Code was vulnerable to different evaluation order in Clang.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/726693004

Cr-Commit-Position: refs/heads/master@{#25397}

This reverts commit d40204f8.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/735653003

Cr-Commit-Position: refs/heads/master@{#25393}

We were deopting without learning anything.

BUG=v8:3417
LOG=N
R=danno@chromium.org

Review URL: https://codereview.chromium.org/368263003

Cr-Commit-Position: refs/heads/master@{#25392}

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/726423002

Cr-Commit-Position: refs/heads/master@{#25387}

Review URL: https://codereview.chromium.org/707463002

Cr-Commit-Position: refs/heads/master@{#25367}

BUG=v8:3684
LOG=n

Review URL: https://codereview.chromium.org/726773002

Cr-Commit-Position: refs/heads/master@{#25364}

This reverts the commit because it possibly causes renderer hangs.

BUG=chromium:431807
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/725633002

Cr-Commit-Position: refs/heads/master@{#25338}

Now that we keep track of whether a function contains super we do not
need kDefaultConstructorCallSuper

BUG=None
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/718833002

Cr-Commit-Position: refs/heads/master@{#25337}

Revert "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name."
Revert "Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136."

This revert is made in order to revert r25099 which potentially causes renderer hangs.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/722873004

Cr-Commit-Position: refs/heads/master@{#25332}

It started showing after r25253.

BUG=v8:3687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/715313003

Cr-Commit-Position: refs/heads/master@{#25324}

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/668143003

Cr-Commit-Position: refs/heads/master@{#25321}

1. Global{Context,Scope}=>Script{Context,Scope}
2. Enable fixed tests
3. Update comments

R=rossberg@chromium.org
BUG=v8:2198
LOG=N

Review URL: https://codereview.chromium.org/716833002

Cr-Commit-Position: refs/heads/master@{#25291}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25291 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/711313002

Cr-Commit-Position: refs/heads/master@{#25258}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

MapCache simplification. It is now a FixedArray that maps number of properties to a WeakCell with a Map.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/712943002

Cr-Commit-Position: refs/heads/master@{#25253}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25253 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Revert "Fixes for Windows and Mac builds after r25250."
TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/699613004

Cr-Commit-Position: refs/heads/master@{#25252}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This CL introduces LayoutDescriptor which is responsible for tracking which in-object fields are tagged and which are not.
LayoutDescriptor field added to Map. Currently unboxing is disabled.

R=hpayer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/391693002

Cr-Commit-Position: refs/heads/master@{#25250}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Introduce two new function kind, one for default constructor and one
for default constructor call super. Then when we are about to pares
these we just generate the correct AST in source.

BUG=v8:3661, v8:3672
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/700523003

Cr-Commit-Position: refs/heads/master@{#25222}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This implements correct semantics for "extensible" top level lexical scope.
The entire lexical scope is represented at runtime by GlobalContextTable, reachable from native context and accumulating global contexts from every script loaded into the context.

When the new script starts executing, it does the following validation:
- checks the GlobalContextTable and global object (non-configurable own) properties against the set of declarations it introduces and reports potential conflicts.
- invalidates the conflicting PropertyCells on global object, so that any code depending on them will miss/deopt causing any contextual lookups to be reexecuted under the new bindings
- adds the lexical bindings it introduces to the GlobalContextTable

Loads and stores for contextual lookups are modified so that they check the GlobalContextTable before looking up properties on global object, thus implementing the shadowing of global object properties by lexical declarations.

R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/705663004

Cr-Commit-Position: refs/heads/master@{#25220}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25220 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/694533003

Cr-Commit-Position: refs/heads/master@{#25219}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25219 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r25142.

TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/702853002

Cr-Commit-Position: refs/heads/master@{#25145}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25145 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/703603003

Cr-Commit-Position: refs/heads/master@{#25142}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/661133002

Cr-Commit-Position: refs/heads/master@{#25136}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r25102.

TBR=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/699143002

Cr-Commit-Position: refs/heads/master@{#25104}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/699633002

Cr-Commit-Position: refs/heads/master@{#25102}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25102 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is a prerequisite for https://codereview.chromium.org/661133002/.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/698043003

Cr-Commit-Position: refs/heads/master@{#25099}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25099 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:427813
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/676393002

Cr-Commit-Position: refs/heads/master@{#25082}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Instead of using multiple generations for the code, first only store the hash that gets aged. Once a hash matched on a next probe, actually cache the code. Use regular code aging to remove entries from the cache.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/675013004

Cr-Commit-Position: refs/heads/master@{#25040}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/690713003

Cr-Commit-Position: refs/heads/master@{#25029}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/684103002

Cr-Commit-Position: refs/heads/master@{#24973}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24973 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/678843004

Cr-Commit-Position: refs/heads/master@{#24927}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

After r24737 pointer updating is done by atomic operations which strictly
require target address to be 8-byte alignment on MIPS64.

The alignment is broken on 64-bit arches because InstructionSize is first field
and has Int size.

Order of fields in object layout are changed to make kNextCodeLinkOffset
divisible by 8. The size of code object header remains the same.

TEST=cctest/test-debug/* on MIPS64
BUG=
R=jkummerow@chromium.org, paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/682673002

Cr-Commit-Position: refs/heads/master@{#24914}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24914 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This CL adds a bitset to describe the type of IC in each IC slot.
This is necessary for clearing ICs of different types.

With FLAG_vector_ics off (the current state), it's not required because
CALL_IC is the only type of IC in the vector.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/679073002

Cr-Commit-Position: refs/heads/master@{#24911}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24911 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Revert "Limit the number of transitions allowed per hidden class." Due to crashes in ClearMapTransitions

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/661583004

Cr-Commit-Position: refs/heads/master@{#24900}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24900 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Private symbols we create in the heap don't have names, but we can
resolve them to a constant string.

This gives handy debugger output like:

(gdb) job 0x2020c67d
0x2020c67d: [Symbol]
 - hash: 547385396
 - name: 0x20208091 <undefined> (uninitialized_symbol)
 - private: 1
 - own: 1
$7 = void
(gdb)

or with ShortPrint() in an array:

...
  [5]: 0x2020c67d <Symbol: 547385396 (uninitialized_symbol)>
...

Printing help for internal symbols

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/677633003

Cr-Commit-Position: refs/heads/master@{#24869}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Each time a transition is added to a hidden class, the whole
transitions array must be copied, which causes poor performance
in some circumstances.  This change limits the maximum size of
the transition array, avoiding this behavior in the pathological
case.  For example, this improves the performance of the EtchMark
benchmark by nearly 60%.

BUG=v8:3616
LOG=
R=verwaest@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/635883003

Patch from Kevin M. McCormick <mckev@amazon.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24857 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/656423004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/659363002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24837 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

- assertions regarding max heap object size.
- ensure string table capacity upfront.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/671843003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

BUG=

Review URL: https://codereview.chromium.org/663313003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24818 ce2b1a6d-e550-0410-aec6-3dcde31c8c00