The problem appeared due to a fact that stubs doesn't create a stack
frame, reusing the stack frame of the caller function. When building
stack traces, the current function is retrieved from PC, and its
callees are retrieved by traversing the stack backwards. Thus, for
stubs, the stub itself was discovered via PC, and then stub's caller's
caller was retrieved from stack.

To fix this problem, a pointer to JSFunction object is now captured
from the topmost stack frame, and is saved into stack trace log
record. Then a simple heuristics is applied whether a referred
function should be added to decoded stack, or not, to avoid reporting
the same function twice (from PC and from the pointer.)

BUG=553
TEST=added to mjsunit/tools/tickprocessor

Review URL: http://codereview.chromium.org/546089

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Always invoke HeapObjectIterator::has_next() before invoking HeapObjectIterator::next().
This is necessary as ::has_next() has an important side-effect of going to the next
page when current page is exhausted.

And to find if pointers are encodable use more precise data---top of map space, not a number
of pages, as pages might stay in map space due to chunking.

Review URL: http://codereview.chromium.org/552066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3672 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/545153

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Backport optimizations from x64 version to ia32.

Review URL: http://codereview.chromium.org/546087

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

compiler for all code.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

I will revert when the bots have picked this one up.
Review URL: http://codereview.chromium.org/549118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

non-optimizing compiler can cope with.  By default it bails out
to the old compiler on encountering a for loop (for performance)
but with this change the --always-fast-compiler flag will enable
functions with for loops to be compiled in the non-optimizing
compiler.  Also enables the non-optimizing compiler on functions
that can be lazily compiled (again only with the flag).
Review URL: http://codereview.chromium.org/552065

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3667 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/549111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/543121

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/545134

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/536089

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/549109

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3662 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is a preparation step for including number type information
in the virtual frame. We need a common place where we can update
the number type information of the result of a binary operation
since we should not modify the state of the virtual frame elements
directly.

Review URL: http://codereview.chromium.org/551080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3661 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

always ambiguous whether it tried to generate fast code, or generate
it quickly.

Review URL: http://codereview.chromium.org/549108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=582
TEST=cctest/test-api/NativeFunctionConstructCall

Review URL: http://codereview.chromium.org/546088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/548069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBD=sgjesse@chromium.org

Review URL: http://codereview.chromium.org/543120

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3657 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/549086

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/543113

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/545118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/543115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3653 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/554001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The implementation of Object.prototype.valueOf and Object.prototype.toString now calls ToObject on "this" as mandated by the spec.
Review URL: http://codereview.chromium.org/542112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/543114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Some tests still fail.

TBR=ager@chromium.org


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also added one method to runtime to get the extensible value
Additionally, added a check on the number of arguments in the start of GetOwnProperty.


Review URL: http://codereview.chromium.org/545116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

generator.

Contexts are no longer stored in the AST but in the code generator's
state.  This means that the running the code generator selector is not
required to use the toplevel code generator (for instance, if we
already know that we can and should use it).

Review URL: http://codereview.chromium.org/546075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Crashes if rax doesn't point to readable memory.
Recent change made rax contain garbage due to write-barrier computation.
(The fact that it hasn't crashed before highly suggests that the line does nothing.)

Review URL: http://codereview.chromium.org/545117

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3644 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=cctest/test-api/NativeFunctionConstructCall
BUG=582

Review URL: http://codereview.chromium.org/551063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3643 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Most of the test cases fail as the different objects according to the tests 
can not have additional properties attached to them. I will file a bug report
on the es5 conform site as they should allow this. Some of the test fails
because we still miss some of the es5 features used.


Review URL: http://codereview.chromium.org/545109

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix lint issue in lineprocessor.cc.

TBR=peter.rybin
Review URL: http://codereview.chromium.org/549081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3641 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=fschneider@chromium.org

Review URL: http://codereview.chromium.org/542107

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3640 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/553009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Sorry for a breakage...

TBR=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/536090

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/491006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

code generator.

Review URL: http://codereview.chromium.org/542105

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3636 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

As this is only needed for internal profiling (not for DevTools),
the following approach had been chosen:

 - during snapshot creation, positions of serialized objects inside
   a snapshot are logged;

 - then during V8 initialization, positions of deserealized objects
   are logged;

 - those positions are used for retrieving code objects names from
   snapshot creation log, which needs to be supplied to tick processor
   script.

Positions logging is controlled with the new flag: --log_snapshot_positions.
This flag is turned off by default, and this adds no startup penalty.

To plug this fix to Golem, the following actions are needed:

 - logs created using 'mksnapshot' need to be stored along with VM images;

 - tick processor script needs to be run with '--snapshot-log=...' cmdline
   argument.

BUG=571

Review URL: http://codereview.chromium.org/551062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/505025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3634 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The patching of the receiver added in r3616 was not GC-safe and could leave a failure object in place of the receiver if allocation of the wrapper JS object failed.
Review URL: http://codereview.chromium.org/546068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3633 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The ARM simulator debugger now has a 'trace' command which is used to toggle the trace of executed instructions.
Review URL: http://codereview.chromium.org/548068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00