Upgrade V8 to 2.2.24

deps/v8/ChangeLog

@@ -1,3 +1,18 @@
+2010-07-14: Version 2.2.24
+
+        Added API for capturing stack traces for uncaught exceptions.
+
+        Fixed crash bug when preparsing from a non-external V8 string
+        (issue 775).
+
+        Fixed JSON.parse bug causing input not to be converted to string
+        (issue 764).
+
+        Added ES5 Object.freeze and Object.isFrozen.
+
+        Performance improvements on all platforms.
+
+
 2010-07-07: Version 2.2.23
 
         API change: Convert Unicode code points outside the basic multilingual
@@ -11,6 +26,7 @@
 
         Performance improvements on all platforms.
 
+
 2010-07-05: Version 2.2.22
 
         Added ES5 Object.isExtensible and Object.preventExtensions.

deps/v8/include/v8.h

@@ -693,6 +693,13 @@ class V8EXPORT Message {
    */
   Handle<Value> GetScriptData() const;
 
+  /**
+   * Exception stack trace. By default stack traces are not captured for
+   * uncaught exceptions. SetCaptureStackTraceForUncaughtExceptions allows
+   * to change this option.
+   */
+  Handle<StackTrace> GetStackTrace() const;
+
   /**
    * Returns the number, 1-based, of the line where the error occurred.
    */
@@ -2458,6 +2465,15 @@ class V8EXPORT V8 {
    */
   static void RemoveMessageListeners(MessageCallback that);
 
+  /**
+   * Tells V8 to capture current stack trace when uncaught exception occurs
+   * and report it to the message listeners. The option is off by default.
+   */
+  static void SetCaptureStackTraceForUncaughtExceptions(
+      bool capture,
+      int frame_limit = 10,
+      StackTrace::StackTraceOptions options = StackTrace::kOverview);
+
   /**
    * Sets V8 flags from a string.
    */

deps/v8/src/accessors.cc

@@ -549,7 +549,7 @@ Object* Accessors::FunctionGetArguments(Object* object, void*) {
     if (frame->function() != *function) continue;
 
     // If there is an arguments variable in the stack, we return that.
-    int index = ScopeInfo<>::StackSlotIndex(frame->code(),
+    int index = ScopeInfo<>::StackSlotIndex(function->shared()->scope_info(),
                                             Heap::arguments_symbol());
     if (index >= 0) {
       Handle<Object> arguments = Handle<Object>(frame->GetExpression(index));

deps/v8/src/api.cc

@@ -1438,6 +1438,22 @@ v8::Handle<Value> Message::GetScriptData() const {
 }
 
 
+v8::Handle<v8::StackTrace> Message::GetStackTrace() const {
+  if (IsDeadCheck("v8::Message::GetStackTrace()")) {
+    return Local<v8::StackTrace>();
+  }
+  ENTER_V8;
+  HandleScope scope;
+  i::Handle<i::JSObject> obj =
+      i::Handle<i::JSObject>::cast(Utils::OpenHandle(this));
+  i::Handle<i::Object> stackFramesObj = GetProperty(obj, "stackFrames");
+  if (!stackFramesObj->IsJSArray()) return v8::Handle<v8::StackTrace>();
+  i::Handle<i::JSArray> stackTrace =
+      i::Handle<i::JSArray>::cast(stackFramesObj);
+  return scope.Close(Utils::StackTraceToLocal(stackTrace));
+}
+
+
 static i::Handle<i::Object> CallV8HeapFunction(const char* name,
                                                i::Handle<i::Object> recv,
                                                int argc,
@@ -1583,7 +1599,9 @@ Local<StackTrace> StackTrace::CurrentStackTrace(int frame_limit,
     StackTraceOptions options) {
   if (IsDeadCheck("v8::StackTrace::CurrentStackTrace()")) Local<StackTrace>();
   ENTER_V8;
-  return i::Top::CaptureCurrentStackTrace(frame_limit, options);
+  i::Handle<i::JSArray> stackTrace =
+      i::Top::CaptureCurrentStackTrace(frame_limit, options);
+  return Utils::StackTraceToLocal(stackTrace);
 }
 
 
@@ -3782,6 +3800,17 @@ void V8::RemoveMessageListeners(MessageCallback that) {
 }
 
 
+void V8::SetCaptureStackTraceForUncaughtExceptions(
+      bool capture,
+      int frame_limit,
+      StackTrace::StackTraceOptions options) {
+  i::Top::SetCaptureStackTraceForUncaughtExceptions(
+      capture,
+      frame_limit,
+      options);
+}
+
+
 void V8::SetCounterFunction(CounterLookupCallback callback) {
   if (IsDeadCheck("v8::V8::SetCounterFunction()")) return;
   i::StatsTable::SetCounterFunction(callback);

deps/v8/src/arm/assembler-arm.cc

@@ -1801,11 +1801,119 @@ void Assembler::vstr(const DwVfpRegister src,
 }
 
 
+static void DoubleAsTwoUInt32(double d, uint32_t* lo, uint32_t* hi) {
+  uint64_t i;
+  memcpy(&i, &d, 8);
+
+  *lo = i & 0xffffffff;
+  *hi = i >> 32;
+}
+
+// Only works for little endian floating point formats.
+// We don't support VFP on the mixed endian floating point platform.
+static bool FitsVMOVDoubleImmediate(double d, uint32_t *encoding) {
+  ASSERT(CpuFeatures::IsEnabled(VFP3));
+
+  // VMOV can accept an immediate of the form:
+  //
+  //  +/- m * 2^(-n) where 16 <= m <= 31 and 0 <= n <= 7
+  //
+  // The immediate is encoded using an 8-bit quantity, comprised of two
+  // 4-bit fields. For an 8-bit immediate of the form:
+  //
+  //  [abcdefgh]
+  //
+  // where a is the MSB and h is the LSB, an immediate 64-bit double can be
+  // created of the form:
+  //
+  //  [aBbbbbbb,bbcdefgh,00000000,00000000,
+  //      00000000,00000000,00000000,00000000]
+  //
+  // where B = ~b.
+  //
+
+  uint32_t lo, hi;
+  DoubleAsTwoUInt32(d, &lo, &hi);
+
+  // The most obvious constraint is the long block of zeroes.
+  if ((lo != 0) || ((hi & 0xffff) != 0)) {
+    return false;
+  }
+
+  // Bits 62:55 must be all clear or all set.
+  if (((hi & 0x3fc00000) != 0) && ((hi & 0x3fc00000) != 0x3fc00000)) {
+    return false;
+  }
+
+  // Bit 63 must be NOT bit 62.
+  if (((hi ^ (hi << 1)) & (0x40000000)) == 0) {
+    return false;
+  }
+
+  // Create the encoded immediate in the form:
+  //  [00000000,0000abcd,00000000,0000efgh]
+  *encoding  = (hi >> 16) & 0xf;      // Low nybble.
+  *encoding |= (hi >> 4) & 0x70000;   // Low three bits of the high nybble.
+  *encoding |= (hi >> 12) & 0x80000;  // Top bit of the high nybble.
+
+  return true;
+}
+
+
+void Assembler::vmov(const DwVfpRegister dst,
+                     double imm,
+                     const Condition cond) {
+  // Dd = immediate
+  // Instruction details available in ARM DDI 0406B, A8-640.
+  ASSERT(CpuFeatures::IsEnabled(VFP3));
+
+  uint32_t enc;
+  if (FitsVMOVDoubleImmediate(imm, &enc)) {
+    // The double can be encoded in the instruction.
+    emit(cond | 0xE*B24 | 0xB*B20 | dst.code()*B12 | 0xB*B8 | enc);
+  } else {
+    // Synthesise the double from ARM immediates. This could be implemented
+    // using vldr from a constant pool.
+    uint32_t lo, hi;
+    DoubleAsTwoUInt32(imm, &lo, &hi);
+
+    if (lo == hi) {
+      // If the lo and hi parts of the double are equal, the literal is easier
+      // to create. This is the case with 0.0.
+      mov(ip, Operand(lo));
+      vmov(dst, ip, ip);
+    } else {
+      // Move the low part of the double into the lower of the corresponsing S
+      // registers of D register dst.
+      mov(ip, Operand(lo));
+      vmov(dst.low(), ip, cond);
+
+      // Move the high part of the double into the higher of the corresponsing S
+      // registers of D register dst.
+      mov(ip, Operand(hi));
+      vmov(dst.high(), ip, cond);
+    }
+  }
+}
+
+
+void Assembler::vmov(const SwVfpRegister dst,
+                     const SwVfpRegister src,
+                     const Condition cond) {
+  // Sd = Sm
+  // Instruction details available in ARM DDI 0406B, A8-642.
+  ASSERT(CpuFeatures::IsEnabled(VFP3));
+  emit(cond | 0xE*B24 | 0xB*B20 |
+       dst.code()*B12 | 0x5*B9 | B6 | src.code());
+}
+
+
 void Assembler::vmov(const DwVfpRegister dst,
                      const DwVfpRegister src,
                      const Condition cond) {
   // Dd = Dm
   // Instruction details available in ARM DDI 0406B, A8-642.
+  ASSERT(CpuFeatures::IsEnabled(VFP3));
   emit(cond | 0xE*B24 | 0xB*B20 |
        dst.code()*B12 | 0x5*B9 | B8 | B6 | src.code());
 }

deps/v8/src/arm/assembler-arm.h

@@ -130,6 +130,20 @@ struct DwVfpRegister {
   // Supporting d0 to d15, can be later extended to d31.
   bool is_valid() const  { return 0 <= code_ && code_ < 16; }
   bool is(DwVfpRegister reg) const  { return code_ == reg.code_; }
+  SwVfpRegister low() const  {
+    SwVfpRegister reg;
+    reg.code_ = code_ * 2;
+
+    ASSERT(reg.is_valid());
+    return reg;
+  }
+  SwVfpRegister high() const  {
+    SwVfpRegister reg;
+    reg.code_ = (code_ * 2) + 1;
+
+    ASSERT(reg.is_valid());
+    return reg;
+  }
   int code() const  {
     ASSERT(is_valid());
     return code_;
@@ -931,6 +945,12 @@ class Assembler : public Malloced {
             int offset,  // Offset must be a multiple of 4.
             const Condition cond = al);
 
+  void vmov(const DwVfpRegister dst,
+            double imm,
+            const Condition cond = al);
+  void vmov(const SwVfpRegister dst,
+            const SwVfpRegister src,
+            const Condition cond = al);
   void vmov(const DwVfpRegister dst,
             const DwVfpRegister src,
             const Condition cond = al);

deps/v8/src/arm/codegen-arm.cc

@@ -4343,9 +4343,7 @@ void CodeGenerator::GenerateMathPow(ZoneList<Expression*>* args) {
     __ bind(&powi);
 
     // Load 1.0 into d0.
-    __ mov(scratch2, Operand(0x3ff00000));
-    __ mov(scratch1, Operand(0));
-    __ vmov(d0, scratch1, scratch2);
+    __ vmov(d0, 1.0);
 
     // Get the absolute untagged value of the exponent and use that for the
     // calculation.
@@ -4405,9 +4403,7 @@ void CodeGenerator::GenerateMathPow(ZoneList<Expression*>* args) {
                                  AVOID_NANS_AND_INFINITIES);
 
     // Load 1.0 into d2.
-    __ mov(scratch2, Operand(0x3ff00000));
-    __ mov(scratch1, Operand(0));
-    __ vmov(d2, scratch1, scratch2);
+    __ vmov(d2, 1.0);
 
     // Calculate the reciprocal of the square root. 1/sqrt(x) = sqrt(1/x).
     __ vdiv(d0, d2, d0);
@@ -4874,12 +4870,8 @@ void CodeGenerator::GenerateRandomHeapNumber(
   __ jmp(&heapnumber_allocated);
 
   __ bind(&slow_allocate_heapnumber);
-  // To allocate a heap number, and ensure that it is not a smi, we
-  // call the runtime function FUnaryMinus on 0, returning the double
-  // -0.0. A new, distinct heap number is returned each time.
-  __ mov(r0, Operand(Smi::FromInt(0)));
-  __ push(r0);
-  __ CallRuntime(Runtime::kNumberUnaryMinus, 1);
+  // Allocate a heap number.
+  __ CallRuntime(Runtime::kNumberAlloc, 0);
   __ mov(r4, Operand(r0));
 
   __ bind(&heapnumber_allocated);

deps/v8/src/arm/constants-arm.cc

@@ -37,6 +37,26 @@ namespace arm {
 
 namespace v8i = v8::internal;
 
+double Instr::DoubleImmedVmov() const {
+  // Reconstruct a double from the immediate encoded in the vmov instruction.
+  //
+  //   instruction: [xxxxxxxx,xxxxabcd,xxxxxxxx,xxxxefgh]
+  //   double: [aBbbbbbb,bbcdefgh,00000000,00000000,
+  //            00000000,00000000,00000000,00000000]
+  //
+  // where B = ~b. Only the high 16 bits are affected.
+  uint64_t high16;
+  high16  = (Bits(17, 16) << 4) | Bits(3, 0);   // xxxxxxxx,xxcdefgh.
+  high16 |= (0xff * Bit(18)) << 6;              // xxbbbbbb,bbxxxxxx.
+  high16 |= (Bit(18) ^ 1) << 14;                // xBxxxxxx,xxxxxxxx.
+  high16 |= Bit(19) << 15;                      // axxxxxxx,xxxxxxxx.
+
+  uint64_t imm = high16 << 48;
+  double d;
+  memcpy(&d, &imm, 8);
+  return d;
+}
+
 
 // These register names are defined in a way to match the native disassembler
 // formatting. See for example the command "objdump -d <binary file>".

deps/v8/src/arm/constants-arm.h

@@ -333,6 +333,9 @@ class Instr {
   inline bool HasH()    const { return HField() == 1; }
   inline bool HasLink() const { return LinkField() == 1; }
 
+  // Decoding the double immediate in the vmov instruction.
+  double DoubleImmedVmov() const;
+
   // Instructions are read of out a code stream. The only way to get a
   // reference to an instruction is to convert a pointer. There is no way
   // to allocate or create instances of class Instr.

deps/v8/src/arm/disasm-arm.cc

@@ -412,6 +412,12 @@ int Decoder::FormatOption(Instr* instr, const char* format) {
       PrintCondition(instr);
       return 4;
     }
+    case 'd': {  // 'd: vmov double immediate.
+      double d = instr->DoubleImmedVmov();
+      out_buffer_pos_ += v8i::OS::SNPrintF(out_buffer_ + out_buffer_pos_,
+                                           "#%g", d);
+      return 1;
+    }
     case 'f': {  // 'f: bitfield instructions - v7 and above.
       uint32_t lsbit = instr->Bits(11, 7);
       uint32_t width = instr->Bits(20, 16) + 1;
@@ -1052,7 +1058,7 @@ void Decoder::DecodeTypeVFP(Instr* instr) {
         if (instr->SzField() == 0x1) {
           Format(instr, "vmov.f64'cond 'Dd, 'Dm");
         } else {
-          Unknown(instr);  // Not used by V8.
+          Format(instr, "vmov.f32'cond 'Sd, 'Sm");
         }
       } else if ((instr->Opc2Field() == 0x7) && (instr->Opc3Field() == 0x3)) {
         DecodeVCVTBetweenDoubleAndSingle(instr);
@@ -1066,6 +1072,12 @@ void Decoder::DecodeTypeVFP(Instr* instr) {
         DecodeVCMP(instr);
       } else if (((instr->Opc2Field() == 0x1)) && (instr->Opc3Field() == 0x3)) {
         Format(instr, "vsqrt.f64'cond 'Dd, 'Dm");
+      } else if (instr->Opc3Field() == 0x0) {
+        if (instr->SzField() == 0x1) {
+          Format(instr, "vmov.f64'cond 'Dd, 'd");
+        } else {
+          Unknown(instr);  // Not used by V8.
+        }
       } else {
         Unknown(instr);  // Not used by V8.
       }

deps/v8/src/arm/full-codegen-arm.cc

@@ -2161,12 +2161,8 @@ void FullCodeGenerator::EmitRandomHeapNumber(ZoneList<Expression*>* args) {
   __ jmp(&heapnumber_allocated);
 
   __ bind(&slow_allocate_heapnumber);
-  // To allocate a heap number, and ensure that it is not a smi, we
-  // call the runtime function FUnaryMinus on 0, returning the double
-  // -0.0. A new, distinct heap number is returned each time.
-  __ mov(r0, Operand(Smi::FromInt(0)));
-  __ push(r0);
-  __ CallRuntime(Runtime::kNumberUnaryMinus, 1);
+  // Allocate a heap number.
+  __ CallRuntime(Runtime::kNumberAlloc, 0);
   __ mov(r4, Operand(r0));
 
   __ bind(&heapnumber_allocated);

deps/v8/src/arm/macro-assembler-arm.cc

@@ -873,88 +873,6 @@ void MacroAssembler::PopTryHandler() {
 }
 
 
-Register MacroAssembler::CheckMaps(JSObject* object, Register object_reg,
-                                   JSObject* holder, Register holder_reg,
-                                   Register scratch,
-                                   int save_at_depth,
-                                   Label* miss) {
-  // Make sure there's no overlap between scratch and the other
-  // registers.
-  ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg));
-
-  // Keep track of the current object in register reg.
-  Register reg = object_reg;
-  int depth = 0;
-
-  if (save_at_depth == depth) {
-    str(reg, MemOperand(sp));
-  }
-
-  // Check the maps in the prototype chain.
-  // Traverse the prototype chain from the object and do map checks.
-  while (object != holder) {
-    depth++;
-
-    // Only global objects and objects that do not require access
-    // checks are allowed in stubs.
-    ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-
-    // Get the map of the current object.
-    ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset));
-    cmp(scratch, Operand(Handle<Map>(object->map())));
-
-    // Branch on the result of the map check.
-    b(ne, miss);
-
-    // Check access rights to the global object.  This has to happen
-    // after the map check so that we know that the object is
-    // actually a global object.
-    if (object->IsJSGlobalProxy()) {
-      CheckAccessGlobalProxy(reg, scratch, miss);
-      // Restore scratch register to be the map of the object.  In the
-      // new space case below, we load the prototype from the map in
-      // the scratch register.
-      ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset));
-    }
-
-    reg = holder_reg;  // from now the object is in holder_reg
-    JSObject* prototype = JSObject::cast(object->GetPrototype());
-    if (Heap::InNewSpace(prototype)) {
-      // The prototype is in new space; we cannot store a reference
-      // to it in the code. Load it from the map.
-      ldr(reg, FieldMemOperand(scratch, Map::kPrototypeOffset));
-    } else {
-      // The prototype is in old space; load it directly.
-      mov(reg, Operand(Handle<JSObject>(prototype)));
-    }
-
-    if (save_at_depth == depth) {
-      str(reg, MemOperand(sp));
-    }
-
-    // Go to the next object in the prototype chain.
-    object = prototype;
-  }
-
-  // Check the holder map.
-  ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset));
-  cmp(scratch, Operand(Handle<Map>(object->map())));
-  b(ne, miss);
-
-  // Log the check depth.
-  LOG(IntEvent("check-maps-depth", depth + 1));
-
-  // Perform security check for access to the global object and return
-  // the holder register.
-  ASSERT(object == holder);
-  ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-  if (object->IsJSGlobalProxy()) {
-    CheckAccessGlobalProxy(reg, scratch, miss);
-  }
-  return reg;
-}
-
-
 void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg,
                                             Register scratch,
                                             Label* miss) {

deps/v8/src/arm/macro-assembler-arm.h

@@ -316,24 +316,6 @@ class MacroAssembler: public Assembler {
   // ---------------------------------------------------------------------------
   // Inline caching support
 
-  // Generates code that verifies that the maps of objects in the
-  // prototype chain of object hasn't changed since the code was
-  // generated and branches to the miss label if any map has. If
-  // necessary the function also generates code for security check
-  // in case of global object holders. The scratch and holder
-  // registers are always clobbered, but the object register is only
-  // clobbered if it the same as the holder register. The function
-  // returns a register containing the holder - either object_reg or
-  // holder_reg.
-  // The function can optionally (when save_at_depth !=
-  // kInvalidProtoDepth) save the object at the given depth by moving
-  // it to [sp].
-  Register CheckMaps(JSObject* object, Register object_reg,
-                     JSObject* holder, Register holder_reg,
-                     Register scratch,
-                     int save_at_depth,
-                     Label* miss);
-
   // Generate code for checking access rights - used for security checks
   // on access to global objects across environments. The holder register
   // is left untouched, whereas both scratch registers are clobbered.

deps/v8/src/arm/regexp-macro-assembler-arm.cc

@@ -799,7 +799,6 @@ Handle<Object> RegExpMacroAssemblerARM::GetCode(Handle<String> source) {
   CodeDesc code_desc;
   masm_->GetCode(&code_desc);
   Handle<Code> code = Factory::NewCode(code_desc,
-                                       NULL,
                                        Code::ComputeFlags(Code::REGEXP),
                                        masm_->CodeObject());
   PROFILE(RegExpCodeCreateEvent(*code, *source));

deps/v8/src/arm/simulator-arm.cc

@@ -2281,7 +2281,7 @@ void Simulator::DecodeTypeVFP(Instr* instr) {
         if (instr->SzField() == 0x1) {
           set_d_register_from_double(vd, get_double_from_d_register(vm));
         } else {
-          UNREACHABLE();  // Not used by V8.
+          set_s_register_from_float(vd, get_float_from_s_register(vm));
         }
       } else if ((instr->Opc2Field() == 0x7) && (instr->Opc3Field() == 0x3)) {
         DecodeVCVTBetweenDoubleAndSingle(instr);
@@ -2298,6 +2298,13 @@ void Simulator::DecodeTypeVFP(Instr* instr) {
         double dm_value = get_double_from_d_register(vm);
         double dd_value = sqrt(dm_value);
         set_d_register_from_double(vd, dd_value);
+      } else if (instr->Opc3Field() == 0x0) {
+        // vmov immediate.
+        if (instr->SzField() == 0x1) {
+          set_d_register_from_double(vd, instr->DoubleImmedVmov());
+        } else {
+          UNREACHABLE();  // Not used by v8.
+        }
       } else {
         UNREACHABLE();  // Not used by V8.
       }

deps/v8/src/arm/stub-cache-arm.cc

@@ -83,6 +83,112 @@ static void ProbeTable(MacroAssembler* masm,
 }
 
 
+// Helper function used to check that the dictionary doesn't contain
+// the property. This function may return false negatives, so miss_label
+// must always call a backup property check that is complete.
+// This function is safe to call if the receiver has fast properties.
+// Name must be a symbol and receiver must be a heap object.
+static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
+                                             Label* miss_label,
+                                             Register receiver,
+                                             String* name,
+                                             Register scratch0,
+                                             Register scratch1) {
+  ASSERT(name->IsSymbol());
+  __ IncrementCounter(&Counters::negative_lookups, 1, scratch0, scratch1);
+  __ IncrementCounter(&Counters::negative_lookups_miss, 1, scratch0, scratch1);
+
+  Label done;
+
+  const int kInterceptorOrAccessCheckNeededMask =
+      (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded);
+
+  // Bail out if the receiver has a named interceptor or requires access checks.
+  Register map = scratch1;
+  __ ldr(map, FieldMemOperand(receiver, HeapObject::kMapOffset));
+  __ ldrb(scratch0, FieldMemOperand(map, Map::kBitFieldOffset));
+  __ tst(scratch0, Operand(kInterceptorOrAccessCheckNeededMask));
+  __ b(ne, miss_label);
+
+  // Check that receiver is a JSObject.
+  __ ldrb(scratch0, FieldMemOperand(map, Map::kInstanceTypeOffset));
+  __ cmp(scratch0, Operand(FIRST_JS_OBJECT_TYPE));
+  __ b(lt, miss_label);
+
+  // Load properties array.
+  Register properties = scratch0;
+  __ ldr(properties, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
+  // Check that the properties array is a dictionary.
+  __ ldr(map, FieldMemOperand(properties, HeapObject::kMapOffset));
+  Register tmp = properties;
+  __ LoadRoot(tmp, Heap::kHashTableMapRootIndex);
+  __ cmp(map, tmp);
+  __ b(ne, miss_label);
+
+  // Restore the temporarily used register.
+  __ ldr(properties, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
+
+  // Compute the capacity mask.
+  const int kCapacityOffset =
+      StringDictionary::kHeaderSize +
+      StringDictionary::kCapacityIndex * kPointerSize;
+
+  // Generate an unrolled loop that performs a few probes before
+  // giving up.
+  static const int kProbes = 4;
+  const int kElementsStartOffset =
+      StringDictionary::kHeaderSize +
+      StringDictionary::kElementsStartIndex * kPointerSize;
+
+  // If names of slots in range from 1 to kProbes - 1 for the hash value are
+  // not equal to the name and kProbes-th slot is not used (its name is the
+  // undefined value), it guarantees the hash table doesn't contain the
+  // property. It's true even if some slots represent deleted properties
+  // (their names are the null value).
+  for (int i = 0; i < kProbes; i++) {
+    // scratch0 points to properties hash.
+    // Compute the masked index: (hash + i + i * i) & mask.
+    Register index = scratch1;
+    // Capacity is smi 2^n.
+    __ ldr(index, FieldMemOperand(properties, kCapacityOffset));
+    __ sub(index, index, Operand(1));
+    __ and_(index, index, Operand(
+        Smi::FromInt(name->Hash() + StringDictionary::GetProbeOffset(i))));
+
+    // Scale the index by multiplying by the entry size.
+    ASSERT(StringDictionary::kEntrySize == 3);
+    __ add(index, index, Operand(index, LSL, 1));  // index *= 3.
+
+    Register entity_name = scratch1;
+    // Having undefined at this place means the name is not contained.
+    ASSERT_EQ(kSmiTagSize, 1);
+    Register tmp = properties;
+    __ add(tmp, properties, Operand(index, LSL, 1));
+    __ ldr(entity_name, FieldMemOperand(tmp, kElementsStartOffset));
+
+    ASSERT(!tmp.is(entity_name));
+    __ LoadRoot(tmp, Heap::kUndefinedValueRootIndex);
+    __ cmp(entity_name, tmp);
+    if (i != kProbes - 1) {
+      __ b(eq, &done);
+
+      // Stop if found the property.
+      __ cmp(entity_name, Operand(Handle<String>(name)));
+      __ b(eq, miss_label);
+
+      // Restore the properties.
+      __ ldr(properties,
+             FieldMemOperand(receiver, JSObject::kPropertiesOffset));
+    } else {
+      // Give up probing if still not found the undefined value.
+      __ b(ne, miss_label);
+    }
+  }
+  __ bind(&done);
+  __ DecrementCounter(&Counters::negative_lookups_miss, 1, scratch0, scratch1);
+}
+
+
 void StubCache::GenerateProbe(MacroAssembler* masm,
                               Code::Flags flags,
                               Register receiver,
@@ -517,6 +623,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                Register receiver,
                Register scratch1,
                Register scratch2,
+               Register scratch3,
                Label* miss) {
     ASSERT(holder->HasNamedInterceptor());
     ASSERT(!holder->GetNamedInterceptor()->getter()->IsUndefined());
@@ -532,6 +639,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                        receiver,
                        scratch1,
                        scratch2,
+                       scratch3,
                        holder,
                        lookup,
                        name,
@@ -543,6 +651,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                      receiver,
                      scratch1,
                      scratch2,
+                     scratch3,
                      name,
                      holder,
                      miss);
@@ -555,6 +664,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                        Register receiver,
                        Register scratch1,
                        Register scratch2,
+                       Register scratch3,
                        JSObject* interceptor_holder,
                        LookupResult* lookup,
                        String* name,
@@ -596,7 +706,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver,
                                         interceptor_holder, scratch1,
-                                        scratch2, name, depth1, miss);
+                                        scratch2, scratch3, name, depth1, miss);
 
