Allow new-space JSFunction objects as constant-function properties.

Port to x64 and ARM and some refactoring of ia32.
Committed: http://code.google.com/p/v8/source/detail?r=10174

[fschneider, 2011-10-12 11:54:13]

This a rather subtle change since it is not easy to verify that we don't
accidentally embed JSFunction into code. Right now we catch this cases only
debug-mode ASSERTs.

To convince myself that I found all places I manually renamed all assember-ia32
functions (mov, cmp, push, Immediate) that take a Handle<Object> as argument in
a separate workspace and checked all call sites that we never store a new-space
JSFunction object without indirecting through a cell.

Ideally we could statically make sure that this can't happen, but for now I
don't see a nice way of enforcing this (without changing a lot of code), so I
left this out of this change.

[Vyacheslav Egorov (Chromium), 2011-10-12 12:36:05]

change is gc unsafe: please transitively check that all callers of
LoadHeapObject can cope with GC (either handlified or don't use raw pointers
across gcs).

http://codereview.chromium.org/8111006/diff/15001/src/arm/macro-assembler-arm.cc
File src/arm/macro-assembler-arm.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/arm/macro-assembler-arm...
src/arm/macro-assembler-arm.cc:1120: LoadHeapObject(r1,
Handle<JSFunction>(function));
Some callers of InvokeFunction are not handlified and use raw pointer across
invocation of InvokeFunction. see for example CompileStringFromCharCodeCall

variable name is used after InvokeFunction is called.

http://codereview.chromium.org/8111006/diff/15001/src/arm/stub-cache-arm.cc
File src/arm/stub-cache-arm.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/arm/stub-cache-arm.cc#n...
src/arm/stub-cache-arm.cc:568: static MaybeObject* GenerateFastApiDirectCall(
This function returns MaybeObject*

Some callers might not be able to survive GC in LoadHeapObject (cell
allocation). 

Maybe introduce TryLoadHeapObject that tries to allocate cell and returns
failure if fails.

http://codereview.chromium.org/8111006/diff/15001/src/arm/stub-cache-arm.cc#n...
src/arm/stub-cache-arm.cc:1192: void
StubCompiler::GenerateLoadConstant(JSObject* object,
some callers of this function are not handlfied and use raw pointers across
invocations of GenerateLoadConstant.

http://codereview.chromium.org/8111006/diff/15001/src/ia32/macro-assembler-ia...
File src/ia32/macro-assembler-ia32.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/ia32/macro-assembler-ia...
src/ia32/macro-assembler-ia32.cc:2059: void
MacroAssembler::InvokeFunction(JSFunction* function,
probably not gc safe.

check all callers.

http://codereview.chromium.org/8111006/diff/15001/src/ia32/stub-cache-ia32.cc
File src/ia32/stub-cache-ia32.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/ia32/stub-cache-ia32.cc...
src/ia32/stub-cache-ia32.cc:415: static MaybeObject*
GenerateFastApiCall(MacroAssembler* masm,
check all callers for gc safeness.

http://codereview.chromium.org/8111006/diff/15001/src/ia32/stub-cache-ia32.cc...
src/ia32/stub-cache-ia32.cc:1109: void
StubCompiler::GenerateLoadConstant(JSObject* object,
check all callers for gc safeness.

http://codereview.chromium.org/8111006/diff/15001/src/x64/macro-assembler-x64.cc
File src/x64/macro-assembler-x64.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/x64/macro-assembler-x64...
src/x64/macro-assembler-x64.cc:3099: void
MacroAssembler::InvokeFunction(JSFunction* function,
check all callers for gc safeness.

http://codereview.chromium.org/8111006/diff/15001/src/x64/stub-cache-x64.cc
File src/x64/stub-cache-x64.cc (right):

http://codereview.chromium.org/8111006/diff/15001/src/x64/stub-cache-x64.cc#n...
src/x64/stub-cache-x64.cc:406: static MaybeObject*
GenerateFastApiCall(MacroAssembler* masm,
check all callers for gc safeness.

http://codereview.chromium.org/8111006/diff/15001/src/x64/stub-cache-x64.cc#n...
src/x64/stub-cache-x64.cc:1084: void
StubCompiler::GenerateLoadConstant(JSObject* object,
check all callers for gc safeness.

[fschneider, 2011-11-16 16:11:08]

Rebased after stub compiler is handlified. Now all code generation functions in
the stub compiler can tolerate GC and make it possible to allocate cells on
demand when embedding new-space functions.

[fschneider, 2011-12-01 14:33:17]

Rebased and fixed one bug on x64.

http://codereview.chromium.org/8111006/diff/29001/src/x64/lithium-codegen-x64.cc
File src/x64/lithium-codegen-x64.cc (right):

http://codereview.chromium.org/8111006/diff/29001/src/x64/lithium-codegen-x64...
src/x64/lithium-codegen-x64.cc:1940: __ PushHeapObject(instr->function());
Fixed missing PushHeapObject here.

[Vyacheslav Egorov (Chromium), 2011-12-02 12:44:42]

lgtm

http://codereview.chromium.org/8111006/diff/29001/src/objects-inl.h
File src/objects-inl.h (right):

http://codereview.chromium.org/8111006/diff/29001/src/objects-inl.h#newcode1713
src/objects-inl.h:1713: if (array->GetHeap()->InNewSpace(value)) {
Get heap once and cache it locally.

[fschneider, 2011-12-02 13:51:19]

http://codereview.chromium.org/8111006/diff/29001/src/objects-inl.h
File src/objects-inl.h (right):

http://codereview.chromium.org/8111006/diff/29001/src/objects-inl.h#newcode1713
src/objects-inl.h:1713: if (array->GetHeap()->InNewSpace(value)) {
On 2011/12/02 12:44:42, Vyacheslav Egorov wrote:
> Get heap once and cache it locally. 

Done.