R=whesse@chromium.org
BUG=v8:1878
TEST=test/mjsunit/regress/regress-1878.js

Review URL: http://codereview.chromium.org/9016041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/9041003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10303 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

r8425 (1081f75) had fixed this originally, but those changes were
accidentally reverted when the experimental/gc branch was merged
at r9600.

BUG=
TEST=debug mozilla regress-137181

Review URL: http://codereview.chromium.org/9026006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org
BUG=http://crbug.com/108296
TEST=test/mjsunit/regress/regress-108296.js

Review URL: http://codereview.chromium.org/8960004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This was a left-over from a time when bounds-check was performed
as part of this instruction.

I also refactored and improved the code for smi-only arrays.

R=vegorov@chromium.org
Review URL: http://codereview.chromium.org/9023006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

First attempt to do this failed, we need per target flags.
Review URL: http://codereview.chromium.org/9018013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* src/debug.cc (Debug::SetBreakPoint): Compare value not pointer.

Review URL: http://codereview.chromium.org/8971002
Patch from Tobias Burnus <burnus@net-b.de>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* src/string-search.h (StringSearch): Avoid -Werror=strict-overflow
  warning.

Review URL: http://codereview.chromium.org/8947022
Patch from Tobias Burnus <burnus@net-b.de>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=1871
TEST=

Review URL: http://codereview.chromium.org/9021011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes how Object.defineProperty() defines JavaScript accessors on
objects with installed API interceptors. The definition itself does not
cause any interceptors to be called, whereas any subsequent accesses on
said object will still fire the interceptor. This behavior is in sync
with API accessors.

R=rossberg@chromium.org
BUG=v8:1651,chromium:94666
TEST=cctest/test-api

Review URL: http://codereview.chromium.org/9021019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1669
TEST=
R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8969017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/9020004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/9019007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10284 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/9017004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10283 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10218 (1f42dff).

Original commit message:

Also several bugs with Smi/double elements handling and make Ensure* routines more flexible.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8894030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10282 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10280 (5f6aec5).

Original commit message:

Tell the register allocator the value is not overwritten.  Never use
temporary registers on ia32, avoid them on x64 and ARM.  Restore the
original copyright date on assembler.cc.

BUG=
TEST=

Review URL: http://codereview.chromium.org/9004017
Patch from Daniel Kalmar <kalmard@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10281 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Tell the register allocator the value is not overwritten.  Never use
temporary registers on ia32, avoid them on x64 and ARM.  Restore the
original copyright date on assembler.cc.

R=fschneider@chromium.org
BUG=v8:1870
TEST=

Review URL: http://codereview.chromium.org/8965038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We use foreign callbacks to make some properties shadow internal values
but still behave as data properties from within JavaScript. This means
when a value is passed to Object.defineProperty() on such a property,
it should update the internal value instead of redefinind the property
and destroying the shadowing.

R=rossberg@chromium.org
BUG=v8:1530
TEST=mjsunit/regress/regress-1530,test262/S15.3.3.1_A4

Review URL: http://codereview.chromium.org/8996008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The first attempt did not properly handle keyed loads/stores and
did not check the constructors of the objects in the prototype
chain.

Added two more tests to handle the fixed cases.

BUG=v8:1823
TEST=LeakGlobalObjectViaMapKeyed,LeakGlobalContextViaMapProto
Review URL: http://codereview.chromium.org/8974009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8953026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10274 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8997004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10272 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1866
TEST=d8 --print-source

Review URL: http://codereview.chromium.org/8969021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This just simplifies the command line used to run test cases, allowing
to copy them from the test harness output without editing. The passed
expression is obsolete by now.

R=yangguo@chromium.org

Review URL: http://codereview.chromium.org/8966023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
TEST=test262

Review URL: http://codereview.chromium.org/8951013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8968010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8957009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: http://codereview.chromium.org/8953016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10262 (694b67).

BUG=
TEST=

Review URL: http://codereview.chromium.org/8947017
Patch from Daniel Kalmar <kalmard@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10250 (77889cc).

BUG=
TEST=

Review URL: http://codereview.chromium.org/8953013
Patch from Daniel Kalmar <kalmard@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10264 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8957005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=

Review URL: http://codereview.chromium.org/8913010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8909004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10261 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8957004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10260 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=
TEST=

Review URL: http://codereview.chromium.org/8915005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
BUG=v8:1475
TEST=test262/15.2.3.6-4-4??

Review URL: http://codereview.chromium.org/8911006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This avoid leaking memory because optimized code may hold on to maps
from different tabs otherwise.

BUG=v8:1823, 102895
Review URL: http://codereview.chromium.org/8892002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=nosnap builder green

Review URL: http://codereview.chromium.org/8915006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=107370
TEST=new additions to mjsunit/array-literal-transitions

Review URL: http://codereview.chromium.org/8914006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This introduces an additional check into the StoreIC_ArrayLength builtin
checking that the array still has fast properties. Redifinitions of the
length property that would cause it's type or attributes to change, will
switch to slow properties, thereby invalidating said optimization.

R=svenpanne@chromium.org
BUG=v8:1756
TEST=test262

Review URL: http://codereview.chromium.org/8895025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00