A64: Synchronize with r18581.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2626 matching lines @@
       previous_object, previous_object_size);
   AddStoreMapConstant(
       allocation_memento, isolate()->factory()->allocation_memento_map());
   Add<HStoreNamedField>(
       allocation_memento,
       HObjectAccess::ForAllocationMementoSite(),
       allocation_site);
   if (FLAG_allocation_site_pretenuring) {
     HValue* memento_create_count = Add<HLoadNamedField>(
         allocation_site, HObjectAccess::ForAllocationSiteOffset(
-            AllocationSite::kMementoCreateCountOffset));
+            AllocationSite::kPretenureCreateCountOffset));
     memento_create_count = AddUncasted<HAdd>(
         memento_create_count, graph()->GetConstant1());
     // This smi value is reset to zero after every gc, overflow isn't a problem
     // since the counter is bounded by the new space size.
     memento_create_count->ClearFlag(HValue::kCanOverflow);
     HStoreNamedField* store = Add<HStoreNamedField>(
         allocation_site, HObjectAccess::ForAllocationSiteOffset(
-            AllocationSite::kMementoCreateCountOffset), memento_create_count);
+            AllocationSite::kPretenureCreateCountOffset), memento_create_count);
     // No write barrier needed to store a smi.
     store->SkipWriteBarrier();
   }
 }
 
 
+HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
+  // Get the global context, then the native context
+  HInstruction* context =
+      Add<HLoadNamedField>(closure, HObjectAccess::ForFunctionContextPointer());
+  HInstruction* global_object = Add<HLoadNamedField>(context,
+      HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
+  HObjectAccess access = HObjectAccess::ForJSObjectOffset(
+      GlobalObject::kNativeContextOffset);
+  return Add<HLoadNamedField>(global_object, access);
+}
+
+
 HInstruction* HGraphBuilder::BuildGetNativeContext() {
   // Get the global context, then the native context
   HInstruction* global_object = Add<HGlobalObject>();
   HObjectAccess access = HObjectAccess::ForJSObjectOffset(
       GlobalObject::kNativeContextOffset);
   return Add<HLoadNamedField>(global_object, access);
 }
 
 
 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
@@ skipping 39 matching lines @@
     return builder()->Add<HConstant>(map);
   }
 
   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
     // No need for a context lookup if the kind_ matches the initial
     // map, because we can just load the map in that case.
     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
     return builder()->AddLoadNamedField(constructor_function_, access);
   }
 
-  HInstruction* native_context = builder()->BuildGetNativeContext();
+  // TODO(mvstanton): we should always have a constructor function if we
+  // are creating a stub.
+  HInstruction* native_context = constructor_function_ != NULL
+      ? builder()->BuildGetNativeContext(constructor_function_)
+      : builder()->BuildGetNativeContext();
+
   HInstruction* index = builder()->Add<HConstant>(
       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
 
   HInstruction* map_array = builder()->Add<HLoadKeyed>(
       native_context, index, static_cast<HValue*>(NULL), FAST_ELEMENTS);
 
   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
 
   return builder()->Add<HLoadKeyed>(
       map_array, kind_index, static_cast<HValue*>(NULL), FAST_ELEMENTS);
@@ skipping 1582 matching lines @@
   ASSERT(current_block() != NULL);
   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
 