     // Invoke an interceptor and if it provides a value,
     // branch to |regular_invoke|.
@@ -612,7 +722,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     if (interceptor_holder != lookup->holder()) {
       stub_compiler_->CheckPrototypes(interceptor_holder, receiver,
                                       lookup->holder(), scratch1,
-                                      scratch2, name, depth2, miss);
+                                      scratch2, scratch3, name, depth2, miss);
     } else {
       // CheckPrototypes has a side effect of fetching a 'holder'
       // for API (object which is instanceof for the signature).  It's
@@ -648,12 +758,13 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                       Register receiver,
                       Register scratch1,
                       Register scratch2,
+                      Register scratch3,
                       String* name,
                       JSObject* interceptor_holder,
                       Label* miss_label) {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver, interceptor_holder,
-                                        scratch1, scratch2, name,
+                                        scratch1, scratch2, scratch3, name,
                                         miss_label);
 
     // Call a runtime function to load the interceptor property.
@@ -738,36 +849,134 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
                                        Register object_reg,
                                        JSObject* holder,
                                        Register holder_reg,
-                                       Register scratch,
+                                       Register scratch1,
+                                       Register scratch2,
                                        String* name,
                                        int save_at_depth,
-                                       Label* miss,
-                                       Register extra) {
-  // Check that the maps haven't changed.
-  Register result =
-      masm()->CheckMaps(object, object_reg, holder, holder_reg, scratch,
-                        save_at_depth, miss);
+                                       Label* miss) {
+  // Make sure there's no overlap between holder and object registers.
+  ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
+  ASSERT(!scratch2.is(object_reg) && !scratch2.is(holder_reg)
+         && !scratch2.is(scratch1));
+
+  // Keep track of the current object in register reg.
+  Register reg = object_reg;
+  int depth = 0;
+
+  if (save_at_depth == depth) {
+    __ str(reg, MemOperand(sp));
+  }
+
+  // Check the maps in the prototype chain.
+  // Traverse the prototype chain from the object and do map checks.
+  JSObject* current = object;
+  while (current != holder) {
+    depth++;
+
+    // Only global objects and objects that do not require access
+    // checks are allowed in stubs.
+    ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded());
+
+    JSObject* prototype = JSObject::cast(current->GetPrototype());
+    if (!current->HasFastProperties() &&
+        !current->IsJSGlobalObject() &&
+        !current->IsJSGlobalProxy()) {
+      if (!name->IsSymbol()) {
+        Object* lookup_result = Heap::LookupSymbol(name);
+        if (lookup_result->IsFailure()) {
+          set_failure(Failure::cast(lookup_result));
+          return reg;
+        } else {
+          name = String::cast(lookup_result);
+        }
+      }
+      ASSERT(current->property_dictionary()->FindEntry(name) ==
+             StringDictionary::kNotFound);
+
+      GenerateDictionaryNegativeLookup(masm(),
+                                       miss,
+                                       reg,
+                                       name,
+                                       scratch1,
+                                       scratch2);
+      __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
+      reg = holder_reg;  // from now the object is in holder_reg
+      __ ldr(reg, FieldMemOperand(scratch1, Map::kPrototypeOffset));
+    } else {
+      // Get the map of the current object.
+      __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
+      __ cmp(scratch1, Operand(Handle<Map>(current->map())));
+
+      // Branch on the result of the map check.
+      __ b(ne, miss);
+
+      // Check access rights to the global object.  This has to happen
+      // after the map check so that we know that the object is
+      // actually a global object.
+      if (current->IsJSGlobalProxy()) {
+        __ CheckAccessGlobalProxy(reg, scratch1, miss);
+        // Restore scratch register to be the map of the object.  In the
+        // new space case below, we load the prototype from the map in
+        // the scratch register.
+        __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
+      }
+
+      reg = holder_reg;  // from now the object is in holder_reg
+      if (Heap::InNewSpace(prototype)) {
+        // The prototype is in new space; we cannot store a reference
+        // to it in the code. Load it from the map.
+        __ ldr(reg, FieldMemOperand(scratch1, Map::kPrototypeOffset));
+      } else {
+        // The prototype is in old space; load it directly.
+        __ mov(reg, Operand(Handle<JSObject>(prototype)));
+      }
+    }
+
+    if (save_at_depth == depth) {
+      __ str(reg, MemOperand(sp));
+    }
+
+    // Go to the next object in the prototype chain.
+    current = prototype;
+  }
+
+  // Check the holder map.
+  __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
+  __ cmp(scratch1, Operand(Handle<Map>(current->map())));
+  __ b(ne, miss);
+
+  // Log the check depth.
+  LOG(IntEvent("check-maps-depth", depth + 1));
+
+  // Perform security check for access to the global object and return
+  // the holder register.
+  ASSERT(current == holder);
+  ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded());
+  if (current->IsJSGlobalProxy()) {
+    __ CheckAccessGlobalProxy(reg, scratch1, miss);
+  }
 
   // If we've skipped any global objects, it's not enough to verify
   // that their maps haven't changed.  We also need to check that the
   // property cell for the property is still empty.
-  while (object != holder) {
-    if (object->IsGlobalObject()) {
+  current = object;
+  while (current != holder) {
+    if (current->IsGlobalObject()) {
       Object* cell = GenerateCheckPropertyCell(masm(),
-                                               GlobalObject::cast(object),
+                                               GlobalObject::cast(current),
                                                name,
-                                               scratch,
+                                               scratch1,
                                                miss);
       if (cell->IsFailure()) {
         set_failure(Failure::cast(cell));
-        return result;
+        return reg;
       }
     }
-    object = JSObject::cast(object->GetPrototype());
+    current = JSObject::cast(current->GetPrototype());
   }
 
   // Return the register containing the holder.
-  return result;
+  return reg;
 }
 
 
@@ -776,6 +985,7 @@ void StubCompiler::GenerateLoadField(JSObject* object,
                                      Register receiver,
                                      Register scratch1,
                                      Register scratch2,
+                                     Register scratch3,
                                      int index,
                                      String* name,
                                      Label* miss) {
@@ -785,7 +995,8 @@ void StubCompiler::GenerateLoadField(JSObject* object,
 
   // Check that the maps haven't changed.
   Register reg =
-      CheckPrototypes(object, receiver, holder, scratch1, scratch2, name, miss);
+      CheckPrototypes(object, receiver, holder, scratch1, scratch2, scratch3,
+                      name, miss);
   GenerateFastPropertyLoad(masm(), r0, reg, holder, index);
   __ Ret();
 }
@@ -796,6 +1007,7 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
                                         Register receiver,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         Object* value,
                                         String* name,
                                         Label* miss) {
@@ -805,7 +1017,8 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
 
   // Check that the maps haven't changed.
   Register reg =
-      CheckPrototypes(object, receiver, holder, scratch1, scratch2, name, miss);
+      CheckPrototypes(object, receiver, holder,
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Return the constant value.
   __ mov(r0, Operand(Handle<Object>(value)));
@@ -819,6 +1032,7 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
                                         Register name_reg,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         AccessorInfo* callback,
                                         String* name,
                                         Label* miss,
@@ -829,7 +1043,8 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
 
   // Check that the maps haven't changed.
   Register reg =
-      CheckPrototypes(object, receiver, holder, scratch1, scratch2, name, miss);
+      CheckPrototypes(object, receiver, holder, scratch1, scratch2, scratch3,
+                      name, miss);
 
   // Push the arguments on the JS stack of the caller.
   __ push(receiver);  // Receiver.
@@ -854,6 +1069,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                            Register name_reg,
                                            Register scratch1,
                                            Register scratch2,
+                                           Register scratch3,
                                            String* name,
                                            Label* miss) {
   ASSERT(interceptor_holder->HasNamedInterceptor());
@@ -881,7 +1097,8 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // property from further up the prototype chain if the call fails.
     // Check that the maps haven't changed.
     Register holder_reg = CheckPrototypes(object, receiver, interceptor_holder,
-                                          scratch1, scratch2, name, miss);
+                                          scratch1, scratch2, scratch3,
+                                          name, miss);
     ASSERT(holder_reg.is(receiver) || holder_reg.is(scratch1));
 
     // Save necessary data before invoking an interceptor.
@@ -930,6 +1147,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                    lookup->holder(),
                                    scratch1,
                                    scratch2,
+                                   scratch3,
                                    name,
                                    miss);
     }
@@ -975,7 +1193,8 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // Call the runtime system to load the interceptor.
     // Check that the maps haven't changed.
     Register holder_reg = CheckPrototypes(object, receiver, interceptor_holder,
-                                          scratch1, scratch2, name, miss);
+                                          scratch1, scratch2, scratch3,
+                                          name, miss);
     PushInterceptorArguments(masm(), receiver, holder_reg,
                              name_reg, interceptor_holder);
 
@@ -1053,7 +1272,7 @@ Object* CallStubCompiler::CompileCallField(JSObject* object,
   __ b(eq, &miss);
 
   // Do the right check and compute the holder register.
-  Register reg = CheckPrototypes(object, r0, holder, r1, r3, name, &miss);
+  Register reg = CheckPrototypes(object, r0, holder, r1, r3, r4, name, &miss);
   GenerateFastPropertyLoad(masm(), r1, reg, holder, index);
 
   GenerateCallFunction(masm(), object, arguments(), &miss);
@@ -1098,7 +1317,7 @@ Object* CallStubCompiler::CompileArrayPushCall(Object* object,
   __ b(eq, &miss);
 
   // Check that the maps haven't changed.
-  CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss);
+  CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, r4, name, &miss);
 
   if (object->IsGlobalObject()) {
     __ ldr(r3, FieldMemOperand(r1, GlobalObject::kGlobalReceiverOffset));
@@ -1149,7 +1368,7 @@ Object* CallStubCompiler::CompileArrayPopCall(Object* object,
   __ b(eq, &miss);
 
   // Check that the maps haven't changed.
-  CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss);
+  CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, r4, name, &miss);
 
   if (object->IsGlobalObject()) {
     __ ldr(r3, FieldMemOperand(r1, GlobalObject::kGlobalReceiverOffset));
@@ -1246,7 +1465,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
       }
 
       // Check that the maps haven't changed.
-      CheckPrototypes(JSObject::cast(object), r1, holder, r0, r3, name,
+      CheckPrototypes(JSObject::cast(object), r1, holder, r0, r3, r4, name,
                       depth, &miss);
 
       // Patch the receiver on the stack with the global proxy if
@@ -1270,7 +1489,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::STRING_FUNCTION_INDEX, r0);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3,
-                        r1, name, &miss);
+                        r1, r4, name, &miss);
       }
       break;
 
@@ -1290,7 +1509,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::NUMBER_FUNCTION_INDEX, r0);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3,
-                        r1, name, &miss);
+                        r1, r4, name, &miss);
       }
       break;
     }
@@ -1313,7 +1532,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::BOOLEAN_FUNCTION_INDEX, r0);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3,
-                        r1, name, &miss);
+                        r1, r4, name, &miss);
       }
       break;
     }
@@ -1372,6 +1591,7 @@ Object* CallStubCompiler::CompileCallInterceptor(JSObject* object,
                    r1,
                    r3,
                    r4,
+                   r0,
                    &miss);
 
   // Move returned value, the function to call, to r1.
@@ -1418,7 +1638,7 @@ Object* CallStubCompiler::CompileCallGlobal(JSObject* object,
   }
 
   // Check that the maps haven't changed.
-  CheckPrototypes(object, r0, holder, r3, r1, name, &miss);
+  CheckPrototypes(object, r0, holder, r3, r1, r4, name, &miss);
 
   // Get the value from the cell.
   __ mov(r3, Operand(Handle<JSGlobalPropertyCell>(cell)));
@@ -1642,7 +1862,7 @@ Object* LoadStubCompiler::CompileLoadNonexistent(String* name,
   __ b(eq, &miss);
 
   // Check the maps of the full prototype chain.
-  CheckPrototypes(object, r0, last, r3, r1, name, &miss);
+  CheckPrototypes(object, r0, last, r3, r1, r4, name, &miss);
 
   // If the last object in the prototype chain is a global object,
   // check that the global property cell is empty.
@@ -1679,7 +1899,7 @@ Object* LoadStubCompiler::CompileLoadField(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadField(object, holder, r0, r3, r1, index, name, &miss);
+  GenerateLoadField(object, holder, r0, r3, r1, r4, index, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -1700,7 +1920,7 @@ Object* LoadStubCompiler::CompileLoadCallback(String* name,
   Label miss;
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(object, holder, r0, r2, r3, r1,
+  bool success = GenerateLoadCallback(object, holder, r0, r2, r3, r1, r4,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -1723,7 +1943,7 @@ Object* LoadStubCompiler::CompileLoadConstant(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadConstant(object, holder, r0, r3, r1, value, name, &miss);
+  GenerateLoadConstant(object, holder, r0, r3, r1, r4, value, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -1751,6 +1971,7 @@ Object* LoadStubCompiler::CompileLoadInterceptor(JSObject* object,
                           r2,
                           r3,
                           r1,
+                          r4,
                           name,
                           &miss);
   __ bind(&miss);
@@ -1782,7 +2003,7 @@ Object* LoadStubCompiler::CompileLoadGlobal(JSObject* object,
   }
 
   // Check that the map of the global has not changed.
-  CheckPrototypes(object, r0, holder, r3, r4, name, &miss);
+  CheckPrototypes(object, r0, holder, r3, r4, r1, name, &miss);
 
   // Get the value from the cell.
   __ mov(r3, Operand(Handle<JSGlobalPropertyCell>(cell)));
@@ -1823,7 +2044,7 @@ Object* KeyedLoadStubCompiler::CompileLoadField(String* name,
   __ cmp(r0, Operand(Handle<String>(name)));
   __ b(ne, &miss);
 
-  GenerateLoadField(receiver, holder, r1, r2, r3, index, name, &miss);
+  GenerateLoadField(receiver, holder, r1, r2, r3, r4, index, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::KEYED_LOAD_IC);
 
@@ -1847,7 +2068,7 @@ Object* KeyedLoadStubCompiler::CompileLoadCallback(String* name,
   __ b(ne, &miss);
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(receiver, holder, r1, r0, r2, r3,
+  bool success = GenerateLoadCallback(receiver, holder, r1, r0, r2, r3, r4,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -1873,7 +2094,7 @@ Object* KeyedLoadStubCompiler::CompileLoadConstant(String* name,
   __ cmp(r0, Operand(Handle<String>(name)));
   __ b(ne, &miss);
 
-  GenerateLoadConstant(receiver, holder, r1, r2, r3, value, name, &miss);
+  GenerateLoadConstant(receiver, holder, r1, r2, r3, r4, value, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::KEYED_LOAD_IC);
 
@@ -1905,6 +2126,7 @@ Object* KeyedLoadStubCompiler::CompileLoadInterceptor(JSObject* receiver,
                           r0,
                           r2,
                           r3,
+                          r4,
                           name,
                           &miss);
   __ bind(&miss);

deps/v8/src/bootstrapper.cc

@@ -812,6 +812,9 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,
     initial_map->set_instance_size(
         initial_map->instance_size() + 5 * kPointerSize);
     initial_map->set_instance_descriptors(*descriptors);
+    initial_map->set_scavenger(
+        Heap::GetScavenger(initial_map->instance_type(),
+                           initial_map->instance_size()));
   }
 
   {  // -- J S O N

deps/v8/src/builtins.cc

@@ -1475,7 +1475,7 @@ void Builtins::Setup(bool create_heap_objects) {
         // During startup it's OK to always allocate and defer GC to later.
         // This simplifies things because we don't need to retry.
         AlwaysAllocateScope __scope__;
-        code = Heap::CreateCode(desc, NULL, flags, masm.CodeObject());
+        code = Heap::CreateCode(desc, flags, masm.CodeObject());
         if (code->IsFailure()) {
           v8::internal::V8::FatalProcessOutOfMemory("CreateCode");
         }

deps/v8/src/code-stubs.cc

@@ -102,8 +102,7 @@ Handle<Code> CodeStub::GetCode() {
         static_cast<Code::Kind>(GetCodeKind()),
         InLoop(),
         GetICState());
-    Handle<Code> new_object =
-        Factory::NewCode(desc, NULL, flags, masm.CodeObject());
+    Handle<Code> new_object = Factory::NewCode(desc, flags, masm.CodeObject());
     RecordCodeGeneration(*new_object, &masm);
 
     if (has_custom_cache()) {
@@ -140,8 +139,7 @@ Object* CodeStub::TryGetCode() {
         static_cast<Code::Kind>(GetCodeKind()),
         InLoop(),
         GetICState());
-    Object* new_object =
-        Heap::CreateCode(desc, NULL, flags, masm.CodeObject());
+    Object* new_object = Heap::CreateCode(desc, flags, masm.CodeObject());
     if (new_object->IsFailure()) return new_object;
     code = Code::cast(new_object);
     RecordCodeGeneration(code, &masm);

deps/v8/src/codegen.cc

@@ -162,9 +162,7 @@ Handle<Code> CodeGenerator::MakeCodeEpilogue(MacroAssembler* masm,
   // Allocate and install the code.
   CodeDesc desc;
   masm->GetCode(&desc);
-  ZoneScopeInfo sinfo(info->scope());
-  Handle<Code> code =
-      Factory::NewCode(desc, &sinfo, flags, masm->CodeObject());
+  Handle<Code> code = Factory::NewCode(desc, flags, masm->CodeObject());
 
 #ifdef ENABLE_DISASSEMBLER
   bool print_code = Bootstrapper::IsActive()

deps/v8/src/compiler.cc

@@ -40,6 +40,7 @@
 #include "oprofile-agent.h"
 #include "rewriter.h"
 #include "scopes.h"
+#include "scopeinfo.h"
 
 namespace v8 {
 namespace internal {
@@ -156,7 +157,12 @@ static Handle<Code> MakeCode(Handle<Context> context, CompilationInfo* info) {
 #ifdef ENABLE_DEBUGGER_SUPPORT
 Handle<Code> MakeCodeForLiveEdit(CompilationInfo* info) {
   Handle<Context> context = Handle<Context>::null();
-  return MakeCode(context, info);
+  Handle<Code> code = MakeCode(context, info);
+  if (!info->shared_info().is_null()) {
+    info->shared_info()->set_scope_info(
+        *ScopeInfo<>::CreateHeapObject(info->scope()));
+  }
+  return code;
 }
 #endif
 
@@ -252,9 +258,11 @@ static Handle<SharedFunctionInfo> MakeFunctionInfo(bool is_global,
 
   // Allocate function.
   Handle<SharedFunctionInfo> result =
-      Factory::NewSharedFunctionInfo(lit->name(),
-                                     lit->materialized_literal_count(),
-                                     code);
+      Factory::NewSharedFunctionInfo(
+          lit->name(),
+          lit->materialized_literal_count(),
+          code,
+          ScopeInfo<>::CreateHeapObject(info.scope()));
 
   ASSERT_EQ(RelocInfo::kNoPosition, lit->function_token_position());
   Compiler::SetFunctionInfo(result, lit, true, script);
@@ -275,9 +283,6 @@ static Handle<SharedFunctionInfo> MakeFunctionInfo(bool is_global,
 }
 
 
-static StaticResource<SafeStringInputBuffer> safe_string_input_buffer;
-
-
 Handle<SharedFunctionInfo> Compiler::Compile(Handle<String> source,
                                              Handle<Object> script_name,
                                              int line_offset,
@@ -306,9 +311,7 @@ Handle<SharedFunctionInfo> Compiler::Compile(Handle<String> source,
     // No cache entry found. Do pre-parsing and compile the script.
     ScriptDataImpl* pre_data = input_pre_data;
     if (pre_data == NULL && source_length >= FLAG_min_preparse_length) {
-      Access<SafeStringInputBuffer> buf(&safe_string_input_buffer);
-      buf->Reset(source.location());
-      pre_data = PreParse(source, buf.value(), extension);
+      pre_data = PreParse(source, NULL, extension);
     }
 
     // Create a script object describing the script to be compiled.
@@ -445,8 +448,9 @@ bool Compiler::CompileLazy(CompilationInfo* info) {
                             info->script(),
                             code);
 
-  // Update the shared function info with the compiled code.
+  // Update the shared function info with the compiled code and the scope info.
   shared->set_code(*code);
+  shared->set_scope_info(*ScopeInfo<>::CreateHeapObject(info->scope()));
 
   // Set the expected number of properties for instances.
   SetExpectedNofPropertiesFromEstimate(shared, lit->expected_property_count());
@@ -481,6 +485,8 @@ Handle<SharedFunctionInfo> Compiler::BuildFunctionInfo(FunctionLiteral* literal,
   bool allow_lazy = literal->AllowsLazyCompilation() &&
       !LiveEditFunctionTracker::IsActive();
 
+  Handle<Object> scope_info(ScopeInfo<>::EmptyHeapObject());
+
   // Generate code
   Handle<Code> code;
   if (FLAG_lazy && allow_lazy) {
@@ -562,13 +568,15 @@ Handle<SharedFunctionInfo> Compiler::BuildFunctionInfo(FunctionLiteral* literal,
                               literal->start_position(),
                               script,
                               code);
+    scope_info = ScopeInfo<>::CreateHeapObject(info.scope());
   }
 
   // Create a shared function info object.
   Handle<SharedFunctionInfo> result =
       Factory::NewSharedFunctionInfo(literal->name(),
                                      literal->materialized_literal_count(),
-                                     code);
+                                     code,
+                                     scope_info);
   SetFunctionInfo(result, literal, false, script);
 
   // Set the expected number of properties for instances and return

deps/v8/src/contexts.cc

@@ -120,9 +120,9 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
       // we have context-local slots
 
       // check non-parameter locals in context
-      Handle<Code> code(context->closure()->code());
+      Handle<Object> scope_info(context->closure()->shared()->scope_info());
       Variable::Mode mode;
-      int index = ScopeInfo<>::ContextSlotIndex(*code, *name, &mode);
+      int index = ScopeInfo<>::ContextSlotIndex(*scope_info, *name, &mode);
       ASSERT(index < 0 || index >= MIN_CONTEXT_SLOTS);
       if (index >= 0) {
         // slot found
@@ -150,11 +150,11 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
       }
 
       // check parameter locals in context
-      int param_index = ScopeInfo<>::ParameterIndex(*code, *name);
+      int param_index = ScopeInfo<>::ParameterIndex(*scope_info, *name);
       if (param_index >= 0) {
         // slot found.
         int index =
-            ScopeInfo<>::ContextSlotIndex(*code,
+            ScopeInfo<>::ContextSlotIndex(*scope_info,
                                           Heap::arguments_shadow_symbol(),
                                           NULL);
         ASSERT(index >= 0);  // arguments must exist and be in the heap context
@@ -170,7 +170,7 @@ Handle<Object> Context::Lookup(Handle<String> name, ContextLookupFlags flags,
 
       // check intermediate context (holding only the function name variable)
       if (follow_context_chain) {
-        int index = ScopeInfo<>::FunctionContextSlotIndex(*code, *name);
+        int index = ScopeInfo<>::FunctionContextSlotIndex(*scope_info, *name);
         if (index >= 0) {
           // slot found
           if (FLAG_trace_contexts) {
@@ -216,18 +216,18 @@ bool Context::GlobalIfNotShadowedByEval(Handle<String> name) {
     ASSERT(context->is_function_context());
 
     // Check non-parameter locals.
-    Handle<Code> code(context->closure()->code());
+    Handle<Object> scope_info(context->closure()->shared()->scope_info());
     Variable::Mode mode;
-    int index = ScopeInfo<>::ContextSlotIndex(*code, *name, &mode);
+    int index = ScopeInfo<>::ContextSlotIndex(*scope_info, *name, &mode);
     ASSERT(index < 0 || index >= MIN_CONTEXT_SLOTS);
     if (index >= 0) return false;
 
     // Check parameter locals.
-    int param_index = ScopeInfo<>::ParameterIndex(*code, *name);
+    int param_index = ScopeInfo<>::ParameterIndex(*scope_info, *name);
     if (param_index >= 0) return false;
 
     // Check context only holding the function name variable.
-    index = ScopeInfo<>::FunctionContextSlotIndex(*code, *name);
+    index = ScopeInfo<>::FunctionContextSlotIndex(*scope_info, *name);
     if (index >= 0) return false;
     context = Context::cast(context->closure()->context());
   }

deps/v8/src/debug.cc

@@ -759,7 +759,7 @@ bool Debug::CompileDebuggerScript(int index) {
   if (caught_exception) {
     Handle<Object> message = MessageHandler::MakeMessageObject(
         "error_loading_debugger", NULL, Vector<Handle<Object> >::empty(),
-        Handle<String>());
+        Handle<String>(), Handle<JSArray>());
     MessageHandler::ReportMessage(NULL, message);
     return false;
   }

deps/v8/src/factory.cc

@@ -277,6 +277,8 @@ Handle<Map> Factory::CopyMap(Handle<Map> src,
   copy->set_inobject_properties(inobject_properties);
   copy->set_unused_property_fields(inobject_properties);
   copy->set_instance_size(copy->instance_size() + instance_size_delta);
+  copy->set_scavenger(Heap::GetScavenger(copy->instance_type(),
+                                         copy->instance_size()));
   return copy;
 }
 
@@ -541,10 +543,9 @@ Handle<JSFunction> Factory::NewFunctionWithoutPrototype(Handle<String> name,
 
 
 Handle<Code> Factory::NewCode(const CodeDesc& desc,
-                              ZoneScopeInfo* sinfo,
                               Code::Flags flags,
                               Handle<Object> self_ref) {
-  CALL_HEAP_FUNCTION(Heap::CreateCode(desc, sinfo, flags, self_ref), Code);
+  CALL_HEAP_FUNCTION(Heap::CreateCode(desc, flags, self_ref), Code);
 }
 
 
@@ -680,9 +681,13 @@ Handle<JSArray> Factory::NewJSArrayWithElements(Handle<FixedArray> elements,
 
 
 Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
-    Handle<String> name, int number_of_literals, Handle<Code> code) {
+    Handle<String> name,
+    int number_of_literals,
+    Handle<Code> code,
+    Handle<Object> scope_info) {
   Handle<SharedFunctionInfo> shared = NewSharedFunctionInfo(name);
   shared->set_code(*code);
+  shared->set_scope_info(*scope_info);
   int literals_array_size = number_of_literals;
   // If the function contains object, regexp or array literals,
   // allocate extra space for a literals array prefix containing the

deps/v8/src/factory.h

@@ -34,9 +34,6 @@
 namespace v8 {
 namespace internal {
 
-// Forward declarations.
-class ZoneScopeInfo;
-
 // Interface for handle based allocation.
 
 class Factory : public AllStatic {
@@ -241,7 +238,6 @@ class Factory : public AllStatic {
       PretenureFlag pretenure = TENURED);
 
   static Handle<Code> NewCode(const CodeDesc& desc,
-                              ZoneScopeInfo* sinfo,
                               Code::Flags flags,
                               Handle<Object> self_reference);
 
