R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/85743002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

A performance regression in array literal creation was caused by refactoring that eliminated a special fast case for shallow arrays. At the same time the general case got a bit slower. This CL restores most of the performance without coding the special fast case. The virtual dispatching is unnecessary because we know what we want to do at compile time. A flag was added to Runtime::CreateArrayLiteral. The flags delivers information about shallowness but also whether or not allocation mementos should be created. This is useful for crankshafted code.

BUG=v8:3008
LOG=Y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/77293003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18046 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

It avoids having dead pointers in code from the time it was marked for deoptimization until it is deoptimized.

BUG=320532,v8:2996
TEST=mjsunit/regress/regress-320532.js
LOG=Y
R=danno@chromium.org

Review URL: https://chromiumcodereview.appspot.com/61213012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18013 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/81043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/50213003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17949 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=dcarney@chromium.org

Review URL: https://chromiumcodereview.appspot.com/67613005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17876 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/75973005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=svenpanne@chromium.org
BUG=v8:2991
LOG=Y

Review URL: https://codereview.chromium.org/68203029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org

Review URL: https://chromiumcodereview.appspot.com/75413002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:3010
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/72333004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Original Issue: https://codereview.chromium.org/29353003/

Note that this version of the patch includes logic for bailing out of compiled ArrayPush/ArrayPop calls if the array is observed (see stub-cache-*)

R=danno@chromium.org
BUG=v8:2946
LOG=N

Review URL: https://codereview.chromium.org/68343016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17769 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=adamk@chromium.org
TBR=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/73123002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Because SetElement & co are interdependent, this patch handlfies all of JSObject::
-SetElement
-SetFastElement
-SetDictionaryElement
-SetFastDoubleElement
-SetElementWithInterceptor
-SetElementWithoutInterceptor
-SetElementWithCallbackSetterInPrototype

R=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/66803002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/68523009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=318454

Review URL: https://codereview.chromium.org/71653008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

patch from issue 54583003 (dependent code).

Zero arguments - very easy

1 argument - three special cases:
  a) If length is a constant in valid array length range,
     no need to check it at runtime.
  b) respect DoNotInline feedback on the AllocationSite for
     cases that the argument is not a smi or is an integer
     with a length that should create a dictionary.
  c) if kind feedback is non-holey, and length is non-constant,
     we'd have to generate a lot of code to be correct.
     Don't inline this case.

N arguments - one special case:
  a) If a deopt ever occurs because an input argument isn't
     compatible with the elements kind, then set the
     DoNotInline flag.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/55933002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This relands r17594 with necessary fixes.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/70003004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/68913002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17621 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

TBR=danno
BUG=

Review URL: https://codereview.chromium.org/67233002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Original Issue: https://codereview.chromium.org/29353003/

TBR=danno
BUG=v8:2946

Review URL: https://codereview.chromium.org/66933003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17607 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Broke ARM build

TBR=danno
BUG=

Review URL: https://codereview.chromium.org/66603004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2946
R=danno@chromium.org

Review URL: https://codereview.chromium.org/29353003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts commit r17594.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59153007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50563003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This is controlled by two flags:

--redirect_code_traces
--redirect_code_traces_to=<filename>

When redirection is enabled but --redirect_code_traces_to is not specified traces are written to a file code-<pid>-<isolate>.asm. This mangling scheme matches hydrogen.cfg and allows easy discovery of compilation artifacts in a multi-V8 environment (e.g. when compilation is traced from inside Chromium).

D8 defines --redirect_code_traces_to=code.asm similar to hydrogen.cfg redirection.

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/43273004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17571 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/26968004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17550 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note that I've left the layering as is to make the diffs clear. Is it worth moving ForceSetObjectProperty to objects.cc? This code is clearly implementing part of the DefineOrRedefine steps from the spec, but it's still odd that it lives in Runtime. Note that handles.cc exposes a ForceSetProperty which just performs a CALL_HEAP_FUNCTION on the Runtime::ForceSetObjectProperty -- which is exposed to the api as v8::Object::ForceSet

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/61883002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17529 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=309723

Review URL: https://codereview.chromium.org/59383012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Our generic KeyedStoreIC doesn't handle the case when a callback is
set on array elements in the prototype chain of the object, nor do
we recognize that we need to avoid the monomorphic case if these
callbacks exist.

This CL addresses the issue by looking for dictionary elements in
the prototype chain on IC misses and crankshaft element store
instructions. When found, the generic IC is used. The generic IC is
changed to go to the runtime in this case too.

In general, keyed loads are immune from this problem because they
won't return the hole: discovery of the hole goes to the runtime where
the callback will be found in the prototype chain. Double array loads
in crankshaft can return the hole but only if the prototype chain is
unaltered (we will catch such alterations).

Includes the following patch as well (already reviewed by bmeurer):
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.

(Review URL for the ElementsTransitionAndStoreIC_Miss change:
https://codereview.chromium.org/26911007)

R=danno@chromium.org

Review URL: https://codereview.chromium.org/35413006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17525 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note the spec now reflects the updated naming:

http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes

R=rossberg@chromium.org, rossberg
BUG=v8:2940

Review URL: https://codereview.chromium.org/46043020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Add support for tracking NotExectuted/ExecutedOnceCodeAge's when --track_gc_object_stats flag is set.

BUG=None
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/40003002

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r17490.

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/59973004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/59343003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/50073005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/32003006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Note: spec has been updated here: http://wiki.ecmascript.org/doku.php?id=harmony:observe_spec_changes.

R=rossberg@chromium.org, rossberg
BUG=v8:2975,v8:2941

Review URL: https://codereview.chromium.org/47703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This change enforces explicit allocation of the initial map for each
JSFunction to introduce a proper layering between the JSFunction class
and the Heap class. A follow-up change will then handlify the two
functions AllocateInitialMap and AllocateFunctionPrototype.

R=rossberg@chromium.org
BUG=v8:2877

Review URL: https://codereview.chromium.org/32323013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17480 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This includes handlifing:
-SetHiddenPropertiesHashTable
-ObjectHashSet::Add/Remove
-ObjectHashTable::Put

And splitting the following methods which previously took "allow creation" enum arguments to into side-effect-free getters and GetOrCreate*-handlfied getters.

-GetHash (now GetHash & handlified GetOrCreateHash)
-GetIdentityHash (now GetIdentityHash & handlified GetOrCreateIdentityHash)
-GetHiddenPropertiesHashTable (now GetHiddenPropertiesHashTable & handlified GetOrCreateaHiddenPropertiesHashTable)

BUG=v8:2877
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/48913008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This reverts r17462 and instead fixes StubCache::ComputeLoadNonexistent by replacing s/IsGlobalObject/IsJSGlobalObject/ there.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/59103005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

CreateArrayLiteral.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/54333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00