   BreakAndContinueInfo break_info(stmt);
   CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry, &break_info));
   HBasicBlock* body_exit =
       JoinContinue(stmt, current_block(), break_info.continue_block());
   HBasicBlock* loop_successor = NULL;
   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
     set_current_block(body_exit);
-    // The block for a true condition, the actual predecessor block of the
-    // back edge.
-    body_exit = graph()->CreateBasicBlock();
     loop_successor = graph()->CreateBasicBlock();
-    CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
-    if (body_exit->HasPredecessor()) {
+    if (stmt->cond()->ToBooleanIsFalse()) {
+      Goto(loop_successor);
+      body_exit = NULL;
+    } else {
+      // The block for a true condition, the actual predecessor block of the
+      // back edge.
+      body_exit = graph()->CreateBasicBlock();
+      CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
+    }
+    if (body_exit != NULL && body_exit->HasPredecessor()) {
       body_exit->SetJoinId(stmt->BackEdgeId());
     } else {
       body_exit = NULL;
     }
     if (loop_successor->HasPredecessor()) {
       loop_successor->SetJoinId(stmt->ExitId());
     } else {
       loop_successor = NULL;
     }
   }
@@ skipping 227 matching lines @@
   ASSERT(current_block()->HasPredecessor());
   return Bailout(kDebuggerStatement);
 }
 
 
 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
   UNREACHABLE();
 }
 
 
-static Handle<SharedFunctionInfo> SearchSharedFunctionInfo(
-    Code* unoptimized_code, FunctionLiteral* expr) {
-  int start_position = expr->start_position();
-  for (RelocIterator it(unoptimized_code); !it.done(); it.next()) {
-    RelocInfo* rinfo = it.rinfo();
-    if (rinfo->rmode() != RelocInfo::EMBEDDED_OBJECT) continue;
-    Object* obj = rinfo->target_object();
-    if (obj->IsSharedFunctionInfo()) {
-      SharedFunctionInfo* shared = SharedFunctionInfo::cast(obj);
-      if (shared->start_position() == start_position) {
-        return Handle<SharedFunctionInfo>(shared);
-      }
-    }
-  }
-
-  return Handle<SharedFunctionInfo>();
-}
-
-
 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
-  Handle<SharedFunctionInfo> shared_info =
-      SearchSharedFunctionInfo(current_info()->shared_info()->code(), expr);
+  Handle<SharedFunctionInfo> shared_info = expr->shared_info();
   if (shared_info.is_null()) {
     shared_info = Compiler::BuildFunctionInfo(expr, current_info()->script());
   }
   // We also have a stack overflow if the recursive compilation did.
   if (HasStackOverflow()) return;
   HFunctionLiteral* instr =
       New<HFunctionLiteral>(shared_info, expr->pretenure());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
@@ skipping 68 matching lines @@
   HValue* context = environment()->context();
   int length = current_info()->scope()->ContextChainLength(var->scope());
   while (length-- > 0) {
     context = Add<HOuterContext>(context);
   }
   return context;
 }
 
 
 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
+  if (expr->is_this()) {
+    current_info()->set_this_has_uses(true);
+  }
+
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
   Variable* variable = expr->var();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       if (IsLexicalVariableMode(variable->mode())) {
         // TODO(rossberg): should this be an ASSERT?
         return Bailout(kReferenceToGlobalLexicalVariable);
       }
@@ skipping 2111 matching lines @@
 
 
 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
     Call* expr,
     HValue* receiver,
     SmallMapList* types,
     Handle<String> name) {
   if (TryCallPolymorphicAsMonomorphic(expr, receiver, types, name)) return;
 
   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
-  HBasicBlock* join = NULL;
-  FunctionSorter order[kMaxCallPolymorphism];
-  int ordered_functions = 0;
 
   Handle<Map> initial_string_map(
       isolate()->native_context()->string_function()->initial_map());
   Handle<Map> string_marker_map(
       JSObject::cast(initial_string_map->prototype())->map());
   Handle<Map> initial_number_map(
       isolate()->native_context()->number_function()->initial_map());
   Handle<Map> number_marker_map(
       JSObject::cast(initial_number_map->prototype())->map());
   Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
 
   bool handle_smi = false;
 
