deps: upgrade v8 to 4.1.0.25

PR-URL: https://github.com/iojs/io.js/pull/1224
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

10 files changed, 126 insertions, 66 deletions

diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index 89caae648c..6cda4f2397 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -45,6 +45,7 @@ Jan de Mooij <jandemooij@gmail.com>
 Jay Freeman <saurik@saurik.com>
 James Pike <g00gle@chilon.net>
 Joel Stanley <joel.stan@gmail.com>
+Johan Bergström <johan@bergstroem.nu>
 John Jozwiak <jjozwiak@codeaurora.org>
 Jonathan Liu <net147@gmail.com>
 Kun Zhang <zhangk@codeaurora.org>
diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py
index 6d19a4e574..040972e8da 100644
--- a/deps/v8/PRESUBMIT.py
+++ b/deps/v8/PRESUBMIT.py
@@ -198,8 +198,8 @@ def _CommonChecks(input_api, output_api):
 
 def _SkipTreeCheck(input_api, output_api):
   """Check the env var whether we want to skip tree check.
-     Only skip if src/version.cc has been updated."""
-  src_version = 'src/version.cc'
+     Only skip if include/v8-version.h has been updated."""
+  src_version = 'include/v8-version.h'
   FilterFile = lambda file: file.LocalPath() == src_version
   if not input_api.AffectedSourceFiles(
       lambda file: file.LocalPath() == src_version):
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
new file mode 100644
index 0000000000..3416edebca
--- /dev/null
+++ b/deps/v8/include/v8-version.h
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_INCLUDE_VERSION_H_  // V8_VERSION_H_ conflicts with src/version.h
+#define V8_INCLUDE_VERSION_H_
+
+// These macros define the version number for the current version.
+// NOTE these macros are used by some of the tool scripts and the build
+// system so their names cannot be changed without changing the scripts.
+#define V8_MAJOR_VERSION 4
+#define V8_MINOR_VERSION 1
+#define V8_BUILD_NUMBER 0
+#define V8_PATCH_LEVEL 25
+
+// Use 1 for candidates and 0 otherwise.
+// (Boolean macro values are not supported by all preprocessors.)
+#define V8_IS_CANDIDATE_VERSION 0
+
+#endif  // V8_INCLUDE_VERSION_H_
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index d35f2fcb27..32730ebc5f 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -19,6 +19,7 @@
 #include <stdint.h>
 #include <stdio.h>
 
+#include "v8-version.h"
 #include "v8config.h"
 
 // We reserve the V8_* prefix for macros defined in V8 public API and
diff --git a/deps/v8/src/hydrogen-check-elimination.cc b/deps/v8/src/hydrogen-check-elimination.cc
index 1530fe1cf5..4bdad06503 100644
--- a/deps/v8/src/hydrogen-check-elimination.cc
+++ b/deps/v8/src/hydrogen-check-elimination.cc
@@ -628,14 +628,23 @@ class HCheckTable : public ZoneObject {
     HValue* object = instr->object()->ActualValue();
     HCheckTableEntry* entry = Find(object);
     // Can only learn more about an object that already has a known set of maps.
-    if (entry == NULL) return;
+    if (entry == NULL) {
+      Kill(object);
+      return;
+    }
     EnsureChecked(entry, object, instr);
     if (entry->maps_->Contains(instr->original_map())) {
       // If the object has the original map, it will be transitioned.
       UniqueSet<Map>* maps = entry->maps_->Copy(zone());
       maps->Remove(instr->original_map());
       maps->Add(instr->transitioned_map(), zone());
-      entry->maps_ = maps;
+      HCheckTableEntry::State state =
+          (entry->state_ == HCheckTableEntry::CHECKED_STABLE &&
+           instr->map_is_stable())
+              ? HCheckTableEntry::CHECKED_STABLE
+              : HCheckTableEntry::CHECKED;
+      Kill(object);
+      Insert(object, NULL, maps, state);
     } else {
       // Object does not have the given map, thus the transition is redundant.
       instr->DeleteAndReplaceWith(object);
diff --git a/deps/v8/src/hydrogen-instructions.h b/deps/v8/src/hydrogen-instructions.h
index 74f2711814..c863612cdd 100644
--- a/deps/v8/src/hydrogen-instructions.h
+++ b/deps/v8/src/hydrogen-instructions.h
@@ -7355,8 +7355,13 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> {
   HValue* context() const { return OperandAt(1); }
   Unique<Map> original_map() const { return original_map_; }
   Unique<Map> transitioned_map() const { return transitioned_map_; }
-  ElementsKind from_kind() const { return from_kind_; }
-  ElementsKind to_kind() const { return to_kind_; }
+  ElementsKind from_kind() const {
+    return FromElementsKindField::decode(bit_field_);
+  }
+  ElementsKind to_kind() const {
+    return ToElementsKindField::decode(bit_field_);
+  }
+  bool map_is_stable() const { return MapIsStableField::decode(bit_field_); }
 