@@ -352,7 +348,10 @@ class Factory : public AllStatic {
   }
 
   static Handle<SharedFunctionInfo> NewSharedFunctionInfo(
-      Handle<String> name, int number_of_literals, Handle<Code> code);
+      Handle<String> name,
+      int number_of_literals,
+      Handle<Code> code,
+      Handle<Object> scope_info);
   static Handle<SharedFunctionInfo> NewSharedFunctionInfo(Handle<String> name);
 
   static Handle<NumberDictionary> DictionaryAtNumberPut(

deps/v8/src/frames.cc

@@ -532,8 +532,11 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   if (IsConstructor()) accumulator->Add("new ");
   accumulator->PrintFunction(function, receiver, &code);
 
+  Handle<Object> scope_info(ScopeInfo<>::EmptyHeapObject());
+
   if (function->IsJSFunction()) {
     Handle<SharedFunctionInfo> shared(JSFunction::cast(function)->shared());
+    scope_info = Handle<Object>(shared->scope_info());
     Object* script_obj = shared->script();
     if (script_obj->IsScript()) {
       Handle<Script> script(Script::cast(script_obj));
@@ -561,7 +564,7 @@ void JavaScriptFrame::Print(StringStream* accumulator,
   // Get scope information for nicer output, if possible. If code is
   // NULL, or doesn't contain scope info, info will return 0 for the
   // number of parameters, stack slots, or context slots.
-  ScopeInfo<PreallocatedStorage> info(code);
+  ScopeInfo<PreallocatedStorage> info(*scope_info);
 
   // Print the parameters.
   int parameters_count = ComputeParametersCount();

deps/v8/src/globals.h

@@ -345,7 +345,6 @@ class ObjectGroup;
 class TickSample;
 class VirtualMemory;
 class Mutex;
-class ZoneScopeInfo;
 
 typedef bool (*WeakSlotCallback)(Object** pointer);
 

deps/v8/src/heap.cc

@@ -799,34 +799,34 @@ class ScavengeVisitor: public ObjectVisitor {
 };
 
 
-// A queue of pointers and maps of to-be-promoted objects during a
-// scavenge collection.
+// A queue of objects promoted during scavenge. Each object is accompanied
+// by it's size to avoid dereferencing a map pointer for scanning.
 class PromotionQueue {
  public:
   void Initialize(Address start_address) {
-    front_ = rear_ = reinterpret_cast<HeapObject**>(start_address);
+    front_ = rear_ = reinterpret_cast<intptr_t*>(start_address);
   }
 
   bool is_empty() { return front_ <= rear_; }
 
-  void insert(HeapObject* object, Map* map) {
-    *(--rear_) = object;
-    *(--rear_) = map;
+  void insert(HeapObject* target, int size) {
+    *(--rear_) = reinterpret_cast<intptr_t>(target);
+    *(--rear_) = size;
     // Assert no overflow into live objects.
     ASSERT(reinterpret_cast<Address>(rear_) >= Heap::new_space()->top());
   }
 
-  void remove(HeapObject** object, Map** map) {
-    *object = *(--front_);
-    *map = Map::cast(*(--front_));
+  void remove(HeapObject** target, int* size) {
+    *target = reinterpret_cast<HeapObject*>(*(--front_));
+    *size = static_cast<int>(*(--front_));
     // Assert no underflow.
     ASSERT(front_ >= rear_);
   }
 
  private:
   // The front of the queue is higher in memory than the rear.
-  HeapObject** front_;
-  HeapObject** rear_;
+  intptr_t* front_;
+  intptr_t* rear_;
 };
 
 
@@ -1041,31 +1041,26 @@ Address Heap::DoScavenge(ObjectVisitor* scavenge_visitor,
     // queue is empty.
     while (new_space_front < new_space_.top()) {
       HeapObject* object = HeapObject::FromAddress(new_space_front);
-      object->Iterate(scavenge_visitor);
-      new_space_front += object->Size();
+      Map* map = object->map();
+      int size = object->SizeFromMap(map);
+      object->IterateBody(map->instance_type(), size, scavenge_visitor);
+      new_space_front += size;
     }
 
     // Promote and process all the to-be-promoted objects.
     while (!promotion_queue.is_empty()) {
-      HeapObject* source;
-      Map* map;
-      promotion_queue.remove(&source, &map);
-      // Copy the from-space object to its new location (given by the
-      // forwarding address) and fix its map.
-      HeapObject* target = source->map_word().ToForwardingAddress();
-      int size = source->SizeFromMap(map);
-      CopyBlock(target->address(), source->address(), size);
-      target->set_map(map);
-
-#if defined(DEBUG) || defined(ENABLE_LOGGING_AND_PROFILING)
-      // Update NewSpace stats if necessary.
-      RecordCopiedObject(target);
-#endif
-      // Visit the newly copied object for pointers to new space.
+      HeapObject* target;
+      int size;
+      promotion_queue.remove(&target, &size);
+
+      // Promoted object might be already partially visited
+      // during dirty regions iteration. Thus we search specificly
+      // for pointers to from semispace instead of looking for pointers
+      // to new space.
       ASSERT(!target->IsMap());
-      IterateAndMarkPointersToNewSpace(target->address(),
-                                       target->address() + size,
-                                       &ScavengePointer);
+      IterateAndMarkPointersToFromSpace(target->address(),
+                                        target->address() + size,
+                                        &ScavengePointer);
     }
 
     // Take another spin if there are now unswept objects in new space
@@ -1077,7 +1072,7 @@ Address Heap::DoScavenge(ObjectVisitor* scavenge_visitor,
 
 
 #if defined(DEBUG) || defined(ENABLE_LOGGING_AND_PROFILING)
-void Heap::RecordCopiedObject(HeapObject* obj) {
+static void RecordCopiedObject(HeapObject* obj) {
   bool should_record = false;
 #ifdef DEBUG
   should_record = FLAG_heap_stats;
@@ -1086,22 +1081,24 @@ void Heap::RecordCopiedObject(HeapObject* obj) {
   should_record = should_record || FLAG_log_gc;
 #endif
   if (should_record) {
-    if (new_space_.Contains(obj)) {
-      new_space_.RecordAllocation(obj);
+    if (Heap::new_space()->Contains(obj)) {
+      Heap::new_space()->RecordAllocation(obj);
     } else {
-      new_space_.RecordPromotion(obj);
+      Heap::new_space()->RecordPromotion(obj);
     }
   }
 }
 #endif  // defined(DEBUG) || defined(ENABLE_LOGGING_AND_PROFILING)
 
 
-
-HeapObject* Heap::MigrateObject(HeapObject* source,
-                                HeapObject* target,
-                                int size) {
+// Helper function used by CopyObject to copy a source object to an
+// allocated target object and update the forwarding pointer in the source
+// object.  Returns the target object.
+inline static HeapObject* MigrateObject(HeapObject* source,
+                                        HeapObject* target,
+                                        int size) {
   // Copy the content of source to target.
-  CopyBlock(target->address(), source->address(), size);
+  Heap::CopyBlock(target->address(), source->address(), size);
 
   // Set the forwarding address.
   source->set_map_word(MapWord::FromForwardingAddress(target));
@@ -1115,117 +1112,281 @@ HeapObject* Heap::MigrateObject(HeapObject* source,
 }
 
 
-static inline bool IsShortcutCandidate(HeapObject* object, Map* map) {
-  STATIC_ASSERT(kNotStringTag != 0 && kSymbolTag != 0);
-  ASSERT(object->map() == map);
-  InstanceType type = map->instance_type();
-  if ((type & kShortcutTypeMask) != kShortcutTypeTag) return false;
-  ASSERT(object->IsString() && !object->IsSymbol());
-  return ConsString::cast(object)->unchecked_second() == Heap::empty_string();
+enum ObjectContents  { DATA_OBJECT, POINTER_OBJECT };
+enum SizeRestriction { SMALL, UNKNOWN_SIZE };
+
+
+template<ObjectContents object_contents, SizeRestriction size_restriction>
+static inline void EvacuateObject(Map* map,
+                                  HeapObject** slot,
+                                  HeapObject* object,
+                                  int object_size) {
+  ASSERT((size_restriction != SMALL) ||
+         (object_size <= Page::kMaxHeapObjectSize));
+  ASSERT(object->Size() == object_size);
+
+  if (Heap::ShouldBePromoted(object->address(), object_size)) {
+    Object* result;
+
+    if ((size_restriction != SMALL) &&
+        (object_size > Page::kMaxHeapObjectSize)) {
+      result = Heap::lo_space()->AllocateRawFixedArray(object_size);
+    } else {
+      if (object_contents == DATA_OBJECT) {
+        result = Heap::old_data_space()->AllocateRaw(object_size);
+      } else {
+        result = Heap::old_pointer_space()->AllocateRaw(object_size);
+      }
+    }
+
+    if (!result->IsFailure()) {
+      HeapObject* target = HeapObject::cast(result);
+      *slot = MigrateObject(object, target, object_size);
+
+      if (object_contents == POINTER_OBJECT) {
+        promotion_queue.insert(target, object_size);
+      }
+
+      Heap::tracer()->increment_promoted_objects_size(object_size);
+      return;
+    }
+  }
+  Object* result = Heap::new_space()->AllocateRaw(object_size);
+  ASSERT(!result->IsFailure());
+  *slot = MigrateObject(object, HeapObject::cast(result), object_size);
+  return;
 }
 
 
-void Heap::ScavengeObjectSlow(HeapObject** p, HeapObject* object) {
-  ASSERT(InFromSpace(object));
-  MapWord first_word = object->map_word();
-  ASSERT(!first_word.IsForwardingAddress());
+template<int object_size_in_words, ObjectContents object_contents>
+static inline void EvacuateObjectOfFixedSize(Map* map,
+                                             HeapObject** slot,
+                                             HeapObject* object) {
+  const int object_size = object_size_in_words << kPointerSizeLog2;
+  EvacuateObject<object_contents, SMALL>(map, slot, object, object_size);
+}
+
+
+template<ObjectContents object_contents>
+static inline void EvacuateObjectOfFixedSize(Map* map,
+                                             HeapObject** slot,
+                                             HeapObject* object) {
+  int object_size = map->instance_size();
+  EvacuateObject<object_contents, SMALL>(map, slot, object, object_size);
+}
+
+
+static inline void EvacuateFixedArray(Map* map,
+                                      HeapObject** slot,
+                                      HeapObject* object) {
+  int object_size = FixedArray::cast(object)->FixedArraySize();
+  EvacuateObject<POINTER_OBJECT, UNKNOWN_SIZE>(map, slot, object, object_size);
+}
+
+
+static inline void EvacuateByteArray(Map* map,
+                                     HeapObject** slot,
+                                     HeapObject* object) {
+  int object_size = ByteArray::cast(object)->ByteArraySize();
+  EvacuateObject<DATA_OBJECT, UNKNOWN_SIZE>(map, slot, object, object_size);
+}
+
+
+static Scavenger GetScavengerForSize(int object_size,
+                                     ObjectContents object_contents) {
+  ASSERT(IsAligned(object_size, kPointerSize));
+  ASSERT(object_size < Page::kMaxHeapObjectSize);
+
+  switch (object_size >> kPointerSizeLog2) {
+#define CASE(n)                                           \
+    case n:                                               \
+      if (object_contents == DATA_OBJECT) {               \
+        return static_cast<Scavenger>(                    \
+          &EvacuateObjectOfFixedSize<n, DATA_OBJECT>);    \
+      } else {                                            \
+        return static_cast<Scavenger>(                    \
+          &EvacuateObjectOfFixedSize<n, POINTER_OBJECT>); \
+      }
+
+    CASE(1);
+    CASE(2);
+    CASE(3);
+    CASE(4);
+    CASE(5);
+    CASE(6);
+    CASE(7);
+    CASE(8);
+    CASE(9);
+    CASE(10);
+    CASE(11);
+    CASE(12);
+    CASE(13);
+    CASE(14);
+    CASE(15);
+    CASE(16);
+    default:
+      if (object_contents == DATA_OBJECT) {
+        return static_cast<Scavenger>(&EvacuateObjectOfFixedSize<DATA_OBJECT>);
+      } else {
+        return static_cast<Scavenger>(
+            &EvacuateObjectOfFixedSize<POINTER_OBJECT>);
+      }
+
+#undef CASE
+  }
+}
+
+
+static inline void EvacuateSeqAsciiString(Map* map,
+                                          HeapObject** slot,
+                                          HeapObject* object) {
+  int object_size = SeqAsciiString::cast(object)->
+      SeqAsciiStringSize(map->instance_type());
+  EvacuateObject<DATA_OBJECT, UNKNOWN_SIZE>(map, slot, object, object_size);
+}
+
+
+static inline void EvacuateSeqTwoByteString(Map* map,
+                                            HeapObject** slot,
+                                            HeapObject* object) {
+  int object_size = SeqTwoByteString::cast(object)->
+      SeqTwoByteStringSize(map->instance_type());
+  EvacuateObject<DATA_OBJECT, UNKNOWN_SIZE>(map, slot, object, object_size);
+}
 
-  // Optimization: Bypass flattened ConsString objects.
-  if (IsShortcutCandidate(object, first_word.ToMap())) {
-    object = HeapObject::cast(ConsString::cast(object)->unchecked_first());
-    *p = object;
-    // After patching *p we have to repeat the checks that object is in the
-    // active semispace of the young generation and not already copied.
-    if (!InNewSpace(object)) return;
-    first_word = object->map_word();
+
+static inline bool IsShortcutCandidate(int type) {
+  return ((type & kShortcutTypeMask) == kShortcutTypeTag);
+}
+
+
+static inline void EvacuateShortcutCandidate(Map* map,
+                                             HeapObject** slot,
+                                             HeapObject* object) {
+  ASSERT(IsShortcutCandidate(map->instance_type()));
+
+  if (ConsString::cast(object)->unchecked_second() == Heap::empty_string()) {
+    HeapObject* first =
+        HeapObject::cast(ConsString::cast(object)->unchecked_first());
+
+    *slot = first;
+
+    if (!Heap::InNewSpace(first)) {
+      object->set_map_word(MapWord::FromForwardingAddress(first));
+      return;
+    }
+
+    MapWord first_word = first->map_word();
     if (first_word.IsForwardingAddress()) {
-      *p = first_word.ToForwardingAddress();
+      HeapObject* target = first_word.ToForwardingAddress();
+
+      *slot = target;
+      object->set_map_word(MapWord::FromForwardingAddress(target));
       return;
     }
+
+    first->map()->Scavenge(slot, first);
+    object->set_map_word(MapWord::FromForwardingAddress(*slot));
+    return;
   }
 
-  int object_size = object->SizeFromMap(first_word.ToMap());
-  // We rely on live objects in new space to be at least two pointers,
-  // so we can store the from-space address and map pointer of promoted
-  // objects in the to space.
-  ASSERT(object_size >= 2 * kPointerSize);
+  int object_size = ConsString::kSize;
+  EvacuateObject<POINTER_OBJECT, SMALL>(map, slot, object, object_size);
+}
 
-  // If the object should be promoted, we try to copy it to old space.
-  if (ShouldBePromoted(object->address(), object_size)) {
-    Object* result;
-    if (object_size > MaxObjectSizeInPagedSpace()) {
-      result = lo_space_->AllocateRawFixedArray(object_size);
-      if (!result->IsFailure()) {
-        HeapObject* target = HeapObject::cast(result);
-
-        if (object->IsFixedArray()) {
-          // Save the from-space object pointer and its map pointer at the
-          // top of the to space to be swept and copied later.  Write the
-          // forwarding address over the map word of the from-space
-          // object.
-          promotion_queue.insert(object, first_word.ToMap());
-          object->set_map_word(MapWord::FromForwardingAddress(target));
-
-          // Give the space allocated for the result a proper map by
-          // treating it as a free list node (not linked into the free
-          // list).
-          FreeListNode* node = FreeListNode::FromAddress(target->address());
-          node->set_size(object_size);
-
-          *p = target;
+
+Scavenger Heap::GetScavenger(int instance_type, int instance_size) {
+  if (instance_type < FIRST_NONSTRING_TYPE) {
+    switch (instance_type & kStringRepresentationMask) {
+      case kSeqStringTag:
+        if ((instance_type & kStringEncodingMask) == kAsciiStringTag) {
+          return &EvacuateSeqAsciiString;
         } else {
-          // In large object space only fixed arrays might possibly contain
-          // intergenerational references.
-          // All other objects can be copied immediately and not revisited.
-          *p = MigrateObject(object, target, object_size);
+          return &EvacuateSeqTwoByteString;
         }
 
-        tracer()->increment_promoted_objects_size(object_size);
-        return;
-      }
-    } else {
-      OldSpace* target_space = Heap::TargetSpace(object);
-      ASSERT(target_space == Heap::old_pointer_space_ ||
-             target_space == Heap::old_data_space_);
-      result = target_space->AllocateRaw(object_size);
-      if (!result->IsFailure()) {
-        HeapObject* target = HeapObject::cast(result);
-        if (target_space == Heap::old_pointer_space_) {
-          // Save the from-space object pointer and its map pointer at the
-          // top of the to space to be swept and copied later.  Write the
-          // forwarding address over the map word of the from-space
-          // object.
-          promotion_queue.insert(object, first_word.ToMap());
-          object->set_map_word(MapWord::FromForwardingAddress(target));
-
-          // Give the space allocated for the result a proper map by
-          // treating it as a free list node (not linked into the free
-          // list).
-          FreeListNode* node = FreeListNode::FromAddress(target->address());
-          node->set_size(object_size);
-
-          *p = target;
+      case kConsStringTag:
+        if (IsShortcutCandidate(instance_type)) {
+          return &EvacuateShortcutCandidate;
         } else {
-          // Objects promoted to the data space can be copied immediately
-          // and not revisited---we will never sweep that space for
-          // pointers and the copied objects do not contain pointers to
-          // new space objects.
-          *p = MigrateObject(object, target, object_size);
-#ifdef DEBUG
-          VerifyNonPointerSpacePointersVisitor v;
-          (*p)->Iterate(&v);
-#endif
+          ASSERT(instance_size == ConsString::kSize);
+          return GetScavengerForSize(ConsString::kSize, POINTER_OBJECT);
         }
-        tracer()->increment_promoted_objects_size(object_size);
-        return;
-      }
+
+      case kExternalStringTag:
+        ASSERT(instance_size == ExternalString::kSize);
+        return GetScavengerForSize(ExternalString::kSize, DATA_OBJECT);
     }
+    UNREACHABLE();
+  }
+
+  switch (instance_type) {
+    case BYTE_ARRAY_TYPE:
+      return reinterpret_cast<Scavenger>(&EvacuateByteArray);
+
+    case FIXED_ARRAY_TYPE:
+      return reinterpret_cast<Scavenger>(&EvacuateFixedArray);
+
+    case JS_OBJECT_TYPE:
+    case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
+    case JS_VALUE_TYPE:
+    case JS_ARRAY_TYPE:
+    case JS_REGEXP_TYPE:
+    case JS_FUNCTION_TYPE:
+    case JS_GLOBAL_PROXY_TYPE:
+    case JS_GLOBAL_OBJECT_TYPE:
+    case JS_BUILTINS_OBJECT_TYPE:
+      return GetScavengerForSize(instance_size, POINTER_OBJECT);
+
+    case ODDBALL_TYPE:
+      return NULL;
+
+    case PROXY_TYPE:
+      return GetScavengerForSize(Proxy::kSize, DATA_OBJECT);
+
+    case MAP_TYPE:
+      return NULL;
+
+    case CODE_TYPE:
+      return NULL;
+
+    case JS_GLOBAL_PROPERTY_CELL_TYPE:
+      return NULL;
+
+    case HEAP_NUMBER_TYPE:
+    case FILLER_TYPE:
+    case PIXEL_ARRAY_TYPE:
+    case EXTERNAL_BYTE_ARRAY_TYPE:
+    case EXTERNAL_UNSIGNED_BYTE_ARRAY_TYPE:
+    case EXTERNAL_SHORT_ARRAY_TYPE:
+    case EXTERNAL_UNSIGNED_SHORT_ARRAY_TYPE:
+    case EXTERNAL_INT_ARRAY_TYPE:
+    case EXTERNAL_UNSIGNED_INT_ARRAY_TYPE:
+    case EXTERNAL_FLOAT_ARRAY_TYPE:
+      return GetScavengerForSize(instance_size, DATA_OBJECT);
+
+    case SHARED_FUNCTION_INFO_TYPE:
+      return GetScavengerForSize(SharedFunctionInfo::kAlignedSize,
+                                 POINTER_OBJECT);
+
+#define MAKE_STRUCT_CASE(NAME, Name, name) \
+        case NAME##_TYPE:
+      STRUCT_LIST(MAKE_STRUCT_CASE)
+#undef MAKE_STRUCT_CASE
+          return GetScavengerForSize(instance_size, POINTER_OBJECT);
+    default:
+      UNREACHABLE();
+      return NULL;
   }
-  // The object should remain in new space or the old space allocation failed.
-  Object* result = new_space_.AllocateRaw(object_size);
-  // Failed allocation at this point is utterly unexpected.
-  ASSERT(!result->IsFailure());
-  *p = MigrateObject(object, HeapObject::cast(result), object_size);
+}
+
+
+void Heap::ScavengeObjectSlow(HeapObject** p, HeapObject* object) {
+  ASSERT(InFromSpace(object));
+  MapWord first_word = object->map_word();
+  ASSERT(!first_word.IsForwardingAddress());
+  Map* map = first_word.ToMap();
+  map->Scavenge(p, object);
 }
 
 
@@ -1243,6 +1404,8 @@ Object* Heap::AllocatePartialMap(InstanceType instance_type,
   reinterpret_cast<Map*>(result)->set_map(raw_unchecked_meta_map());
   reinterpret_cast<Map*>(result)->set_instance_type(instance_type);
   reinterpret_cast<Map*>(result)->set_instance_size(instance_size);
+  reinterpret_cast<Map*>(result)->
+      set_scavenger(GetScavenger(instance_type, instance_size));
   reinterpret_cast<Map*>(result)->set_inobject_properties(0);
   reinterpret_cast<Map*>(result)->set_pre_allocated_property_fields(0);
   reinterpret_cast<Map*>(result)->set_unused_property_fields(0);
@@ -1259,6 +1422,7 @@ Object* Heap::AllocateMap(InstanceType instance_type, int instance_size) {
   Map* map = reinterpret_cast<Map*>(result);
   map->set_map(meta_map());
   map->set_instance_type(instance_type);
+  map->set_scavenger(GetScavenger(instance_type, instance_size));
   map->set_prototype(null_value());
   map->set_constructor(null_value());
   map->set_instance_size(instance_size);
@@ -1891,6 +2055,7 @@ Object* Heap::AllocateSharedFunctionInfo(Object* name) {
   share->set_name(name);
   Code* illegal = Builtins::builtin(Builtins::Illegal);
   share->set_code(illegal);
+  share->set_scope_info(ScopeInfo<>::EmptyHeapObject());
   Code* construct_stub = Builtins::builtin(Builtins::JSConstructStubGeneric);
   share->set_construct_stub(construct_stub);
   share->set_expected_nof_properties(0);
@@ -2318,12 +2483,13 @@ static void FlushCodeForFunction(SharedFunctionInfo* function_info) {
   // Check that there are heap allocated locals in the scopeinfo. If
   // there is, we are potentially using eval and need the scopeinfo
   // for variable resolution.
-  if (ScopeInfo<>::HasHeapAllocatedLocals(function_info->code()))
+  if (ScopeInfo<>::HasHeapAllocatedLocals(function_info->scope_info()))
     return;
 
   HandleScope scope;
-  // Compute the lazy compilable version of the code.
+  // Compute the lazy compilable version of the code, clear the scope info.
   function_info->set_code(*ComputeLazyCompile(function_info->length()));
+  function_info->set_scope_info(ScopeInfo<>::EmptyHeapObject());
 }
 
 
@@ -2348,7 +2514,6 @@ void Heap::FlushCode() {
 
 
 Object* Heap::CreateCode(const CodeDesc& desc,
-                         ZoneScopeInfo* sinfo,
                          Code::Flags flags,
                          Handle<Object> self_reference) {
   // Allocate ByteArray before the Code object, so that we do not risk
@@ -2358,9 +2523,7 @@ Object* Heap::CreateCode(const CodeDesc& desc,
 
   // Compute size
   int body_size = RoundUp(desc.instr_size, kObjectAlignment);
-  int sinfo_size = 0;
-  if (sinfo != NULL) sinfo_size = sinfo->Serialize(NULL);
-  int obj_size = Code::SizeFor(body_size, sinfo_size);
+  int obj_size = Code::SizeFor(body_size);
   ASSERT(IsAligned(obj_size, Code::kCodeAlignment));
   Object* result;
   if (obj_size > MaxObjectSizeInPagedSpace()) {
@@ -2377,7 +2540,6 @@ Object* Heap::CreateCode(const CodeDesc& desc,
   ASSERT(!CodeRange::exists() || CodeRange::contains(code->address()));
   code->set_instruction_size(desc.instr_size);
   code->set_relocation_info(ByteArray::cast(reloc_info));
-  code->set_sinfo_size(sinfo_size);
   code->set_flags(flags);
   // Allow self references to created code object by patching the handle to
   // point to the newly allocated Code object.
@@ -2390,7 +2552,6 @@ Object* Heap::CreateCode(const CodeDesc& desc,
   // objects. These pointers can include references to the code object itself,
   // through the self_reference parameter.
   code->CopyFrom(desc);
-  if (sinfo != NULL) sinfo->Serialize(code);  // write scope info
 
 #ifdef DEBUG
   code->Verify();
@@ -2431,9 +2592,7 @@ Object* Heap::CopyCode(Code* code, Vector<byte> reloc_info) {
 
   int new_body_size = RoundUp(code->instruction_size(), kObjectAlignment);
 
-  int sinfo_size = code->sinfo_size();
-
-  int new_obj_size = Code::SizeFor(new_body_size, sinfo_size);
+  int new_obj_size = Code::SizeFor(new_body_size);
 
   Address old_addr = code->address();
 
@@ -2460,8 +2619,6 @@ Object* Heap::CopyCode(Code* code, Vector<byte> reloc_info) {
 
   // Copy patched rinfo.
   memcpy(new_code->relocation_start(), reloc_info.start(), reloc_info.length());
-  // Copy sinfo.
-  memcpy(new_code->sinfo_start(), code->sinfo_start(), code->sinfo_size());
 
   // Relocate the copy.
   ASSERT(!CodeRange::exists() || CodeRange::contains(code->address()));
@@ -3657,7 +3814,7 @@ bool Heap::IteratePointersInDirtyMapsRegion(
         Max(start, prev_map + Map::kPointerFieldsBeginOffset);
 
     Address pointer_fields_end =
-        Min(prev_map + Map::kCodeCacheOffset + kPointerSize, end);
+        Min(prev_map + Map::kPointerFieldsEndOffset, end);
 
     contains_pointers_to_new_space =
       IteratePointersInDirtyRegion(pointer_fields_start,
@@ -3675,10 +3832,11 @@ bool Heap::IteratePointersInDirtyMapsRegion(
   if (map_aligned_end != end) {
     ASSERT(Memory::Object_at(map_aligned_end)->IsMap());
 
-    Address pointer_fields_start = map_aligned_end + Map::kPrototypeOffset;
+    Address pointer_fields_start =
+        map_aligned_end + Map::kPointerFieldsBeginOffset;
 