+  // A map from functions to a set of receivers' maps.
+  struct FuncMapEntry {
+    Handle<JSFunction> func;
+    SmallMapList maps;
+  };
+  FuncMapEntry func_map[kMaxCallPolymorphism];
+  FunctionSorter order[kMaxCallPolymorphism];
+  int func_count = 0;
+  int maps_count = 0;
+
   for (int i = 0;
-       i < types->length() && ordered_functions < kMaxCallPolymorphism;
+       i < types->length() && func_count < kMaxCallPolymorphism;
        ++i) {
     Handle<Map> map = types->at(i);
     if (expr->ComputeTarget(map, name)) {
       if (map.is_identical_to(number_marker_map)) handle_smi = true;
-      order[ordered_functions++] =
-          FunctionSorter(i,
-                         expr->target()->shared()->profiler_ticks(),
-                         InliningAstSize(expr->target()),
-                         expr->target()->shared()->SourceSize());
+
+      // Try to find the target function among known targets.
+      int func_index = 0;
+      for (; func_index < func_count; ++func_index) {
+        if (*func_map[func_index].func == *expr->target()) {
+          break;
+        }
+      }
+      FuncMapEntry* entry = &func_map[func_index];
+      if (func_index == func_count) {
+        // Entry not found, "allocate" it.
+        entry->func = expr->target();
+        entry->maps.Reserve(types->length() - maps_count, zone());
+        order[func_index] =
+            FunctionSorter(func_index,
+                           entry->func->shared()->profiler_ticks(),
+                           InliningAstSize(entry->func),
+                           entry->func->shared()->SourceSize());
+        ++func_count;
+      }
+      entry->maps.Add(map, zone());
+      ++maps_count;
     }
   }
 
-  std::sort(order, order + ordered_functions);
+  std::sort(order, order + func_count);
 
   HBasicBlock* number_block = NULL;
+  HBasicBlock* join = NULL;
 
-  for (int fn = 0; fn < ordered_functions; ++fn) {
+  if (func_count > 0) {
+    // Only needed once.
+    join = graph()->CreateBasicBlock();
+    if (handle_smi) {
+      HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
+      HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
+      number_block = graph()->CreateBasicBlock();
+      FinishCurrentBlock(
+          New<HIsSmiAndBranch>(receiver, empty_smi_block, not_smi_block));
+      Goto(empty_smi_block, number_block);
+      set_current_block(not_smi_block);
+    } else {
+      BuildCheckHeapObject(receiver);
+    }
+  }
+
+  for (int fn = 0; fn < func_count; ++fn) {
     int i = order[fn].index();
-    Handle<Map> map = types->at(i);
-    if (fn == 0) {
-      // Only needed once.
-      join = graph()->CreateBasicBlock();
-      if (handle_smi) {
-        HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
-        HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
-        number_block = graph()->CreateBasicBlock();
-        FinishCurrentBlock(New<HIsSmiAndBranch>(
-                receiver, empty_smi_block, not_smi_block));
-        Goto(empty_smi_block, number_block);
-        set_current_block(not_smi_block);
+    FuncMapEntry* func_map_entry = &func_map[i];
+
+    HBasicBlock* call_block = graph()->CreateBasicBlock();
+    HBasicBlock* if_false = NULL;
+
+    int maps_count = func_map_entry->maps.length();
+    for (int m = 0; m < maps_count; ++m) {
+      Handle<Map> map = func_map_entry->maps.at(m);
+      HBasicBlock* if_true = graph()->CreateBasicBlock();
+      if_false = graph()->CreateBasicBlock();
+      HUnaryControlInstruction* compare;
+
+      if (handle_smi && map.is_identical_to(number_marker_map)) {
+        compare =
+            New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
+        map = initial_number_map;
+        expr->set_number_check(
+            Handle<JSObject>(JSObject::cast(map->prototype())));
+      } else if (map.is_identical_to(string_marker_map)) {
+        compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
+        map = initial_string_map;
+        expr->set_string_check(
+            Handle<JSObject>(JSObject::cast(map->prototype())));
       } else {
-        BuildCheckHeapObject(receiver);
+        compare = New<HCompareMap>(receiver, map, if_true, if_false);
+        expr->set_map_check();
       }
-    }
-    HBasicBlock* if_true = graph()->CreateBasicBlock();
-    HBasicBlock* if_false = graph()->CreateBasicBlock();
-    HUnaryControlInstruction* compare;
 
