stubs safe
when there is no natives cache and therefore multiple versions of the
builtin functions.

Review URL: http://codereview.chromium.org/594009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This uses the fact that if a map stayed the same then the object
still passes the type check. A new builtin is added to handle the
API call in this case.

Review URL: http://codereview.chromium.org/573003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3825 ce2b1a6d-e550-0410-aec6-3dcde31c8c00