TBR=vegorov@chromium.org
BUG=v8:1322

Review URL: https://chromiumcodereview.appspot.com/9453012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10813 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1969
TEST=regress/regress-1969

Review URL: https://chromiumcodereview.appspot.com/9455011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=fschneider@chromium.org,vegorov@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://chromiumcodereview.appspot.com/9453007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The previous code relied on the tricky global invariant that there is no map
sharing when accessor properties are involved (or in other words: that
TransformToFastProperties is dumb enough :-). Although this is not a real
problem with the current code, this assumption breaks when map sharing in fast
mode is enabled, so we defensively copy an AccessorPair.

Review URL: https://chromiumcodereview.appspot.com/9430048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Split executable memory chunks into two pieces: header with all metadata (protection: RW) and body (protection: RWX). Separate header from metadata with a guard page and add a guard page after the page body.

R=erik.corry@gmail.com
BUG=http://crbug.com/115151

Review URL: https://chromiumcodereview.appspot.com/9452002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This refactors the way we (re)define elements to perform normalization
and attribute updating at a much deeper level, thereby removing some
bogus special cases in upper runtime layers.

Most element setters take an indicator flag that distinguishes between
setting and defining. Setting of an element causes attributes to remain
unchanged, writability to be checked and callbacks to be called.
Defining of an element causes attributes to be updated and callbacks to
be overridden. The same approach could be taken for properties.

R=svenpanne@chromium.org
BUG=v8:1772
TEST=test262,test262/15.2.3.6-4-333-11

Review URL: https://chromiumcodereview.appspot.com/9443014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/9456006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The old HashMap class had an explicit member to determine the allocation
policy. The template version matches the approach used already for
lists.

Cleanup some include dependencies and unnecessary forward declarations.

Cleanup some dead code from isolate.h and replace some HEAP macros
with GetHeap().
Review URL: https://chromiumcodereview.appspot.com/9372106

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10806 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9454009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch from Mathias Bynens <mathias@qiwi.be>
BUG=1958
TEST=Try `var a\u200c\u200d;` and confirm it doesn't throw an error.

Review URL: https://chromiumcodereview.appspot.com/9433031
Patch from Mathias Bynens <mathias@qiwi.be>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It is achieved by:
1. skipping entries those dominators have already reached root.
2. processing only entries those retainers have changed their
   dominators and skipping other entries.
3. removing extra memory indirection by making the dominators array
   contain entry indices instead of entries themselves.

The dominators building time has dropped from ~4000 ms to ~200 ms
on gmail.com heap snapshot.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9372105
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

CpuFeatures::Probe request executable memory before any isolate is initialized and entered.

TBR=erik.corry@gmail.com

Review URL: https://chromiumcodereview.appspot.com/9433051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=115151

Review URL: https://chromiumcodereview.appspot.com/9372083
Patch from Cris Neckar <cdn@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Modify PreProcessOsrEntry to work with OSR entries that have non-empty expression stack.

Modify graph builder to take for-in state from environment instead of directly referencing emitted instructions.

Extend %OptimizeFunctionOnNextCall with an argument to force OSR to make writing OSR tests easier: %OptimizeFunctionOnNextCall(f, "osr").

R=fschneider@chromium.org
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9431030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9432026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.

HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).

New hydrogen instructions:

- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;

Changed hydrogen instructions:

- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.

R=fschneider@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9425045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1943
TEST=

Review URL: https://chromiumcodereview.appspot.com/9428027
Patch from Jonathan Liu <net147@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1962
TEST=

Review URL: https://chromiumcodereview.appspot.com/9430044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10792 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9416092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9430043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=vegorov@google.com,yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9430011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This CL is an intermediate step only, in the end we need to have a single
DefineOrRedefineAccessorProperty call for a single Object.defineProperty
call. Currently we can end up making two such calls, making the necessary access
checks extremely ugly and hard (impossible?) to get right for complete spec
conformance.

The bulk of the change is quite mechanical:

 * Prepare an AccessorPair *before* we add it to our data structures,
   eliminating the previous voodoo-like threading of a placeholder.

 * The previous item makes it possible to activate our check that we do not
   share AccessorPairs by accident.

 * Split a monster method into 2 quite unrelated methods.

 * Use templated To method in a few places.

Review URL: https://chromiumcodereview.appspot.com/9428026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/9430042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1963
TEST=run preparser with no command line arguments

Review URL: https://chromiumcodereview.appspot.com/9431028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Pass the zone explicitly to avoid calling Isolate::Current()->zone().
Review URL: https://chromiumcodereview.appspot.com/9430002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10785 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Replaced multiple calls to AddNumber with a single AddString.
AddNumber may now print the value directly into the output buffer.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/9395087
Patch from Alexei Filippov <alexeif@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

when Object.isExtensible(o) === false

Added corresponding tests

ES5 description: http://es5.github.com/#x11.13.1

Related issue: http://code.google.com/p/v8/issues/detail?id=1901

Contributed by ioseb.dzmanashvili@gmail.com

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9429002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9428001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Runtime_DefineOrRedfineAccessorProperty basically does the same, so we have 1
code path less to worry about.

Review URL: https://chromiumcodereview.appspot.com/9424033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10779 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This makes LFunctionLiteral safe even when it is used from inside inlined function.

All other architectures were implementing LFunctionLiteral correctly.

R=mstarzinger@chromium.org
TEST=test/mjsunit/regress/regress-inlining-function-literal-context.js

Review URL: https://chromiumcodereview.appspot.com/9425061

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9425059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

in 64 bit spill slots.
Review URL: https://chromiumcodereview.appspot.com/9378006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10700 (c976fbd5).

Original commit message:
This change enables optimization of top-level and eval-code. For this to work, it adds
support for declaring global variables in optimized code.

At the same time it disables the eager generation of deoptimization support data
in the full code generator (originally introduced in
r10040). This speeds up initial compilation and saves
memory for functions that won't be optimized. It requires
recompiling the function with deoptimization
support when we decide to optimize it.

BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9418006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The bulk of this CL is purely mechanical: Make the CONVERT_FOO macros more
uniform by always using an index instead of an object. Apart from this, it
includes a few minor changes like using CONVERT_SMI_ARG_CHECKED a bit more or
introducing a new macro for PropertyDetails. Nothing spectacular, just something
sitting on my disk for quite some time now...

Review URL: https://chromiumcodereview.appspot.com/9395075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org
TEST=cctest/test-regexp/CharacterClassEscapes

Review URL: https://chromiumcodereview.appspot.com/9425050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10771 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
TEST=test262/S15.10.2.12_A?_T1,mjsunit/regexp

Review URL: https://chromiumcodereview.appspot.com/9426032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org (reviewed offline)


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

A GC in the access check callbacks NamedSecurityCallback and IndexedSecurityCallback
violates the contract about these callbacks.

Added a EXTERNAL VMState scope around the call to FailedAccessCheckCallback to be
consistent with the other callback invocations.

BUG=v8:1952
TEST=cctest/test-api/TurnOnAccessCheckAndRecompile
Review URL: https://chromiumcodereview.appspot.com/9425048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9426034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/9421036


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00