-    if (handle_smi && map.is_identical_to(number_marker_map)) {
-      compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
-      map = initial_number_map;
-      expr->set_number_check(
-          Handle<JSObject>(JSObject::cast(map->prototype())));
-    } else if (map.is_identical_to(string_marker_map)) {
-      compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
-      map = initial_string_map;
-      expr->set_string_check(
-          Handle<JSObject>(JSObject::cast(map->prototype())));
-    } else {
-      compare = New<HCompareMap>(receiver, map, if_true, if_false);
-      expr->set_map_check();
+      FinishCurrentBlock(compare);
+
+      if (expr->check_type() == NUMBER_CHECK) {
+        Goto(if_true, number_block);
+        if_true = number_block;
+        number_block->SetJoinId(expr->id());
+      }
+      set_current_block(if_true);
+
+      expr->ComputeTarget(map, name);
+      ASSERT(*expr->target() == *func_map_entry->func);
+
+      AddCheckPrototypeMaps(expr->holder(), map);
+
+      Goto(if_true, call_block);
+
+      set_current_block(if_false);
     }
 
-    FinishCurrentBlock(compare);
+    // Generate call once for all corresponding maps.
+    call_block->SetJoinId(expr->id());
+    set_current_block(call_block);
 
-    if (expr->check_type() == NUMBER_CHECK) {
-      Goto(if_true, number_block);
-      if_true = number_block;
-      number_block->SetJoinId(expr->id());
-    }
-    set_current_block(if_true);
-
-    expr->ComputeTarget(map, name);
-    AddCheckPrototypeMaps(expr->holder(), map);
     if (FLAG_trace_inlining && FLAG_polymorphic_inlining) {
       Handle<JSFunction> caller = current_info()->closure();
       SmartArrayPointer<char> caller_name =
           caller->shared()->DebugName()->ToCString();
       PrintF("Trying to inline the polymorphic call to %s from %s\n",
              name->ToCString().get(),
              caller_name.get());
     }
     if (FLAG_polymorphic_inlining && TryInlineCall(expr)) {
       // Trying to inline will signal that we should bailout from the
       // entire compilation by setting stack overflow on the visitor.
       if (HasStackOverflow()) return;
     } else {
       HCallConstantFunction* call =
           New<HCallConstantFunction>(expr->target(), argument_count);
       PreProcessCall(call);
       AddInstruction(call);
       if (!ast_context()->IsEffect()) Push(call);
     }
+    if (current_block() != NULL) Goto(join);
 
-    if (current_block() != NULL) Goto(join);
     set_current_block(if_false);
   }
 
   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
   // know about and do not want to handle ones we've never seen.  Otherwise
   // use a generic IC.
-  if (ordered_functions == types->length() && FLAG_deoptimize_uncommon_cases) {
+  if (maps_count == types->length() && FLAG_deoptimize_uncommon_cases) {
     // Because the deopt may be the only path in the polymorphic call, make sure
     // that the environment stack matches the depth on deopt that it otherwise
     // would have had after a successful call.
     Drop(argument_count);
     if (!ast_context()->IsEffect()) Push(graph()->GetConstant0());
     FinishExitWithHardDeoptimization("Unknown map in polymorphic call", join);
   } else {
     HCallNamed* call = New<HCallNamed>(name, argument_count);
     PreProcessCall(call);
 
@@ skipping 229 matching lines @@
   ASSERT(target_shared->has_deoptimization_support());
   AstTyper::Run(&target_info);
 
   // Save the pending call context. Set up new one for the inlined function.
   // The function state is new-allocated because we need to delete it
   // in two different places.
   FunctionState* target_state = new FunctionState(
       this, &target_info, inlining_kind);
 