   std::ostream& PrintDataTo(std::ostream& os) const OVERRIDE;  // NOLINT
 
@@ -7372,29 +7377,33 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> {
   int RedefinedOperandIndex() OVERRIDE { return 0; }
 
  private:
-  HTransitionElementsKind(HValue* context,
-                          HValue* object,
+  HTransitionElementsKind(HValue* context, HValue* object,
                           Handle<Map> original_map,
                           Handle<Map> transitioned_map)
       : original_map_(Unique<Map>(original_map)),
         transitioned_map_(Unique<Map>(transitioned_map)),
-        from_kind_(original_map->elements_kind()),
-        to_kind_(transitioned_map->elements_kind()) {
+        bit_field_(
+            FromElementsKindField::encode(original_map->elements_kind()) |
+            ToElementsKindField::encode(transitioned_map->elements_kind()) |
+            MapIsStableField::encode(transitioned_map->is_stable())) {
     SetOperandAt(0, object);
     SetOperandAt(1, context);
     SetFlag(kUseGVN);
     SetChangesFlag(kElementsKind);
-    if (!IsSimpleMapChangeTransition(from_kind_, to_kind_)) {
+    if (!IsSimpleMapChangeTransition(from_kind(), to_kind())) {
       SetChangesFlag(kElementsPointer);
       SetChangesFlag(kNewSpacePromotion);
     }
     set_representation(Representation::Tagged());
   }
 
+  class FromElementsKindField : public BitField<ElementsKind, 0, 5> {};
+  class ToElementsKindField : public BitField<ElementsKind, 5, 5> {};
+  class MapIsStableField : public BitField<bool, 10, 1> {};
+
   Unique<Map> original_map_;
   Unique<Map> transitioned_map_;
-  ElementsKind from_kind_;
-  ElementsKind to_kind_;
+  uint32_t bit_field_;
 };
 
 
diff --git a/deps/v8/src/hydrogen.cc b/deps/v8/src/hydrogen.cc
index a6843115bb..e8fa84f264 100644
--- a/deps/v8/src/hydrogen.cc
+++ b/deps/v8/src/hydrogen.cc
@@ -6954,9 +6954,6 @@ HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
     PropertyAccessType access_type,
     KeyedAccessStoreMode store_mode) {
   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
-  if (dependency) {
-    checked_object->ClearDependsOnFlag(kElementsKind);
-  }
 
   if (access_type == STORE && map->prototype()->IsJSObject()) {
     // monomorphic stores need a prototype chain check because shape
diff --git a/deps/v8/src/version.cc b/deps/v8/src/version.cc
index edcf2be2db..eaef96d44d 100644
--- a/deps/v8/src/version.cc
+++ b/deps/v8/src/version.cc
@@ -1,51 +1,17 @@
 // Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
+#include "include/v8-version.h"
 #include "src/v8.h"
-
 #include "src/version.h"
 
-// These macros define the version number for the current version.
-// NOTE these macros are used by some of the tool scripts and the build
-// system so their names cannot be changed without changing the scripts.
-#define MAJOR_VERSION     4
-#define MINOR_VERSION     1
-#define BUILD_NUMBER      0
-#define PATCH_LEVEL       21
-// Use 1 for candidates and 0 otherwise.
-// (Boolean macro values are not supported by all preprocessors.)
-#define IS_CANDIDATE_VERSION 0
-
 // Define SONAME to have the build system put a specific SONAME into the
 // shared library instead the generic SONAME generated from the V8 version
 // number. This define is mainly used by the build system script.
 #define SONAME            ""
 
