specification under development. The optimizations are patterned after
those previously done for CanvasPixelArray. This CL adds all of the
necessary framework but continues to use the generic KeyedLoadIC and
KeyedStoreIC code, to create a baseline for benchmarking purposes. The
next CL will add the optimized ICs to ic-ia32.cc and ic-x64.cc.

These new CanvasArray types have different semantics than
CanvasPixelArray; out-of-range values are clamped via C cast
semantics, which is cheaper than the clamping behavior specified by
CanvasPixelArray. Out-of-range indices raise exceptions instead of
being silently ignored.

As part of this work, pulled FloatingPointHelper::AllocateHeapNumber
up to MacroAssembler on ia32 and x64 platforms. Slightly refactored
KeyedLoadIC and KeyedStoreIC. Fixed encoding for fistp_d on x64 and
added a few more instructions that are needed for the new ICs. The
test cases in test-api.cc have been verified by hand to exercise all
of the generated code paths in the forthcoming specialized ICs.

Review URL: http://codereview.chromium.org/293023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

generator.  We use the normal store IC mechanism with the global
object as the receiver.  The following code is generated for 'x=true'
at toplevel.

======== IA32:

27  mov eax,0xf5d06161          ;; object: 0xf5d06161 <true>
32  mov ecx,0xf5d09c35          ;; object: 0xf5d09c35 <String[1]: x>
37  push [esi+0x17]
40  call StoreIC_Initialize  (0xf5ce75c0)    ;; code: STORE_IC, UNINITIALIZED
45  mov [esp],eax

======== X64:

25  movq rax,0x7f867a7b6199    ;; object: 0x7f867a7b6199 <true>
35  movq rcx,0x7f867a7bae71    ;; object: 0x7f867a7bae71 <String[1]: x>
45  push [rsi+0x2f]
49  call StoreIC_Initialize  (0x7f8655929ac0)    ;; code: STORE_IC, UNINITIALIZED
54  movq [rsp],rax

======== ARM:

32  e59f0054       ldr r0, [pc, #+84]          ;; object: 0xf5b78161 <true>
36  e59f2054       ldr r2, [pc, #+84]          ;; object: 0xf5b7bc35 <String[1]: x>
40  e598c017       ldr ip, [r8, #+23]
44  e52dc004       str ip, [sp, #-4]!
48  e1a0e00f       mov lr, pc
52  e59ff048       ldr pc, [pc, #+72]          ;; debug: statement 0
                                               ;; code: STORE_IC, UNINITIALIZED
56  e58d0000       str r0, [sp, #+0]

Review URL: http://codereview.chromium.org/305005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The check for arguments in registers in one of the three versions of GenericBinaryOpStub::GenerateCall was plain wrong.

BUG=475
TEST=mjsunit/regress/regress-475.js
Review URL: http://codereview.chromium.org/307002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3092 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

fast-mode compiler.  Support was already present, but disabled.

Review URL: http://codereview.chromium.org/295004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/294019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3090 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/261037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

constant known at compile time.  Do not ever use the stack to
materialize (non-function-argument) constants.  Currently, constants
are only the non-materialized, non-function literals in the AST.

It is a known issue that there is no test coverage for the cases of
assigning a non-literal to a variable and returning a literal.  Those
code paths are unreachable and tests will be added when they become
reachable.

For the code '.result = true', we had previously on ia32:

27  push 0xf5c28161             ;; object: 0xf5c28161 <true>
32  pop [ebp+0xf4]

Now:

27  mov eax,0xf5c26161          ;; object: 0xf5c26161 <true>
32  mov [ebp+0xf4],eax

======== We had previously on x64:

25  movq r10,0x7fb8c2f78199    ;; object: 0x7fb8c2f78199 <true>
35  push r10
37  pop [rbp-0x18]

Now:

25  movq r10,0x7fb131386199    ;; object: 0x7fb131386199 <true>
35  movq [rbp-0x18],r10

The generated code for ARM did not include the extra memory traffic.
It was already eliminated by the ARM assembler's push/pop elimination.

