Port r17741 (fe14ef8)

Original commit message:
patch from issue 54583003 (dependent code).

Zero arguments - very easy

1 argument - three special cases:
a) If length is a constant in valid array length range,
no need to check it at runtime.
b) respect DoNotInline feedback on the AllocationSite for
cases that the argument is not a smi or is an integer
with a length that should create a dictionary.
c) if kind feedback is non-holey, and length is non-constant,
we'd have to generate a lot of code to be correct.
Don't inline this case.

N arguments - one special case:
a) If a deopt ever occurs because an input argument isn't
compatible with the elements kind, then set the
DoNotInline flag.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/72893003

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Because SetElement & co are interdependent, this patch handlfies all of JSObject::
-SetElement
-SetFastElement
-SetDictionaryElement
-SetFastDoubleElement
-SetElementWithInterceptor
-SetElementWithoutInterceptor
-SetElementWithCallbackSetterInPrototype

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/66803002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/68523009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/62953007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/72073004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2333
LOG=N
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/48443002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org, yurys@chromium.org
TEST=cctest/test-heap/DisableInlineAllocation

Review URL: https://codereview.chromium.org/69953023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17752 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r17746 for breaking layout tests.

TBR=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/72753002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17751 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/72703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

LOG=
BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/61733023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/70093002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=318454

Review URL: https://codereview.chromium.org/71653008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23537067

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is the exact copy of r17365 which was reverted in r17488 due to memory corruption. The root cause for the memory corruption - missing check for bump pointer limit before storing filler map must be addressed in r17626 where allocation hooks were removed from the generated code and left only in the runtime.

This is initial implementation of allocation profiler.

Whenever new object allocation is reported to the HeapProfiler and allocation tracking is on we will capture current stack trace, add it to the collection of the allocation traces (a tree) and attribute the allocated size to the top JS function on the stack.

Format of serialized heap snapshot is extended to include information about recorded allocation stack traces.

This patch is r17301 plus a fix for the test crash in debug mode. The test crashed because we were traversing stack trace when just allocated object wasn't completely configured, in particular the map pointer was incorrect. Invalid Map pointer broke heap iteration required to find Code object for a given pc during stack traversal. The solution is to insert free space filler in the newly allocated block just before collecting stack trace.

BUG=chromium:277984,v8:2949
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/61893031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17742 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

patch from issue 54583003 (dependent code).

Zero arguments - very easy

1 argument - three special cases:
  a) If length is a constant in valid array length range,
     no need to check it at runtime.
  b) respect DoNotInline feedback on the AllocationSite for
     cases that the argument is not a smi or is an integer
     with a length that should create a dictionary.
  c) if kind feedback is non-holey, and length is non-constant,
     we'd have to generate a lot of code to be correct.
     Don't inline this case.

N arguments - one special case:
  a) If a deopt ever occurs because an input argument isn't
     compatible with the elements kind, then set the
     DoNotInline flag.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/55933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/63173023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17740 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/62713006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17739 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The callers to NumberToSize are supposed to validate the number, but
this adds a last line of defense.

TBR=jkummerow@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/61733021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:3004
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/63173022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17736 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r17733 for breaking Linux build.

TBR=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/69243005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The callers to NumberToSize are supposed to validate the number, but
this adds a last line of defense.

R=jkummerow@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/72323003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/72623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It turns out that Sunspider 1.0's 3d-morph verifies that the floating
point error must start with 6.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/61593008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:319120
TEST=test/mjsunit/regress/regress-319120.js
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/61753013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

MIPS: Simplify behavior of code stubs that accept a variable number of stack arguments in addition to their parameters.

Port r17680 (cc0b972)

Original commit message:
Before, we'd add a special
variable to the environment with the value of a register with the
number of arguments. Now, that register just appears as a parameter to
the code stub.

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/70163006

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/71783002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

An optimization in the array constructor wasn't firing because the code
would check for constant values, failing to find them through
intervening HForceRepresentation instructions. Repaired this site. A
follow-on CL will provide a better way of making decisions based on
constant HValues.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59623009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/68503006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is again to make sunspider's weird result verification happy.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/61753011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/71573002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Enable physical memory argument to be passed as an argument to ConfigureResourceConstraintsForPlatform.

BUG=312241
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/68203003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/70663003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/70263003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/71443002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/71373003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jkummerow@chromium.org
BUG=v8:2989

Review URL: https://codereview.chromium.org/62283008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Sunspider verifies floating point results to the last bit, so this is to
make sure that we return the expected result.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/71123003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jkummerow@chromium.org
BUG=v8:2989

Review URL: https://codereview.chromium.org/68573003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Adds a notion of private symbols, mainly intended for internal use, especially, self-hosting of built-in types that would otherwise require new C++ classes.

On the JS side (i.e., in built-ins), private properties can be created and accessed through a set of macros:

  NEW_PRIVATE(print_name)
  HAS_PRIVATE(obj, sym)
  GET_PRIVATE(obj, sym)
  SET_PRIVATE(obj, sym, val)
  DELETE_PRIVATE(obj, sym)

In the V8 API, they are accessible via a new class Private, and respective HasPrivate/Get/Private/SetPrivate/DeletePrivate methods on calss Object.

These APIs are designed and restricted such that their implementation can later be replaced by whatever ES7+ will officially provide.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/48923002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

arguments in addition to their parameters. Before, we'd add a special
variable to the environment with the value of a register with the
number of arguments. Now, that register just appears as a parameter to
the code stub.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/70203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00