     Address pointer_fields_end =
-        Min(end, map_aligned_end + Map::kCodeCacheOffset + kPointerSize);
+        Min(end, map_aligned_end + Map::kPointerFieldsEndOffset);
 
     contains_pointers_to_new_space =
       IteratePointersInDirtyRegion(pointer_fields_start,
@@ -3691,9 +3849,9 @@ bool Heap::IteratePointersInDirtyMapsRegion(
 }
 
 
-void Heap::IterateAndMarkPointersToNewSpace(Address start,
-                                            Address end,
-                                            ObjectSlotCallback callback) {
+void Heap::IterateAndMarkPointersToFromSpace(Address start,
+                                             Address end,
+                                             ObjectSlotCallback callback) {
   Address slot_address = start;
   Page* page = Page::FromAddress(start);
 
@@ -3701,7 +3859,7 @@ void Heap::IterateAndMarkPointersToNewSpace(Address start,
 
   while (slot_address < end) {
     Object** slot = reinterpret_cast<Object**>(slot_address);
-    if (Heap::InNewSpace(*slot)) {
+    if (Heap::InFromSpace(*slot)) {
       ASSERT((*slot)->IsHeapObject());
       callback(reinterpret_cast<HeapObject**>(slot));
       if (Heap::InNewSpace(*slot)) {

deps/v8/src/heap.h

@@ -36,8 +36,6 @@
 namespace v8 {
 namespace internal {
 
-// Forward declarations.
-class ZoneScopeInfo;
 
 // Defines all the roots in Heap.
 #define UNCONDITIONAL_STRONG_ROOT_LIST(V)                                      \
@@ -626,7 +624,6 @@ class Heap : public AllStatic {
   // object by containing this pointer.
   // Please note this function does not perform a garbage collection.
   static Object* CreateCode(const CodeDesc& desc,
-                            ZoneScopeInfo* sinfo,
                             Code::Flags flags,
                             Handle<Object> self_reference);
 
@@ -774,11 +771,12 @@ class Heap : public AllStatic {
                                       DirtyRegionCallback visit_dirty_region,
                                       ObjectSlotCallback callback);
 
-  // Iterate pointers to new space found in memory interval from start to end.
+  // Iterate pointers to from semispace of new space found in memory interval
+  // from start to end.
   // Update dirty marks for page containing start address.
-  static void IterateAndMarkPointersToNewSpace(Address start,
-                                               Address end,
-                                               ObjectSlotCallback callback);
+  static void IterateAndMarkPointersToFromSpace(Address start,
+                                                Address end,
+                                                ObjectSlotCallback callback);
 
   // Iterate pointers to new space found in memory interval from start to end.
   // Return true if pointers to new space was found.
@@ -985,6 +983,8 @@ class Heap : public AllStatic {
 
   static void RecordStats(HeapStats* stats);
 
+  static Scavenger GetScavenger(int instance_type, int instance_size);
+
   // Copy block of memory from src to dst. Size of block should be aligned
   // by pointer size.
   static inline void CopyBlock(Address dst, Address src, int byte_size);
@@ -1232,17 +1232,7 @@ class Heap : public AllStatic {
     set_instanceof_cache_function(the_hole_value());
   }
 
-  // Helper function used by CopyObject to copy a source object to an
-  // allocated target object and update the forwarding pointer in the source
-  // object.  Returns the target object.
-  static inline HeapObject* MigrateObject(HeapObject* source,
-                                          HeapObject* target,
-                                          int size);
-
 #if defined(DEBUG) || defined(ENABLE_LOGGING_AND_PROFILING)
-  // Record the copy of an object in the NewSpace's statistics.
-  static void RecordCopiedObject(HeapObject* obj);
-
   // Record statistics before and after garbage collection.
   static void ReportStatisticsBeforeGC();
   static void ReportStatisticsAfterGC();

deps/v8/src/ia32/assembler-ia32.cc

@@ -121,7 +121,6 @@ void CpuFeatures::Probe() {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Code>::null());
   if (!code->IsCode()) return;

deps/v8/src/ia32/codegen-ia32.cc

@@ -6678,11 +6678,8 @@ void CodeGenerator::GenerateRandomHeapNumber(
   __ jmp(&heapnumber_allocated);
 
   __ bind(&slow_allocate_heapnumber);
-  // To allocate a heap number, and ensure that it is not a smi, we
-  // call the runtime function FUnaryMinus on 0, returning the double
-  // -0.0.  A new, distinct heap number is returned each time.
-  __ push(Immediate(Smi::FromInt(0)));
-  __ CallRuntime(Runtime::kNumberUnaryMinus, 1);
+  // Allocate a heap number.
+  __ CallRuntime(Runtime::kNumberAlloc, 0);
   __ mov(edi, eax);
 
   __ bind(&heapnumber_allocated);

deps/v8/src/ia32/full-codegen-ia32.cc

@@ -2242,11 +2242,8 @@ void FullCodeGenerator::EmitRandomHeapNumber(ZoneList<Expression*>* args) {
   __ jmp(&heapnumber_allocated);
 
   __ bind(&slow_allocate_heapnumber);
-  // To allocate a heap number, and ensure that it is not a smi, we
-  // call the runtime function FUnaryMinus on 0, returning the double
-  // -0.0.  A new, distinct heap number is returned each time.
-  __ push(Immediate(Smi::FromInt(0)));
-  __ CallRuntime(Runtime::kNumberUnaryMinus, 1);
+  // Allocate a heap number.
+  __ CallRuntime(Runtime::kNumberAlloc, 0);
   __ mov(edi, eax);
 
   __ bind(&heapnumber_allocated);

deps/v8/src/ia32/regexp-macro-assembler-ia32.cc

@@ -872,7 +872,6 @@ Handle<Object> RegExpMacroAssemblerIA32::GetCode(Handle<String> source) {
   CodeDesc code_desc;
   masm_->GetCode(&code_desc);
   Handle<Code> code = Factory::NewCode(code_desc,
-                                       NULL,
                                        Code::ComputeFlags(Code::REGEXP),
                                        masm_->CodeObject());
   PROFILE(RegExpCodeCreateEvent(*code, *source));

deps/v8/src/ia32/stub-cache-ia32.cc

@@ -111,7 +111,7 @@ static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
                                              Register receiver,
                                              String* name,
                                              Register r0,
-                                             Register extra) {
+                                             Register r1) {
   ASSERT(name->IsSymbol());
   __ IncrementCounter(&Counters::negative_lookups, 1);
   __ IncrementCounter(&Counters::negative_lookups_miss, 1);
@@ -121,11 +121,13 @@ static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
 
   const int kInterceptorOrAccessCheckNeededMask =
       (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded);
+
   // Bail out if the receiver has a named interceptor or requires access checks.
-  __ test(FieldOperand(r0, Map::kBitFieldOffset),
-          Immediate(kInterceptorOrAccessCheckNeededMask));
+  __ test_b(FieldOperand(r0, Map::kBitFieldOffset),
+            kInterceptorOrAccessCheckNeededMask);
   __ j(not_zero, miss_label, not_taken);
 
+  // Check that receiver is a JSObject.
   __ CmpInstanceType(r0, FIRST_JS_OBJECT_TYPE);
   __ j(below, miss_label, not_taken);
 
@@ -158,10 +160,7 @@ static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
   for (int i = 0; i < kProbes; i++) {
     // r0 points to properties hash.
     // Compute the masked index: (hash + i + i * i) & mask.
-    if (extra.is(no_reg)) {
-      __ push(receiver);
-    }
-    Register index = extra.is(no_reg) ? receiver : extra;
+    Register index = r1;
     // Capacity is smi 2^n.
     __ mov(index, FieldOperand(properties, kCapacityOffset));
     __ dec(index);
@@ -173,27 +172,18 @@ static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
     ASSERT(StringDictionary::kEntrySize == 3);
     __ lea(index, Operand(index, index, times_2, 0));  // index *= 3.
 
-    Register entity_name = extra.is(no_reg) ? properties : extra;
+    Register entity_name = r1;
     // Having undefined at this place means the name is not contained.
     ASSERT_EQ(kSmiTagSize, 1);
     __ mov(entity_name, Operand(properties, index, times_half_pointer_size,
                                 kElementsStartOffset - kHeapObjectTag));
     __ cmp(entity_name, Factory::undefined_value());
-    if (extra.is(no_reg)) {
-      // 'receiver' shares a register with 'entity_name'.
-      __ pop(receiver);
-    }
     if (i != kProbes - 1) {
       __ j(equal, &done, taken);
 
       // Stop if found the property.
       __ cmp(entity_name, Handle<String>(name));
       __ j(equal, miss_label, not_taken);
-
-      if (extra.is(no_reg)) {
-        // Restore the properties if their register was occupied by the name.
-        __ mov(properties, FieldOperand(receiver, JSObject::kPropertiesOffset));
-      }
     } else {
       // Give up probing if still not found the undefined value.
       __ j(not_equal, miss_label, not_taken);
@@ -525,6 +515,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                Register receiver,
                Register scratch1,
                Register scratch2,
+               Register scratch3,
                Label* miss) {
     ASSERT(holder->HasNamedInterceptor());
     ASSERT(!holder->GetNamedInterceptor()->getter()->IsUndefined());
@@ -541,6 +532,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                        receiver,
                        scratch1,
                        scratch2,
+                       scratch3,
                        holder,
                        lookup,
                        name,
@@ -552,6 +544,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                      receiver,
                      scratch1,
                      scratch2,
+                     scratch3,
                      name,
                      holder,
                      miss);
@@ -564,6 +557,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                         Register receiver,
                         Register scratch1,
                         Register scratch2,
+                        Register scratch3,
                         JSObject* interceptor_holder,
                         LookupResult* lookup,
                         String* name,
@@ -603,7 +597,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver,
                                         interceptor_holder, scratch1,
-                                        scratch2, name, depth1, miss);
+                                        scratch2, scratch3, name, depth1, miss);
 
     // Invoke an interceptor and if it provides a value,
     // branch to |regular_invoke|.
@@ -619,7 +613,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     if (interceptor_holder != lookup->holder()) {
       stub_compiler_->CheckPrototypes(interceptor_holder, receiver,
                                       lookup->holder(), scratch1,
-                                      scratch2, name, depth2, miss);
+                                      scratch2, scratch3, name, depth2, miss);
     } else {
       // CheckPrototypes has a side effect of fetching a 'holder'
       // for API (object which is instanceof for the signature).  It's
@@ -655,12 +649,13 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                       Register receiver,
                       Register scratch1,
                       Register scratch2,
+                      Register scratch3,
                       String* name,
                       JSObject* interceptor_holder,
                       Label* miss_label) {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver, interceptor_holder,
-                                        scratch1, scratch2, name,
+                                        scratch1, scratch2, scratch3, name,
                                         miss_label);
 
     __ EnterInternalFrame();
@@ -862,14 +857,15 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
                                        Register object_reg,
                                        JSObject* holder,
                                        Register holder_reg,
-                                       Register scratch,
+                                       Register scratch1,
+                                       Register scratch2,
                                        String* name,
                                        int save_at_depth,
-                                       Label* miss,
-                                       Register extra) {
+                                       Label* miss) {
   // Make sure there's no overlap between holder and object registers.
-  ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg));
-  ASSERT(!extra.is(object_reg) && !extra.is(holder_reg) && !extra.is(scratch));
+  ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
+  ASSERT(!scratch2.is(object_reg) && !scratch2.is(holder_reg)
+         && !scratch2.is(scratch1));
   // Keep track of the current object in register reg.
   Register reg = object_reg;
   JSObject* current = object;
@@ -909,31 +905,31 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
                                        miss,
                                        reg,
                                        name,
-                                       scratch,
-                                       extra);
-      __ mov(scratch, FieldOperand(reg, HeapObject::kMapOffset));
+                                       scratch1,
+                                       scratch2);
+      __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
       reg = holder_reg;  // from now the object is in holder_reg
-      __ mov(reg, FieldOperand(scratch, Map::kPrototypeOffset));
+      __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
     } else if (Heap::InNewSpace(prototype)) {
       // Get the map of the current object.
-      __ mov(scratch, FieldOperand(reg, HeapObject::kMapOffset));
-      __ cmp(Operand(scratch), Immediate(Handle<Map>(current->map())));
+      __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
+      __ cmp(Operand(scratch1), Immediate(Handle<Map>(current->map())));
       // Branch on the result of the map check.
       __ j(not_equal, miss, not_taken);
       // Check access rights to the global object.  This has to happen
       // after the map check so that we know that the object is
       // actually a global object.
       if (current->IsJSGlobalProxy()) {
-        __ CheckAccessGlobalProxy(reg, scratch, miss);
+        __ CheckAccessGlobalProxy(reg, scratch1, miss);
 
         // Restore scratch register to be the map of the object.
         // We load the prototype from the map in the scratch register.
-        __ mov(scratch, FieldOperand(reg, HeapObject::kMapOffset));
+        __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
       }
       // The prototype is in new space; we cannot store a reference
       // to it in the code. Load it from the map.
       reg = holder_reg;  // from now the object is in holder_reg
-      __ mov(reg, FieldOperand(scratch, Map::kPrototypeOffset));
+      __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
     } else {
       // Check the map of the current object.
       __ cmp(FieldOperand(reg, HeapObject::kMapOffset),
@@ -944,7 +940,7 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
       // after the map check so that we know that the object is
       // actually a global object.
       if (current->IsJSGlobalProxy()) {
-        __ CheckAccessGlobalProxy(reg, scratch, miss);
+        __ CheckAccessGlobalProxy(reg, scratch1, miss);
       }
       // The prototype is in old space; load it directly.
       reg = holder_reg;  // from now the object is in holder_reg
@@ -971,7 +967,7 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
   // Perform security check for access to the global object.
   ASSERT(holder->IsJSGlobalProxy() || !holder->IsAccessCheckNeeded());
   if (holder->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(reg, scratch, miss);
+    __ CheckAccessGlobalProxy(reg, scratch1, miss);
   };
 
   // If we've skipped any global objects, it's not enough to verify
@@ -981,7 +977,7 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
                                               object,
                                               holder,
                                               name,
-                                              scratch,
+                                              scratch1,
                                               miss);
   if (result->IsFailure()) set_failure(Failure::cast(result));
 
@@ -995,6 +991,7 @@ void StubCompiler::GenerateLoadField(JSObject* object,
                                      Register receiver,
                                      Register scratch1,
                                      Register scratch2,
+                                     Register scratch3,
                                      int index,
                                      String* name,
                                      Label* miss) {
@@ -1005,7 +1002,7 @@ void StubCompiler::GenerateLoadField(JSObject* object,
   // Check the prototype chain.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Get the value from the properties.
   GenerateFastPropertyLoad(masm(), eax, reg, holder, index);
@@ -1019,6 +1016,7 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
                                         Register name_reg,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         AccessorInfo* callback,
                                         String* name,
                                         Label* miss,
@@ -1030,7 +1028,7 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
   // Check that the maps haven't changed.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   Handle<AccessorInfo> callback_handle(callback);
 
@@ -1094,6 +1092,7 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
                                         Register receiver,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         Object* value,
                                         String* name,
                                         Label* miss) {
@@ -1104,7 +1103,7 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
   // Check that the maps haven't changed.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Return the constant value.
   __ mov(eax, Handle<Object>(value));
@@ -1119,6 +1118,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                            Register name_reg,
                                            Register scratch1,
                                            Register scratch2,
+                                           Register scratch3,
                                            String* name,
                                            Label* miss) {
   ASSERT(interceptor_holder->HasNamedInterceptor());
@@ -1147,7 +1147,8 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // property from further up the prototype chain if the call fails.
     // Check that the maps haven't changed.
     Register holder_reg = CheckPrototypes(object, receiver, interceptor_holder,
-                                          scratch1, scratch2, name, miss);
+                                          scratch1, scratch2, scratch3,
+                                          name, miss);
     ASSERT(holder_reg.is(receiver) || holder_reg.is(scratch1));
 
     // Save necessary data before invoking an interceptor.
@@ -1195,6 +1196,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                    lookup->holder(),
                                    scratch1,
                                    scratch2,
+                                   scratch3,
                                    name,
                                    miss);
     }
@@ -1235,7 +1237,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // Check that the maps haven't changed.
     Register holder_reg =
         CheckPrototypes(object, receiver, interceptor_holder,
-                        scratch1, scratch2, name, miss);
+                        scratch1, scratch2, scratch3, name, miss);
     __ pop(scratch2);  // save old return address
     PushInterceptorArguments(masm(), receiver, holder_reg,
                              name_reg, interceptor_holder);
@@ -1310,8 +1312,8 @@ Object* CallStubCompiler::CompileCallField(JSObject* object,
   __ j(zero, &miss, not_taken);
 
   // Do the right check and compute the holder register.
-  Register reg = CheckPrototypes(object, edx, holder, ebx, eax,
-                                 name, &miss, edi);
+  Register reg = CheckPrototypes(object, edx, holder, ebx, eax, edi,
+                                 name, &miss);
 
   GenerateFastPropertyLoad(masm(), edi, reg, holder, index);
 
@@ -1373,7 +1375,7 @@ Object* CallStubCompiler::CompileArrayPushCall(Object* object,
 
   CheckPrototypes(JSObject::cast(object), edx,
                   holder, ebx,
-                  eax, name, &miss, edi);
+                  eax, edi, name, &miss);
 
   if (argc == 0) {
     // Noop, return the length.
@@ -1519,7 +1521,7 @@ Object* CallStubCompiler::CompileArrayPopCall(Object* object,
   __ j(zero, &miss);
   CheckPrototypes(JSObject::cast(object), edx,
                   holder, ebx,
-                  eax, name, &miss, edi);
+                  eax, edi, name, &miss);
 
   // Get the elements array of the object.
   __ mov(ebx, FieldOperand(edx, JSArray::kElementsOffset));
@@ -1594,7 +1596,7 @@ Object* CallStubCompiler::CompileStringCharCodeAtCall(Object* object,
                                             Context::STRING_FUNCTION_INDEX,
                                             eax);
   CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
-                  ebx, edx, name, &miss, edi);
+                  ebx, edx, edi, name, &miss);
 
   Register receiver = ebx;
   Register index = edi;
@@ -1659,7 +1661,7 @@ Object* CallStubCompiler::CompileStringCharAtCall(Object* object,
                                             Context::STRING_FUNCTION_INDEX,
                                             eax);
   CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
-                  ebx, edx, name, &miss, edi);
+                  ebx, edx, edi, name, &miss);
 
   Register receiver = eax;
   Register index = edi;
@@ -1764,7 +1766,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
 
       // Check that the maps haven't changed.
       CheckPrototypes(JSObject::cast(object), edx, holder,
-                      ebx, eax, name, depth, &miss, edi);
+                      ebx, eax, edi, name, depth, &miss);
 
       // Patch the receiver on the stack with the global proxy if
       // necessary.
@@ -1787,7 +1789,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::STRING_FUNCTION_INDEX, eax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
-                        ebx, edx, name, &miss, edi);
+                        ebx, edx, edi, name, &miss);
       }
       break;
 
@@ -1807,7 +1809,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::NUMBER_FUNCTION_INDEX, eax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
-                        ebx, edx, name, &miss, edi);
+                        ebx, edx, edi, name, &miss);
       }
       break;
     }
@@ -1828,7 +1830,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::BOOLEAN_FUNCTION_INDEX, eax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), eax, holder,
-                        ebx, edx, name, &miss, edi);
+                        ebx, edx, edi, name, &miss);
       }
       break;
     }
@@ -1888,6 +1890,7 @@ Object* CallStubCompiler::CompileCallInterceptor(JSObject* object,
                    edx,
                    ebx,
                    edi,
+                   eax,
                    &miss);
 
   // Restore receiver.
@@ -1950,7 +1953,7 @@ Object* CallStubCompiler::CompileCallGlobal(JSObject* object,
   }
 
   // Check that the maps haven't changed.
-  CheckPrototypes(object, edx, holder, ebx, eax, name, &miss, edi);
+  CheckPrototypes(object, edx, holder, ebx, eax, edi, name, &miss);
 
   // Get the value from the cell.
   __ mov(edi, Immediate(Handle<JSGlobalPropertyCell>(cell)));
@@ -2226,7 +2229,7 @@ Object* LoadStubCompiler::CompileLoadNonexistent(String* name,
   // Check the maps of the full prototype chain. Also check that
   // global property cells up to (but not including) the last object
   // in the prototype chain are empty.
-  CheckPrototypes(object, eax, last, ebx, edx, name, &miss);
+  CheckPrototypes(object, eax, last, ebx, edx, edi, name, &miss);
 
   // If the last object in the prototype chain is a global object,
   // check that the global property cell is empty.
@@ -2263,7 +2266,7 @@ Object* LoadStubCompiler::CompileLoadField(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadField(object, holder, eax, ebx, edx, index, name, &miss);
+  GenerateLoadField(object, holder, eax, ebx, edx, edi, index, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -2284,7 +2287,7 @@ Object* LoadStubCompiler::CompileLoadCallback(String* name,
   Label miss;
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(object, holder, eax, ecx, ebx, edx,
+  bool success = GenerateLoadCallback(object, holder, eax, ecx, ebx, edx, edi,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -2307,7 +2310,7 @@ Object* LoadStubCompiler::CompileLoadConstant(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadConstant(object, holder, eax, ebx, edx, value, name, &miss);
+  GenerateLoadConstant(object, holder, eax, ebx, edx, edi, value, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -2338,6 +2341,7 @@ Object* LoadStubCompiler::CompileLoadInterceptor(JSObject* receiver,
                           ecx,
                           edx,
                           ebx,
+                          edi,
                           name,
                           &miss);
 
@@ -2370,7 +2374,7 @@ Object* LoadStubCompiler::CompileLoadGlobal(JSObject* object,
   }
 
   // Check that the maps haven't changed.
-  CheckPrototypes(object, eax, holder, ebx, edx, name, &miss, edi);
+  CheckPrototypes(object, eax, holder, ebx, edx, edi, name, &miss);
 
   // Get the value from the cell.
   __ mov(ebx, Immediate(Handle<JSGlobalPropertyCell>(cell)));
@@ -2415,7 +2419,7 @@ Object* KeyedLoadStubCompiler::CompileLoadField(String* name,
   __ cmp(Operand(eax), Immediate(Handle<String>(name)));
   __ j(not_equal, &miss, not_taken);
 
-  GenerateLoadField(receiver, holder, edx, ebx, ecx, index, name, &miss);
+  GenerateLoadField(receiver, holder, edx, ebx, ecx, edi, index, name, &miss);
 
   __ bind(&miss);
   __ DecrementCounter(&Counters::keyed_load_field, 1);
@@ -2444,7 +2448,7 @@ Object* KeyedLoadStubCompiler::CompileLoadCallback(String* name,
   __ j(not_equal, &miss, not_taken);
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(receiver, holder, edx, eax, ebx, ecx,
+  bool success = GenerateLoadCallback(receiver, holder, edx, eax, ebx, ecx, edi,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -2474,7 +2478,7 @@ Object* KeyedLoadStubCompiler::CompileLoadConstant(String* name,
   __ cmp(Operand(eax), Immediate(Handle<String>(name)));
   __ j(not_equal, &miss, not_taken);
 
-  GenerateLoadConstant(receiver, holder, edx, ebx, ecx,
+  GenerateLoadConstant(receiver, holder, edx, ebx, ecx, edi,
                        value, name, &miss);
   __ bind(&miss);
   __ DecrementCounter(&Counters::keyed_load_constant_function, 1);
@@ -2510,6 +2514,7 @@ Object* KeyedLoadStubCompiler::CompileLoadInterceptor(JSObject* receiver,
                           eax,
                           ecx,
                           ebx,
+                          edi,
                           name,
                           &miss);
   __ bind(&miss);

deps/v8/src/ic.cc

@@ -525,17 +525,12 @@ void CallICBase::UpdateCaches(LookupResult* lookup,
   // Bail out if we didn't find a result.
   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 
-#ifndef V8_TARGET_ARCH_IA32
-  // Normal objects only implemented for IA32 by now.
-  if (HasNormalObjectsInPrototypeChain(lookup, *object)) return;
-#else
   if (lookup->holder() != *object &&
       HasNormalObjectsInPrototypeChain(lookup, object->GetPrototype())) {
     // Suppress optimization for prototype chains with slow properties objects
     // in the middle.
     return;
   }
-#endif
 
   // Compute the number of arguments.
   int argc = target()->arguments_count();

deps/v8/src/json.js

@@ -29,7 +29,7 @@ var $JSON = global.JSON;
 
 function ParseJSONUnfiltered(text) {
   var s = $String(text);
-  var f = %CompileString(text, true);
+  var f = %CompileString(s, true);
   return f();
 }
 

deps/v8/src/mark-compact.cc

@@ -425,8 +425,10 @@ void MarkCompactCollector::MarkMapContents(Map* map) {
   // Since the descriptor array has been marked already, it is fine
   // that one of these fields contains a pointer to it.
   MarkingVisitor visitor;  // Has no state or contents.
-  visitor.VisitPointers(HeapObject::RawField(map, Map::kPrototypeOffset),
-                        HeapObject::RawField(map, Map::kSize));
+  visitor.VisitPointers(HeapObject::RawField(map,
+                                             Map::kPointerFieldsBeginOffset),
+                        HeapObject::RawField(map,
+                                             Map::kPointerFieldsEndOffset));
 }
 
 

deps/v8/src/messages.cc

@@ -66,7 +66,8 @@ Handle<Object> MessageHandler::MakeMessageObject(
     const char* type,
     MessageLocation* loc,
     Vector< Handle<Object> > args,
-    Handle<String> stack_trace) {
+    Handle<String> stack_trace,
+    Handle<JSArray> stack_frames) {
   // Build error message object
   v8::HandleScope scope;  // Instantiate a closeable HandleScope for EscapeFrom.
   Handle<Object> type_str = Factory::LookupAsciiSymbol(type);
@@ -90,13 +91,17 @@ Handle<Object> MessageHandler::MakeMessageObject(
   Handle<Object> stack_trace_val = stack_trace.is_null()
     ? Factory::undefined_value()
     : Handle<Object>::cast(stack_trace);
-  const int argc = 6;
+  Handle<Object> stack_frames_val =  stack_frames.is_null()
+    ? Factory::undefined_value()
+    : Handle<Object>::cast(stack_frames);
+  const int argc = 7;
   Object** argv[argc] = { type_str.location(),
                           array.location(),
                           start_handle.location(),
                           end_handle.location(),
                           script.location(),
-                          stack_trace_val.location() };
+                          stack_trace_val.location(),
+                          stack_frames_val.location() };
 
   // Setup a catch handler to catch exceptions in creating the message. This
   // handler is non-verbose to avoid calling MakeMessage recursively in case of

deps/v8/src/messages.h

@@ -96,7 +96,8 @@ class MessageHandler {
   static Handle<Object> MakeMessageObject(const char* type,
                                           MessageLocation* loc,
                                           Vector< Handle<Object> > args,
-                                          Handle<String> stack_trace);
+                                          Handle<String> stack_trace,
+                                          Handle<JSArray> stack_frames);
 
   // Report a formatted message (needs JS allocation).
   static void ReportMessage(MessageLocation* loc, Handle<Object> message);

deps/v8/src/messages.js

@@ -181,7 +181,6 @@ function FormatMessage(message) {
       // RangeError
       invalid_array_length:         "Invalid array length",
       stack_overflow:               "Maximum call stack size exceeded",
-      apply_overflow:               "Function.prototype.apply cannot support %0 arguments",
       // SyntaxError
       unable_to_parse:              "Parse error",
       duplicate_regexp_flag:        "Duplicate RegExp flag %0",
@@ -601,18 +600,22 @@ function GetPositionInLine(message) {
 }
 
