Object model changes
----------------------------------------
New fixed_cow_array_map is used for the elements array of a JSObject
to mark it as COW. The JSObject's map and other fields are not
affected. The JSObject's map still has the "fast elements" bit set. It
means we can do only the receiver map check in keyed loads and the
receiver and the elements map checks in keyed stores. So introducing
COW arrays doesn't hurt performance of these operations. But note that
the elements map check is necessary in all mutating operations because
the "has fast elements" bit now means "has fast elements for reading".
EnsureWritableFastElements can be used in runtime functions to perform
the necessary lazy copying.

Generated code changes
----------------------------------------
Generic keyed load is updated to only do the receiver map check (this
could have been done earlier). FastCloneShallowArrayStub now has two
modes: clone elements and use COW elements. AssertFastElements macro
is added to check the elements when necessary. The custom call IC
generators for Array.prototype.{push,pop} are updated to avoid going
to the slow case (and patching the IC) when calling the builtin should
work.

COW enablement
----------------------------------------
Currently we only put shallow and simple literal arrays in the COW
mode. This is done by the parser.

Review URL: http://codereview.chromium.org/3144002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3117018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5274 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix some bit op bugs introduced last week on IA32:
http://code.google.com/p/chromium/issues/detail?id=52096
Review URL: http://codereview.chromium.org/3151017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note: it intentionally lags behind current HeapStats (which now has os_error field)
as these new minidumps could not be produced by current versions of Chrome yet.

Review URL: http://codereview.chromium.org/3170015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3143015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Load() or constructing a reference.
Review URL: http://codereview.chromium.org/3125011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3108023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Upgraded the CodeGenerator::ToBoolean() function in the ARM backend to use complete JIT code generation and not make runtime calls to ToBool (when VFP is enabled). 

This change also includes the vcmp VFP instruction that supports a constant 0.0 as the second operand. 

Patch by Subrato K De <subratokde@codeaurora.org>



git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3120011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also hoist the load of the valueOf symbol out of the loop.
Review URL: http://codereview.chromium.org/3170014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3123013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

That could allow us to understand why commit of from space sometimes fails.
Another option would be start a separate structure with OS-related info, but
as it's a single field, let's put it into HeapStats, at least for now.

Review URL: http://codereview.chromium.org/3118013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3161009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

approach.

Review URL: http://codereview.chromium.org/3152016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=http://code.google.com/p/v8/issues/detail?id=798
TEST=test/mjsunit/regress/regress-798.js
Review URL: http://codereview.chromium.org/3082012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

for instance throw exceptions in case of failed access checks.

Review URL: http://codereview.chromium.org/3165016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3133007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3131008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This should help in cases like:
function Constructor() {
  this.foo = constFunction;
  this.bar = "baz";
}

for (...) {
  o = new Constructor();
  // Constant call IC will work.
  o.foo();
  // Inlined property load will see the same map.
  use(o.bar);
}

This change also fixes a latent bug in custom call IC-s for strings
exposed by string-charcodeat.js.

Review URL: http://codereview.chromium.org/3160006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Don't do fuzzing of _IsStringWrapperSafeForDefaultValueOf as it expects a non-smi as its first argument.
Review URL: http://codereview.chromium.org/3109010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5253 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This adds a check to the fast case string add to ensure that the String object still have the default valueOf function. The default valueOf is sitting on a hidden prototype of String.prototype.

Before using the fast case valueOf the object is checked for a local valueOf property. For slow case objects this check always reports true (the dictionary is not probed, so valueOf might be there) and for fast case objects the descriptor array is checked for the valueOf symbol (just liniar scan). After that the prototype is checked for beeing the initial value of String.prototype. If this all pass (that is the default valueOf is still in place) this result is cached on the map making the check fast the next time.

This is only implemented in the optimizing compiler, as the two usages of %_IsStringWrapperSafeForDefaultValueOf is never hit by the full compiler.

I will port to x64 and ARM when this has been reviewed for ia32.

I will remove the performance counters prior to final commit.

BUG=http://code.google.com/p/v8/issues/detail?id=760
TEST=test/mjsunit/regress/regress-760-1.js
TEST=test/mjsunit/regress/regress-760-2.js

Review URL: http://codereview.chromium.org/3117006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3172008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5251 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3166008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5248 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3180001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5247 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3066044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5246 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3104007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change changes the lazy compilation stub to a builtin and
eliminates the argc (argument count for the function for which to
create a lazy stub) parameter.

Review URL: http://codereview.chromium.org/3146008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5244 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Return (smi) 0 instead of object null from the FILTER_KEY builtin.

Add a test which tests keys being deleted during for-in.
Review URL: http://codereview.chromium.org/3170004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3166005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5240 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3166006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3119005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5238 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch by Jay Freeman.
Fixes issue 463.

Review URL: http://codereview.chromium.org/3117007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3118007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=822
TEST=test-heap-profiler/Issue822

Review URL: http://codereview.chromium.org/3128004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3172003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

in allowing more flexible compilation and to simplify builtins lookup. 

This changes a number of places where code objects are assigned to
SharedFunctionInfo objects to also assign this code object to the
JSFunction. In addition, the code flushing is changed slightly to
accomodate this (we need to flush the code from functions pointing to
SharedFunctionInfo objects that has already been flushed).


Review URL: http://codereview.chromium.org/3120006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5233 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It doesn't work correctly for array indices.

Review URL: http://codereview.chromium.org/3109002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3115004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=51594
TEST=test-cpu-profiler/CrashIfStoppingLastNonExistentProfile

Review URL: http://codereview.chromium.org/3108004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3015066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00