R=ulan@chromium.org

Review URL: https://codereview.chromium.org/62143002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17531 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/62213002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note that I've left the layering as is to make the diffs clear. Is it worth moving ForceSetObjectProperty to objects.cc? This code is clearly implementing part of the DefineOrRedefine steps from the spec, but it's still odd that it lives in Runtime. Note that handles.cc exposes a ForceSetProperty which just performs a CALL_HEAP_FUNCTION on the Runtime::ForceSetObjectProperty -- which is exposed to the api as v8::Object::ForceSet

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also, do not allocate sub-closures for every call to typed array constructor.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/59913003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=309723

Review URL: https://codereview.chromium.org/59383012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61953002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61943002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This improves the generated code for HSeqStringSetChar across
all platforms, taking advantage of constant operands whenever
possible. It also drops the unused DefineSameAsFirst constraint
for the register allocator on x64 and ia32, where it caused
unnecessary spills when the string operand was live across the
HSeqStringSetChar instruction.

A new GVN flag StringChars is introduced to express dependencies
between HSeqStringSetChar, HStringCharCodeAt and the upcoming
HSeqStringGetChar (the GVNFlags type is now 64bit in size).

Also improves the test case.

TEST=mjsunit/string-natives
R=mstarzinger@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/57383004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note the spec now reflects the updated naming:

http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes

R=rossberg@chromium.org, rossberg
BUG=v8:2940

Review URL: https://codereview.chromium.org/46043020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Apparently, this wasn't the cause for dromaeo regressions.

> BUG=none
> R=jkummerow@chromium.org
>
> Review URL: https://codereview.chromium.org/26457002

R=verwaest@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/36843002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/60513010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17516 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add support for tracking NotExectuted/ExecutedOnceCodeAge's when --track_gc_object_stats flag is set.

BUG=None
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/40003002

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add isolate parameter to SetResourceConstraints, and deprecate version which depends on current isolate.

BUG=None
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/38993005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port: r17485 (0d82025)

Original commit message:
When --optimize-for-size is true, the prologue generation outputs the
pre-aging code stub address directly to the instruction stream. Previously
this was done using dd() which failed if there was any pending constant
pool entries left to be written. This CL introduces an emit_code_stub_address()
for this purpose instead.

BUG=v8:2968

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r17466 (e519285)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/58853003

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17507 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It was marked as flaky on linux nosnap, arm and nacl before. Now it's marked universally flaky since windows joined the list.

BUG=v8:2921
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/54713002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r17465 (9f3f3d1)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/59853002

Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17505 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/59973006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r17490.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/59973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/59343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit f7f04272208d565020b528145ce6cef0f89c7079.

BUG=312233
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/59133003

Patch from Ross Mcilroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/59913002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/44173003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50073005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/59773002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r17365 for memory corruption. The issues
are most probably related to storing a filler map without
checking the bump pointer first, and traversing the stack
when called from within a stub (or builtin), while the code
assumes that it's called from a JS function.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59583003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/37463002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It is very hard to understand the structure of the heap even for about:blank page
because code objects in the heap have no names. This patch propagates the names
for Code::STUB and Code::BUILTIN code objects.
Also it assign function names from SharedFunctionInfo to the code objects.

BUG=
R=alph@chromium.org, svenpanne@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/52643002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When --optimize-for-size is true, the prologue generation outputs the
pre-aging code stub address directly to the instruction stream.  Previously
this was done using dd() which failed if there was any pending constant
pool entries left to be written.  This CL introduces an emit_code_stub_address()
for this purpose instead.

BUG=v8:2968
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/47743007

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=306220

Review URL: https://codereview.chromium.org/46593010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/32003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note: spec has been updated here: http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes.

R=rossberg@chromium.org, rossberg
BUG=v8:2975,v8:2941

Review URL: https://codereview.chromium.org/47703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change enforces explicit allocation of the initial map for each
JSFunction to introduce a proper layering between the JSFunction class
and the Heap class. A follow-up change will then handlify the two
functions AllocateInitialMap and AllocateFunctionPrototype.

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/32323013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/53573004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=None
R=bmeurer@chromium.org, ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/29203003

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This includes handlifing:
-SetHiddenPropertiesHashTable
-ObjectHashSet::Add/Remove
-ObjectHashTable::Put

And splitting the following methods which previously took "allow creation" enum arguments to into side-effect-free getters and GetOrCreate*-handlfied getters.

-GetHash (now GetHash & handlified GetOrCreateHash)
-GetIdentityHash (now GetIdentityHash & handlified GetOrCreateIdentityHash)
-GetHiddenPropertiesHashTable (now GetHiddenPropertiesHashTable & handlified GetOrCreateaHiddenPropertiesHashTable)

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/48913008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=arv@chromium.org, rossberg@chromium.org, rossberg
BUG=v8:2942

Review URL: https://codereview.chromium.org/36313002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r17462 and instead fixes StubCache::ComputeLoadNonexistent by replacing s/IsGlobalObject/IsJSGlobalObject/ there.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59103005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

To keep the structure of the serializer more or less untouched, we use
some ingenious Corry-approved(TM) 3-step technology (a.k.a. "hack"):

   * Create copies of code objects.
   * Wipe out all absolute addresses in these copies.
   * Write out the cleaned copies instead of the originals.

In conjunction with --random-seed, our snapshots are reproducible now.

BUG=v8:2885
R=bmeurer@chromium.org, erik.corry@gmail.com

Review URL: https://codereview.chromium.org/54823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17473 ce2b1a6d-e550-0410-aec6-3dcde31c8c00