The input value isn't what is written into the field if the representation is double. A heap-number is written to the field instead; which requires a write-barrier.

BUG=chromium:254570
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/18854018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2745
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18899002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15572 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reenables https://codereview.chromium.org/17842004 (again).

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18895002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18044003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15570 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/18887002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2745
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18830003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15568 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18238008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15567 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

- Splits all non-normal Store ICs into handler and IC.
- Ensures monomorphic store ICs go polymorphic.
- Feeds polymorphic type feedback into count operation.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/14142005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

icu uses the same identifiers, so we can't just #undef them

BUG=v8:2745
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/18209003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The commit r15561 introduced a lot of debug mode test failures
on MIPS. This change solves these failures by making
the FP-saved version of StoreBufferOverflowStub available
at snapshot time. This stub was added to ARM by commit r14359.

BUG=

Review URL: https://codereview.chromium.org/18238012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r15556 (3cd37fff)

BUG=

Review URL: https://codereview.chromium.org/18615008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15563 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

MIPS: Bugfix: The general array constructor stub did not handle the case properly when it is called with a function pointer in the type cell, instead assuming that an AllocationSite object should be present.

Port r15555 (262c081)

Original commit message:
The case where this can happen is if the cell is uninitialized, then the
first constructor call made is to the Array function of a different
context. In that case, we'll store the function pointer in the cell,
and then go ahead and call the array constructor stub too. The bug is
fixed by checking for the AllocationSite object map. If not found, the
constructor stub goes forward with a default ElementsKind, just as in
several other cases.

A test in allocation-site-info.js was beefed up to make sure the state
chain described above is traversed.

BUG=

Review URL: https://codereview.chromium.org/18858003
Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r15545 (8cf04c4)

Original commit message:
This creates a platform where we can do additional things with allocation sites,
other than just aid in reducing array transitions.

BUG=

Review URL: https://codereview.chromium.org/18089025
Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18801004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15560 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reverts https://codereview.chromium.org/17842004 (again), due to SS regression.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18337003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15559 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Revert "Introduce a handle zapping setting, and enable it by default for release and debug" due to performance impact.

R=jochen@chromium.org

Review URL: https://chromiumcodereview.appspot.com/18325027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15558 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

On MSVS, this throws an error

BUG=v8:2745
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18854002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15557 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/18749004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

properly when it is called with a function pointer in the type cell,
instead assuming that an AllocationSite object should be present. The
case where this can happen is if the cell is uninitialized, then the
first constructor call made is to the Array function of a different
context. In that case, we'll store the function pointer in the cell,
and then go ahead and call the array constructor stub too. The bug is
fixed by checking for the AllocationSite object map. If not found, the
constructor stub goes forward with a default ElementsKind, just as in
several other cases.

A test in allocation-site-info.js was beefed up to make sure the state
chain described above is traversed.

BUG=
R=hpayer@chromium.org, hpayer@google.com

Review URL: https://codereview.chromium.org/18277006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15555 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Do at least two GCs in LowMemoryNotification.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/18635006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:167394
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18838002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15553 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reenables https://codereview.chromium.org/17842004

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18847002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18843002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15551 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When computing next_gc_likely_to_collect_more do not take into account already
free nodes in PostGarbageCollectionProcessing.

This reduces the number of full GC in LowMemoryNotification from 7 to ~2.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/18834002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15550 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

All three tests have existing timing issues on the blink waterfall and receive a timeout on the V8 waterfall in Windows debug.

See http://src.chromium.org/viewvc/blink/trunk/LayoutTests/TestExpectations

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18434005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15549 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The checks are split out from "extra checks" which are too expensive to
turn on by default.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/18316006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

That way, we don't end up collecting all samples in the garbage
collector when the i18n extension is loaded.

BUG=v8:2745
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18714006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18434004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15546 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This creates a platform where we can do additional things with allocation sites,
other than just aid in reducing array transitions.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/15094018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Functions that are optimized by the parallel thread and ready for installing
are not necessarily marked as in-recompilation-queue. For example, OSR could
have replaced the code by optimized code.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/18769003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15544 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Some code was commented out earlier as a todo. Now the code can be reenabled,
because allocation site feedback is working there again.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/18753005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org
BUG=v8:2745

Review URL: https://codereview.chromium.org/18654006

Patch from Jochen Eisinger <jochen@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15542 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/18832002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

function, and that function handle matches the target handle.

BUG=
R=danno@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18751003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dslomov@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/18826002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15537 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18396003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/18568007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Remove some expectations from our blacklist, because they are  part of blink's expectations now:

http://src.chromium.org/viewvc/blink?view=revision&revision=153636

Blink revision 153636 is now included in DEPS revision 153656.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/18823002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15534 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/18549004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/18660002

Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00