R=mstarzinger@chromium.org

Review URL: http://codereview.chromium.org/9086005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10333 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Due to perf regressions

TBR=fschneider@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8983027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10332 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Loosen the requirement for Map equivalency on several map checks, including checks up the prototype chain, that are not sensitive to ElementsKinds. These selected map checks should also match against FAST_DOUBLE_ELEMENT and FAST_ELEMENT transitions of the original map. This specifically helps all variants of transitioned JSArrays to still efficiently call builtins like push, pop and sort.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9015020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

CPU-eating DOS attacks against node.js servers.  Based on code from
Bert Belder.  This version only solves the issue for those that compile
V8 themselves or those that do not use snapshots.  A snapshot-based
precompiled V8 will still have predictable string hash codes.
Review URL: http://codereview.chromium.org/9086006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Namely they are SLOW_ASSERT, RETURN_IF_SCHEDULED_EXCEPTION, and
RETURN_IF_EMTPY_HANDLE_VALUE.

R=svenpanne@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8983016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10329 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8983014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10320 (bb429e82)

BUG=
TEST=

Review URL: http://codereview.chromium.org/9082001
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10308 (4e74cc88)

BUG=
TEST=

Review URL: http://codereview.chromium.org/9078002
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10306 (9141da8e)

BUG=
TEST=

Review URL: http://codereview.chromium.org/9080001
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=test-api/LeaveScriptCallback

Review URL: http://codereview.chromium.org/8937003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10323 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9074002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10322 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1325
TEST=

Review URL: http://codereview.chromium.org/9065008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=vegorov@chromium.org
BUG=none
TEST=no asserts in debug tests with smi-only-array on

Review URL: http://codereview.chromium.org/9015023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There is a call to Object::GetElement that could conceivably cause a GC.
Handlify all raw pointer local variables.

R=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8952028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10319 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=fschneider@chromium.org

Review URL: http://codereview.chromium.org/9069001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10316 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8952023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Otherwise transition will hide CONSTANT_FUNCTION property with the same name residing on the prototype.

R=danno@chromium.org
BUG=v8:1883

Review URL: http://codereview.chromium.org/9064003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9051014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=jkummerow@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/8968042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1849
TEST=test/mjsunit/regress/regress-1849.js

Review URL: http://codereview.chromium.org/8968028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10309 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=whesse@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9006051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=whesse@chromium.org
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/9008042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=whesse@chromium.org
BUG=v8:1878
TEST=test/mjsunit/regress/regress-1878.js

Review URL: http://codereview.chromium.org/9016041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/9041003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10303 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

r8425 (1081f75) had fixed this originally, but those changes were
accidentally reverted when the experimental/gc branch was merged
at r9600.

BUG=
TEST=debug mozilla regress-137181

Review URL: http://codereview.chromium.org/9026006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org
BUG=http://crbug.com/108296
TEST=test/mjsunit/regress/regress-108296.js

Review URL: http://codereview.chromium.org/8960004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This was a left-over from a time when bounds-check was performed
as part of this instruction.

I also refactored and improved the code for smi-only arrays.

R=vegorov@chromium.org
Review URL: http://codereview.chromium.org/9023006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

First attempt to do this failed, we need per target flags.
Review URL: http://codereview.chromium.org/9018013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10297 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* src/debug.cc (Debug::SetBreakPoint): Compare value not pointer.

Review URL: http://codereview.chromium.org/8971002
Patch from Tobias Burnus <burnus@net-b.de>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

* src/string-search.h (StringSearch): Avoid -Werror=strict-overflow
  warning.

Review URL: http://codereview.chromium.org/8947022
Patch from Tobias Burnus <burnus@net-b.de>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=1871
TEST=

Review URL: http://codereview.chromium.org/9021011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes how Object.defineProperty() defines JavaScript accessors on
objects with installed API interceptors. The definition itself does not
cause any interceptors to be called, whereas any subsequent accesses on
said object will still fire the interceptor. This behavior is in sync
with API accessors.

R=rossberg@chromium.org
BUG=v8:1651,chromium:94666
TEST=cctest/test-api

Review URL: http://codereview.chromium.org/9021019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1669
TEST=
R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8969017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/9020004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/9019007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10284 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/9017004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10283 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10218 (1f42dff).

Original commit message:

Also several bugs with Smi/double elements handling and make Ensure* routines more flexible.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8894030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10282 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r10280 (5f6aec5).

Original commit message:

Tell the register allocator the value is not overwritten.  Never use
temporary registers on ia32, avoid them on x64 and ARM.  Restore the
original copyright date on assembler.cc.

BUG=
TEST=

Review URL: http://codereview.chromium.org/9004017
Patch from Daniel Kalmar <kalmard@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10281 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Tell the register allocator the value is not overwritten.  Never use
temporary registers on ia32, avoid them on x64 and ARM.  Restore the
original copyright date on assembler.cc.

R=fschneider@chromium.org
BUG=v8:1870
TEST=

Review URL: http://codereview.chromium.org/8965038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We use foreign callbacks to make some properties shadow internal values
but still behave as data properties from within JavaScript. This means
when a value is passed to Object.defineProperty() on such a property,
it should update the internal value instead of redefinind the property
and destroying the shadowing.

R=rossberg@chromium.org
BUG=v8:1530
TEST=mjsunit/regress/regress-1530,test262/S15.3.3.1_A4

Review URL: http://codereview.chromium.org/8996008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00