 
-function ErrorMessage(type, args, startPos, endPos, script, stackTrace) {
+function ErrorMessage(type, args, startPos, endPos, script, stackTrace,
+                      stackFrames) {
   this.startPos = startPos;
   this.endPos = endPos;
   this.type = type;
   this.args = args;
   this.script = script;
   this.stackTrace = stackTrace;
+  this.stackFrames = stackFrames;
 }
 
 
-function MakeMessage(type, args, startPos, endPos, script, stackTrace) {
-  return new ErrorMessage(type, args, startPos, endPos, script, stackTrace);
+function MakeMessage(type, args, startPos, endPos, script, stackTrace,
+                     stackFrames) {
+  return new ErrorMessage(type, args, startPos, endPos, script, stackTrace,
+                          stackFrames);
 }
 
 

deps/v8/src/objects-debug.cc

@@ -789,6 +789,7 @@ void SharedFunctionInfo::SharedFunctionInfoVerify() {
   CHECK(IsSharedFunctionInfo());
   VerifyObjectField(kNameOffset);
   VerifyObjectField(kCodeOffset);
+  VerifyObjectField(kScopeInfoOffset);
   VerifyObjectField(kInstanceClassNameOffset);
   VerifyObjectField(kFunctionDataOffset);
   VerifyObjectField(kScriptOffset);

deps/v8/src/objects-inl.h

@@ -2060,6 +2060,21 @@ void ExternalFloatArray::set(int index, float value) {
   ptr[index] = value;
 }
 
+inline Scavenger Map::scavenger() {
+  Scavenger callback = reinterpret_cast<Scavenger>(
+      READ_INTPTR_FIELD(this, kScavengerCallbackOffset));
+
+  ASSERT(callback == Heap::GetScavenger(instance_type(),
+                                        instance_size()));
+
+  return callback;
+}
+
+inline void Map::set_scavenger(Scavenger callback) {
+  WRITE_INTPTR_FIELD(this,
+                     kScavengerCallbackOffset,
+                     reinterpret_cast<intptr_t>(callback));
+}
 
 int Map::instance_size() {
   return READ_BYTE_FIELD(this, kInstanceSizeOffset) << kPointerSizeLog2;
@@ -2496,6 +2511,7 @@ ACCESSORS(BreakPointInfo, break_point_objects, Object, kBreakPointObjectsIndex)
 #endif
 
 ACCESSORS(SharedFunctionInfo, name, Object, kNameOffset)
+ACCESSORS(SharedFunctionInfo, scope_info, Object, kScopeInfoOffset)
 ACCESSORS(SharedFunctionInfo, construct_stub, Code, kConstructStubOffset)
 ACCESSORS(SharedFunctionInfo, instance_class_name, Object,
           kInstanceClassNameOffset)
@@ -2808,7 +2824,6 @@ JSValue* JSValue::cast(Object* obj) {
 
 INT_ACCESSORS(Code, instruction_size, kInstructionSizeOffset)
 ACCESSORS(Code, relocation_info, ByteArray, kRelocationInfoOffset)
-INT_ACCESSORS(Code, sinfo_size, kSInfoSizeOffset)
 
 
 byte* Code::instruction_start()  {
@@ -2852,11 +2867,6 @@ bool Code::contains(byte* pc) {
 }
 
 
-byte* Code::sinfo_start() {
-  return FIELD_ADDR(this, kHeaderSize + body_size());
-}
-
-
 ACCESSORS(JSArray, length, Object, kLengthOffset)
 
 

deps/v8/src/objects.cc

@@ -2190,6 +2190,8 @@ Object* JSObject::NormalizeProperties(PropertyNormalizationMode mode,
     int new_instance_size = map()->instance_size() - instance_size_delta;
     new_map->set_inobject_properties(0);
     new_map->set_instance_size(new_instance_size);
+    new_map->set_scavenger(Heap::GetScavenger(new_map->instance_type(),
+                                              new_map->instance_size()));
     Heap::CreateFillerObjectAt(this->address() + new_instance_size,
                                instance_size_delta);
   }
@@ -5033,7 +5035,7 @@ void Map::ClearNonLiveTransitions(Object* real_prototype) {
 
 void Map::MapIterateBody(ObjectVisitor* v) {
   // Assumes all Object* members are contiguously allocated!
-  IteratePointers(v, kPrototypeOffset, kCodeCacheOffset + kPointerSize);
+  IteratePointers(v, kPointerFieldsBeginOffset, kPointerFieldsEndOffset);
 }
 
 
@@ -5325,8 +5327,6 @@ void Code::CodeIterateBody(ObjectVisitor* v) {
   for (; !it.done(); it.next()) {
     it.rinfo()->Visit(v);
   }
-
-  ScopeInfo<>::IterateScopeInfo(this, v);
 }
 
 

deps/v8/src/objects.h

@@ -2744,10 +2744,6 @@ class Code: public HeapObject {
 
   inline int relocation_size();
 
-  // [sinfo_size]: Size of scope information.
-  inline int sinfo_size();
-  inline void set_sinfo_size(int value);
-
   // [flags]: Various code flags.
   inline Flags flags();
   inline void set_flags(Flags flags);
@@ -2816,9 +2812,6 @@ class Code: public HeapObject {
   // Returns true if pc is inside this object's instructions.
   inline bool contains(byte* pc);
 
-  // Returns the address of the scope information.
-  inline byte* sinfo_start();
-
   // Relocate the code by delta bytes. Called to signal that this code
   // object has been moved by delta bytes.
   void Relocate(intptr_t delta);
@@ -2826,12 +2819,10 @@ class Code: public HeapObject {
   // Migrate code described by desc.
   void CopyFrom(const CodeDesc& desc);
 
-  // Returns the object size for a given body and sinfo size (Used for
-  // allocation).
-  static int SizeFor(int body_size, int sinfo_size) {
+  // Returns the object size for a given body (used for allocation).
+  static int SizeFor(int body_size) {
     ASSERT_SIZE_TAG_ALIGNED(body_size);
-    ASSERT_SIZE_TAG_ALIGNED(sinfo_size);
-    return RoundUp(kHeaderSize + body_size + sinfo_size, kCodeAlignment);
+    return RoundUp(kHeaderSize + body_size, kCodeAlignment);
   }
 
   // Calculate the size of the code object to report for log events. This takes
@@ -2851,7 +2842,7 @@ class Code: public HeapObject {
   static inline Code* cast(Object* obj);
 
   // Dispatched behavior.
-  int CodeSize() { return SizeFor(body_size(), sinfo_size()); }
+  int CodeSize() { return SizeFor(body_size()); }
   void CodeIterateBody(ObjectVisitor* v);
 #ifdef DEBUG
   void CodePrint();
@@ -2865,8 +2856,7 @@ class Code: public HeapObject {
   // Layout description.
   static const int kInstructionSizeOffset = HeapObject::kHeaderSize;
   static const int kRelocationInfoOffset = kInstructionSizeOffset + kIntSize;
-  static const int kSInfoSizeOffset = kRelocationInfoOffset + kPointerSize;
-  static const int kFlagsOffset = kSInfoSizeOffset + kIntSize;
+  static const int kFlagsOffset = kRelocationInfoOffset + kPointerSize;
   static const int kKindSpecificFlagsOffset  = kFlagsOffset + kIntSize;
   // Add padding to align the instruction start following right after
   // the Code object header.
@@ -2899,6 +2889,7 @@ class Code: public HeapObject {
   DISALLOW_IMPLICIT_CONSTRUCTORS(Code);
 };
 
+typedef void (*Scavenger)(Map* map, HeapObject** slot, HeapObject* object);
 
 // All heap objects have a Map that describes their structure.
 //  A Map contains information about:
@@ -3100,6 +3091,13 @@ class Map: public HeapObject {
   void MapVerify();
 #endif
 
+  inline Scavenger scavenger();
+  inline void set_scavenger(Scavenger callback);
+
+  inline void Scavenge(HeapObject** slot, HeapObject* obj) {
+    scavenger()(this, slot, obj);
+  }
+
   static const int kMaxPreAllocatedPropertyFields = 255;
 
   // Layout description.
@@ -3110,7 +3108,8 @@ class Map: public HeapObject {
   static const int kInstanceDescriptorsOffset =
       kConstructorOffset + kPointerSize;
   static const int kCodeCacheOffset = kInstanceDescriptorsOffset + kPointerSize;
-  static const int kPadStart = kCodeCacheOffset + kPointerSize;
+  static const int kScavengerCallbackOffset = kCodeCacheOffset + kPointerSize;
+  static const int kPadStart = kScavengerCallbackOffset + kPointerSize;
   static const int kSize = MAP_POINTER_ALIGN(kPadStart);
 
   // Layout of pointer fields. Heap iteration code relies on them
@@ -3273,6 +3272,9 @@ class SharedFunctionInfo: public HeapObject {
   // [code]: Function code.
   DECL_ACCESSORS(code, Code)
 
+  // [scope_info]: Scope info.
+  DECL_ACCESSORS(scope_info, Object)
+
   // [construct stub]: Code stub for constructing instances of this function.
   DECL_ACCESSORS(construct_stub, Code)
 
@@ -3426,7 +3428,8 @@ class SharedFunctionInfo: public HeapObject {
   // Pointer fields.
   static const int kNameOffset = HeapObject::kHeaderSize;
   static const int kCodeOffset = kNameOffset + kPointerSize;
-  static const int kConstructStubOffset = kCodeOffset + kPointerSize;
+  static const int kScopeInfoOffset = kCodeOffset + kPointerSize;
+  static const int kConstructStubOffset = kScopeInfoOffset + kPointerSize;
   static const int kInstanceClassNameOffset =
       kConstructStubOffset + kPointerSize;
   static const int kFunctionDataOffset =

deps/v8/src/parser.cc

@@ -1968,8 +1968,8 @@ Statement* Parser::ParseNativeDeclaration(bool* ok) {
   const int literals = fun->NumberOfLiterals();
   Handle<Code> code = Handle<Code>(fun->shared()->code());
   Handle<Code> construct_stub = Handle<Code>(fun->shared()->construct_stub());
-  Handle<SharedFunctionInfo> shared =
-      Factory::NewSharedFunctionInfo(name, literals, code);
+  Handle<SharedFunctionInfo> shared = Factory::NewSharedFunctionInfo(
+      name, literals, code, Handle<Object>(fun->shared()->scope_info()));
   shared->set_construct_stub(*construct_stub);
 
   // Copy the function data to the shared function info.

deps/v8/src/platform-openbsd.cc

@@ -83,6 +83,12 @@ void OS::Setup() {
 }
 
 
+void OS::ReleaseStore(volatile AtomicWord* ptr, AtomicWord value) {
+  __asm__ __volatile__("" : : : "memory");
+  *ptr = value;
+}
+
+
 uint64_t OS::CpuFeaturesImpliedByPlatform() {
   return 0;  // OpenBSD runs on anything.
 }

deps/v8/src/profile-generator.cc

@@ -1555,13 +1555,12 @@ void HeapSnapshotGenerator::ExtractClosureReferences(JSObject* js_obj,
     JSFunction* func = JSFunction::cast(js_obj);
     Context* context = func->context();
     ZoneScope zscope(DELETE_ON_EXIT);
-    ScopeInfo<ZoneListAllocationPolicy> scope_info(
-        context->closure()->shared()->code());
-    int locals_number = scope_info.NumberOfLocals();
+    Object* scope_info = context->closure()->shared()->scope_info();
+    ScopeInfo<ZoneListAllocationPolicy> zone_scope_info(scope_info);
+    int locals_number = zone_scope_info.NumberOfLocals();
     for (int i = 0; i < locals_number; ++i) {
-      String* local_name = *scope_info.LocalName(i);
-      int idx = ScopeInfo<>::ContextSlotIndex(
-          context->closure()->shared()->code(), local_name, NULL);
+      String* local_name = *zone_scope_info.LocalName(i);
+      int idx = ScopeInfo<>::ContextSlotIndex(scope_info, local_name, NULL);
       if (idx >= 0 && idx < context->length()) {
         snapshot_->SetClosureReference(entry, local_name, context->get(idx));
       }

deps/v8/src/runtime.cc

@@ -1606,9 +1606,10 @@ static Object* Runtime_SetCode(Arguments args) {
     if (!EnsureCompiled(shared, KEEP_EXCEPTION)) {
       return Failure::Exception();
     }
-    // Set the code, formal parameter count, and the length of the target
-    // function.
+    // Set the code, scope info, formal parameter count,
+    // and the length of the target function.
     target->set_code(fun->code());
+    target->shared()->set_scope_info(shared->scope_info());
     target->shared()->set_length(shared->length());
     target->shared()->set_formal_parameter_count(
         shared->formal_parameter_count());
@@ -5608,6 +5609,14 @@ static Object* Runtime_NumberUnaryMinus(Arguments args) {
 }
 
 
+static Object* Runtime_NumberAlloc(Arguments args) {
+  NoHandleAllocation ha;
+  ASSERT(args.length() == 0);
+
+  return Heap::NumberFromDouble(9876543210.0);
+}
+
+
 static Object* Runtime_NumberDiv(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
@@ -6860,7 +6869,8 @@ static Object* Runtime_NewContext(Arguments args) {
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, function, args[0]);
-  int length = ScopeInfo<>::NumberOfContextSlots(function->code());
+  int length =
+      ScopeInfo<>::NumberOfContextSlots(function->shared()->scope_info());
   Object* result = Heap::AllocateFunctionContext(length, function);
   if (result->IsFailure()) return result;
 
@@ -8480,9 +8490,10 @@ static Object* Runtime_GetFrameDetails(Arguments args) {
   // Check for constructor frame.
   bool constructor = it.frame()->IsConstructor();
 
-  // Get code and read scope info from it for local variable information.
-  Handle<Code> code(it.frame()->code());
-  ScopeInfo<> info(*code);
+  // Get scope info and read from it for local variable information.
+  Handle<JSFunction> function(JSFunction::cast(it.frame()->function()));
+  Handle<Object> scope_info(function->shared()->scope_info());
+  ScopeInfo<> info(*scope_info);
 
   // Get the context.
   Handle<Context> context(Context::cast(it.frame()->context()));
@@ -8510,7 +8521,8 @@ static Object* Runtime_GetFrameDetails(Arguments args) {
       }
       ASSERT(context->is_function_context());
       locals->set(i * 2 + 1,
-                  context->get(ScopeInfo<>::ContextSlotIndex(*code, *name,
+                  context->get(ScopeInfo<>::ContextSlotIndex(*scope_info,
+                                                             *name,
                                                              NULL)));
     }
   }
@@ -8651,7 +8663,7 @@ static Object* Runtime_GetFrameDetails(Arguments args) {
 
 
 // Copy all the context locals into an object used to materialize a scope.
-static void CopyContextLocalsToScopeObject(Handle<Code> code,
+static void CopyContextLocalsToScopeObject(Handle<SharedFunctionInfo> shared,
                                            ScopeInfo<>& scope_info,
                                            Handle<Context> context,
                                            Handle<JSObject> scope_object) {
@@ -8660,7 +8672,7 @@ static void CopyContextLocalsToScopeObject(Handle<Code> code,
        i < scope_info.number_of_context_slots();
        i++) {
     int context_index =
-        ScopeInfo<>::ContextSlotIndex(*code,
+        ScopeInfo<>::ContextSlotIndex(shared->scope_info(),
                                       *scope_info.context_slot_name(i),
                                       NULL);
 
@@ -8678,8 +8690,8 @@ static void CopyContextLocalsToScopeObject(Handle<Code> code,
 // frame.
 static Handle<JSObject> MaterializeLocalScope(JavaScriptFrame* frame) {
   Handle<JSFunction> function(JSFunction::cast(frame->function()));
-  Handle<Code> code(function->code());
-  ScopeInfo<> scope_info(*code);
+  Handle<SharedFunctionInfo> shared(function->shared());
+  ScopeInfo<> scope_info(shared->scope_info());
 
   // Allocate and initialize a JSObject with all the arguments, stack locals
   // heap locals and extension properties of the debugged function.
@@ -8702,7 +8714,7 @@ static Handle<JSObject> MaterializeLocalScope(JavaScriptFrame* frame) {
   // Third fill all context locals.
   Handle<Context> frame_context(Context::cast(frame->context()));
   Handle<Context> function_context(frame_context->fcontext());
-  CopyContextLocalsToScopeObject(code, scope_info,
+  CopyContextLocalsToScopeObject(shared, scope_info,
                                  function_context, local_scope);
 
   // Finally copy any properties from the function context extension. This will
@@ -8729,8 +8741,8 @@ static Handle<JSObject> MaterializeLocalScope(JavaScriptFrame* frame) {
 static Handle<JSObject> MaterializeClosure(Handle<Context> context) {
   ASSERT(context->is_function_context());
 
-  Handle<Code> code(context->closure()->code());
-  ScopeInfo<> scope_info(*code);
+  Handle<SharedFunctionInfo> shared(context->closure()->shared());
+  ScopeInfo<> scope_info(shared->scope_info());
 
   // Allocate and initialize a JSObject with all the content of theis function
   // closure.
@@ -8738,7 +8750,7 @@ static Handle<JSObject> MaterializeClosure(Handle<Context> context) {
 
   // Check whether the arguments shadow object exists.
   int arguments_shadow_index =
-      ScopeInfo<>::ContextSlotIndex(*code,
+      ScopeInfo<>::ContextSlotIndex(shared->scope_info(),
                                     Heap::arguments_shadow_symbol(),
                                     NULL);
   if (arguments_shadow_index >= 0) {
@@ -8754,7 +8766,7 @@ static Handle<JSObject> MaterializeClosure(Handle<Context> context) {
   }
 
   // Fill all context locals to the context extension.
-  CopyContextLocalsToScopeObject(code, scope_info, context, closure_scope);
+  CopyContextLocalsToScopeObject(shared, scope_info, context, closure_scope);
 
   // Finally copy any properties from the function context extension. This will
   // be variables introduced by eval.
@@ -8803,8 +8815,8 @@ class ScopeIterator {
       // created for evaluating top level code and it is not a real local scope.
       // Checking for the existence of .result seems fragile, but the scope info
       // saved with the code object does not otherwise have that information.
-      Handle<Code> code(function_->code());
-      int index = ScopeInfo<>::StackSlotIndex(*code, Heap::result_symbol());
+      int index = ScopeInfo<>::StackSlotIndex(function_->shared()->scope_info(),
+                                              Heap::result_symbol());
       at_local_ = index < 0;
     } else if (context_->is_function_context()) {
       at_local_ = true;
@@ -8918,8 +8930,7 @@ class ScopeIterator {
 
       case ScopeIterator::ScopeTypeLocal: {
         PrintF("Local:\n");
-        Handle<Code> code(function_->code());
-        ScopeInfo<> scope_info(*code);
+        ScopeInfo<> scope_info(function_->shared()->scope_info());
         scope_info.Print();
         if (!CurrentContext().is_null()) {
           CurrentContext()->Print();
@@ -9443,7 +9454,7 @@ static Handle<Context> CopyWithContextChain(Handle<Context> context_chain,
 // Runtime_DebugEvaluate.
 static Handle<Object> GetArgumentsObject(JavaScriptFrame* frame,
                                          Handle<JSFunction> function,
-                                         Handle<Code> code,
+                                         Handle<Object> scope_info,
                                          const ScopeInfo<>* sinfo,
                                          Handle<Context> function_context) {
   // Try to find the value of 'arguments' to pass as parameter. If it is not
@@ -9451,14 +9462,14 @@ static Handle<Object> GetArgumentsObject(JavaScriptFrame* frame,
   // does not support eval) then create an 'arguments' object.
   int index;
   if (sinfo->number_of_stack_slots() > 0) {
-    index = ScopeInfo<>::StackSlotIndex(*code, Heap::arguments_symbol());
+    index = ScopeInfo<>::StackSlotIndex(*scope_info, Heap::arguments_symbol());
     if (index != -1) {
       return Handle<Object>(frame->GetExpression(index));
     }
   }
 
   if (sinfo->number_of_context_slots() > Context::MIN_CONTEXT_SLOTS) {
-    index = ScopeInfo<>::ContextSlotIndex(*code, Heap::arguments_symbol(),
+    index = ScopeInfo<>::ContextSlotIndex(*scope_info, Heap::arguments_symbol(),
                                           NULL);
     if (index != -1) {
       return Handle<Object>(function_context->get(index));
@@ -9510,8 +9521,8 @@ static Object* Runtime_DebugEvaluate(Arguments args) {
   JavaScriptFrameIterator it(id);
   JavaScriptFrame* frame = it.frame();
   Handle<JSFunction> function(JSFunction::cast(frame->function()));
-  Handle<Code> code(function->code());
-  ScopeInfo<> sinfo(*code);
+  Handle<Object> scope_info(function->shared()->scope_info());
+  ScopeInfo<> sinfo(*scope_info);
 
   // Traverse the saved contexts chain to find the active context for the
   // selected frame.
@@ -9533,7 +9544,7 @@ static Object* Runtime_DebugEvaluate(Arguments args) {
       Factory::NewFunction(Factory::empty_string(), Factory::undefined_value());
   go_between->set_context(function->context());
 #ifdef DEBUG
-  ScopeInfo<> go_between_sinfo(go_between->shared()->code());
+  ScopeInfo<> go_between_sinfo(go_between->shared()->scope_info());
   ASSERT(go_between_sinfo.number_of_parameters() == 0);
   ASSERT(go_between_sinfo.number_of_context_slots() == 0);
 #endif
@@ -9579,8 +9590,8 @@ static Object* Runtime_DebugEvaluate(Arguments args) {
                       &has_pending_exception);
   if (has_pending_exception) return Failure::Exception();
 
-  Handle<Object> arguments = GetArgumentsObject(frame, function, code, &sinfo,
-                                                function_context);
+  Handle<Object> arguments = GetArgumentsObject(frame, function, scope_info,
+                                                &sinfo, function_context);
 
   // Invoke the evaluation function and return the result.
   const int argc = 2;

deps/v8/src/runtime.h

@@ -115,6 +115,7 @@ namespace internal {
   F(NumberDiv, 2, 1) \
   F(NumberMod, 2, 1) \
   F(NumberUnaryMinus, 1, 1) \
+  F(NumberAlloc, 0, 1) \
   \
   F(StringAdd, 2, 1) \
   F(StringBuilderConcat, 3, 1) \

deps/v8/src/runtime.js

@@ -431,7 +431,7 @@ function APPLY_PREPARE(args) {
   // big enough, but sanity check the value to avoid overflow when
   // multiplying with pointer size.
   if (length > 0x800000) {
-    throw %MakeRangeError('apply_overflow', [length]);
+    throw %MakeRangeError('stack_overflow', []);
   }
 
   if (!IS_FUNCTION(this)) {
@@ -450,7 +450,7 @@ function APPLY_PREPARE(args) {
 
 
 function APPLY_OVERFLOW(length) {
-  throw %MakeRangeError('apply_overflow', [length]);
+  throw %MakeRangeError('stack_overflow', []);
 }
 
 

deps/v8/src/scanner.cc

@@ -341,8 +341,7 @@ Scanner::Scanner(ParserMode pre)
 
 void Scanner::Initialize(Handle<String> source,
                          ParserLanguage language) {
-  safe_string_input_buffer_.Reset(source.location());
-  Init(source, &safe_string_input_buffer_, 0, source->length(), language);
+  Init(source, NULL, 0, source->length(), language);
 }
 
 
@@ -357,9 +356,7 @@ void Scanner::Initialize(Handle<String> source,
                          int start_position,
                          int end_position,
                          ParserLanguage language) {
-  safe_string_input_buffer_.Reset(source.location());
-  Init(source, &safe_string_input_buffer_,
-       start_position, end_position, language);
+  Init(source, NULL, start_position, end_position, language);
 }
 
 
@@ -368,6 +365,10 @@ void Scanner::Init(Handle<String> source,
                    int start_position,
                    int end_position,
                    ParserLanguage language) {
+  // Either initialize the scanner from a character stream or from a
+  // string.
+  ASSERT(source.is_null() || stream == NULL);
+
   // Initialize the source buffer.
   if (!source.is_null() && StringShape(*source).IsExternalTwoByte()) {
     two_byte_string_buffer_.Initialize(
@@ -382,6 +383,10 @@ void Scanner::Init(Handle<String> source,
         end_position);
     source_ = &ascii_string_buffer_;
   } else {
+    if (!source.is_null()) {
+      safe_string_input_buffer_.Reset(source.location());
+      stream = &safe_string_input_buffer_;
+    }
     char_stream_buffer_.Initialize(source,
                                    stream,
                                    start_position,

deps/v8/src/scopeinfo.cc

@@ -148,7 +148,7 @@ ScopeInfo<Allocator>::ScopeInfo(Scope* scope)
 }
 
 
-// Encoding format in the Code object:
+// Encoding format in a FixedArray object:
 //
 // - function name
 //
@@ -244,22 +244,45 @@ static Object** ReadList(Object** p,
 
 
 template<class Allocator>
-ScopeInfo<Allocator>::ScopeInfo(Code* code)
+Handle<Object> ScopeInfo<Allocator>::CreateHeapObject(Scope* scope) {
+  ScopeInfo<ZoneListAllocationPolicy> sinfo(scope);
+  return sinfo.Serialize();
+}
+
+
+template<class Allocator>
+Object* ScopeInfo<Allocator>::EmptyHeapObject() {
+  return Heap::empty_fixed_array();
+}
+
+
+inline bool IsNotEmpty(Object* data) {
+  return FixedArray::cast(data)->length() != 0;
+}
+
+
+inline Object** GetDataStart(Object* data) {
+  return FixedArray::cast(data)->data_start();
+}
+
+
+template<class Allocator>
+ScopeInfo<Allocator>::ScopeInfo(Object* data)
   : function_name_(Factory::empty_symbol()),
     parameters_(4),
     stack_slots_(8),
     context_slots_(8),
     context_modes_(8) {
-  if (code == NULL || code->sinfo_size() == 0) return;
-
-  Object** p0 = &Memory::Object_at(code->sinfo_start());
-  Object** p = p0;
-  p = ReadSymbol(p, &function_name_);
-  p = ReadBool(p, &calls_eval_);
-  p = ReadList<Allocator>(p, &context_slots_, &context_modes_);
-  p = ReadList<Allocator>(p, &parameters_);
-  p = ReadList<Allocator>(p, &stack_slots_);
-  ASSERT((p - p0) * kPointerSize == code->sinfo_size());
+  if (IsNotEmpty(data)) {
+    Object** p0 = GetDataStart(data);
+    Object** p = p0;
+    p = ReadSymbol(p, &function_name_);
+    p = ReadBool(p, &calls_eval_);
+    p = ReadList<Allocator>(p, &context_slots_, &context_modes_);
+    p = ReadList<Allocator>(p, &parameters_);
+    p = ReadList<Allocator>(p, &stack_slots_);
+    ASSERT((p - p0) == FixedArray::cast(data)->length());
+  }
 }
 