Review URL: http://codereview.chromium.org/300003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3088 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/293003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=472



git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/269105

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3084 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Typically there is no or few global handles to delete (only manually deleted, but those might be
reused).

Review URL: http://codereview.chromium.org/274050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/283009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3081 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/287004


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3080 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Slots appear only indirectly in the AST (through variables linked to
variable proxies).  Slots are shared among variable references, so
putting compilation-time state on them is potentially a source of
bugs.  Avoid it for now.

Review URL: http://codereview.chromium.org/284009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3079 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/287003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It also fixes "backtrace" command so that it didn't give away random stack if we are running

Review URL: http://codereview.chromium.org/242034


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

fast-mode code generator.

AST expression nodes are annotated with a location when doing the
initial syntactic check of the AST.  In the current implementation,
expression locations are 'temporary' (ie, allocated to the stack) or
'nowhere' (ie, the expression's value is not needed though it must be
evaluated for side effects).

For the assignment '.result = true' on IA32, we had before (with the
true value already on top of the stack):

32  mov eax,[esp]
35  mov [ebp+0xf4],eax
38  pop eax

Now:

32  pop [ebp+0xf4]


======== On x64, before:

37  movq rax,[rsp]
41  movq [rbp-0x18],rax
45  pop rax

Now:

37  pop [rbp-0x18]


======== On ARM, before (with the true value in register ip):

36  str ip, [sp, #-4]!
40  ldr ip, [sp, #+0]
44  str ip, [fp, #-12]
48  add sp, sp, #4

Now:

36  str ip, [fp, #-12]


Review URL: http://codereview.chromium.org/267118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/271102

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

"jsregexp.h" and "jump-target.h" required "macro-assembler.h" to
always be included first.  Instead the include of "macro-assembler.h"
has moved into those header files.

"dateparser-inl.h" required "dateparser.h" to always be included
first.  Instead the include of "dateparser.h" has moved into
"dateparser-inl.h".

Review URL: http://codereview.chromium.org/267117

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

true at the top level we generate:

  0  stmdb sp!, {r1, r8, fp, lr}
  4  add fp, sp, #8
  8  ldr ip, [r10, #+4]
 12  ldr r2, [r10, #+0]
 16  str ip, [sp, #-4]!
 20  add lr, pc, #4
 24  cmp sp, r2
 28  ldrcc pc, [pc, #+68]        ;; code: STUB, StackCheck, minor: 0
 32  ldr ip, [pc, #+68]          ;; object: 0xf5bc4161 <true>
 36  str ip, [sp, #-4]!
 40  ldr ip, [sp, #+0]
 44  str ip, [fp, #-12]
 48  add sp, sp, #4
 52  ldr ip, [fp, #-12]
 56  str ip, [sp, #-4]!
 60  ldr r0, [sp], #+4
 64  mov sp, fp                  ;; js return
 68  ldmia sp!, {fp, lr}
 72  add sp, sp, #4
 76  bx lr
 80  ldr r0, [r10, #+4]
 84  mov sp, fp                  ;; js return
 88  ldmia sp!, {fp, lr}
 92  add sp, sp, #4
 96  bx lr
100  constant pool begin
104  constant
108  constant

Review URL: http://codereview.chromium.org/264067

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix X64 build in the case that debugger support is disabled.  Change function name from IsCallInstruction to IsPatchedReturnSequence on all platforms.
Review URL: http://codereview.chromium.org/267116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

top-level code we generate:

 0  push rbp
 1  movq rbp,rsp
 4  push rsi
 5  push rdi
 6  push [r13+0x8]
10  cmpq rsp,[r13+0x0]
14  jnc 25  (0x7ff2c378ff19)
20  call 0x7ff2c377d260     ;; code: STUB, StackCheck, minor: 0
25  movq r10,0x7ff2e8608199    ;; object: 0x7ff2e8608199 <true>
35  push r10
37  movq rax,[rsp]
41  movq [rbp-0x18],rax
45  pop rax
46  push [rbp-0x18]
50  pop rax
51  movq rsp,rbp      ;; js return
54  pop rbp
55  ret 0x8
58  int3
59  int3
60  int3
61  int3
62  int3
63  int3
64  movq rax,[r13+0x8]
68  movq rsp,rbp      ;; js return
71  pop rbp
72  ret 0x8
75  int3
76  int3
77  int3
78  int3
79  int3
80  int3

Review URL: http://codereview.chromium.org/264066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

line.  This is to make it easier to add and remove sources without
having to reformat line breaks.  It also enables sorting with M-x
sort-lines (in emacs) or the like.

