Generalize internalization of substrings.

Make a template version of SubStringKey, which allows internalization of substrings of sequential and external strings.

R=dcarney@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/143223004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Skip Mozilla tests with timeouts.

- Let Mozilla tests with timeouts always run in no-variants mode. Otherwise the stress-run causes a 16 minutes timeout in debug mode and 32 minutes on arm debug.
- Four test cases with exponentially long running regular expressions are skipped entirely.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/148913006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18916 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is a preview of the captured arguments object materialization,
mostly to make sure that it is going in the right direction. The current
version is passing all the existing test + a bunch of new tests
(packaged in the change list, too).

The patch extends the SlotRef object to describe captured and duplicated
objects. Since the SlotRefs are not independent of each other anymore,
there is a new SlotRefValueBuilder class that stores the SlotRefs and
later materializes the objects from the SlotRefs.

Note that unlike the previous implementation of SlotRefs, we now build
the SlotRef entries for the entire frame, not just the particular
function.  This is because duplicate objects might refer to previous
captured objects (that might live inside other inlined function's part
of the frame).

We also need to store the materialized objects between other potential
invocations of the same arguments object so that we materialize each
captured object at most once.  The materialized objects of frames live
in the new MaterielizedObjectStore object (contained in Isolate),
indexed by the frame's FP address.  Each argument materialization (and
deoptimization) tries to lookup its captured objects in the store before
building new ones.  Deoptimization also removes the materialized objects
from the store. We also schedule a lazy deopt to be sure that we always
get rid of the materialized objects and that the optmized function
adopts the materialized objects (instead of happily computing with its
captured representations).

Concerns:

- Is there a simpler/more correct way to store the already-materialized
objects? (At the moment there is a custom root reference to JSArray
containing frames' FixedArrays with their captured objects.)

- Is the FP address the right key for a frame? (Note that deoptimizer's
representation of frame is different from the argument object
materializer's one - it is not easy to find common ground.)

- Performance is suboptimal in several places, but a quick local run of
benchmarks does not seem to show a perf hit. Examples of possible
improvements: smarter generation of SlotRefs (build other functions'
SlotRefs only for captured objects and only if necessary), smarter
lookup of stored materialized objects.

- Ideally, we would like to share the code for argument materialization
with deoptimizer's materializer.  However, the supporting data structures
(mainly the frame descriptor) are quite different in each case, so it
looks more like a separate project.

Thanks for any feedback.

R=mstarzinger@chromium.org, danno@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/103243005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Sheriff] Mark test-debug/* as flaky on Mac.

BUG=v8:3125
LOG=n
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/135183015

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18920 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Don't parallelize tests that register extensions.

These tests register extensions on the isolate and the configuration of the extensions runs out of scope. If run in parallel, other tests access the isolate's state and read the registered extensions.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/149413005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18921 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make 'ASAN' configurable in test status file.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/149173006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revert "Captured arguments object materialization"

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/130803009

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Sheriff] Mark test-debug/* as flaky on Mac.

Now including release mode.

BUG=v8:3125
LOG=n
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/149623002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Do not overwrite builtin code names in heap profiler

Make sure builtin code objects get their builtin tags
first. Otherwise a particular JSFunction object could set
its custom name to a generic builtin.

LOG=N
R=ulan@chromium.org, yurys@chromium.org

Review URL: https://codereview.chromium.org/145973006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18926 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make eager allocation site pretenuring decisions.

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/149393005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
[Sheriff] Mark profviz flaky on GC stress.

BUG=
TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/149763002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Remove the HValueOf instruction.

Port r18905 (88f14cd3)

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/130803012

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18930 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Prepare push to trunk.  Now working on version 3.24.28.

R=jkummerow@chromium.org
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/149943002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
MIPS: Turn RegExpConstructResultStub into a HydrogenCodeStub.

Port r18902 (ba394fbc)

Original commit message:
This has the additional benefit that it is now possible to
inline the RegExpResult construction code into Hydrogen
builtins.

BUG=
R=plind44@gmail.com

Review URL: https://codereview.chromium.org/149863003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix test expectations for cctest/test-debug.

BUG=v8:3125
R=bmeurer@chromium.org
TBR=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/150173003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The current
version is passing all the existing test + a bunch of new tests
(packaged in the change list, too).

The patch extends the SlotRef object to describe captured and duplicated
objects. Since the SlotRefs are not independent of each other anymore,
there is a new SlotRefValueBuilder class that stores the SlotRefs and
later materializes the objects from the SlotRefs.

Note that unlike the previous implementation of SlotRefs, we now build
the SlotRef entries for the entire frame, not just the particular
function.  This is because duplicate objects might refer to previous
captured objects (that might live inside other inlined function's part
of the frame).

We also need to store the materialized objects between other potential
invocations of the same arguments object so that we materialize each
captured object at most once.  The materialized objects of frames live
in the new MaterielizedObjectStore object (contained in Isolate),
indexed by the frame's FP address.  Each argument materialization (and
deoptimization) tries to lookup its captured objects in the store before
building new ones.  Deoptimization also removes the materialized objects
from the store. We also schedule a lazy deopt to be sure that we always
get rid of the materialized objects and that the optmized function
adopts the materialized objects (instead of happily computing with its
captured representations).

Concerns:

- Is the FP address the right key for a frame? (Note that deoptimizer's
representation of frame is different from the argument object
materializer's one - it is not easy to find common ground.)

- Performance is suboptimal in several places, but a quick local run of
benchmarks does not seem to show a perf hit. Examples of possible
improvements: smarter generation of SlotRefs (build other functions'
SlotRefs only for captured objects and only if necessary), smarter
lookup of stored materialized objects.

- Ideally, we would like to share the code for argument materialization
with deoptimizer's materializer.  However, the supporting data structures
(mainly the frame descriptor) are quite different in each case, so it
looks more like a separate project.

Thanks for any feedback.

R=danno@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=18918

Review URL: https://codereview.chromium.org/103243005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make sure we delete[] what we got from new[], not one byte after it.

R=ulan@chromium.org

Review URL: https://codereview.chromium.org/150213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18937 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Support loads from primitive values.
This also changes load computation to use HeapTypes rather than Maps.
TODO: move conversion between maps and heaptypes earlier in the process, already in the oracle.

BUG=
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/147763006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The uninitialized value is immortal immovable.

R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/137953008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
stub api getters

R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/150213003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@18941 ce2b1a6d-e550-0410-aec6-3dcde31c8c00