 
@@ -313,57 +336,49 @@ static Object** WriteList(Object** p,
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::Serialize(Code* code) {
+Handle<Object> ScopeInfo<Allocator>::Serialize() {
   // function name, calls eval, length & sentinel for 3 tables:
   const int extra_slots = 1 + 1 + 2 * 3;
-  int size = (extra_slots +
-              context_slots_.length() * 2 +
-              parameters_.length() +
-              stack_slots_.length()) * kPointerSize;
-
-  if (code != NULL) {
-    CHECK(code->sinfo_size() == size);
-    Object** p0 = &Memory::Object_at(code->sinfo_start());
-    Object** p = p0;
-    p = WriteSymbol(p, function_name_);
-    p = WriteBool(p, calls_eval_);
-    p = WriteList(p, &context_slots_, &context_modes_);
-    p = WriteList(p, &parameters_);
-    p = WriteList(p, &stack_slots_);
-    ASSERT((p - p0) * kPointerSize == size);
-  }
+  int length = extra_slots +
+               context_slots_.length() * 2 +
+               parameters_.length() +
+               stack_slots_.length();
 
-  return size;
-}
+  Handle<Object> data(Factory::NewFixedArray(length, TENURED));
+  AssertNoAllocation nogc;
 
+  Object** p0 = GetDataStart(*data);
+  Object** p = p0;
+  p = WriteSymbol(p, function_name_);
+  p = WriteBool(p, calls_eval_);
+  p = WriteList(p, &context_slots_, &context_modes_);
+  p = WriteList(p, &parameters_);
+  p = WriteList(p, &stack_slots_);
+  ASSERT((p - p0) == length);
 
-template<class Allocator>
-void ScopeInfo<Allocator>::IterateScopeInfo(Code* code, ObjectVisitor* v) {
-  Object** start = &Memory::Object_at(code->sinfo_start());
-  Object** end = &Memory::Object_at(code->sinfo_start() + code->sinfo_size());
-  v->VisitPointers(start, end);
+  return data;
 }
 
 
-static Object** ContextEntriesAddr(Code* code) {
-  ASSERT(code->sinfo_size() > 0);
+static Object** ContextEntriesAddr(Object* data) {
+  ASSERT(IsNotEmpty(data));
   // +2 for function name and calls eval:
-  return &Memory::Object_at(code->sinfo_start()) + 2;
+  return GetDataStart(data) + 2;
 }
 
 
-static Object** ParameterEntriesAddr(Code* code) {
-  ASSERT(code->sinfo_size() > 0);
-  Object** p = ContextEntriesAddr(code);
+static Object** ParameterEntriesAddr(Object* data) {
+  ASSERT(IsNotEmpty(data));
+  Object** p = ContextEntriesAddr(data);
   int n;  // number of context slots;
   p = ReadInt(p, &n);
   return p + n*2 + 1;  // *2 for pairs, +1 for sentinel
 }
 
 
-static Object** StackSlotEntriesAddr(Code* code) {
-  ASSERT(code->sinfo_size() > 0);
-  Object** p = ParameterEntriesAddr(code);
+static Object** StackSlotEntriesAddr(Object* data) {
+  ASSERT(IsNotEmpty(data));
+  Object** p = ParameterEntriesAddr(data);
   int n;  // number of parameter slots;
   p = ReadInt(p, &n);
   return p + n + 1;  // +1 for sentinel
@@ -371,10 +386,10 @@ static Object** StackSlotEntriesAddr(Code* code) {
 
 
 template<class Allocator>
-bool ScopeInfo<Allocator>::CallsEval(Code* code) {
-  if (code->sinfo_size() > 0) {
+bool ScopeInfo<Allocator>::CallsEval(Object* data) {
+  if (IsNotEmpty(data)) {
     // +1 for function name:
-    Object** p = &Memory::Object_at(code->sinfo_start()) + 1;
+    Object** p = GetDataStart(data) + 1;
     bool calls_eval;
     p = ReadBool(p, &calls_eval);
     return calls_eval;
@@ -384,9 +399,9 @@ bool ScopeInfo<Allocator>::CallsEval(Code* code) {
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::NumberOfStackSlots(Code* code) {
-  if (code->sinfo_size() > 0) {
-    Object** p = StackSlotEntriesAddr(code);
+int ScopeInfo<Allocator>::NumberOfStackSlots(Object* data) {
+  if (IsNotEmpty(data)) {
+    Object** p = StackSlotEntriesAddr(data);
     int n;  // number of stack slots;
     ReadInt(p, &n);
     return n;
@@ -396,9 +411,9 @@ int ScopeInfo<Allocator>::NumberOfStackSlots(Code* code) {
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::NumberOfContextSlots(Code* code) {
-  if (code->sinfo_size() > 0) {
-    Object** p = ContextEntriesAddr(code);
+int ScopeInfo<Allocator>::NumberOfContextSlots(Object* data) {
+  if (IsNotEmpty(data)) {
+    Object** p = ContextEntriesAddr(data);
     int n;  // number of context slots;
     ReadInt(p, &n);
     return n + Context::MIN_CONTEXT_SLOTS;
@@ -408,9 +423,9 @@ int ScopeInfo<Allocator>::NumberOfContextSlots(Code* code) {
 
 
 template<class Allocator>
-bool ScopeInfo<Allocator>::HasHeapAllocatedLocals(Code* code) {
-  if (code->sinfo_size() > 0) {
-    Object** p = ContextEntriesAddr(code);
+bool ScopeInfo<Allocator>::HasHeapAllocatedLocals(Object* data) {
+  if (IsNotEmpty(data)) {
+    Object** p = ContextEntriesAddr(data);
     int n;  // number of context slots;
     ReadInt(p, &n);
     return n > 0;
@@ -420,14 +435,14 @@ bool ScopeInfo<Allocator>::HasHeapAllocatedLocals(Code* code) {
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::StackSlotIndex(Code* code, String* name) {
+int ScopeInfo<Allocator>::StackSlotIndex(Object* data, String* name) {
   ASSERT(name->IsSymbol());
-  if (code->sinfo_size() > 0) {
+  if (IsNotEmpty(data)) {
     // Loop below depends on the NULL sentinel after the stack slot names.
-    ASSERT(NumberOfStackSlots(code) > 0 ||
-           *(StackSlotEntriesAddr(code) + 1) == NULL);
+    ASSERT(NumberOfStackSlots(data) > 0 ||
+           *(StackSlotEntriesAddr(data) + 1) == NULL);
     // slots start after length entry
-    Object** p0 = StackSlotEntriesAddr(code) + 1;
+    Object** p0 = StackSlotEntriesAddr(data) + 1;
     Object** p = p0;
     while (*p != NULL) {
       if (*p == name) return static_cast<int>(p - p0);
@@ -439,19 +454,19 @@ int ScopeInfo<Allocator>::StackSlotIndex(Code* code, String* name) {
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::ContextSlotIndex(Code* code,
+int ScopeInfo<Allocator>::ContextSlotIndex(Object* data,
                                            String* name,
                                            Variable::Mode* mode) {
   ASSERT(name->IsSymbol());
-  int result = ContextSlotCache::Lookup(code, name, mode);
+  int result = ContextSlotCache::Lookup(data, name, mode);
   if (result != ContextSlotCache::kNotFound) return result;
-  if (code->sinfo_size() > 0) {
+  if (IsNotEmpty(data)) {
     // Loop below depends on the NULL sentinel after the context slot names.
-    ASSERT(NumberOfContextSlots(code) >= Context::MIN_CONTEXT_SLOTS ||
-           *(ContextEntriesAddr(code) + 1) == NULL);
+    ASSERT(NumberOfContextSlots(data) >= Context::MIN_CONTEXT_SLOTS ||
+           *(ContextEntriesAddr(data) + 1) == NULL);
 
     // slots start after length entry
-    Object** p0 = ContextEntriesAddr(code) + 1;
+    Object** p0 = ContextEntriesAddr(data) + 1;
     Object** p = p0;
     // contexts may have no variable slots (in the presence of eval()).
     while (*p != NULL) {
@@ -462,21 +477,21 @@ int ScopeInfo<Allocator>::ContextSlotIndex(Code* code,
         Variable::Mode mode_value = static_cast<Variable::Mode>(v);
         if (mode != NULL) *mode = mode_value;
         result = static_cast<int>((p - p0) >> 1) + Context::MIN_CONTEXT_SLOTS;
-        ContextSlotCache::Update(code, name, mode_value, result);
+        ContextSlotCache::Update(data, name, mode_value, result);
         return result;
       }
       p += 2;
     }
   }
-  ContextSlotCache::Update(code, name, Variable::INTERNAL, -1);
+  ContextSlotCache::Update(data, name, Variable::INTERNAL, -1);
   return -1;
 }
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::ParameterIndex(Code* code, String* name) {
+int ScopeInfo<Allocator>::ParameterIndex(Object* data, String* name) {
   ASSERT(name->IsSymbol());
-  if (code->sinfo_size() > 0) {
+  if (IsNotEmpty(data)) {
     // We must read parameters from the end since for
     // multiply declared parameters the value of the
     // last declaration of that parameter is used
@@ -487,7 +502,7 @@ int ScopeInfo<Allocator>::ParameterIndex(Code* code, String* name) {
     // once, with corresponding index. This requires a new
     // implementation of the ScopeInfo code. See also other
     // comments in this file regarding this.
-    Object** p = ParameterEntriesAddr(code);
+    Object** p = ParameterEntriesAddr(data);
     int n;  // number of parameters
     Object** p0 = ReadInt(p, &n);
     p = p0 + n;
@@ -501,12 +516,12 @@ int ScopeInfo<Allocator>::ParameterIndex(Code* code, String* name) {
 
 
 template<class Allocator>
-int ScopeInfo<Allocator>::FunctionContextSlotIndex(Code* code, String* name) {
+int ScopeInfo<Allocator>::FunctionContextSlotIndex(Object* data, String* name) {
   ASSERT(name->IsSymbol());
-  if (code->sinfo_size() > 0) {
-    Object** p = &Memory::Object_at(code->sinfo_start());
+  if (IsNotEmpty(data)) {
+    Object** p = GetDataStart(data);
     if (*p == name) {
-      p = ContextEntriesAddr(code);
+      p = ContextEntriesAddr(data);
       int n;  // number of context slots
       ReadInt(p, &n);
       ASSERT(n != 0);
@@ -544,20 +559,20 @@ int ScopeInfo<Allocator>::NumberOfLocals() const {
 }
 
 
-int ContextSlotCache::Hash(Code* code, String* name) {
+int ContextSlotCache::Hash(Object* data, String* name) {
   // Uses only lower 32 bits if pointers are larger.
   uintptr_t addr_hash =
-      static_cast<uint32_t>(reinterpret_cast<uintptr_t>(code)) >> 2;
+      static_cast<uint32_t>(reinterpret_cast<uintptr_t>(data)) >> 2;
   return static_cast<int>((addr_hash ^ name->Hash()) % kLength);
 }
 
 
-int ContextSlotCache::Lookup(Code* code,
+int ContextSlotCache::Lookup(Object* data,
                              String* name,
                              Variable::Mode* mode) {
-  int index = Hash(code, name);
+  int index = Hash(data, name);
   Key& key = keys_[index];
-  if ((key.code == code) && key.name->Equals(name)) {
+  if ((key.data == data) && key.name->Equals(name)) {
     Value result(values_[index]);
     if (mode != NULL) *mode = result.mode();
     return result.index() + kNotFound;
@@ -566,28 +581,28 @@ int ContextSlotCache::Lookup(Code* code,
 }
 
 
-void ContextSlotCache::Update(Code* code,
+void ContextSlotCache::Update(Object* data,
                               String* name,
                               Variable::Mode mode,
                               int slot_index) {
   String* symbol;
   ASSERT(slot_index > kNotFound);
   if (Heap::LookupSymbolIfExists(name, &symbol)) {
-    int index = Hash(code, symbol);
+    int index = Hash(data, symbol);
     Key& key = keys_[index];
-    key.code = code;
+    key.data = data;
     key.name = symbol;
     // Please note value only takes a uint as index.
     values_[index] = Value(mode, slot_index - kNotFound).raw();
 #ifdef DEBUG
-    ValidateEntry(code, name, mode, slot_index);
+    ValidateEntry(data, name, mode, slot_index);
 #endif
   }
 }
 
 
 void ContextSlotCache::Clear() {
-  for (int index = 0; index < kLength; index++) keys_[index].code = NULL;
+  for (int index = 0; index < kLength; index++) keys_[index].data = NULL;
 }
 
 
@@ -599,15 +614,15 @@ uint32_t ContextSlotCache::values_[ContextSlotCache::kLength];
 
 #ifdef DEBUG
 
-void ContextSlotCache::ValidateEntry(Code* code,
+void ContextSlotCache::ValidateEntry(Object* data,
                                      String* name,
                                      Variable::Mode mode,
                                      int slot_index) {
   String* symbol;
   if (Heap::LookupSymbolIfExists(name, &symbol)) {
-    int index = Hash(code, name);
+    int index = Hash(data, name);
     Key& key = keys_[index];
-    ASSERT(key.code == code);
+    ASSERT(key.data == data);
     ASSERT(key.name->Equals(name));
     Value result(values_[index]);
     ASSERT(result.mode() == mode);

deps/v8/src/scopeinfo.h

@@ -37,7 +37,7 @@ namespace internal {
 // Scope information represents information about a functions's
 // scopes (currently only one, because we don't do any inlining)
 // and the allocation of the scope's variables. Scope information
-// is stored in a compressed form with Code objects and is used
+// is stored in a compressed form in FixedArray objects and is used
 // at runtime (stack dumps, deoptimization, etc.).
 //
 // Historical note: In other VMs built by this team, ScopeInfo was
@@ -54,23 +54,16 @@ class ScopeInfo BASE_EMBEDDED {
   // Create a ScopeInfo instance from a scope.
   explicit ScopeInfo(Scope* scope);
 
-  // Create a ScopeInfo instance from a Code object.
-  explicit ScopeInfo(Code* code);
+  // Create a ScopeInfo instance from an Object holding the serialized data.
+  explicit ScopeInfo(Object* data);
 
-  // Write the ScopeInfo data into a Code object, and returns the
-  // amount of space that was needed. If no Code object is provided
-  // (NULL handle), Serialize() only returns the amount of space needed.
-  //
-  // This operations requires that the Code object has the correct amount
-  // of space for the ScopeInfo data; otherwise the operation fails (fatal
-  // error). Any existing scope info in the Code object is simply overwritten.
-  int Serialize(Code* code);
+  // Creates a heap object holding the serialized scope info.
+  Handle<Object> Serialize();
 
-  // Garbage collection support for scope info embedded in Code objects.
-  // This code is in ScopeInfo because only here we should have to know
-  // about the encoding.
-  static void IterateScopeInfo(Code* code, ObjectVisitor* v);
+  static Handle<Object> CreateHeapObject(Scope* scope);
 
+  // Serializes empty scope info.
+  static Object* EmptyHeapObject();
 
   // --------------------------------------------------------------------------
   // Lookup
@@ -100,44 +93,44 @@ class ScopeInfo BASE_EMBEDDED {
   // object.
   //
   // ScopeInfo is the only class which should have to know about the
-  // encoding of it's information in a Code object, which is why these
+  // encoding of it's information in a FixedArray object, which is why these
   // functions are in this class.
 
   // Does this scope call eval.
-  static bool CallsEval(Code* code);
+  static bool CallsEval(Object* data);
 
   // Return the number of stack slots for code.
-  static int NumberOfStackSlots(Code* code);
+  static int NumberOfStackSlots(Object* data);
 
   // Return the number of context slots for code.
-  static int NumberOfContextSlots(Code* code);
+  static int NumberOfContextSlots(Object* data);
 
   // Return if this has context slots besides MIN_CONTEXT_SLOTS;
-  static bool HasHeapAllocatedLocals(Code* code);
+  static bool HasHeapAllocatedLocals(Object* data);
 
-  // Lookup support for scope info embedded in Code objects. Returns
+  // Lookup support for serialized scope info. Returns the
   // the stack slot index for a given slot name if the slot is
   // present; otherwise returns a value < 0. The name must be a symbol
   // (canonicalized).
-  static int StackSlotIndex(Code* code, String* name);
+  static int StackSlotIndex(Object* data, String* name);
 
-  // Lookup support for scope info embedded in Code objects. Returns the
+  // Lookup support for serialized scope info. Returns the
   // context slot index for a given slot name if the slot is present; otherwise
   // returns a value < 0. The name must be a symbol (canonicalized).
   // If the slot is present and mode != NULL, sets *mode to the corresponding
   // mode for that variable.
-  static int ContextSlotIndex(Code* code, String* name, Variable::Mode* mode);
+  static int ContextSlotIndex(Object* data, String* name, Variable::Mode* mode);
 
-  // Lookup support for scope info embedded in Code objects. Returns the
+  // Lookup support for serialized scope info. Returns the
   // parameter index for a given parameter name if the parameter is present;
   // otherwise returns a value < 0. The name must be a symbol (canonicalized).
-  static int ParameterIndex(Code* code, String* name);
+  static int ParameterIndex(Object* data, String* name);
 
-  // Lookup support for scope info embedded in Code objects. Returns the
+  // Lookup support for serialized scope info. Returns the
   // function context slot index if the function name is present (named
   // function expressions, only), otherwise returns a value < 0. The name
   // must be a symbol (canonicalized).
-  static int FunctionContextSlotIndex(Code* code, String* name);
+  static int FunctionContextSlotIndex(Object* data, String* name);
 
   // --------------------------------------------------------------------------
   // Debugging support
@@ -155,32 +148,21 @@ class ScopeInfo BASE_EMBEDDED {
   List<Variable::Mode, Allocator > context_modes_;
 };
 
-class ZoneScopeInfo: public ScopeInfo<ZoneListAllocationPolicy> {
- public:
-  // Create a ZoneScopeInfo instance from a scope.
-  explicit ZoneScopeInfo(Scope* scope)
-      : ScopeInfo<ZoneListAllocationPolicy>(scope) {}
-
-  // Create a ZoneScopeInfo instance from a Code object.
-  explicit ZoneScopeInfo(Code* code)
-      :  ScopeInfo<ZoneListAllocationPolicy>(code) {}
-};
-
 
-// Cache for mapping (code, property name) into context slot index.
+// Cache for mapping (data, property name) into context slot index.
 // The cache contains both positive and negative results.
 // Slot index equals -1 means the property is absent.
 // Cleared at startup and prior to mark sweep collection.
 class ContextSlotCache {
  public:
-  // Lookup context slot index for (code, name).
+  // Lookup context slot index for (data, name).
   // If absent, kNotFound is returned.
-  static int Lookup(Code* code,
+  static int Lookup(Object* data,
                     String* name,
                     Variable::Mode* mode);
 
   // Update an element in the cache.
-  static void Update(Code* code,
+  static void Update(Object* data,
                      String* name,
                      Variable::Mode mode,
                      int slot_index);
@@ -190,10 +172,10 @@ class ContextSlotCache {
 
   static const int kNotFound = -2;
  private:
-  inline static int Hash(Code* code, String* name);
+  inline static int Hash(Object* data, String* name);
 
 #ifdef DEBUG
-  static void ValidateEntry(Code* code,
+  static void ValidateEntry(Object* data,
                             String* name,
                             Variable::Mode mode,
                             int slot_index);
@@ -201,7 +183,7 @@ class ContextSlotCache {
 
   static const int kLength = 256;
   struct Key {
-    Code* code;
+    Object* data;
     String* name;
   };
 

deps/v8/src/serialize.cc

@@ -673,6 +673,14 @@ void Deserializer::ReadObject(int space_number,
     LOG(SnapshotPositionEvent(address, source_->position()));
   }
   ReadChunk(current, limit, space_number, address);
+
+  if (space == Heap::map_space()) {
+    ASSERT(size == Map::kSize);
+    HeapObject* obj = HeapObject::FromAddress(address);
+    Map* map = reinterpret_cast<Map*>(obj);
+    map->set_scavenger(Heap::GetScavenger(map->instance_type(),
+                                          map->instance_size()));
+  }
 }
 
 

deps/v8/src/stub-cache.cc

@@ -1186,7 +1186,7 @@ Object* StubCompiler::GetCodeWithFlags(Code::Flags flags, const char* name) {
   // Create code object in the heap.
   CodeDesc desc;
   masm_.GetCode(&desc);
-  Object* result = Heap::CreateCode(desc, NULL, flags, masm_.CodeObject());
+  Object* result = Heap::CreateCode(desc, flags, masm_.CodeObject());
 #ifdef ENABLE_DISASSEMBLER
   if (FLAG_print_code_stubs && !result->IsFailure()) {
     Code::cast(result)->Disassemble(name);

deps/v8/src/stub-cache.h

@@ -429,23 +429,23 @@ class StubCompiler BASE_EMBEDDED {
                            Register object_reg,
                            JSObject* holder,
                            Register holder_reg,
-                           Register scratch,
+                           Register scratch1,
+                           Register scratch2,
                            String* name,
-                           Label* miss,
-                           Register extra = no_reg) {
-    return CheckPrototypes(object, object_reg, holder, holder_reg, scratch,
-                           name, kInvalidProtoDepth, miss, extra);
+                           Label* miss) {
+    return CheckPrototypes(object, object_reg, holder, holder_reg, scratch1,
+                           scratch2, name, kInvalidProtoDepth, miss);
   }
 
   Register CheckPrototypes(JSObject* object,
                            Register object_reg,
                            JSObject* holder,
                            Register holder_reg,
-                           Register scratch,
+                           Register scratch1,
+                           Register scratch2,
                            String* name,
                            int save_at_depth,
-                           Label* miss,
-                           Register extra = no_reg);
+                           Label* miss);
 
  protected:
   Object* GetCodeWithFlags(Code::Flags flags, const char* name);
@@ -459,6 +459,7 @@ class StubCompiler BASE_EMBEDDED {
                          Register receiver,
                          Register scratch1,
                          Register scratch2,
+                         Register scratch3,
                          int index,
                          String* name,
                          Label* miss);
@@ -469,6 +470,7 @@ class StubCompiler BASE_EMBEDDED {
                             Register name_reg,
                             Register scratch1,
                             Register scratch2,
+                            Register scratch3,
                             AccessorInfo* callback,
                             String* name,
                             Label* miss,
@@ -479,6 +481,7 @@ class StubCompiler BASE_EMBEDDED {
                             Register receiver,
                             Register scratch1,
                             Register scratch2,
+                            Register scratch3,
                             Object* value,
                             String* name,
                             Label* miss);
@@ -490,6 +493,7 @@ class StubCompiler BASE_EMBEDDED {
                                Register name_reg,
                                Register scratch1,
                                Register scratch2,
+                               Register scratch3,
                                String* name,
                                Label* miss);
 

deps/v8/src/top.cc

@@ -44,6 +44,11 @@ Mutex* Top::break_access_ = OS::CreateMutex();
 
 NoAllocationStringAllocator* preallocated_message_space = NULL;
 
+bool capture_stack_trace_for_uncaught_exceptions = false;
+int stack_trace_for_uncaught_exceptions_frame_limit = 0;
+StackTrace::StackTraceOptions stack_trace_for_uncaught_exceptions_options =
+    StackTrace::kOverview;
+
 Address top_addresses[] = {
 #define C(name) reinterpret_cast<Address>(Top::name()),
     TOP_ADDRESS_LIST(C)
@@ -365,9 +370,8 @@ Handle<String> Top::StackTraceString() {
 }
 
 
-Local<StackTrace> Top::CaptureCurrentStackTrace(
+Handle<JSArray> Top::CaptureCurrentStackTrace(
     int frame_limit, StackTrace::StackTraceOptions options) {
-  v8::HandleScope scope;
   // Ensure no negative values.
   int limit = Max(frame_limit, 0);
   Handle<JSArray> stack_trace = Factory::NewJSArray(frame_limit);
@@ -443,7 +447,7 @@ Local<StackTrace> Top::CaptureCurrentStackTrace(
   }
 
   stack_trace->set_length(Smi::FromInt(frames_seen));
-  return scope.Close(Utils::StackTraceToLocal(stack_trace));
+  return stack_trace;
 }
 
 
@@ -681,10 +685,7 @@ Failure* Top::StackOverflow() {
   // TODO(1240995): To avoid having to call JavaScript code to compute
   // the message for stack overflow exceptions which is very likely to
   // double fault with another stack overflow exception, we use a
-  // precomputed message. This is somewhat problematic in that it
-  // doesn't use ReportUncaughtException to determine the location
-  // from where the exception occurred. It should probably be
-  // reworked.
+  // precomputed message.
   DoThrow(*exception, NULL, kStackOverflowMessage);
   return Failure::Exception();
 }
@@ -778,25 +779,6 @@ void Top::ComputeLocation(MessageLocation* target) {
 }
 
 
-void Top::ReportUncaughtException(Handle<Object> exception,
-                                  MessageLocation* location,
-                                  Handle<String> stack_trace) {
-  Handle<Object> message;
-  if (!Bootstrapper::IsActive()) {
-    // It's not safe to try to make message objects while the bootstrapper
-    // is active since the infrastructure may not have been properly
-    // initialized.
-    message =
-      MessageHandler::MakeMessageObject("uncaught_exception",
-                                        location,
-                                        HandleVector<Object>(&exception, 1),
-                                        stack_trace);
-  }
-  // Report the uncaught exception.
-  MessageHandler::ReportMessage(location, message);
-}
-
-
 bool Top::ShouldReturnException(bool* is_caught_externally,
                                 bool catchable_by_javascript) {
   // Find the top-most try-catch handler.
@@ -869,8 +851,15 @@ void Top::DoThrow(Object* exception,
       // may not have been properly initialized.
       Handle<String> stack_trace;
       if (FLAG_trace_exception) stack_trace = StackTraceString();
+      Handle<JSArray> stack_trace_object;
+      if (report_exception && capture_stack_trace_for_uncaught_exceptions) {
+          stack_trace_object = Top::CaptureCurrentStackTrace(
+              stack_trace_for_uncaught_exceptions_frame_limit,
+              stack_trace_for_uncaught_exceptions_options);
+      }
       message_obj = MessageHandler::MakeMessageObject("uncaught_exception",
-          location, HandleVector<Object>(&exception_handle, 1), stack_trace);
+          location, HandleVector<Object>(&exception_handle, 1), stack_trace,
+          stack_trace_object);
     }
   }
 
@@ -997,6 +986,16 @@ bool Top::OptionalRescheduleException(bool is_bottom_call) {
 }
 
 
+void Top::SetCaptureStackTraceForUncaughtExceptions(
+      bool capture,
+      int frame_limit,
+      StackTrace::StackTraceOptions options) {
+  capture_stack_trace_for_uncaught_exceptions = capture;
+  stack_trace_for_uncaught_exceptions_frame_limit = frame_limit;
+  stack_trace_for_uncaught_exceptions_options = options;
+}
+
+
 bool Top::is_out_of_memory() {
   if (has_pending_exception()) {
     Object* e = pending_exception();

deps/v8/src/top.h

@@ -227,6 +227,11 @@ class Top {
         (try_catch_handler() == thread_local_.catcher_);
   }
 
+  static void SetCaptureStackTraceForUncaughtExceptions(
+      bool capture,
+      int frame_limit,
+      StackTrace::StackTraceOptions options);
+
   // Tells whether the current context has experienced an out of memory
   // exception.
   static bool is_out_of_memory();
@@ -266,7 +271,7 @@ class Top {
   static void PrintStack(StringStream* accumulator);
   static void PrintStack();
   static Handle<String> StackTraceString();
-  static Local<StackTrace> CaptureCurrentStackTrace(
+  static Handle<JSArray> CaptureCurrentStackTrace(
       int frame_limit,
       StackTrace::StackTraceOptions options);
 
