The instanceoff stub now supports arguments in registers and checks for null,
smi and string values without going to runtime.

Needs porting to X64 and ARM.
Review URL: http://codereview.chromium.org/5828004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add array bound checks to code generated for SwapElements. This fixes a bug that lead to a segfault when an array was modified while it was sorted.

Review URL: http://codereview.chromium.org/5686006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add generated code to calculate Math.log and to search Transcendental cache for logs.  Implemented on all platforms.
Review URL: http://codereview.chromium.org/5437002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

properties. For these closures we would like to be able to use
constant functions and for that we need the closures allocated in old
space.
Review URL: http://codereview.chromium.org/5220007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/5122005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5860 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Split out the random number state between JavaScript and private API

I've added v8::RandomPrivate() for internaly used random numbers, and pass the state in as a parameter to a random_base function.

I still need to implement strong seeding. I already know how and will be landing that in another patch.

BUG=http://code.google.com/p/v8/issues/detail?id=936
TEST=None.

Codereview URL: http://codereview.chromium.org/5143004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5845 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The expression of the key is now evaluated before the arguments, so all expressions in a keyed call are evaluared from left to right.

BUG=http://code.google.com/p/v8/issues/detail?id=931
TEST=test/mjsunit/regress/regress-931.js
Review URL: http://codereview.chromium.org/5161002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/4654002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=http://code.google.com/p/v8/issues/detail?id=927
TEST=test/mjsunit/regress/regress-927.js

Review URL: http://codereview.chromium.org/4746001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/4469002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/4308001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5755 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This switches out the existing constant splitting with masking that works like this:

1. Generate a random 32-bit value at compilation time.
2. XOR the 32-bit constant with the random value.
3. Emit the resulting immediate value along with the XOR operation to generate the original value.


BUG=http://code.google.com/p/v8/issues/detail?id=908

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=http://code.google.com/p/v8/issues/detail?id=907

Review URL: http://codereview.chromium.org/4004006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5718 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3605008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/3609008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Change more functions used by the Compiler class to have a uniform
interface: they get passed as argument an input/output pointer to a
CompilationInfo that they mutate if they succeed, and they return a
flag telling whether they succeeded.

Also, remove some unnecessary timers.

Review URL: http://codereview.chromium.org/3561012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5583 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The plan is to use the CompilationInfo class to communicate inputs and
outputs to compilation pipeline phases, which each return a boolean
success/failure flag.

The intent is to make it easier to compose small pieces of the
pipeline without having to grow a custom function each time, each
taking a half dozen arguments.

This change modifies the very front end (the parser).

Review URL: http://codereview.chromium.org/3586006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3537003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

For some reason, the scope's arguments and arguments shadow were
variable proxies, which resulted in all references to the arguments
shadow being shared in the AST.  This makes it hard to put per-node
state on the AST nodes.

I took the opportunity to remove Variable::AsVariable which has
confused people in the past, and to rename Variable::slot to the more
accurate Variable::AsSlot.

Review URL: http://codereview.chromium.org/3432022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Contextual load requires only a map check followed by a cell hole
check so we can generate pretty compact code for that. The fact that
we have inlined code is marked by mov ecx, offset instruction after
the IC call. Inlining is only enabled inside loops and in non-builtin
functions.

The generated code size increase is about 3%. This descreased the
pc-to-code cache hit rate in some of the benchmarks that trigger
GC. To compensate we now have 4 times as much entries in the cache.

Review URL: http://codereview.chromium.org/3402014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The stubs get an additional flag for including the smi code
inside the stub. This allows us to generate more compact code
if we don't want to inline the smi case outside the stub.

Review URL: http://codereview.chromium.org/3388005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In case one of the arguments is known to be a string we emit a few
fast conversion attempts for the other.  This allows using the
StringAddStub instead of STRING_ADD_{LEFT,RIGHT} builtins.

Review URL: http://codereview.chromium.org/3338007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5405 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Remove dependence of code-stubs on codegen, the virtual frame code generator.  Move some functions used by code-stubs and full-codegen from codegen to macro-assembler.
Review URL: http://codereview.chromium.org/3169049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3141022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

slightly better code and allow passing arguments to binary op stubs
in registers on the platforms that support it.
Review URL: http://codereview.chromium.org/3203005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5339 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Move code stub implementations from codegen-[platform].cc files to new code-stub-[platform].cc files, and declarations to new code-stub-[platform].h files.
Remaining work is to do the same for platform-independent code stub declarations, and to remove all dependencies on codegen header files from code stub files.
Review URL: http://codereview.chromium.org/3195022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5338 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

a dummy receiver that we end up ignoring anyway.
Review URL: http://codereview.chromium.org/3136032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

operations.
Review URL: http://codereview.chromium.org/3120027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5332 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

flow graph code completely. Add new AST node for null compares
and use it to make the full codegens better at generating code
for null comparisons.
Review URL: http://codereview.chromium.org/3146037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3197011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5322 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/3158020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

instruction.

By changing the pointer to the code object to a pointer to the first
instruction we can call directly this instruction directly instead of
looking up the address through the code object.

Review URL: http://codereview.chromium.org/3156028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Object model changes
----------------------------------------
New fixed_cow_array_map is used for the elements array of a JSObject
to mark it as COW. The JSObject's map and other fields are not
affected. The JSObject's map still has the "fast elements" bit set. It
means we can do only the receiver map check in keyed loads and the
receiver and the elements map checks in keyed stores. So introducing
COW arrays doesn't hurt performance of these operations. But note that
the elements map check is necessary in all mutating operations because
the "has fast elements" bit now means "has fast elements for reading".
EnsureWritableFastElements can be used in runtime functions to perform
the necessary lazy copying.

Generated code changes
----------------------------------------
Generic keyed load is updated to only do the receiver map check (this
could have been done earlier). FastCloneShallowArrayStub now has two
modes: clone elements and use COW elements. AssertFastElements macro
is added to check the elements when necessary. The custom call IC
generators for Array.prototype.{push,pop} are updated to avoid going
to the slow case (and patching the IC) when calling the builtin should
work.

COW enablement
----------------------------------------
Currently we only put shallow and simple literal arrays in the COW
mode. This is done by the parser.

Review URL: http://codereview.chromium.org/3144002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Fix some bit op bugs introduced last week on IA32:
http://code.google.com/p/chromium/issues/detail?id=52096
Review URL: http://codereview.chromium.org/3151017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

approach.

Review URL: http://codereview.chromium.org/3152016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5259 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This adds a check to the fast case string add to ensure that the String object still have the default valueOf function. The default valueOf is sitting on a hidden prototype of String.prototype.

Before using the fast case valueOf the object is checked for a local valueOf property. For slow case objects this check always reports true (the dictionary is not probed, so valueOf might be there) and for fast case objects the descriptor array is checked for the valueOf symbol (just liniar scan). After that the prototype is checked for beeing the initial value of String.prototype. If this all pass (that is the default valueOf is still in place) this result is cached on the map making the check fast the next time.

This is only implemented in the optimizing compiler, as the two usages of %_IsStringWrapperSafeForDefaultValueOf is never hit by the full compiler.

I will port to x64 and ARM when this has been reviewed for ia32.

I will remove the performance counters prior to final commit.

BUG=http://code.google.com/p/v8/issues/detail?id=760
TEST=test/mjsunit/regress/regress-760-1.js
TEST=test/mjsunit/regress/regress-760-2.js

Review URL: http://codereview.chromium.org/3117006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Return (smi) 0 instead of object null from the FILTER_KEY builtin.

Add a test which tests keys being deleted during for-in.
Review URL: http://codereview.chromium.org/3170004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00