-#if IS_CANDIDATE_VERSION
+#if V8_IS_CANDIDATE_VERSION
 #define CANDIDATE_STRING " (candidate)"
 #else
 #define CANDIDATE_STRING ""
@@ -54,24 +20,24 @@
 #define SX(x) #x
 #define S(x) SX(x)
 
-#if PATCH_LEVEL > 0
-#define VERSION_STRING                                                         \
-    S(MAJOR_VERSION) "." S(MINOR_VERSION) "." S(BUILD_NUMBER) "."              \
-        S(PATCH_LEVEL) CANDIDATE_STRING
+#if V8_PATCH_LEVEL > 0
+#define VERSION_STRING                                                      \
+  S(V8_MAJOR_VERSION) "." S(V8_MINOR_VERSION) "." S(V8_BUILD_NUMBER) "." S( \
+      V8_PATCH_LEVEL) CANDIDATE_STRING
 #else
-#define VERSION_STRING                                                         \
-    S(MAJOR_VERSION) "." S(MINOR_VERSION) "." S(BUILD_NUMBER)                  \
-        CANDIDATE_STRING
+#define VERSION_STRING                                               \
+  S(V8_MAJOR_VERSION) "." S(V8_MINOR_VERSION) "." S(V8_BUILD_NUMBER) \
+      CANDIDATE_STRING
 #endif
 
 namespace v8 {
 namespace internal {
 
-int Version::major_ = MAJOR_VERSION;
-int Version::minor_ = MINOR_VERSION;
-int Version::build_ = BUILD_NUMBER;
-int Version::patch_ = PATCH_LEVEL;
-bool Version::candidate_ = (IS_CANDIDATE_VERSION != 0);
+int Version::major_ = V8_MAJOR_VERSION;
+int Version::minor_ = V8_MINOR_VERSION;
+int Version::build_ = V8_BUILD_NUMBER;
+int Version::patch_ = V8_PATCH_LEVEL;
+bool Version::candidate_ = (V8_IS_CANDIDATE_VERSION != 0);
 const char* Version::soname_ = SONAME;
 const char* Version::version_string_ = VERSION_STRING;
 
diff --git a/deps/v8/test/mjsunit/regress/regress-460917.js b/deps/v8/test/mjsunit/regress/regress-460917.js
new file mode 100644
index 0000000000..68e1b63088
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-460917.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function boom(a1, a2) {
+  // Do something with a2 that needs a map check (for DOUBLE_ELEMENTS).
+  var s = a2[0];
+  // Emit a load that transitions a1 to FAST_ELEMENTS.
+  var t = a1[0];
+  // Emit a store to a2 that assumes DOUBLE_ELEMENTS.
+  // The map check is considered redundant and will be eliminated.
+  a2[0] = 0.3;
+}
+
+// Prepare type feedback for the "t = a1[0]" load: fast elements.
+var fast_elem = new Array(1);
+fast_elem[0] = "tagged";
+boom(fast_elem, [1]);
+
+// Prepare type feedback for the "a2[0] = 0.3" store: double elements.
+var double_elem = new Array(1);
+double_elem[0] = 0.1;
+boom(double_elem, double_elem);
+
+// Reset |double_elem| and go have a party.
+double_elem = new Array(10);
+double_elem[0] = 0.1;
+
+%OptimizeFunctionOnNextCall(boom);
+boom(double_elem, double_elem);
+
+assertEquals(0.3, double_elem[0]);
+assertEquals(undefined, double_elem[1]);
diff --git a/deps/v8/test/mjsunit/regress/regress-467481.js b/deps/v8/test/mjsunit/regress/regress-467481.js
new file mode 100644
index 0000000000..dcb12d89b0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-467481.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a1, a2) {
+  var v7 = a2[0];
+  var v8 = a1[0];
+  a2[0] = 0.3;
+}
+v6 = new Array(1);
+v6[0] = "tagged";
+f(v6, [1]);
+v5 = new Array(1);
+v5[0] = 0.1;
+f(v5, v5);
+v5 = new Array(10);
+f(v5, v5);
+%OptimizeFunctionOnNextCall(f);
+f(v5, v5);
+v5[0];