This is done by first committing the deoptimization entry code with a minimal
area size (OS::CommitPageSize) and later using CommitArea to adjust the size.

Committed: http://code.google.com/p/v8/source/detail?r=13494

Review URL: https://chromiumcodereview.appspot.com/11566011
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13532 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://codereview.chromium.org/12093016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13531 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/12088021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=haraken@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12040075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r13506 (0d666576)

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/12077009
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The previous duplication is quite bad from an architectural point of
view. Furthermore, it messes up the output of --hydrogen-stats.

As remarked in a comment, there is still more unification work to do, but at
least this CL is a step in the right direction...

Review URL: https://codereview.chromium.org/12091016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.

BUG=chromium:172345

Review URL: https://chromiumcodereview.appspot.com/12082023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Disable the flag by default because of Chrome crashes.

BUG=172488,172489
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12091018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13523 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This allows Crankshaft to allow inlining of multiple different closures
that were all derived from the same shared function info. This pattern
appears when libraries provide generic closures that are used over and
over again at different call-sites.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-closures

Review URL: https://codereview.chromium.org/12071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12039088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13521 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Replaced a scary pointer comparison by strcmp on the way.

Review URL: https://codereview.chromium.org/12035101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13510 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12049086

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13507 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also includes some other minor cleanup to make Keyed related IC code
more uniform.

Review URL: https://chromiumcodereview.appspot.com/11896091

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Basically, the work list for the fixed point iteration has been removed.

BUG=v8:2510

Review URL: https://codereview.chromium.org/12052075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13505 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=v8:2437

Review URL: https://chromiumcodereview.appspot.com/12033099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Merge UpdateStoreCaches into a single function dispatching on ComputeStoreMonorphic and UpdateMegamorphicCache.

Review URL: https://chromiumcodereview.appspot.com/12057003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/12040094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13502 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2487

Review URL: https://codereview.chromium.org/12033011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This allows Crankshaft to generate monomorphic loads when the receiver
type is statically known even though the load site has polymorphic type
feedback. This applies to inlined constructor calls and literals.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/property-static

Review URL: https://codereview.chromium.org/12051058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12047084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
TEST=test-api.cc::PersistentHandleInNewSpaceVisitor

Review URL: https://codereview.chromium.org/11365131
Patch from Kentaro Hara <haraken@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch seems to cause crashes on Windows.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12049069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is done by first committing the deoptimization entry code with a minimal
area size (OS::CommitPageSize) and later using CommitArea to adjust the size.

Review URL: https://codereview.chromium.org/11566011
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If a live range was split immediately before an instruction that required a
safe-point pointer map, it was possible for the safe-point to incorrectly use the
register/stack slot information of the preceeding live range rather than the one
that actually covers the safe-point.

R=mstarzinger@chromium.org,vegorov@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12040052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

ComputeLoadMonorphic and UpdateMegamorphicCache.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The removal of HCheckMaps is invalid when the instruction has a virtual
usage, which can happen e.g. for HLoadElements or HJSArrayLength.

R=jkummerow@chromium.org
TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html

Review URL: https://codereview.chromium.org/12033073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/12049033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This allows side effect dominator tracking to remove map checks that are
dominated by a single HStoreNamedField that performs a transition on the
same object. A similar trick could be applied to HAllocateObject.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12035026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13488 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

V8 crashes with this flag when trying to compile hydrogen stubs.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12045048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://codereview.chromium.org/11953043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/11953056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/11428137
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes a corner case that happens when JSFunctions are enqueued as
code flushing candidates but their respective SharedFunctionInfo isn't.
If the JSFunction gets evicted due to optimization the code slot in the
SharedFunctionInfo will never be recorded in the slots buffer.

R=hpayer@chromium.org
BUG=chromium:168801
TEST=cctest/test-heap/Regress168801

Review URL: https://codereview.chromium.org/11896064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Finding a property, but not using an IC, indicates that the variable was
found on the prototype (in DOMWindow). Those properties need to be
ignored while storing global properties via the IC.

Review URL: https://chromiumcodereview.appspot.com/12040039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

After r13289 the divisor can be non-constant, so we should check for zero.

BUG=171641
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: https://chromiumcodereview.appspot.com/11953025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13478 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r13475 (0076e1ee)

Original commit message:
With parallel recompilation enabled, objects made accessible by handles may
have changed between graph construction and graph optimization. Therefore
we must not assume that information on those objects remain the same between
those two phases. To police this, we forbid handle dereferencing during
graph optimization.
Exceptions to this rule are:
 - Dereferencing the handle to obtain the raw location of the object. This
   is safe since parallel recompilation acquires RelocationLock
 - Some places that dereference the handle for a type check. These are checked
   to be safe on a case-by-case basis.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/12049037
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r13454 (2c0dd0ff)

Original commit message:
HCheckPrototypeMaps currently records the prototype and the holder of the
prototype chain (both ends of the chain) and assumes that the chain elements
and their maps did not change in during the entirety of Crankshaft. The actual
traversal of the prototype chain happens in Lithium at code generation.
With parallel compilation, this assumption is not longer correct.

BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/12036030
Patch from Akos Palfi <palfia@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

With parallel recompilation enabled, objects made accessible by handles may
have changed between graph construction and graph optimization. Therefore
we must not assume that information on those objects remain the same between
those two phases. To police this, we forbid handle dereferencing during
graph optimization.
Exceptions to this rule are:
 - Dereferencing the handle to obtain the raw location of the object. This
   is safe since parallel recompilation acquires RelocationLock
 - Some places that dereference the handle for a type check. These are checked
   to be safe on a case-by-case basis.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12049012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13475 ce2b1a6d-e550-0410-aec6-3dcde31c8c00