This reverts commit 69957c36edaebe0b9b614099eb1b067fb0208671. Blink roll this patch depends on was reverted for some reason.

BUG=None
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19483003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

These methods have been superceeded by equivalents accepting object arguments exposing more details.

This is exactly the same change as r15708 which was reverted in r15710 due to pending Blink changes.

BUG=None
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19542003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r15697 (61d56196)

Original commit message:
The code aging sequence contains a load which is unecessary for optimised
function. This has been replaced by a nop.

BUG=

Review URL: https://codereview.chromium.org/19683005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r15715 (2e830d4)

Original commit message:
The gc should be able to traverse all AllocationSites for decision making. The sites are threaded into a weak list. Special problems include:

* Allocations of AllocationSites occur in generated code, so generated code needs to be able to add to the list. For now I have a special hydrogen instruction, though it would be nice to use general purpose instructions.
* The snapshot contains AllocationSites, and these need to be re-threaded into the list on deserialization.

Something nice is that the AllocationSites are only created in old space, so a special new space visitor isn't required.

BUG=

Review URL: https://codereview.chromium.org/19635002
Patch from Balazs Kilvady <kilvadyb@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15732 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19267023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18774002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/19590002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r15725 and replaces it with the following one-liner
in hydrogen.cc's HandleLiteralCompareTypeof:

-  CHECK_ALIVE(VisitForValue(sub_expr));
+  CHECK_ALIVE(VisitForTypeOf(sub_expr));

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19523005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=259300
R=ulan@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/19569003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19507004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19556003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18429005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15724 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:260345
R=danno@chromium.org

Review URL: https://codereview.chromium.org/19582002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=loislo@chromium.org, verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19397002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19568002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=None
R=loislo@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/19554002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15716 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The gc should be able to traverse all AllocationSites for decision making. The sites are threaded into a weak list. Special problems include:

* Allocations of AllocationSites occur in generated code, so generated code needs to be able to add to the list. For now I have a special hydrogen instruction, though it would be nice to use general purpose instructions.
* The snapshot contains AllocationSites, and these need to be re-threaded into the list on deserialization.

Something nice is that the AllocationSites are only created in old space, so a special new space visitor isn't required.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/18173013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The reason is that an AllocationMemento associated with an array only
lives for one gc (it is unrooted). So an excess of garbage collections
in these tests cause the Memento to be lost, and expected behavior
can't be guaranteed.

BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/19544002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix the invalid array length check, replacing it with a check of
the elements pointer similar to TransitionElementsKindStub.
Refactor common code from ElementsTransitionAndStoreStub and TransitionElementsKindStub into BuildTransitionElementsKind() helper method.
Add test case for the MD5 computation that used to crash before,
and a small test case for the specific issue.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19367003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

ES6 does not prescribe it, but both Blink and Firefox have it.

Also does a small rename of parameter in test.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/19562002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19256020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r15708 to make WebKit bots happy while Blink change https://src.chromium.org/viewvc/blink?view=rev&revision=154386 is not rolled into Chromium.

BUG=None
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19557002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/19495002

Patch from HaiTao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

These methods have been superceeded by equivalents accepting object arguments exposing more details.

BUG=None
R=loislo@chromium.org, yangguo@chromium.org

Review URL: https://codereview.chromium.org/19549002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If NULL is a nullptr (such as on my FreeBSD system), it is not possible to
use reinterpret_cast to convert it to another pointer. Plus, just using NULL
directly achieves the same effect.

R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19388005

Patch from Raphael Kubo da Costa <raphael.kubo.da.costa@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Reland "Calls to HCheckFunction can be eliminated if the value is an HConstant"
(https://codereview.chromium.org/18751003/).

The CL failed because of heap snapshot issues. alph@chromium.org just checked in
a fix for that (https://code.google.com/p/v8/source/detail?r=15694).

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/19504007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=danno@chromium.org, mstarzinger@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/19504006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/18535011

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The stub used to check the length of the JS array to see if
there's a need to duplicate the elements backing store. This
way it will not duplicate the elements array when going from
double to object even if the elements array is not the empty
fixed array. Later on it will then store pointers into a
FixedDoubleArray.

The native code stub used to check whether elements points to
the empty_fixed_array singleton instead of testing the length.
The Hydrogen stub does that as well now.

R=danno@chromium.org

Review URL: https://codereview.chromium.org/19289009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19543002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The code aging sequence contains a load which is unecessary for optimised
function. This has been replaced by a nop.

BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/19379003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19235011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This bug causes segfault in the octane benchmark,
because the deoptimization entries do not fit in the
deopt table.
This change increases the table entry size.

TEST=octane benchmark

BUG=

Review URL: https://codereview.chromium.org/19381004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It produced orphan DependentCode nodes because links were not created explicitly in ExtractPropertyCellReferences and IndexedReferencesExtractor was disabled for ProperyCells.

R=danno@chromium.org, loislo@chromium.org

Review URL: https://codereview.chromium.org/19368002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=chromium:260585
R=hpayer@chromium.org

Review URL: https://chromiumcodereview.appspot.com/19267019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TransitionArray references were added to the TA's map object instead
of TA itself.

R=verwaest@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/19265002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/19182002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The second test has an existing expectation that is extended.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/19299004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For STM and LDM instuctions with writeback update base register only after all registers have been saved/loaded. This guarantees that invariant sp <= fp is always true when iterating stack in the Sampler.

BUG=v8:2782
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/19243002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/19290008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15686 ce2b1a6d-e550-0410-aec6-3dcde31c8c00