The stub used to check the length of the JS array to see if
there's a need to duplicate the elements backing store. This
way it will not duplicate the elements array when going from
double to object even if the elements array is not the empty
fixed array. Later on it will then store pointers into a
FixedDoubleArray.

The native code stub used to check whether elements points to
the empty_fixed_array singleton instead of testing the length.
The Hydrogen stub does that as well now.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19289009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The code aging sequence contains a load which is unecessary for optimised
function. This has been replaced by a nop.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/19379003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19235011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This bug causes segfault in the octane benchmark,
because the deoptimization entries do not fit in the
deopt table.
This change increases the table entry size.

TEST=octane benchmark

BUG=

Review URL: https://codereview.chromium.org/19381004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It produced orphan DependentCode nodes because links were not created explicitly in ExtractPropertyCellReferences and IndexedReferencesExtractor was disabled for ProperyCells.

R=danno@chromium.org, loislo@chromium.org

Review URL: https://codereview.chromium.org/19368002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:260585
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19267019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TransitionArray references were added to the TA's map object instead
of TA itself.

R=verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19265002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/19182002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The second test has an existing expectation that is extended.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19299004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For STM and LDM instuctions with writeback update base register only after all registers have been saved/loaded. This guarantees that invariant sp <= fp is always true when iterating stack in the Sampler.

BUG=v8:2782
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19243002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19290008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=hpayer@chromium.org, hpayer@google.com

Review URL: https://codereview.chromium.org/19235010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Further refinement to semantics that I have missed in previous change.
Both Blink and Firefox are permissive with arguments to .set method.
However, when first argument to "set" is a number, all implementations
throw, so that users know that
   a.set(0,27)
does not assign 27 to 0th element of a, not 0 to 27th element of a.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19210002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15684 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/19272011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch allows callbacks to lazily allocate the InternalArray which is used to store pendingChangeRecords. This moves some of the expense of observation to the case where changes actually occurred.

When there are no pendingChangeRecords, the callbackInfo structure is a number which is the callbacks priority. Whenever a changeRecord is enqueued to the callback, it "normalizes" to be an InternalArray with a priority property. Immediately before its changeRecords are delivered, it returns to its optimized state.

---
Note: Naming confusion resolved:

This patch corrects some naming confusion in object-observe.js. Previously, we used the terms "callback" and "observer" to mean roughly the same thing, and overloaded the term "observer" to be both the callback itself and the *registration* on a object to observe (which now includes an accept map).

This patch resolves this confusion:

"object" (objectInfo, objectInfoMap): This refers to the observed object and its structures

"callback" (callbackInfo, callbackInfoMap): This refers to the callback to whom change records may be delivered

"observer" (objectInfo.changeObservers): This refers to a registration to observe a given object by a given callback with the specified accept list.
---

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/19132002

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15682 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When deopt testing is activated, a new status code will be returned by optimization status queries (status=maybe deopted).

This will make those tests work that test for 'not status=no', when performing deopt testing.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19184002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This was accidently re-enabled with r15674.

TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/19229003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

To turn on optimizations for debug when building standalone, a compiler flag can be used:

make optdebug=on

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19164003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If you want to use the system icu library, you'll need to use gyp_v8 (as
opposed to the standalone Makefiles)

BUG=v8:2475
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19195003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Causes breakage in crypto-(sha1|md5) SunSpider

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19214002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15674 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This essentially relands r14930 and r14935 with adaptions to the current
code base. It models the instantiation of an implicit receiver for
CallNew nodes in hydrogen using HAllocate together with generic stores
instead of one specialized HAllocateObject instruction, hence creating a
single choking point for inlined allocation in optimized code.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/19207002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org
BUG=173361

Review URL: https://codereview.chromium.org/19199002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

(was broken since r15640)

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/19188002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19153004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15666 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org
BUG=chromium:260106
TEST=cctest/test-api/Regress260106

Review URL: https://codereview.chromium.org/19159003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

four or even five different logging destinations.
I think we can extract the code related to a destination
into a separate class, do the same for the all destinations
and have four classes with more or less simple common logging
API

BUG=none
Meta-bug= https://code.google.com/p/chromium/issues/detail?id=260203

R=yangguo@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/18259024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15664 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Avoid the implicit recursion for range analysis, using a loop with
an explicit stack instead.

BUG=chromium:259452
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/19145002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15661 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also turn the recursion on the domination chain into a loop with
an explicit stack, to avoid possible stack overflow here.

R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/19150002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We now use DoubleTo(U)Int32 that follows ES specification.

R=titzer@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/18703007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19154003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19086003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19154002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The code previously assumed that an array with fast properties must have
a writable length property. But Object.freeze() now exposes a way to make
length read-only without moving the object into slow mode. This patch
simply adds a !is_frozen check to the IC code. Any future optimizations
to attribute-setting on JSArrays will need to make similar accomodations.

R=danno
BUG=v8:2711,259548

Review URL: https://chromiumcodereview.appspot.com/19115002
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch enables objects to undergo a single transition when they become observed, avoiding the need to create a new map for every observed objects.

Observed objects which become unobserved does not cause another map transition and unobserved does not clear the observed bit on the map. The unobserved object.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18221006

Patch from Rafael Weinstein <rafaelw@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/18254008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/18915009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

FCmp() pops 2 arguments from the stack...

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/18254007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://codereview.chromium.org/18301015

Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00