   HConstant* undefined = graph()->GetConstantUndefined();
-  bool undefined_receiver = HEnvironment::UseUndefinedReceiver(
-      target, function, call_kind, inlining_kind);
+
   HEnvironment* inner_env =
       environment()->CopyForInlining(target,
                                      arguments_count,
                                      function,
                                      undefined,
-                                     function_state()->inlining_kind(),
-                                     undefined_receiver);
+                                     function_state()->inlining_kind());
 
 // TODO(jochen): Remove this #ifdef once A64's register allocator can allocate
 // cp.
 #if !V8_TARGET_ARCH_A64
   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
   inner_env->BindContext(context);
 #endif
 
   Add<HSimulate>(return_id);
   current_block()->UpdateEnvironment(inner_env);
   HArgumentsObject* arguments_object = NULL;
 
   // If the function uses arguments object create and bind one, also copy
   // current arguments values to use them for materialization.
   if (function->scope()->arguments() != NULL) {
     ASSERT(function->scope()->arguments()->IsStackAllocated());
     HEnvironment* arguments_env = inner_env->arguments_environment();
     int arguments_count = arguments_env->parameter_count();
     arguments_object = Add<HArgumentsObject>(arguments_count);
     inner_env->Bind(function->scope()->arguments(), arguments_object);
     for (int i = 0; i < arguments_count; i++) {
       arguments_object->AddArgument(arguments_env->Lookup(i), zone());
     }
   }
 
   HEnterInlined* enter_inlined =
       Add<HEnterInlined>(target, arguments_count, function,
                          function_state()->inlining_kind(),
                          function->scope()->arguments(),
-                         arguments_object, undefined_receiver);
+                         arguments_object);
   function_state()->set_entry(enter_inlined);
 
   VisitDeclarations(target_info.scope()->declarations());
   VisitStatements(function->body());
   if (HasStackOverflow()) {
     // Bail out if the inline function did, as we cannot residualize a call
     // instead.
     TraceInline(target, caller, "inline graph construction failed");
     target_shared->DisableOptimization(kInliningBailedOut);
     inline_bailout_ = true;
@@ skipping 348 matching lines @@
   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
 
   // Found pattern f.apply(receiver, arguments).
   CHECK_ALIVE_OR_RETURN(VisitForValue(prop->obj()), true);
   HValue* function = Top();
 
   AddCheckConstantFunction(expr->holder(), function, function_map);
-  Drop(1);
 
   CHECK_ALIVE_OR_RETURN(VisitForValue(args->at(0)), true);
   HValue* receiver = Pop();
 
+  Drop(1);  // Pop the function.
+
   if (function_state()->outer() == NULL) {
     HInstruction* elements = Add<HArgumentsElements>(false);
     HInstruction* length = Add<HArgumentsLength>(elements);
     HValue* wrapped_receiver = BuildWrapReceiver(receiver, function);
     HInstruction* result = New<HApplyArguments>(function,
                                                 wrapped_receiver,
                                                 length,
                                                 elements);
     ast_context()->ReturnInstruction(result, expr->id());
     return true;
@@ skipping 28 matching lines @@
     HInvokeFunction* call = New<HInvokeFunction>(function,
                                                  known_function,
                                                  arguments_count);
     Drop(arguments_count);
     ast_context()->ReturnInstruction(call, expr->id());
     return true;
   }
 }
 
 
+HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
+                                                    Handle<JSFunction> target) {
+  SharedFunctionInfo* shared = target->shared();
+  if (shared->is_classic_mode() && !shared->native()) {
+    HValue* context = Add<HLoadNamedField>(
+        function,
+        HObjectAccess::ForJSObjectOffset(JSFunction::kContextOffset));
+    HValue* global_object = Add<HLoadNamedField>(
+        context,
+        HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
+    return Add<HLoadNamedField>(
+        global_object,
+        HObjectAccess::ForJSObjectOffset(
+            GlobalObject::kGlobalReceiverOffset));
+  }
+  return graph()->GetConstantUndefined();
+}
+
+
 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
   Expression* callee = expr->expression();
   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
   HInstruction* call = NULL;
 
