Review URL: http://codereview.chromium.org/6603015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7044 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

The latter doesn't handle promotion of null/undefined to global object as
receiver for non-strict functions.

Review URL: http://codereview.chromium.org/6615013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6614015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6606005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7041 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In built-in code we use arrays for internal computations.
This makes it possible to affect the built-in code by putting getters
or setters on the Array prototype chain.
This adds a new internal Array constructor that creates Arrays with
a very simplistic prototype chain that doesn't include any publicly
visible objects. These Arrays shoudl ofcourse never leak outside the
builtins, since that would expose the prototype object.
The prototype object contains only the array functions that we use:
push, pop and join (and not even a toString, so it doesn't stringify
well).

Also change uses of .call to %_CallFunction.

BUG=1206

Review URL: http://codereview.chromium.org/6602081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

SetElement can cause an exception to be thrown. If its return value
isn't checked, this exception might not be handled at the correct time.
In some cases, it's a matter of returning Exception::Failure() from
a runtime function.
In other cases, code using SetElement on a JSArray has been changed
to setting directly on a FixedArray and only creating the JSArray
at the end.

Review URL: http://codereview.chromium.org/6588130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=karlklose@chromium.org
Review URL: http://codereview.chromium.org/6614012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1093
Review URL: http://codereview.chromium.org/6611014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=karlklose@chromium.org
Review URL: http://codereview.chromium.org/6615008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7036 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6603012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6597106

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/6615006


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7032 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add ArithmeticD(MOD) to x64 optimizing code generator.  Minor changes to ArithmeticD on other platforms.
Review URL: http://codereview.chromium.org/6594118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6591073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7028 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Do not use subgraphs to implement the translation of simple branching
control flow, for the function body entry, or for labeled blocks.

Combine all the loop construction functions into a single one.

Resolve a possible problem with duplicate AST IDs used both for joined loop
break blocks, the normal loop exit, and for their common successor, by never
introducing the extra (successor) block and instead making the normal loop
exit a predecessor of the break join block.  There is a similar issue with
joined continue blocks.

Remove a (never needed) two-element zone list per each time we replace one
hydrogen value with another.

Review URL: http://codereview.chromium.org/6604002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7026 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6588118

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6596105

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7021 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=74627

Review URL: http://codereview.chromium.org/6588116

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7018 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Build all loop graphs without using class HSubgraph.  This also eliminates a
silly goto for the update expression of a for loop.

Support for peeling loops is removed because it's currently untested.

Review URL: http://codereview.chromium.org/6602031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It avoids strange performance behavior where hot functions do not
get optimized if there is no GC to promote them, and it does not seem
to hurt us otherwise.

Review URL: http://codereview.chromium.org/6594073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7016 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6596104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7015 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TEST=none
BUG=none

Patch by Rodolph Perfetta from ARM Ltd.

Review URL: http://codereview.chromium.org/6594009


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7014 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes issue 1116 and enables the stub in lithium codegen.

Review URL: http://codereview.chromium.org/6588113

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7013 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/6357005


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7012 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

LiveObjectList functionality.

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/6351007


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7011 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

On IA32 we use InstanceofStub::left(), but on x64 we have just used rax and rdx directly. This fixes the assertion crashes on x64 crankshaft.


Review URL: http://codereview.chromium.org/6596101

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

the Windows WebCore build.

http://build.chromium.org/p/client.v8/builders/Webkit/builds/854/steps/compile/logs/stdio

TBR=cira@chromium.org

Review URL: http://codereview.chromium.org/6596100

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If this does not work I will revert the latests changes to the
experimental i8n extension.

TBR=cira@chromium.org

Review URL: http://codereview.chromium.org/6594111

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is vendor specific, and is prefixed by v8.

WebKit layout tests will be added in a separate CL.

Review URL: http://codereview.chromium.org/6598014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7006 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We simply need to remove early checks in the resolve eval runtime
functions. CallFunctionStub that follows will handle non-functions in
the right way.

Review URL: http://codereview.chromium.org/6591075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

into heap snapshots non-HeapObjects. This is needed as a
preparation for adding DOM subtrees tracking.

BUG=none
TEST=none

Review URL: http://codereview.chromium.org/6596073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7004 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6594076

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7003 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6591070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes an assert when an exception is thrown inside instanceof.

BUG=v8:1207
TEST=mjsunit/regress/regress-1207.js

Review URL: http://codereview.chromium.org/6588083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6598066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6998 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/6602034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6997 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6588082

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6996 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6594074

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6995 ce2b1a6d-e550-0410-aec6-3dcde31c8c00