BUG=v8::1129
TEST=test/mjsunit/regress/regress-1129.js

Review URL: http://codereview.chromium.org/6476027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6471025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

I discussed with Soeren, and they do need this on arm as well.

Review URL: http://codereview.chromium.org/6478029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This fixes GC issues when in the threading tests.


Review URL: http://codereview.chromium.org/6478026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6732 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

This should fix the flaky cctest failure on the debug run of x64 with
crankshaft enabled.

Review URL: http://codereview.chromium.org/6480032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6731 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement
may throw or its behaviour can be altered.  Instead operate on plain FixedArrays and
turn them into JSArry later.

BUG=v8:1130
TEST=test/mjsunit/regress/regress-1130.js

Review URL: http://codereview.chromium.org/6481001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6480003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Do not do standard property lookup on hidden properties object as it might
reach Object.prototype which can be altered to forge identity hashes.
Instead do only local lookup.

Review URL: http://codereview.chromium.org/6472001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

In the case where the function is not found in the global object,
we have to generate a generic call.

BUG=v8:1106
TEST=mjsunit/regress/regress-1106.js

Review URL: http://codereview.chromium.org/6483010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1131
TEST=test/mjsunit/regress/regress-1131.js

Review URL: http://codereview.chromium.org/6469006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6410112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Already done on ia-32. This change is for x64 and ARM.
We now always require fixed input registers at calls to
avoid overlap with temp registers.

This fixes the affected instructions on ARM.

Review URL: http://codereview.chromium.org/6471021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

We could try to treat an HPhi as an HInstruction because the code did
not properly handle the case of a phi in a block with itself as one of
the predecessors.

BUG=v8:1134

Review URL: http://codereview.chromium.org/6471020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6721 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6480027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Whenever we use a fixed temp at a call that can eagerly deopt we
now allow fixed register exclusively to avoid any overlap.

Review URL: http://codereview.chromium.org/6479014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6714 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Make esi available to the register allocator rather than dedicating it
permanently to the context.

The context is still passed in register esi to JavaScript and to the runtime
as part of the calling convention.  Because some stubs might end up calling
JS or the runtime, it is also conservatively passed to stubs.

Roughly half the calls have been modified to use the context as an input
value in fixed register esi.  The other half are marked as calls or deferred
code so esi is spilled and can be explicitly set.

It is no longer necessary to restore the context to esi after a call that
might change it.

Review URL: http://codereview.chromium.org/6452001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

As they are no more used in DevTools profiler, there is no
need to prefix them with "devtools.profiler" namespace.

Review URL: http://codereview.chromium.org/6456025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6712 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6463022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Compare JSObjects by identity immediately.

When invoking EQUALS JS builtin, 1st argument is passed as a receiver and
if it's a global object, it gets overwritten with global proxy object and
thus one gets incorrect results.

BUG=v8:1082

TBR=ricow@chromium.org

Review URL: http://codereview.chromium.org/6461028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If we have a property access of the form this.x, where the access site sees
the global object, we can specialize the IC stub so that it performs a map
check without first performing a heap object check.

Ensure that we do not get in JS code with a non-JSObject this value by
deoptimizing at Function.prototype.apply if the first argument is not a
JSObject.

BUG=v8:1128

Review URL: http://codereview.chromium.org/6463025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Make VS2005 project files compile without errors: changelist http://codereview.chromium.org/6286135/.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6706 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6459023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Change the comparison in the full code generator to use CompareIC instead of the CompareStub to record the types. This also implements the patching in the full code generator where the inlined smi code is de-activated by default to call the CompareIC once and then activating the inlined smi code by patching the code.

Fixed the smi comparison in the ICCompareStub.

Fixed ToBooleanStub to ensure that the scratch register used is not the input. Use r9 as default as that will never be input with Crankshaft.

Implemented lithium instruction CmpTAndBranch.

Make sure that the lithium instruction CmpID have operands in registrers as the current optimized code expects that.
Review URL: http://codereview.chromium.org/6461017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

the code generated by the full code generator after my previous
change.

The generated code is the same as on ia32 and so is the patching.

Review URL: http://codereview.chromium.org/6456023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6458026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6702 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8::1126
TEST=test/mjsunit/regress/regress-1126.js

Review URL: http://codereview.chromium.org/6459021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6701 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6461018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6458027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6699 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6460030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6698 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6447007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Instead of using the stack, use a temporary integer register
and avoid memory access.

Review URL: http://codereview.chromium.org/6452002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6696 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Since our zap values are valid heap object addreses we might hit asserts if a heap object gets the value of a zap constant as its address. 

Review URL: http://codereview.chromium.org/6456022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

When constructing stack traces we interpret the deoptimization data for
optimized frames to find the receiver value.  This value could sometimes be
eliminated from the deoptimization data if we though it was unused.

BUG=v8:1118

Review URL: http://codereview.chromium.org/6465023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=1125
TEST=test/mjsunit/regress/regress-1125.js

Review URL: http://codereview.chromium.org/6463001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

If --debug-code is on, check that returned value and Top::has_pending_exception
agree on exception state.

Review URL: http://codereview.chromium.org/6450004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1121
TEST=test/mjsunit/regress/regress-1121.js

Review URL: http://codereview.chromium.org/6454004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Review URL: http://codereview.chromium.org/6458001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

Plus use more robust path when formatting messages---work
directly with fixed arrays.

BUG=v8:1107
TEST=test/mjsunit/getter-in-prototype.js,test/mjsunit/regress/regress-1107.js

Review URL: http://codereview.chromium.org/6451004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

BUG=v8:1111

Review URL: http://codereview.chromium.org/6450005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6688 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

2) We cannot assert the declared property will go to the extension in the presence of callbacks and interceptors.

BUG=1119
TEST=test/mjsunit/regress/regress-1119.js

Review URL: http://codereview.chromium.org/6454011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00