As of dominators and retained sizes calculation take quite small time now
comparing to the main passes, it is worth to exclude these from progress
indicator. Now the indicator smoothly runs to 100%, while previously
it ran to 50% and then instantly jumped to 100%.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9465010
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9455059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This allows elements of the non-strict arguments object to be redefined
with custom attributes and still maintain an alias into the context.
Such a slow alias is maintained by placing a special marker into the
dictionary backing store of the arguments object.

R=rossberg@chromium.org
BUG=v8:1772
TEST=test262,mjsunit/object-define-property

Review URL: https://chromiumcodereview.appspot.com/9460004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9463010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10826 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit 630437a0239ce4de029ea367083cb12a8099506c.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10825 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9467005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

As of dominators and retained sizes calculation take quite small time now
comparing to the main passes, it is worth to exclude these from progress
indicator. Now the indicator smoothly runs to 100%, while previously
it ran to 50% and then instantly jumped to 100%.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9463008
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes Object.getOwnPropertyDescriptor to report string character
elements as enumerable in accordance with the spec.

BUG=v8:862
TEST=mjsunit/get-own-property-descriptor

Review URL: https://chromiumcodereview.appspot.com/9447053
Patch from Ioseb Dzmanashvili <ioseb.dzmanashvili@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10822 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Replace timestamps with affected bool vector. Timestamps could cause
some entries marked as affected on iteration i, to be recalculated
twice on iterations i and i+1. Which is redundant.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9467002
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10821 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9466003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10820 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The context is only needed in the esi register if there is a call to
the generic stub.
Review URL: https://chromiumcodereview.appspot.com/9467001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9465003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9452022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9455016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9455015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

a previous change decreased the size of a zone object and it seems
that sometimes the OS report more memory used even though there
is less zone allocation.
Review URL: https://chromiumcodereview.appspot.com/9443019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vegorov@chromium.org
BUG=v8:1322

Review URL: https://chromiumcodereview.appspot.com/9453012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1969
TEST=regress/regress-1969

Review URL: https://chromiumcodereview.appspot.com/9455011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=fschneider@chromium.org,vegorov@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/9453007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The previous code relied on the tricky global invariant that there is no map
sharing when accessor properties are involved (or in other words: that
TransformToFastProperties is dumb enough :-). Although this is not a real
problem with the current code, this assumption breaks when map sharing in fast
mode is enabled, so we defensively copy an AccessorPair.

Review URL: https://chromiumcodereview.appspot.com/9430048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Split executable memory chunks into two pieces: header with all metadata (protection: RW) and body (protection: RWX). Separate header from metadata with a guard page and add a guard page after the page body.

R=erik.corry@gmail.com
BUG=http://crbug.com/115151

Review URL: https://chromiumcodereview.appspot.com/9452002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This refactors the way we (re)define elements to perform normalization
and attribute updating at a much deeper level, thereby removing some
bogus special cases in upper runtime layers.

Most element setters take an indicator flag that distinguishes between
setting and defining. Setting of an element causes attributes to remain
unchanged, writability to be checked and callbacks to be called.
Defining of an element causes attributes to be updated and callbacks to
be overridden. The same approach could be taken for properties.

R=svenpanne@chromium.org
BUG=v8:1772
TEST=test262,test262/15.2.3.6-4-333-11

Review URL: https://chromiumcodereview.appspot.com/9443014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9456006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The old HashMap class had an explicit member to determine the allocation
policy. The template version matches the approach used already for
lists.

Cleanup some include dependencies and unnecessary forward declarations.

Cleanup some dead code from isolate.h and replace some HEAP macros
with GetHeap().
Review URL: https://chromiumcodereview.appspot.com/9372106

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10806 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9454009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch from Mathias Bynens <mathias@qiwi.be>
BUG=1958
TEST=Try `var a\u200c\u200d;` and confirm it doesn't throw an error.

Review URL: https://chromiumcodereview.appspot.com/9433031
Patch from Mathias Bynens <mathias@qiwi.be>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It is achieved by:
1. skipping entries those dominators have already reached root.
2. processing only entries those retainers have changed their
   dominators and skipping other entries.
3. removing extra memory indirection by making the dominators array
   contain entry indices instead of entries themselves.

The dominators building time has dropped from ~4000 ms to ~200 ms
on gmail.com heap snapshot.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9372105
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

CpuFeatures::Probe request executable memory before any isolate is initialized and entered.

TBR=erik.corry@gmail.com

Review URL: https://chromiumcodereview.appspot.com/9433051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=115151

Review URL: https://chromiumcodereview.appspot.com/9372083
Patch from Cris Neckar <cdn@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Modify PreProcessOsrEntry to work with OSR entries that have non-empty expression stack.

Modify graph builder to take for-in state from environment instead of directly referencing emitted instructions.

Extend %OptimizeFunctionOnNextCall with an argument to force OSR to make writing OSR tests easier: %OptimizeFunctionOnNextCall(f, "osr").

R=fschneider@chromium.org
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9431030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9432026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.

HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).

New hydrogen instructions:

- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;

Changed hydrogen instructions:

- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9425045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1943
TEST=

Review URL: https://chromiumcodereview.appspot.com/9428027
Patch from Jonathan Liu <net147@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1962
TEST=

Review URL: https://chromiumcodereview.appspot.com/9430044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9416092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9430043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=vegorov@google.com,yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9430011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This CL is an intermediate step only, in the end we need to have a single
DefineOrRedefineAccessorProperty call for a single Object.defineProperty
call. Currently we can end up making two such calls, making the necessary access
checks extremely ugly and hard (impossible?) to get right for complete spec
conformance.

The bulk of the change is quite mechanical:

 * Prepare an AccessorPair *before* we add it to our data structures,
   eliminating the previous voodoo-like threading of a placeholder.

 * The previous item makes it possible to activate our check that we do not
   share AccessorPairs by accident.

 * Split a monster method into 2 quite unrelated methods.

 * Use templated To method in a few places.

Review URL: https://chromiumcodereview.appspot.com/9428026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9430042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1963
TEST=run preparser with no command line arguments

Review URL: https://chromiumcodereview.appspot.com/9431028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00