A follow-up to r9994.

R=vitalyr@chromium.org
BUG=102895
TEST=cctests/test-heap-profiler/NoHandleLeaks

Review URL: http://codereview.chromium.org/8468016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: http://codereview.chromium.org/8595007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8561011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10028 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10012 (09c6bcba81).

Original commit message:
There is no need to bail out to runtime system when creating sliced strings of external strings since the string content is unimportant.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8585041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1831

Review URL: http://codereview.chromium.org/8597006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note that some cctests and d8 still contain statical members with exit time destructors.

BUG=v8:1828

Review URL: http://codereview.chromium.org/8586025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10025 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8590026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10024 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=test/mjsunit/string-externalize.js

Review URL: http://codereview.chromium.org/8513010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8574058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8574053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10021 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10006 (4b344a03).

Original commit message:

Changes the way we do lazy deoptimization:

1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.

     CALL
     GAP
     LAZY-BAILOUT ==> lazy-deopt-call

2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.

   STACK-CHECK
   GAP ==> lazy-deopt-call

The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.

Additional changes:
* RegExpLiteral marked it as having side-effects so that it
  gets an explicitlazy-bailout instruction (instead of
  treating it specially like stack-checks)
* Enable target recording CallFunctionStub to achieve
  more inlining on optimized code.

BUG=
TEST=
Review URL: http://codereview.chromium.org/8587008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Landing: [hydrogen] optimize switch with string clauses. Patch by Fedor Indutny <fedor.indutny@gmail.com>.

Original code review: http://codereview.chromium.org/8373029/
Review URL: http://codereview.chromium.org/8589019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10019 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

DoDeferredBinaryOpStub is not used (or even defined) anywhere.
MIPS can handle special cases of div, which is the only place it's used in the ARM version.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8588005
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10018 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

EmitIsObject is only called from one function, DoIsObjectAndBranch.
DoIsObjectAndBranch now passes the temp2 register to EmitIsObject
instead of simply relying on the two functions using the same
lithium scratch register.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8588004
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Changes:
-separated the two code-paths (constant power of 2 divisor similar to ARM and everything else)
-replaced a bailout condition with faster handling (negative modulo result)
-removed a possibly useless mov instruction from one path
-replaced the IsConstantOperand condition with the more meaningful HasPowerOf2Divisor (although in this specific case they're equivalent)

BUG=
TEST=

Review URL: http://codereview.chromium.org/8591002
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10016 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: http://codereview.chromium.org/8520023
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10015 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r9979(0cf0570a).

Original commit message:

Also simplify ia32 and x64 handing of the trace_elements_transition flag.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8557004
Patch from Gergely Kis <gregely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10014 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There is no need to bail out to runtime system when creating sliced strings of external strings since the string content is unimportant.

Review URL: http://codereview.chromium.org/8513016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8568042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=103587

Review URL: http://codereview.chromium.org/8575006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1678

Review URL: http://codereview.chromium.org/8513012
Patch from Matthew Sporleder <msporleder@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We pass in the object that we set the map on.
Review URL: http://codereview.chromium.org/8486005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Changes the way we do lazy deoptimization:

1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.

     CALL
     GAP
     LAZY-BAILOUT ==> lazy-deopt-call

2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.

   STACK-CHECK
   GAP ==> lazy-deopt-call

The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.

Additional changes:
 * RegExpLiteral marked it as having side-effects so that it 
   gets an explicitlazy-bailout instruction (instead of
   treating it specially like stack-checks)
 * Enable target recording CallFunctionStub to achieve
   more inlining on optimized code.

BUG=v8:1789
TEST=jslint and uglify run without crashing, mjsunit/compiler/regress-lazy-deopt.js
Review URL: http://codereview.chromium.org/8492004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It mysteriously disappeared about 800 revisions ago... :-} Thanks to Jakob for spotting this!

Review URL: http://codereview.chromium.org/8574036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=erik.corry@gmail.com
Review URL: http://codereview.chromium.org/8520031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10004 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/8571017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10003 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8570017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=http://code.google.com/p/v8/issues/detail?id=1821

Review URL: http://codereview.chromium.org/8536042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8468005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

So far free variables references in eval code are not statically
resolved. For example in
    function foo() { var x = 1; eval("y = x"); }
the variable x will get mode DYNAMIC and y will get mode DYNAMIC_GLOBAL,
i.e. free variable references trigger dynamic lookups with a fast case
handling for global variables.

The CL introduces static resolution of free variables references in eval
code. If possible variable references are resolved to bindings belonging to
outer scopes of the eval call site.

This is achieved by deserializing the outer scope chain using
Scope::DeserializeScopeChain prior to parsing the eval code similar to lazy
parsing of functions. The existing code for variable resolution is used,
however resolution starts at the first outer unresolved scope instead of
always starting at the root of the scope tree.

This is a prerequisite for statically checking validity of assignments in
the extended code as specified by the current ES.next draft which will be
introduced by a subsequent CL. More specifically section 11.13 of revision 4
of the ES.next draft reads:
* It is a Syntax Error if the AssignmentExpression is contained in extended
  code and the LeftHandSideExpression is an Identifier that does not
  statically resolve to a declarative environment record binding or if the
  resolved binding is an immutable binding.

TEST=existing tests in mjsunit

Review URL: http://codereview.chromium.org/8508052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In this case uncommiting marking deque is impossible.

R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8528030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8510058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9997 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
TEST=mjsunit/array-elements-from-array-prototype-chain

Review URL: http://codereview.chromium.org/8572004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9996 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8572003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=102895
TEST=none

Review URL: http://codereview.chromium.org/8528024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9994 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is a deliberate non-conformity introduced more than 2 years ago to
be compatible with JSC. The current state is that all other browsers
perform ES5 conform in that regard.

R=erik.corry@gmail.com
BUG=chromium:1717,chromium:39662
TEST=test262/15.2.3.6-4-6??,mjsunit/undeletable-functions

Review URL: http://codereview.chromium.org/8566009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: http://codereview.chromium.org/8510048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This test depends on OSR being triggered. That's why I can't
use %OptimizeFunctionOnNextCall.
Review URL: http://codereview.chromium.org/8555004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Afterpatch for r9985.

Review URL: http://codereview.chromium.org/8565005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9986 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Implementation for this case

var x = {};
x.__defineGetter__("y", function Y() { return 42; });

BUG=v8:1818
TEST=cctest/test-heap-profiler/FastCaseGetter

Review URL: http://codereview.chromium.org/8491041
Patch from Ilya Tikhonovsky <loislo@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9985 ce2b1a6d-e550-0410-aec6-3dcde31c8c00