@@ -302,9 +307,6 @@ class Top {
                       const char* message);
   static bool ShouldReturnException(bool* is_caught_externally,
                                     bool catchable_by_javascript);
-  static void ReportUncaughtException(Handle<Object> exception,
-                                      MessageLocation* location,
-                                      Handle<String> stack_trace);
 
   // Attempts to compute the current source location, storing the
   // result in the target out parameter.

deps/v8/src/v8natives.js

@@ -723,7 +723,7 @@ function ObjectDefineProperty(obj, p, attributes) {
 
 // ES5 section 15.2.3.7.
 function ObjectDefineProperties(obj, properties) {
- if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
+  if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
      !IS_UNDETECTABLE(obj))
     throw MakeTypeError("obj_ctor_property_non_object", ["defineProperties"]);
   var props = ToObject(properties);
@@ -745,6 +745,24 @@ function ObjectDefineProperties(obj, properties) {
 }
 
 
+// ES5 section 15.2.3.9.
+function ObjectFreeze(obj) {
+  if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
+      !IS_UNDETECTABLE(obj)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["freeze"]);
+  }
+  var names = ObjectGetOwnPropertyNames(obj);
+  for (var key in names) {
+    var name = names[key];
+    var desc = GetOwnProperty(obj, name);
+    if (IsDataDescriptor(desc)) desc.setWritable(false);
+    if (desc.isConfigurable()) desc.setConfigurable(false);
+    DefineOwnProperty(obj, name, desc, true);
+  }  
+  ObjectPreventExtension(obj);
+}
+
+
 // ES5 section 15.2.3.10
 function ObjectPreventExtension(obj) {
   if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
@@ -756,6 +774,26 @@ function ObjectPreventExtension(obj) {
 }
 
 
+// ES5 section 15.2.3.12
+function ObjectIsFrozen(obj) {
+  if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
+      !IS_UNDETECTABLE(obj)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["isFrozen"]);
+  }
+  var names = ObjectGetOwnPropertyNames(obj);
+  for (var key in names) {
+    var name = names[key];
+    var desc = GetOwnProperty(obj, name);
+    if (IsDataDescriptor(desc) && desc.writable) return false;
+    if (desc.configurable) return false;
+  }
+  if (!ObjectIsExtensible(obj)) {
+    return true;
+  }
+  return false;
+}
+
+
 // ES5 section 15.2.3.13
 function ObjectIsExtensible(obj) {
   if ((!IS_SPEC_OBJECT_OR_NULL(obj) || IS_NULL_OR_UNDEFINED(obj)) &&
@@ -799,10 +837,12 @@ function SetupObject() {
     "create", ObjectCreate,
     "defineProperty", ObjectDefineProperty,
     "defineProperties", ObjectDefineProperties,
+    "freeze", ObjectFreeze,
     "getPrototypeOf", ObjectGetPrototypeOf,
     "getOwnPropertyDescriptor", ObjectGetOwnPropertyDescriptor,
     "getOwnPropertyNames", ObjectGetOwnPropertyNames,
     "isExtensible", ObjectIsExtensible,
+    "isFrozen", ObjectIsFrozen,
     "preventExtensions", ObjectPreventExtension
   ));
 }

deps/v8/src/version.cc

@@ -34,7 +34,7 @@
 // cannot be changed without changing the SCons build script.
 #define MAJOR_VERSION     2
 #define MINOR_VERSION     2
-#define BUILD_NUMBER      23
+#define BUILD_NUMBER      24
 #define PATCH_LEVEL       0
 #define CANDIDATE_VERSION false
 

deps/v8/src/vm-state-inl.h

@@ -74,8 +74,10 @@ VMState::VMState(StateTag state)
   if (state == EXTERNAL) state = OTHER;
 #endif
   state_ = state;
-  previous_ = current_state_;  // Save the previous state.
-  current_state_ = this;       // Install the new state.
+  // Save the previous state.
+  previous_ = reinterpret_cast<VMState*>(current_state_);
+  // Install the new state.
+  OS::ReleaseStore(&current_state_, reinterpret_cast<AtomicWord>(this));
 
 #ifdef ENABLE_LOGGING_AND_PROFILING
   if (FLAG_log_state_changes) {
@@ -103,7 +105,8 @@ VMState::VMState(StateTag state)
 
 VMState::~VMState() {
   if (disabled_) return;
-  current_state_ = previous_;  // Return to the previous state.
+  // Return to the previous state.
+  OS::ReleaseStore(&current_state_, reinterpret_cast<AtomicWord>(previous_));
 
 #ifdef ENABLE_LOGGING_AND_PROFILING
   if (FLAG_log_state_changes) {

deps/v8/src/vm-state.cc

@@ -33,7 +33,7 @@ namespace v8 {
 namespace internal {
 
 #ifdef ENABLE_VMSTATE_TRACKING
-VMState* VMState::current_state_ = NULL;
+AtomicWord VMState::current_state_ = 0;
 #endif
 
 } }  // namespace v8::internal

deps/v8/src/vm-state.h

@@ -44,15 +44,17 @@ class VMState BASE_EMBEDDED {
 
   // Used for debug asserts.
   static bool is_outermost_external() {
-    return current_state_ == NULL;
+    return current_state_ == 0;
   }
 
   static StateTag current_state() {
-    return current_state_ ? current_state_->state() : EXTERNAL;
+    VMState* state = reinterpret_cast<VMState*>(current_state_);
+    return state ? state->state() : EXTERNAL;
   }
 
   static Address external_callback() {
-    return current_state_ ? current_state_->external_callback_ : NULL;
+    VMState* state = reinterpret_cast<VMState*>(current_state_);
+    return state ? state->external_callback_ : NULL;
   }
 
  private:
@@ -62,7 +64,7 @@ class VMState BASE_EMBEDDED {
   Address external_callback_;
 
   // A stack of VM states.
-  static VMState* current_state_;
+  static AtomicWord current_state_;
 #else
  public:
   explicit VMState(StateTag state) {}

deps/v8/src/x64/assembler-x64.cc

@@ -119,7 +119,6 @@ void CpuFeatures::Probe()  {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>());
   if (!code->IsCode()) return;

deps/v8/src/x64/full-codegen-x64.cc

@@ -2243,11 +2243,8 @@ void FullCodeGenerator::EmitRandomHeapNumber(ZoneList<Expression*>* args) {
   __ jmp(&heapnumber_allocated);
 
   __ bind(&slow_allocate_heapnumber);
-  // To allocate a heap number, and ensure that it is not a smi, we
-  // call the runtime function FUnaryMinus on 0, returning the double
-  // -0.0.  A new, distinct heap number is returned each time.
-  __ Push(Smi::FromInt(0));
-  __ CallRuntime(Runtime::kNumberUnaryMinus, 1);
+  // Allocate a heap number.
+  __ CallRuntime(Runtime::kNumberAlloc, 0);
   __ movq(rbx, rax);
 
   __ bind(&heapnumber_allocated);

deps/v8/src/x64/macro-assembler-x64.cc

@@ -2322,101 +2322,6 @@ void MacroAssembler::LeaveExitFrame(ExitFrame::Mode mode, int result_size) {
 }
 
 
-Register MacroAssembler::CheckMaps(JSObject* object,
-                                   Register object_reg,
-                                   JSObject* holder,
-                                   Register holder_reg,
-                                   Register scratch,
-                                   int save_at_depth,
-                                   Label* miss) {
-  // Make sure there's no overlap between scratch and the other
-  // registers.
-  ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg));
-
-  // Keep track of the current object in register reg.  On the first
-  // iteration, reg is an alias for object_reg, on later iterations,
-  // it is an alias for holder_reg.
-  Register reg = object_reg;
-  int depth = 0;
-
-  if (save_at_depth == depth) {
-    movq(Operand(rsp, kPointerSize), object_reg);
-  }
-
-  // Check the maps in the prototype chain.
-  // Traverse the prototype chain from the object and do map checks.
-  while (object != holder) {
-    depth++;
-
-    // Only global objects and objects that do not require access
-    // checks are allowed in stubs.
-    ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-
-    JSObject* prototype = JSObject::cast(object->GetPrototype());
-    if (Heap::InNewSpace(prototype)) {
-      // Get the map of the current object.
-      movq(scratch, FieldOperand(reg, HeapObject::kMapOffset));
-      Cmp(scratch, Handle<Map>(object->map()));
-      // Branch on the result of the map check.
-      j(not_equal, miss);
-      // Check access rights to the global object.  This has to happen
-      // after the map check so that we know that the object is
-      // actually a global object.
-      if (object->IsJSGlobalProxy()) {
-        CheckAccessGlobalProxy(reg, scratch, miss);
-
-        // Restore scratch register to be the map of the object.
-        // We load the prototype from the map in the scratch register.
-        movq(scratch, FieldOperand(reg, HeapObject::kMapOffset));
-      }
-      // The prototype is in new space; we cannot store a reference
-      // to it in the code. Load it from the map.
-      reg = holder_reg;  // from now the object is in holder_reg
-      movq(reg, FieldOperand(scratch, Map::kPrototypeOffset));
-
-    } else {
-      // Check the map of the current object.
-      Cmp(FieldOperand(reg, HeapObject::kMapOffset),
-          Handle<Map>(object->map()));
-      // Branch on the result of the map check.
-      j(not_equal, miss);
-      // Check access rights to the global object.  This has to happen
-      // after the map check so that we know that the object is
-      // actually a global object.
-      if (object->IsJSGlobalProxy()) {
-        CheckAccessGlobalProxy(reg, scratch, miss);
-      }
-      // The prototype is in old space; load it directly.
-      reg = holder_reg;  // from now the object is in holder_reg
-      Move(reg, Handle<JSObject>(prototype));
-    }
-
-    if (save_at_depth == depth) {
-      movq(Operand(rsp, kPointerSize), reg);
-    }
-
-    // Go to the next object in the prototype chain.
-    object = prototype;
-  }
-
-  // Check the holder map.
-  Cmp(FieldOperand(reg, HeapObject::kMapOffset), Handle<Map>(holder->map()));
-  j(not_equal, miss);
-
-  // Log the check depth.
-  LOG(IntEvent("check-maps-depth", depth + 1));
-
-  // Perform security check for access to the global object and return
-  // the holder register.
-  ASSERT(object == holder);
-  ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-  if (object->IsJSGlobalProxy()) {
-    CheckAccessGlobalProxy(reg, scratch, miss);
-  }
-  return reg;
-}
-
-
 void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg,
                                             Register scratch,
                                             Label* miss) {

deps/v8/src/x64/macro-assembler-x64.h

@@ -596,24 +596,6 @@ class MacroAssembler: public Assembler {
   // ---------------------------------------------------------------------------
   // Inline caching support
 
-  // Generates code that verifies that the maps of objects in the
-  // prototype chain of object hasn't changed since the code was
-  // generated and branches to the miss label if any map has. If
-  // necessary the function also generates code for security check
-  // in case of global object holders. The scratch and holder
-  // registers are always clobbered, but the object register is only
-  // clobbered if it the same as the holder register. The function
-  // returns a register containing the holder - either object_reg or
-  // holder_reg.
-  // The function can optionally (when save_at_depth !=
-  // kInvalidProtoDepth) save the object at the given depth by moving
-  // it to [rsp + kPointerSize].
-  Register CheckMaps(JSObject* object, Register object_reg,
-                     JSObject* holder, Register holder_reg,
-                     Register scratch,
-                     int save_at_depth,
-                     Label* miss);
-
   // Generate code for checking access rights - used for security checks
   // on access to global objects across environments. The holder register
   // is left untouched, but the scratch register and kScratchRegister,

deps/v8/src/x64/regexp-macro-assembler-x64.cc

@@ -960,7 +960,6 @@ Handle<Object> RegExpMacroAssemblerX64::GetCode(Handle<String> source) {
   CodeDesc code_desc;
   masm_->GetCode(&code_desc);
   Handle<Code> code = Factory::NewCode(code_desc,
-                                       NULL,
                                        Code::ComputeFlags(Code::REGEXP),
                                        masm_->CodeObject());
   PROFILE(RegExpCodeCreateEvent(*code, *source));

deps/v8/src/x64/stub-cache-x64.cc

@@ -81,6 +81,100 @@ static void ProbeTable(MacroAssembler* masm,
 }
 
 
+// Helper function used to check that the dictionary doesn't contain
+// the property. This function may return false negatives, so miss_label
+// must always call a backup property check that is complete.
+// This function is safe to call if the receiver has fast properties.
+// Name must be a symbol and receiver must be a heap object.
+static void GenerateDictionaryNegativeLookup(MacroAssembler* masm,
+                                             Label* miss_label,
+                                             Register receiver,
+                                             String* name,
+                                             Register r0,
+                                             Register r1) {
+  ASSERT(name->IsSymbol());
+  __ IncrementCounter(&Counters::negative_lookups, 1);
+  __ IncrementCounter(&Counters::negative_lookups_miss, 1);
+
+  Label done;
+  __ movq(r0, FieldOperand(receiver, HeapObject::kMapOffset));
+
+  const int kInterceptorOrAccessCheckNeededMask =
+      (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded);
+
+  // Bail out if the receiver has a named interceptor or requires access checks.
+  __ testb(FieldOperand(r0, Map::kBitFieldOffset),
+           Immediate(kInterceptorOrAccessCheckNeededMask));
+  __ j(not_zero, miss_label);
+
+  // Check that receiver is a JSObject.
+  __ CmpInstanceType(r0, FIRST_JS_OBJECT_TYPE);
+  __ j(below, miss_label);
+
+  // Load properties array.
+  Register properties = r0;
+  __ movq(properties, FieldOperand(receiver, JSObject::kPropertiesOffset));
+
+  // Check that the properties array is a dictionary.
+  __ CompareRoot(FieldOperand(properties, HeapObject::kMapOffset),
+                 Heap::kHashTableMapRootIndex);
+  __ j(not_equal, miss_label);
+
+  // Compute the capacity mask.
+  const int kCapacityOffset =
+      StringDictionary::kHeaderSize +
+      StringDictionary::kCapacityIndex * kPointerSize;
+
+  // Generate an unrolled loop that performs a few probes before
+  // giving up.
+  static const int kProbes = 4;
+  const int kElementsStartOffset =
+      StringDictionary::kHeaderSize +
+      StringDictionary::kElementsStartIndex * kPointerSize;
+
+  // If names of slots in range from 1 to kProbes - 1 for the hash value are
+  // not equal to the name and kProbes-th slot is not used (its name is the
+  // undefined value), it guarantees the hash table doesn't contain the
+  // property. It's true even if some slots represent deleted properties
+  // (their names are the null value).
+  for (int i = 0; i < kProbes; i++) {
+    // r0 points to properties hash.
+    // Compute the masked index: (hash + i + i * i) & mask.
+    Register index = r1;
+    // Capacity is smi 2^n.
+    __ SmiToInteger32(index, FieldOperand(properties, kCapacityOffset));
+    __ decl(index);
+    __ and_(index,
+            Immediate(name->Hash() + StringDictionary::GetProbeOffset(i)));
+
+    // Scale the index by multiplying by the entry size.
+    ASSERT(StringDictionary::kEntrySize == 3);
+    __ lea(index, Operand(index, index, times_2, 0));  // index *= 3.
+
+    Register entity_name = r1;
+    // Having undefined at this place means the name is not contained.
+    ASSERT_EQ(kSmiTagSize, 1);
+    __ movq(entity_name, Operand(properties, index, times_pointer_size,
+                                 kElementsStartOffset - kHeapObjectTag));
+    __ Cmp(entity_name, Factory::undefined_value());
+    // __ jmp(miss_label);
+    if (i != kProbes - 1) {
+      __ j(equal, &done);
+
+      // Stop if found the property.
+      __ Cmp(entity_name, Handle<String>(name));
+      __ j(equal, miss_label);
+    } else {
+      // Give up probing if still not found the undefined value.
+      __ j(not_equal, miss_label);
+    }
+  }
+
+  __ bind(&done);
+  __ DecrementCounter(&Counters::negative_lookups_miss, 1);
+}
+
+
 void StubCompiler::GenerateLoadMiss(MacroAssembler* masm, Code::Kind kind) {
   ASSERT(kind == Code::LOAD_IC || kind == Code::KEYED_LOAD_IC);
   Code* code = NULL;
@@ -497,6 +591,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                Register receiver,
                Register scratch1,
                Register scratch2,
+               Register scratch3,
                Label* miss) {
     ASSERT(holder->HasNamedInterceptor());
     ASSERT(!holder->GetNamedInterceptor()->getter()->IsUndefined());
@@ -512,6 +607,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                        receiver,
                        scratch1,
                        scratch2,
+                       scratch3,
                        holder,
                        lookup,
                        name,
@@ -523,6 +619,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                      receiver,
                      scratch1,
                      scratch2,
+                     scratch3,
                      name,
                      holder,
                      miss);
@@ -535,6 +632,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                         Register receiver,
                         Register scratch1,
                         Register scratch2,
+                        Register scratch3,
                         JSObject* interceptor_holder,
                         LookupResult* lookup,
                         String* name,
@@ -574,7 +672,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver,
                                         interceptor_holder, scratch1,
-                                        scratch2, name, depth1, miss);
+                                        scratch2, scratch3, name, depth1, miss);
 
     // Invoke an interceptor and if it provides a value,
     // branch to |regular_invoke|.
@@ -590,7 +688,7 @@ class CallInterceptorCompiler BASE_EMBEDDED {
     if (interceptor_holder != lookup->holder()) {
       stub_compiler_->CheckPrototypes(interceptor_holder, receiver,
                                       lookup->holder(), scratch1,
-                                      scratch2, name, depth2, miss);
+                                      scratch2, scratch3, name, depth2, miss);
     } else {
       // CheckPrototypes has a side effect of fetching a 'holder'
       // for API (object which is instanceof for the signature).  It's
@@ -626,12 +724,13 @@ class CallInterceptorCompiler BASE_EMBEDDED {
                       Register receiver,
                       Register scratch1,
                       Register scratch2,
+                      Register scratch3,
                       String* name,
                       JSObject* interceptor_holder,
                       Label* miss_label) {
     Register holder =
         stub_compiler_->CheckPrototypes(object, receiver, interceptor_holder,
-                                        scratch1, scratch2, name,
+                                        scratch1, scratch2, scratch3, name,
                                         miss_label);
 
     __ EnterInternalFrame();
@@ -784,7 +883,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
 
       // Check that the maps haven't changed.
       CheckPrototypes(JSObject::cast(object), rdx, holder,
-                      rbx, rax, name, depth, &miss);
+                      rbx, rax, rdi, name, depth, &miss);
 
       // Patch the receiver on the stack with the global proxy if
       // necessary.
@@ -807,7 +906,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::STRING_FUNCTION_INDEX, rax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), rax, holder,
-                        rbx, rdx, name, &miss);
+                        rbx, rdx, rdi, name, &miss);
       }
       break;
 
@@ -826,7 +925,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::NUMBER_FUNCTION_INDEX, rax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), rax, holder,
-                        rbx, rdx, name, &miss);
+                        rbx, rdx, rdi, name, &miss);
       }
       break;
     }
@@ -847,7 +946,7 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
         GenerateDirectLoadGlobalFunctionPrototype(
             masm(), Context::BOOLEAN_FUNCTION_INDEX, rax);
         CheckPrototypes(JSObject::cast(object->GetPrototype()), rax, holder,
-                        rbx, rdx, name, &miss);
+                        rbx, rdx, rdi, name, &miss);
       }
       break;
     }
@@ -902,7 +1001,8 @@ Object* CallStubCompiler::CompileCallField(JSObject* object,
   __ JumpIfSmi(rdx, &miss);
 
   // Do the right check and compute the holder register.
-  Register reg = CheckPrototypes(object, rdx, holder, rbx, rax, name, &miss);
+  Register reg = CheckPrototypes(object, rdx, holder, rbx, rax, rdi,
+                                 name, &miss);
 
   GenerateFastPropertyLoad(masm(), rdi, reg, holder, index);
 
@@ -965,6 +1065,7 @@ Object* CallStubCompiler::CompileArrayPushCall(Object* object,
                   holder,
                   rbx,
                   rax,
+                  rdi,
                   name,
                   &miss);
 
@@ -1119,7 +1220,7 @@ Object* CallStubCompiler::CompileArrayPopCall(Object* object,
 
   CheckPrototypes(JSObject::cast(object), rdx,
                   holder, rbx,
-                  rax, name, &miss);
+                  rax, rdi, name, &miss);
 
   // Get the elements array of the object.
   __ movq(rbx, FieldOperand(rdx, JSArray::kElementsOffset));
@@ -1226,6 +1327,7 @@ Object* CallStubCompiler::CompileCallInterceptor(JSObject* object,
                    rdx,
                    rbx,
                    rdi,
+                   rax,
                    &miss);
 
   // Restore receiver.
@@ -1288,7 +1390,7 @@ Object* CallStubCompiler::CompileCallGlobal(JSObject* object,
   }
 
   // Check that the maps haven't changed.
-  CheckPrototypes(object, rdx, holder, rbx, rax, name, &miss);
+  CheckPrototypes(object, rdx, holder, rbx, rax, rdi, name, &miss);
 
   // Get the value from the cell.
   __ Move(rdi, Handle<JSGlobalPropertyCell>(cell));
@@ -1353,7 +1455,7 @@ Object* LoadStubCompiler::CompileLoadCallback(String* name,
   Label miss;
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(object, holder, rax, rcx, rbx, rdx,
+  bool success = GenerateLoadCallback(object, holder, rax, rcx, rbx, rdx, rdi,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -1376,7 +1478,7 @@ Object* LoadStubCompiler::CompileLoadConstant(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadConstant(object, holder, rax, rbx, rdx, value, name, &miss);
+  GenerateLoadConstant(object, holder, rax, rbx, rdx, rdi, value, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -1401,7 +1503,7 @@ Object* LoadStubCompiler::CompileLoadNonexistent(String* name,
   // Check the maps of the full prototype chain. Also check that
   // global property cells up to (but not including) the last object
   // in the prototype chain are empty.
-  CheckPrototypes(object, rax, last, rbx, rdx, name, &miss);
+  CheckPrototypes(object, rax, last, rbx, rdx, rdi, name, &miss);
 
   // If the last object in the prototype chain is a global object,
   // check that the global property cell is empty.
@@ -1438,7 +1540,7 @@ Object* LoadStubCompiler::CompileLoadField(JSObject* object,
   // -----------------------------------
   Label miss;
 
-  GenerateLoadField(object, holder, rax, rbx, rdx, index, name, &miss);
+  GenerateLoadField(object, holder, rax, rbx, rdx, rdi, index, name, &miss);
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
@@ -1469,6 +1571,7 @@ Object* LoadStubCompiler::CompileLoadInterceptor(JSObject* receiver,
                           rcx,
                           rdx,
                           rbx,
+                          rdi,
                           name,
                           &miss);
 
@@ -1500,7 +1603,7 @@ Object* LoadStubCompiler::CompileLoadGlobal(JSObject* object,
   }
 
   // Check that the maps haven't changed.
-  CheckPrototypes(object, rax, holder, rbx, rdx, name, &miss);
+  CheckPrototypes(object, rax, holder, rbx, rdx, rdi, name, &miss);
 
   // Get the value from the cell.
   __ Move(rbx, Handle<JSGlobalPropertyCell>(cell));
@@ -1546,7 +1649,7 @@ Object* KeyedLoadStubCompiler::CompileLoadCallback(String* name,
   __ j(not_equal, &miss);
 
   Failure* failure = Failure::InternalError();
-  bool success = GenerateLoadCallback(receiver, holder, rdx, rax, rbx, rcx,
+  bool success = GenerateLoadCallback(receiver, holder, rdx, rax, rbx, rcx, rdi,
                                       callback, name, &miss, &failure);
   if (!success) return failure;
 
@@ -1600,7 +1703,7 @@ Object* KeyedLoadStubCompiler::CompileLoadConstant(String* name,
   __ Cmp(rax, Handle<String>(name));
   __ j(not_equal, &miss);
 
-  GenerateLoadConstant(receiver, holder, rdx, rbx, rcx,
+  GenerateLoadConstant(receiver, holder, rdx, rbx, rcx, rdi,
                        value, name, &miss);
   __ bind(&miss);
   __ DecrementCounter(&Counters::keyed_load_constant_function, 1);
@@ -1660,6 +1763,7 @@ Object* KeyedLoadStubCompiler::CompileLoadInterceptor(JSObject* receiver,
                           rax,
                           rcx,
                           rbx,
+                          rdi,
                           name,
                           &miss);
   __ bind(&miss);
@@ -1875,7 +1979,7 @@ Object* KeyedLoadStubCompiler::CompileLoadField(String* name,
   __ Cmp(rax, Handle<String>(name));
   __ j(not_equal, &miss);
 
-  GenerateLoadField(receiver, holder, rdx, rbx, rcx, index, name, &miss);
+  GenerateLoadField(receiver, holder, rdx, rbx, rcx, rdi, index, name, &miss);
 
   __ bind(&miss);
   __ DecrementCounter(&Counters::keyed_load_field, 1);
@@ -1954,6 +2058,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                            Register name_reg,
                                            Register scratch1,
                                            Register scratch2,
+                                           Register scratch3,
                                            String* name,
                                            Label* miss) {
   ASSERT(interceptor_holder->HasNamedInterceptor());
@@ -1981,7 +2086,8 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // property from further up the prototype chain if the call fails.
     // Check that the maps haven't changed.
     Register holder_reg = CheckPrototypes(object, receiver, interceptor_holder,
-                                          scratch1, scratch2, name, miss);
+                                          scratch1, scratch2, scratch3,
+                                          name, miss);
     ASSERT(holder_reg.is(receiver) || holder_reg.is(scratch1));
 