Review URL: http://codereview.chromium.org/276042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Turned on with '--log-producers' flag, also needs '--noinline-new' (this is temporarily), '--log-code', '--log-gc'. Not all allocations are traced (I'm investigating.)

Stacks are stored using weak handles. Thus, when an object is collected, its allocation stack is deleted.

Review URL: http://codereview.chromium.org/267077

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=iposva@chromium.org

Review URL: http://codereview.chromium.org/275020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

fast code generator is optimized for compilation time and code size.

Currently it is only implemented on IA32.  It is potentially triggered
for any code in the global scope (including code eval'd in the global
scope).  It performs a syntactic check and chooses to compile in fast
mode if the AST contains only supported constructs and matches some
other constraints.

Initially supported constructs are

* ExpressionStatement,
* ReturnStatement,
* VariableProxy (variable references) to parameters and
    stack-allocated locals,
* Assignment with lhs a parameter or stack-allocated local, and
* Literal

This allows compilation of literals at the top level and not much
else.

All intermediate values are allocated to temporaries and the stack is
used for all temporaries.  The extra memory traffic is a known issue.

The code generated for 'true' is:

 0  push ebp
 1  mov ebp,esp
 3  push esi
 4  push edi
 5  push 0xf5cca135             ;; object: 0xf5cca135 <undefined>
10  cmp esp,[0x8277efc]
16  jnc 27  (0xf5cbbb1b)
22  call 0xf5cac960             ;; code: STUB, StackCheck, minor: 0
27  push 0xf5cca161             ;; object: 0xf5cca161 <true>
32  mov eax,[esp]
35  mov [ebp+0xf4],eax
38  pop eax
39  mov eax,[ebp+0xf4]
42  mov esp,ebp                 ;; js return
44  pop ebp
45  ret 0x4
48  mov eax,0xf5cca135          ;; object: 0xf5cca135 <undefined>
53  mov esp,ebp                 ;; js return
55  pop ebp
56  ret 0x4

Review URL: http://codereview.chromium.org/273050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3067 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is the first step to address http://crbug.com/23131 by creating
a series of V8 ConsStrings as more data arrives from the server.

Review URL: http://codereview.chromium.org/271085

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3066 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/267092

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3065 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Do not create handles for values of internal fields---this operation is performance
critical and plain pointers are safe.

Appy the same approach to External wrapping and unwrapping.

Plus some minor refactorings.

Review URL: http://codereview.chromium.org/270085

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/276018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3063 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Hidden properties are used like internal fields which do not have
access checks. The checks can cause problems because there may be no
current context. See http://crbug.com/24200.

Review URL: http://codereview.chromium.org/271080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3062 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

are in a separate subdirectory called 'compiler' in the mjsunit directory.

Review URL: http://codereview.chromium.org/273039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch by Jan de Mooij <jandemooij@gmail.com>
Review at http://codereview.chromium.org/271072


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/275016


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=ager@chromium.org

Review URL: http://codereview.chromium.org/272045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Check that constructor is a FunctionMirror before calling .name(), otherwise we may end up calling name method on a mirror object that doesn't have it.

Review URL: http://codereview.chromium.org/271053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Increase stack space on Win64 sample and cctest executables.

Review URL: http://codereview.chromium.org/264047


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

contains_array_literal_ implies materialized_literal_count_ > 0, and
we appear not to need to know about array literals specifically.

Review URL: http://codereview.chromium.org/272043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3055 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

__ARM_EABI__ macro to determine the ABI on ARM.
Review URL: http://codereview.chromium.org/274016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/273033


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00