R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15778006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14802 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15692004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The compare nil ic introduces a mechanism called lightweight miss. The
idea is to insert a direct call to the miss handler instead of going
through the deopt routine. This can be use for uninitialized stubs, to
directly jump to the runtime.

This cl
1. Cleans up naming
2. localizes the lightweight miss functionality on the only user (compare nil ic)
3. fixes DoCodegen, to actually call the correct method (uninitialized vs initialized)

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15806005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Bug description: in strict mode, null as receiver is not implicitly converted
to the global object, so that when formatting the stack trace, the receiver of
the stack frame is null. The IS_OBJECT check returns true for null, but
%GetDataProperty expected a JSObject, which results in a failed RUNTIME_ASSERT.

R=mvstanton@chromium.org
BUG=237617

Review URL: https://chromiumcodereview.appspot.com/15670003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/15941004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15791005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15763004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Introduce ObjectAccess, which is used by LoadNamedField and StoreNamedField to denote what parts of an object are referred to by a given load or store. Refactor HGraphBuilder to use ObjectAccess, which removes the need to manually set GVN flags and simplifies the code as well.

Review URL: https://codereview.chromium.org/14284010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14791 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=titzer@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/15849003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15814005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14789 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14781 (a3491cb7)

BUG=

Review URL: https://codereview.chromium.org/15952002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14779 (33d24080)

BUG=

Review URL: https://codereview.chromium.org/15889007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14778 (c7fdf61b)

BUG=

Review URL: https://codereview.chromium.org/15927005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14769 (f0000b20)

BUG=

Review URL: https://codereview.chromium.org/15949002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14785 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14768 (5dec309f)

BUG=

Review URL: https://codereview.chromium.org/15948003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14767 (40dd85ec)

BUG=

Review URL: https://codereview.chromium.org/15745021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14783 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14765 (22625125)

BUG=

Review URL: https://codereview.chromium.org/15781006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15886004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/14700006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15884002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14779 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15858006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14778 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org
BUG=chromium:240032
TEST=mjsunit/regress/regress-crbug-240032

Review URL: https://codereview.chromium.org/15779004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13841012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Javascript constructors called from C++ code didn't have a type cell
properly filled in on ia32. This showed up as a bug in webkit bindings.
Re-enabled flag optimize-constructed-arrays.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/15870002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15660005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15848003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14771 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/15001041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/15743006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/13923003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14768 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15848002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14767 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/15660003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15303004

Patch from Daniel Clifford <danno@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14765 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/15648008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=

Review URL: https://codereview.chromium.org/15734007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

Relanding r14758 and r14759 with fix for Test262: only mark properties
and elements READ_ONLY if they are not JS setter/getters. Tightened up
tests to assert frozen-ness, and added targeted tests for the new code
(covering accessors).

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15691007

Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Port r14756 (fda1989f)

BUG=

Review URL: https://codereview.chromium.org/15690003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

and "Fix Object.freeze on dictionary-backed arrays to properly freeze elements"

This reverts r14758 and r14759 due to introducing failures in Test262

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Follow-up to r14758: slightly rearranges JSObject::Freeze() to avoid duplicating
code while still retaining proper dictionary elements storage behavior.

Also fix a lint error.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15737018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14759 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This patch both speeds up the freeze operation itself, but also
allows properties to remain in fast mode. Objects with non-empty
elements backing stores still end up with slow elements.

BUG=v8:1858, 115960
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/14888005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org
BUG=chromium:242924
TEST=mjsunit/regress/regress-crbug-242924

Review URL: https://codereview.chromium.org/15735012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00