     // Save necessary data before invoking an interceptor.
@@ -2029,6 +2135,7 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
                                    lookup->holder(),
                                    scratch1,
                                    scratch2,
+                                   scratch3,
                                    name,
                                    miss);
     }
@@ -2068,7 +2175,8 @@ void StubCompiler::GenerateLoadInterceptor(JSObject* object,
     // Call the runtime system to load the interceptor.
     // Check that the maps haven't changed.
     Register holder_reg = CheckPrototypes(object, receiver, interceptor_holder,
-                                          scratch1, scratch2, name, miss);
+                                          scratch1, scratch2, scratch3,
+                                          name, miss);
     __ pop(scratch2);  // save old return address
     PushInterceptorArguments(masm(), receiver, holder_reg,
                              name_reg, interceptor_holder);
@@ -2087,6 +2195,7 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
                                         Register name_reg,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         AccessorInfo* callback,
                                         String* name,
                                         Label* miss,
@@ -2097,7 +2206,7 @@ bool StubCompiler::GenerateLoadCallback(JSObject* object,
   // Check that the maps haven't changed.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Push the arguments on the JS stack of the caller.
   __ pop(scratch2);  // remove return address
@@ -2122,41 +2231,143 @@ Register StubCompiler::CheckPrototypes(JSObject* object,
                                        Register object_reg,
                                        JSObject* holder,
                                        Register holder_reg,
-                                       Register scratch,
+                                       Register scratch1,
+                                       Register scratch2,
                                        String* name,
                                        int save_at_depth,
-                                       Label* miss,
-                                       Register extra) {
-  // Check that the maps haven't changed.
-  Register result =
-      masm()->CheckMaps(object,
-                        object_reg,
-                        holder,
-                        holder_reg,
-                        scratch,
-                        save_at_depth,
-                        miss);
+                                       Label* miss) {
+  // Make sure there's no overlap between holder and object registers.
+  ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
+  ASSERT(!scratch2.is(object_reg) && !scratch2.is(holder_reg)
+         && !scratch2.is(scratch1));
+
+  // Keep track of the current object in register reg.  On the first
+  // iteration, reg is an alias for object_reg, on later iterations,
+  // it is an alias for holder_reg.
+  Register reg = object_reg;
+  int depth = 0;
+
+  if (save_at_depth == depth) {
+    __ movq(Operand(rsp, kPointerSize), object_reg);
+  }
+
+  // Check the maps in the prototype chain.
+  // Traverse the prototype chain from the object and do map checks.
+  JSObject* current = object;
+  while (current != holder) {
+    depth++;
+
+    // Only global objects and objects that do not require access
+    // checks are allowed in stubs.
+    ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded());
+
+    JSObject* prototype = JSObject::cast(current->GetPrototype());
+    if (!current->HasFastProperties() &&
+        !current->IsJSGlobalObject() &&
+        !current->IsJSGlobalProxy()) {
+      if (!name->IsSymbol()) {
+        Object* lookup_result = Heap::LookupSymbol(name);
+        if (lookup_result->IsFailure()) {
+          set_failure(Failure::cast(lookup_result));
+          return reg;
+        } else {
+          name = String::cast(lookup_result);
+        }
+      }
+      ASSERT(current->property_dictionary()->FindEntry(name) ==
+             StringDictionary::kNotFound);
+
+      GenerateDictionaryNegativeLookup(masm(),
+                                       miss,
+                                       reg,
+                                       name,
+                                       scratch1,
+                                       scratch2);
+      __ movq(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
+      reg = holder_reg;  // from now the object is in holder_reg
+      __ movq(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
+    } else if (Heap::InNewSpace(prototype)) {
+      // Get the map of the current object.
+      __ movq(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
+      __ Cmp(scratch1, Handle<Map>(current->map()));
+      // Branch on the result of the map check.
+      __ j(not_equal, miss);
+      // Check access rights to the global object.  This has to happen
+      // after the map check so that we know that the object is
+      // actually a global object.
+      if (current->IsJSGlobalProxy()) {
+        __ CheckAccessGlobalProxy(reg, scratch1, miss);
+
+        // Restore scratch register to be the map of the object.
+        // We load the prototype from the map in the scratch register.
+        __ movq(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
+      }
+      // The prototype is in new space; we cannot store a reference
+      // to it in the code. Load it from the map.
+      reg = holder_reg;  // from now the object is in holder_reg
+      __ movq(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
+
+    } else {
+      // Check the map of the current object.
+      __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
+          Handle<Map>(current->map()));
+      // Branch on the result of the map check.
+      __ j(not_equal, miss);
+      // Check access rights to the global object.  This has to happen
+      // after the map check so that we know that the object is
+      // actually a global object.
+      if (current->IsJSGlobalProxy()) {
+        __ CheckAccessGlobalProxy(reg, scratch1, miss);
+      }
+      // The prototype is in old space; load it directly.
+      reg = holder_reg;  // from now the object is in holder_reg
+      __ Move(reg, Handle<JSObject>(prototype));
+    }
+
+    if (save_at_depth == depth) {
+      __ movq(Operand(rsp, kPointerSize), reg);
+    }
+
+    // Go to the next object in the prototype chain.
+    current = prototype;
+  }
+
+  // Check the holder map.
+  __ Cmp(FieldOperand(reg, HeapObject::kMapOffset), Handle<Map>(holder->map()));
+  __ j(not_equal, miss);
+
+  // Log the check depth.
+  LOG(IntEvent("check-maps-depth", depth + 1));
+
+  // Perform security check for access to the global object and return
+  // the holder register.
+  ASSERT(current == holder);
+  ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded());
+  if (current->IsJSGlobalProxy()) {
+    __ CheckAccessGlobalProxy(reg, scratch1, miss);
+  }
 
   // If we've skipped any global objects, it's not enough to verify
   // that their maps haven't changed.  We also need to check that the
   // property cell for the property is still empty.
-  while (object != holder) {
-    if (object->IsGlobalObject()) {
+  current = object;
+  while (current != holder) {
+    if (current->IsGlobalObject()) {
       Object* cell = GenerateCheckPropertyCell(masm(),
-                                               GlobalObject::cast(object),
+                                               GlobalObject::cast(current),
                                                name,
-                                               scratch,
+                                               scratch1,
                                                miss);
       if (cell->IsFailure()) {
         set_failure(Failure::cast(cell));
-        return result;
+        return reg;
       }
     }
-    object = JSObject::cast(object->GetPrototype());
+    current = JSObject::cast(current->GetPrototype());
   }
 
   // Return the register containing the holder.
-  return result;
+  return reg;
 }
 
 
@@ -2165,6 +2376,7 @@ void StubCompiler::GenerateLoadField(JSObject* object,
                                      Register receiver,
                                      Register scratch1,
                                      Register scratch2,
+                                     Register scratch3,
                                      int index,
                                      String* name,
                                      Label* miss) {
@@ -2174,7 +2386,7 @@ void StubCompiler::GenerateLoadField(JSObject* object,
   // Check the prototype chain.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Get the value from the properties.
   GenerateFastPropertyLoad(masm(), rax, reg, holder, index);
@@ -2187,6 +2399,7 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
                                         Register receiver,
                                         Register scratch1,
                                         Register scratch2,
+                                        Register scratch3,
                                         Object* value,
                                         String* name,
                                         Label* miss) {
@@ -2196,7 +2409,7 @@ void StubCompiler::GenerateLoadConstant(JSObject* object,
   // Check that the maps haven't changed.
   Register reg =
       CheckPrototypes(object, receiver, holder,
-                      scratch1, scratch2, name, miss);
+                      scratch1, scratch2, scratch3, name, miss);
 
   // Return the constant value.
   __ Move(rax, Handle<Object>(value));

deps/v8/test/cctest/test-api.cc

@@ -470,7 +470,10 @@ TEST(MakingExternalStringConditions) {
   i::Heap::CollectGarbage(0, i::NEW_SPACE);
   i::Heap::CollectGarbage(0, i::NEW_SPACE);
 
-  Local<String> small_string = String::New(AsciiToTwoByteString("small"));
+  uint16_t* two_byte_string = AsciiToTwoByteString("small");
+  Local<String> small_string = String::New(two_byte_string);
+  i::DeleteArray(two_byte_string);
+
   // We should refuse to externalize newly created small string.
   CHECK(!small_string->CanMakeExternal());
   // Trigger GCs so that the newly allocated string moves to old gen.
@@ -479,7 +482,10 @@ TEST(MakingExternalStringConditions) {
   // Old space strings should be accepted.
   CHECK(small_string->CanMakeExternal());
 
-  small_string = String::New(AsciiToTwoByteString("small 2"));
+  two_byte_string = AsciiToTwoByteString("small 2");
+  small_string = String::New(two_byte_string);
+  i::DeleteArray(two_byte_string);
+
   // We should refuse externalizing newly created small string.
   CHECK(!small_string->CanMakeExternal());
   for (int i = 0; i < 100; i++) {
@@ -492,8 +498,11 @@ TEST(MakingExternalStringConditions) {
   char* buf = i::NewArray<char>(buf_size);
   memset(buf, 'a', buf_size);
   buf[buf_size - 1] = '\0';
-  Local<String> large_string = String::New(AsciiToTwoByteString(buf));
+
+  two_byte_string = AsciiToTwoByteString(buf);
+  Local<String> large_string = String::New(two_byte_string);
   i::DeleteArray(buf);
+  i::DeleteArray(two_byte_string);
   // Large strings should be immediately accepted.
   CHECK(large_string->CanMakeExternal());
 }
@@ -688,7 +697,11 @@ THREADED_TEST(StringConcat) {
     const char* two_byte_string_2 = "a_times_two_plus_b(4, 8) + ";
     const char* two_byte_extern_2 = "a_times_two_plus_b(1, 2);";
     Local<String> left = v8_str(one_byte_string_1);
-    Local<String> right = String::New(AsciiToTwoByteString(two_byte_string_1));
+
+    uint16_t* two_byte_source = AsciiToTwoByteString(two_byte_string_1);
+    Local<String> right = String::New(two_byte_source);
+    i::DeleteArray(two_byte_source);
+
     Local<String> source = String::Concat(left, right);
     right = String::NewExternal(
         new TestAsciiResource(i::StrDup(one_byte_extern_1)));
@@ -698,7 +711,11 @@ THREADED_TEST(StringConcat) {
     source = String::Concat(source, right);
     right = v8_str(one_byte_string_2);
     source = String::Concat(source, right);
-    right = String::New(AsciiToTwoByteString(two_byte_string_2));
+
+    two_byte_source = AsciiToTwoByteString(two_byte_string_2);
+    right = String::New(two_byte_source);
+    i::DeleteArray(two_byte_source);
+
     source = String::Concat(source, right);
     right = String::NewExternal(
         new TestResource(AsciiToTwoByteString(two_byte_extern_2)));
@@ -3821,9 +3838,10 @@ v8::Handle<Value> WhammyPropertyGetter(Local<String> name,
 THREADED_TEST(WeakReference) {
   v8::HandleScope handle_scope;
   v8::Handle<v8::ObjectTemplate> templ= v8::ObjectTemplate::New();
+  Whammy* whammy = new Whammy();
   templ->SetNamedPropertyHandler(WhammyPropertyGetter,
                                  0, 0, 0, 0,
-                                 v8::External::New(new Whammy()));
+                                 v8::External::New(whammy));
   const char* extension_list[] = { "v8/gc" };
   v8::ExtensionConfiguration extensions(1, extension_list);
   v8::Persistent<Context> context = Context::New(&extensions);
@@ -3842,7 +3860,7 @@ THREADED_TEST(WeakReference) {
       "4";
   v8::Handle<Value> result = CompileRun(code);
   CHECK_EQ(4.0, result->NumberValue());
-
+  delete whammy;
   context.Dispose();
 }
 
@@ -8612,20 +8630,31 @@ TEST(PreCompileAPIVariationsAreSame) {
   v8::HandleScope scope;
 
   const char* cstring = "function foo(a) { return a+1; }";
+
   v8::ScriptData* sd_from_cstring =
       v8::ScriptData::PreCompile(cstring, i::StrLength(cstring));
 
   TestAsciiResource* resource = new TestAsciiResource(cstring);
-  v8::ScriptData* sd_from_istring = v8::ScriptData::PreCompile(
+  v8::ScriptData* sd_from_external_string = v8::ScriptData::PreCompile(
       v8::String::NewExternal(resource));
 
-  CHECK_EQ(sd_from_cstring->Length(), sd_from_istring->Length());
+  v8::ScriptData* sd_from_string = v8::ScriptData::PreCompile(
+      v8::String::New(cstring));
+
+  CHECK_EQ(sd_from_cstring->Length(), sd_from_external_string->Length());
+  CHECK_EQ(0, memcmp(sd_from_cstring->Data(),
+                     sd_from_external_string->Data(),
+                     sd_from_cstring->Length()));
+
+  CHECK_EQ(sd_from_cstring->Length(), sd_from_string->Length());
   CHECK_EQ(0, memcmp(sd_from_cstring->Data(),
-                     sd_from_istring->Data(),
+                     sd_from_string->Data(),
                      sd_from_cstring->Length()));
 
+
   delete sd_from_cstring;
-  delete sd_from_istring;
+  delete sd_from_external_string;
+  delete sd_from_string;
 }
 
 
@@ -9049,6 +9078,7 @@ THREADED_TEST(MorphCompositeStringTest) {
     CHECK_EQ(String::New(expected_slice_on_cons),
              env->Global()->Get(v8_str("slice_on_cons")));
   }
+  i::DeleteArray(two_byte_string);
 }
 
 
@@ -9073,6 +9103,7 @@ TEST(CompileExternalTwoByteSource) {
                                   i::StrLength(ascii_sources[i])));
     v8::Local<v8::String> source = v8::String::NewExternal(&uc16_resource);
     v8::Script::Compile(source);
+    i::DeleteArray(two_byte_string);
   }
 }
 
@@ -10350,6 +10381,40 @@ THREADED_TEST(CaptureStackTrace) {
 }
 
 
+static void StackTraceForUncaughtExceptionListener(
+    v8::Handle<v8::Message> message,
+    v8::Handle<Value>) {
+  v8::Handle<v8::StackTrace> stack_trace = message->GetStackTrace();
+  CHECK_EQ(2, stack_trace->GetFrameCount());
+  checkStackFrame("origin", "foo", 2, 3, false, false,
+                  stack_trace->GetFrame(0));
+  checkStackFrame("origin", "bar", 5, 3, false, false,
+                  stack_trace->GetFrame(1));
+}
+
+TEST(CaptureStackTraceForUncaughtException) {
+  report_count = 0;
+  v8::HandleScope scope;
+  LocalContext env;
+  v8::V8::AddMessageListener(StackTraceForUncaughtExceptionListener);
+  v8::V8::SetCaptureStackTraceForUncaughtExceptions(true);
+
+  Script::Compile(v8_str("function foo() {\n"
+                         "  throw 1;\n"
+                         "};\n"
+                         "function bar() {\n"
+                         "  foo();\n"
+                         "};"),
+                  v8_str("origin"))->Run();
+  v8::Local<v8::Object> global = env->Global();
+  Local<Value> trouble = global->Get(v8_str("bar"));
+  CHECK(trouble->IsFunction());
+  Function::Cast(*trouble)->Call(global, 0, NULL);
+  v8::V8::SetCaptureStackTraceForUncaughtExceptions(false);
+  v8::V8::RemoveMessageListeners(StackTraceForUncaughtExceptionListener);
+}
+
+
 // Test that idle notification can be handled and eventually returns true.
 THREADED_TEST(IdleNotification) {
   bool rv = false;

deps/v8/test/cctest/test-assembler-arm.cc

@@ -70,7 +70,6 @@ TEST(0) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -107,7 +106,6 @@ TEST(1) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -153,7 +151,6 @@ TEST(2) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -201,7 +198,6 @@ TEST(3) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -261,7 +257,6 @@ TEST(4) {
     CodeDesc desc;
     assm.GetCode(&desc);
     Object* code = Heap::CreateCode(desc,
-                                    NULL,
                                     Code::ComputeFlags(Code::STUB),
                                     Handle<Object>(Heap::undefined_value()));
     CHECK(code->IsCode());
@@ -301,7 +296,6 @@ TEST(5) {
     CodeDesc desc;
     assm.GetCode(&desc);
     Object* code = Heap::CreateCode(desc,
-                                    NULL,
                                     Code::ComputeFlags(Code::STUB),
                                     Handle<Object>(Heap::undefined_value()));
     CHECK(code->IsCode());

deps/v8/test/cctest/test-assembler-ia32.cc

@@ -70,7 +70,6 @@ TEST(AssemblerIa320) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -108,7 +107,6 @@ TEST(AssemblerIa321) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -150,7 +148,6 @@ TEST(AssemblerIa322) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -185,7 +182,6 @@ TEST(AssemblerIa323) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
   // don't print the code - our disassembler can't handle cvttss2si
@@ -220,7 +216,6 @@ TEST(AssemblerIa324) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
   // don't print the code - our disassembler can't handle cvttsd2si
@@ -250,7 +245,6 @@ TEST(AssemblerIa325) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
   F0 f = FUNCTION_CAST<F0>(code->entry());
@@ -288,7 +282,6 @@ TEST(AssemblerIa326) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
 #ifdef DEBUG
@@ -329,7 +322,6 @@ TEST(AssemblerIa328) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
   CHECK(code->IsCode());
@@ -385,7 +377,6 @@ TEST(AssemblerIa329) {
   assm.GetCode(&desc);
   Code* code =
       Code::cast(Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value())));
   CHECK(code->IsCode());

deps/v8/test/cctest/test-disasm-arm.cc

@@ -437,6 +437,11 @@ TEST(Vfp) {
             "eeb10bc0       vsqrt.f64 d0, d0");
     COMPARE(vsqrt(d2, d3, ne),
             "1eb12bc3       vsqrt.f64ne d2, d3");
+
+    COMPARE(vmov(d0, 1.0),
+            "eeb70b00       vmov.f64 d0, #1");
+    COMPARE(vmov(d2, -13.0),
+            "eeba2b0a       vmov.f64 d2, #-13");
   }
 
   VERIFY_RUN();

deps/v8/test/cctest/test-disasm-ia32.cc

@@ -415,7 +415,6 @@ TEST(DisasmIa320) {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());

deps/v8/test/cctest/test-heap-profiler.cc

@@ -598,12 +598,13 @@ TEST(HeapSnapshotCodeObjects) {
   CHECK_NE(NULL, lazy_code);
 
   // Verify that non-compiled code doesn't contain references to "x"
-  // literal, while compiled code does.
+  // literal, while compiled code does. The scope info is stored in FixedArray
+  // objects attached to the SharedFunctionInfo.
   bool compiled_references_x = false, lazy_references_x = false;
   for (int i = 0, count = compiled_code->GetChildrenCount(); i < count; ++i) {
     const v8::HeapGraphEdge* prop = compiled_code->GetChild(i);
     const v8::HeapGraphNode* node = prop->GetToNode();
-    if (node->GetType() == v8::HeapGraphNode::CODE) {
+    if (node->GetType() == v8::HeapGraphNode::ARRAY) {
       if (HasString(node, "x")) {
         compiled_references_x = true;
         break;
@@ -613,7 +614,7 @@ TEST(HeapSnapshotCodeObjects) {
   for (int i = 0, count = lazy_code->GetChildrenCount(); i < count; ++i) {
     const v8::HeapGraphEdge* prop = lazy_code->GetChild(i);
     const v8::HeapGraphNode* node = prop->GetToNode();
-    if (node->GetType() == v8::HeapGraphNode::CODE) {
+    if (node->GetType() == v8::HeapGraphNode::ARRAY) {
       if (HasString(node, "x")) {
         lazy_references_x = true;
         break;

deps/v8/test/cctest/test-heap.cc

@@ -77,7 +77,6 @@ static void CheckFindCodeObject() {
   CodeDesc desc;
   assm.GetCode(&desc);
   Object* code = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(code->IsCode());
@@ -91,7 +90,6 @@ static void CheckFindCodeObject() {
   }
 
   Object* copy = Heap::CreateCode(desc,
-                                  NULL,
                                   Code::ComputeFlags(Code::STUB),
                                   Handle<Object>(Heap::undefined_value()));
   CHECK(copy->IsCode());

deps/v8/test/es5conform/es5conform.status

@@ -49,25 +49,15 @@ chapter15/15.1: FAIL_OK
 
 # NOT IMPLEMENTED: seal
 chapter15/15.2/15.2.3/15.2.3.8: UNIMPLEMENTED
-# NOT IMPLEMENTED: freeze
-chapter15/15.2/15.2.3/15.2.3.9: UNIMPLEMENTED
 # NOT IMPLEMENTED: isSealed
 chapter15/15.2/15.2.3/15.2.3.11: UNIMPLEMENTED
-# NOT IMPLEMENTED: isFrozen
-chapter15/15.2/15.2.3/15.2.3.12: UNIMPLEMENTED
 
 # NOT IMPLEMENTED: seal
 chapter15/15.2/15.2.3/15.2.3.3/15.2.3.3-4-20: UNIMPLEMENTED
 
-# NOT IMPLEMENTED: freeze
-chapter15/15.2/15.2.3/15.2.3.3/15.2.3.3-4-21: UNIMPLEMENTED
-
 # NOT IMPLEMENTED: isSealed
 chapter15/15.2/15.2.3/15.2.3.3/15.2.3.3-4-23: UNIMPLEMENTED
 
-# NOT IMPLEMENTED: isFrozen
-chapter15/15.2/15.2.3/15.2.3.3/15.2.3.3-4-24: UNIMPLEMENTED
-
 # NOT IMPLEMENTED: bind
 chapter15/15.2/15.2.3/15.2.3.3/15.2.3.3-4-38: UNIMPLEMENTED
 

deps/v8/test/mjsunit/apply.js

@@ -94,7 +94,7 @@ function f() {
   }
   return doo;
 }
-  
+
 assertEquals("42foofishhorse", f.apply(this, arr), "apply to this");
 
 function s() {
@@ -112,28 +112,13 @@ function al() {
   return arguments.length + arguments[arguments.length - 1];
 }
 
-var stack_corner_case_failure = false;
-
 for (var j = 1; j < 0x40000000; j <<= 1) {
   try {
     var a = new Array(j);
     a[j - 1] = 42;
     assertEquals(42 + j, al.apply(345, a));
   } catch (e) {
-    if (e.toString().indexOf("Maximum call stack size exceeded") != -1) {
-      // For some combinations of build settings, it may be the case that the
-      // stack here is just tall enough to contain the array whose size is
-      // specified by j but is not tall enough to contain the activation
-      // record for the apply call. Allow one such corner case through,
-      // checking that the length check will do the right thing for an array
-      // the next size up.
-      assertEquals(false, stack_corner_case_failure);
-      stack_corner_case_failure = true;
-      continue;
-    }
-    assertTrue(e.toString().indexOf("Function.prototype.apply") != -1,
-              "exception does not contain Function.prototype.apply: " +
-                  e.toString());
+    assertTrue(e.toString().indexOf("Maximum call stack size exceeded") != -1);
     for (; j < 0x40000000; j <<= 1) {
       var caught = false;
       try {
@@ -143,9 +128,7 @@ for (var j = 1; j < 0x40000000; j <<= 1) {
         assertUnreachable("Apply of array with length " + a.length +
                           " should have thrown");
       } catch (e) {
-        assertTrue(e.toString().indexOf("Function.prototype.apply") != -1,
-                   "exception does not contain Function.prototype.apply [" +
-                   "length = " + j + "]: " + e.toString());
+        assertTrue(e.toString().indexOf("Maximum call stack size exceeded") != -1);
         caught = true;
       }
       assertTrue(caught, "exception not caught");

deps/v8/test/mjsunit/json.js

@@ -85,7 +85,7 @@ n4.toISOString = function () {
 };
 assertEquals(null, n4.toJSON());
 
-assertEquals(Object.prototype, JSON.__proto__);
+assertTrue(Object.prototype === JSON.__proto__);
 assertEquals("[object JSON]", Object.prototype.toString.call(JSON));
 
 // DontEnum
@@ -313,3 +313,7 @@ TestInvalid('1); throw "foo"; (1');
 var x = 0;
 eval("(1); x++; (1)");
 TestInvalid('1); x++; (1');
+
+// Test string conversion of argument.
+var o = { toString: function() { return "42"; } };
+assertEquals(42, JSON.parse(o));

deps/v8/test/mjsunit/object-freeze.js

@@ -0,0 +1,174 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests the Object.freeze and Object.isFrozen methods - ES 15.2.3.9 and
+// ES 15.2.3.12
+
+
+// Test that we throw an error if an object is not passed as argument.
+var non_objects = new Array(undefined, null, 1, -1, 0, 42.43);
+for (var key in non_objects) {
+  try {
+    Object.freeze(non_objects[key]);
+    assertUnreachable();
+  } catch(e) {
+    assertTrue(/Object.freeze called on non-object/.test(e));
+  }
+}
+
+for (var key in non_objects) {
+  try {
+    Object.isFrozen(non_objects[key]);
+    assertUnreachable();
+  } catch(e) {
+    assertTrue(/Object.isFrozen called on non-object/.test(e));
+  }
+}
+
+// Test normal data properties.
+var obj = { x: 42, z: 'foobar' };
+var desc = Object.getOwnPropertyDescriptor(obj, 'x');
+assertTrue(desc.writable);
+assertTrue(desc.configurable);
+assertEquals(42, desc.value);
+
+desc = Object.getOwnPropertyDescriptor(obj, 'z');
+assertTrue(desc.writable);
+assertTrue(desc.configurable);
+assertEquals('foobar', desc.value);
+
+assertTrue(Object.isExtensible(obj));
+assertFalse(Object.isFrozen(obj));
+
+Object.freeze(obj);
+
+// Make sure we are no longer extensible.
+assertFalse(Object.isExtensible(obj));
+assertTrue(Object.isFrozen(obj));
+
+try {
+   obj.foo = 42;
+   assertUnreachable();
+} catch(e) {
+  assertTrue(/object is not extensible/.test(e));
+}
+
+desc = Object.getOwnPropertyDescriptor(obj, 'x');
+assertFalse(desc.writable);
+assertFalse(desc.configurable);
+assertEquals(42, desc.value);
+
+desc = Object.getOwnPropertyDescriptor(obj, 'z');
+assertFalse(desc.writable);
+assertFalse(desc.configurable);
+assertEquals("foobar", desc.value);
+
+// Make sure that even if we try overwrite a value that is not writable, it is
+// not changed. 
+obj.x = "tete";
+assertEquals(42, obj.x);
+obj.x = { get: function() {return 43}, set: function() {} };
+assertEquals(42, obj.x);
+
+// Test on accessors.
+var obj2 = {};
+function get() { return 43; };
+function set() {};
+Object.defineProperty(obj2, 'x', { get: get, set: set, configurable: true });
+
+desc = Object.getOwnPropertyDescriptor(obj2, 'x');
+assertTrue(desc.configurable);
+assertEquals(undefined, desc.value);
+assertEquals(set, desc.set);
+assertEquals(get, desc.get);
+
+assertTrue(Object.isExtensible(obj2));
+assertFalse(Object.isFrozen(obj2));
+Object.freeze(obj2);
+assertTrue(Object.isFrozen(obj2));
+assertFalse(Object.isExtensible(obj2));
+
+desc = Object.getOwnPropertyDescriptor(obj2, 'x');
+assertFalse(desc.configurable);
+assertEquals(undefined, desc.value);
+assertEquals(set, desc.set);
+assertEquals(get, desc.get);
+
+try {
+  obj2.foo = 42;
+  assertUnreachable();
+} catch(e) {
+  assertTrue(/object is not extensible/.test(e));
+}
+
+
+// Test freeze on arrays.
+var arr = new Array(42,43);
+
+desc = Object.getOwnPropertyDescriptor(arr, '0');
+assertTrue(desc.configurable);
+assertTrue(desc.writable);
+assertEquals(42, desc.value);
+
+desc = Object.getOwnPropertyDescriptor(arr, '1');
+assertTrue(desc.configurable);
+assertTrue(desc.writable);
+assertEquals(43, desc.value);
+
+assertTrue(Object.isExtensible(arr));
+assertFalse(Object.isFrozen(arr));
+Object.freeze(arr);
+assertTrue(Object.isFrozen(arr));
+assertFalse(Object.isExtensible(arr));
+
+desc = Object.getOwnPropertyDescriptor(arr, '0');
+assertFalse(desc.configurable);
+assertFalse(desc.writable);
+assertEquals(42, desc.value);
+
+desc = Object.getOwnPropertyDescriptor(arr, '1');
+assertFalse(desc.configurable);
+assertFalse(desc.writable);
+assertEquals(43, desc.value);
+
+arr[0] = 'foo';
+
+assertEquals(arr[0], 42);
+
+
+// Test that isFrozen return the correct value even if configurable has been set
+// to false on all properties manually and the extensible flag has also been set
+// to false manually.
+var obj3 = { x: 42, y: 'foo' };
+
+assertFalse(Object.isFrozen(obj3));
+
+Object.defineProperty(obj3, 'x', {configurable: false, writable: false});
+Object.defineProperty(obj3, 'y', {configurable: false, writable: false});
+Object.preventExtensions(obj3);
+
+assertTrue(Object.isFrozen(obj3));