Finally sovles the problem that r5342 attempted to solve.
When adding a stub to a map's code cache we need to make
sure that this map is not used by object that do not need
this stub.

Existing solution had 2 flaws:
1. It checked that the map is cached by asking the current context.
If the object escaped into another context then NormalizedMapCache::Contains
returns false negative.

2. If a map gets evicted from the cache we should not try to modify it
even though Contains returns false.

This patch implements much less fragile solution of the same problem:
A map now has a flag (is_shared) that is set once the map is added
to a cache, stays set even after the cache eviction, and is cleared
if the object goes back to fast mode.

Added a regression test.

Review URL: http://codereview.chromium.org/3472006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5518 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For some reason, the scope's arguments and arguments shadow were
variable proxies, which resulted in all references to the arguments
shadow being shared in the AST.  This makes it hard to put per-node
state on the AST nodes.

I took the opportunity to remove Variable::AsVariable which has
confused people in the past, and to rename Variable::slot to the more
accurate Variable::AsSlot.

Review URL: http://codereview.chromium.org/3432022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3412028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5515 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3442012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5514 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=876

Review URL: http://codereview.chromium.org/3466013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add support for index properties with getters, setters or indexed interceptors.

For indexed interceptor case only fix crashes, do not guarantee any semantic soundness. Separate issue opened for this http://code.google.com/p/v8/issues/detail?id=877

BUG=http://code.google.com/p/v8/issues/detail?id=874

Review URL: http://codereview.chromium.org/3462005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3449004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The number of inobject properties used to be derived from the number
of this property assignments in the constructor (and increased by 2 to
allow for properties added later). This very often leads to wasted inobject 
slots.

This patch reclaims some of the unused inobject space by the following method:
 - for each constructor function the first several objects are allocated using the initial 
   ("generous) instance size estimation (this is called 'tracking phase').
 - during the tracking phase map transitions are tracked and actual property counts are collected.
 - at the end of the tracking phase instance sizes in the maps are decreased if necessary
   (starting with the function's initial map and traversing the transition tree).
 - all further allocation use more realistic instance size estimation.

Shrinking generously allocated objects without costly heap traversal is made possible 
by initializing their inobject properties with one_pointer_filler_map (instead of undefined). 

The initial slack for the generous allocation is increased from 2 to 6 which really helps some tests.

Review URL: http://codereview.chromium.org/3329019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5510 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We should not allow handle dereference and GC inside the same expression because order of subexpression evalution are not defined.

Review URL: http://codereview.chromium.org/3398014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5509 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There are 3 methods where early return happen before the 
miss label is bound. This is harmless in Release mode, 
in Debug an assertion fails.

Review URL: http://codereview.chromium.org/3405022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It complaints of type conversions.

Review URL: http://codereview.chromium.org/3396015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5507 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

strlen returns size_t and VS2008 is now pretty picky about that.

Review URL: http://codereview.chromium.org/3384019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG: 52801

Review URL: http://codereview.chromium.org/3389022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3466009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=erik.corry

Review URL: http://codereview.chromium.org/3446015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3327022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=672
Review URL: http://codereview.chromium.org/3444011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5498 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Contextual load requires only a map check followed by a cell hole
check so we can generate pretty compact code for that. The fact that
we have inlined code is marked by mov ecx, offset instruction after
the IC call. Inlining is only enabled inside loops and in non-builtin
functions.

The generated code size increase is about 3%. This descreased the
pc-to-code cache hit rate in some of the benchmarks that trigger
GC. To compensate we now have 4 times as much entries in the cache.

Review URL: http://codereview.chromium.org/3402014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Test was failing is due to a fact that MSVC in debug mode uses
separate instances for identical string literals.

TBR=sgjesse@chromium.org

Review URL: http://codereview.chromium.org/3381013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3471001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5494 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

inputs by scrambling the input strings.
Review URL: http://codereview.chromium.org/3435012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It turns out they were filtered out. But when I unfiltered them, I
discovered another issue: when DevTools run, regexp literals get
recompiled each time they called (looks like this is concerned with
switching to full compiler), so I ended up having multiple entries for
the same regexp. To fix this, I changed the way of how code entries
equivalence is considered.

BUG=crbug/55999
TEST=cctest/test-profile-generator/ProfileNodeFindOrAddChildForSameFunction
(the test isn't for the whole issue, but rather for equivalence testing)

Review URL: http://codereview.chromium.org/3426008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/2000004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=None
TEST=compiles

Patch from Thiago Farina <tfarina@chromium.org>

Review URL: http://codereview.chromium.org/3413015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix bug in writing symbol ids over 128.

Review URL: http://codereview.chromium.org/3416010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3408011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We must also check the current context has not changed.

The bug reported by Florian.

Review URL: http://codereview.chromium.org/3410014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5483 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3411013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3275011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Currenly the constructor like this:
function f() {
  this.a = 0;
  this.a = 1;
  this.a = 2;
}
creates a map with duplicate desciptors which is bad in many ways.


Review URL: http://codereview.chromium.org/3434004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Loading from out-of-range has to go to the runtime system to check if there
exists a property with that index in the prototype.

Review URL: http://codereview.chromium.org/3410011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

stores) in the full codegens.
Review URL: http://codereview.chromium.org/3431010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5469 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5468 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When running profiling in debug mode, several assertions in frame
iterators that are undoubtedly useful when iterator is started from a
VM thread in a known "good" state, may fail when running over a stack
of a suspended VM thread. This patch makes SafeStackFrameIterator
to proactively check addresses and bail out from iteration early,
before an assertion will be triggered.

BUG=crbug/55565

Review URL: http://codereview.chromium.org/3436006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5467 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

http://codereview.chromium.org/3442004/show

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Added some more uses of NearLabel.

Review URL: http://codereview.chromium.org/3381005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5465 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3425005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change introduces near labels in the assembler, allowing us to
uptimize forward jumps (conditional and unconditional) if we can
guarantee that the jump is witin range -128 to +127.

I changed a large fractions of the existing Labels to NearLabels, and
left out cases where it was not immediately clear if it could be used
or not (not immediately clear means labels covering a large code
block, or used in function calls which we could potentially change to
accept near labels). 

Review URL: http://codereview.chromium.org/3388004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5460 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3429006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00