BUG=
TEST=

Review URL: http://codereview.chromium.org/8520023
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10015 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r9979(0cf0570a).

Original commit message:

Also simplify ia32 and x64 handing of the trace_elements_transition flag.

BUG=
TEST=

Review URL: http://codereview.chromium.org/8557004
Patch from Gergely Kis <gregely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10014 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

There is no need to bail out to runtime system when creating sliced strings of external strings since the string content is unimportant.

Review URL: http://codereview.chromium.org/8513016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8568042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=103587

Review URL: http://codereview.chromium.org/8575006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1678

Review URL: http://codereview.chromium.org/8513012
Patch from Matthew Sporleder <msporleder@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We pass in the object that we set the map on.
Review URL: http://codereview.chromium.org/8486005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Changes the way we do lazy deoptimization:

1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.

     CALL
     GAP
     LAZY-BAILOUT ==> lazy-deopt-call

2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.

   STACK-CHECK
   GAP ==> lazy-deopt-call

The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.

Additional changes:
 * RegExpLiteral marked it as having side-effects so that it 
   gets an explicitlazy-bailout instruction (instead of
   treating it specially like stack-checks)
 * Enable target recording CallFunctionStub to achieve
   more inlining on optimized code.

BUG=v8:1789
TEST=jslint and uglify run without crashing, mjsunit/compiler/regress-lazy-deopt.js
Review URL: http://codereview.chromium.org/8492004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It mysteriously disappeared about 800 revisions ago... :-} Thanks to Jakob for spotting this!

Review URL: http://codereview.chromium.org/8574036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=erik.corry@gmail.com
Review URL: http://codereview.chromium.org/8520031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10004 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/8571017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10003 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8570017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10002 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=http://code.google.com/p/v8/issues/detail?id=1821

Review URL: http://codereview.chromium.org/8536042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8468005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

So far free variables references in eval code are not statically
resolved. For example in
    function foo() { var x = 1; eval("y = x"); }
the variable x will get mode DYNAMIC and y will get mode DYNAMIC_GLOBAL,
i.e. free variable references trigger dynamic lookups with a fast case
handling for global variables.

The CL introduces static resolution of free variables references in eval
code. If possible variable references are resolved to bindings belonging to
outer scopes of the eval call site.

This is achieved by deserializing the outer scope chain using
Scope::DeserializeScopeChain prior to parsing the eval code similar to lazy
parsing of functions. The existing code for variable resolution is used,
however resolution starts at the first outer unresolved scope instead of
always starting at the root of the scope tree.

This is a prerequisite for statically checking validity of assignments in
the extended code as specified by the current ES.next draft which will be
introduced by a subsequent CL. More specifically section 11.13 of revision 4
of the ES.next draft reads:
* It is a Syntax Error if the AssignmentExpression is contained in extended
  code and the LeftHandSideExpression is an Identifier that does not
  statically resolve to a declarative environment record binding or if the
  resolved binding is an immutable binding.

TEST=existing tests in mjsunit

Review URL: http://codereview.chromium.org/8508052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In this case uncommiting marking deque is impossible.

R=erik.corry@gmail.com

Review URL: http://codereview.chromium.org/8528030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8510058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9997 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
TEST=mjsunit/array-elements-from-array-prototype-chain

Review URL: http://codereview.chromium.org/8572004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9996 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8572003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=erik.corry@gmail.com
BUG=102895
TEST=none

Review URL: http://codereview.chromium.org/8528024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9994 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is a deliberate non-conformity introduced more than 2 years ago to
be compatible with JSC. The current state is that all other browsers
perform ES5 conform in that regard.

R=erik.corry@gmail.com
BUG=chromium:1717,chromium:39662
TEST=test262/15.2.3.6-4-6??,mjsunit/undeletable-functions

Review URL: http://codereview.chromium.org/8566009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: http://codereview.chromium.org/8510048

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This test depends on OSR being triggered. That's why I can't
use %OptimizeFunctionOnNextCall.
Review URL: http://codereview.chromium.org/8555004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9987 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Afterpatch for r9985.

Review URL: http://codereview.chromium.org/8565005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9986 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Implementation for this case

var x = {};
x.__defineGetter__("y", function Y() { return 42; });

BUG=v8:1818
TEST=cctest/test-heap-profiler/FastCaseGetter

Review URL: http://codereview.chromium.org/8491041
Patch from Ilya Tikhonovsky <loislo@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9985 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8518001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9984 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8540007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8540006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Also simplify ia32 and x64 handing of the trace_elements_transition flag.

R=jkummerow@chromium.org
BUG=none
TEST=array-literal-transitions.js

Review URL: http://codereview.chromium.org/8539011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9979 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

1) Make sure that commits sneaking in before the "Prepare Push" CL is landed are included in the push.
2) Easy-to-copy output at the end.

Review URL: http://codereview.chromium.org/8511060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Original commit message:

Add a level of indirection to exception handler addresses.

To support deoptimization of exception handlers, the handler address in the
stack is converted to a pair of code object and an index into a separate
table of code offsets.  The index part is invariant under deoptimization.
The index is packed into the handler state field so that handler size does
not change.

R=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8538011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r9975.  This change broke (at least) snapshots on x64.

TBR=fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8540005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

To support deoptimization of exception handlers, the handler address in the
stack is converted to a pair of code object and an index into a separate
table of code offsets.  The index part is invariant under deoptimization.
The index is packed into the handler state field so that handler size does
not change.

R=vegorov@chromium.org,fschneider@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8462010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9975 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch continues the refactoring that started in r9597 and
extends it with support for the serializer.
This is required for MIPS support in the serializer.

Review URL: http://codereview.chromium.org/8467010
Patch from Gergely Kis <gergely@homejinni.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9971 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=vegorov@chromium.org

Review URL: http://codereview.chromium.org/8536011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9967 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8538006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8539008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9965 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Our Heap::FreeQueuedChunks generates fake inner chunks in large object
pages queued for freeing, so that StoreBuffer::Filter can recognize them
as pages to be freed. This also relies on MemoryChunk::Contains to work
properly, which is why the size field needs to be initialized as well.

R=vegorov@chromium.org
BUG=v8:1817
TEST=mozilla/js1_5/Regress/regress-360969-05

Review URL: http://codereview.chromium.org/8536009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8511052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/8520010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9962 ce2b1a6d-e550-0410-aec6-3dcde31c8c00