   Property* prop = callee->AsProperty();
   if (prop != NULL) {
@@ skipping 94 matching lines @@
       if (type == kUseCell &&
           !current_info()->global_object()->IsAccessCheckNeeded()) {
         Handle<GlobalObject> global(current_info()->global_object());
         known_global_function = expr->ComputeGlobalTarget(global, &lookup);
       }
       if (known_global_function) {
         // Push the global object instead of the global receiver because
         // code generated by the full code generator expects it.
         HGlobalObject* global_object = Add<HGlobalObject>();
         Push(global_object);
+
         CHECK_ALIVE(VisitExpressions(expr->arguments()));
 
         CHECK_ALIVE(VisitForValue(expr->expression()));
         HValue* function = Pop();
         Add<HCheckValue>(function, expr->target());
 
-        // Replace the global object with the global receiver.
-        HGlobalReceiver* global_receiver = Add<HGlobalReceiver>(global_object);
-        // Index of the receiver from the top of the expression stack.
+        // Patch the global object on the stack by the expected receiver.
+        HValue* receiver = ImplicitReceiverFor(function, expr->target());
         const int receiver_index = argument_count - 1;
-        ASSERT(environment()->ExpressionStackAt(receiver_index)->
-               IsGlobalObject());
-        environment()->SetExpressionStackAt(receiver_index, global_receiver);
+        environment()->SetExpressionStackAt(receiver_index, receiver);
 
         if (TryInlineBuiltinFunctionCall(expr, false)) {  // Nothing to drop.
           if (FLAG_trace_inlining) {
             PrintF("Inlining builtin ");
             expr->target()->ShortPrint();
             PrintF("\n");
           }
           return;
         }
         if (TryInlineCall(expr)) return;
 
         if (expr->target().is_identical_to(current_info()->closure())) {
           graph()->MarkRecursive();
         }
 
         if (CallStubCompiler::HasCustomCallGenerator(expr->target())) {
+          // We're about to install a contextual IC, which expects the global
+          // object as receiver rather than the global proxy.
+          HGlobalObject* global_object = Add<HGlobalObject>();
+          const int receiver_index = argument_count - 1;
+          environment()->SetExpressionStackAt(receiver_index, global_object);
           // When the target has a custom call IC generator, use the IC,
           // because it is likely to generate better code.
-          call = PreProcessCall(New<HCallNamed>(var->name(), argument_count));
+          call = PreProcessCall(New<HCallGlobal>(var->name(), argument_count));
         } else {
           call = PreProcessCall(New<HCallKnownGlobal>(
               expr->target(), argument_count));
         }
       } else {
         HGlobalObject* receiver = Add<HGlobalObject>();
         Push(Add<HPushArgument>(receiver));
         CHECK_ALIVE(VisitArgumentList(expr->arguments()));
 
         call = New<HCallGlobal>(var->name(), argument_count);
         Drop(argument_count);
       }
 
     } else if (expr->IsMonomorphic()) {
       // The function is on the stack in the unoptimized code during
       // evaluation of the arguments.
       CHECK_ALIVE(VisitForValue(expr->expression()));
       HValue* function = Top();
-      HGlobalObject* global = Add<HGlobalObject>();
-      HGlobalReceiver* receiver = Add<HGlobalReceiver>(global);
+
+      Add<HCheckValue>(function, expr->target());
+
+      HValue* receiver = ImplicitReceiverFor(function, expr->target());
       Push(receiver);
+
       CHECK_ALIVE(VisitExpressions(expr->arguments()));
-      Add<HCheckValue>(function, expr->target());
 
       if (TryInlineBuiltinFunctionCall(expr, true)) {  // Drop the function.
         if (FLAG_trace_inlining) {
           PrintF("Inlining builtin ");
           expr->target()->ShortPrint();
           PrintF("\n");
         }
         return;
       }
 
       if (TryInlineCall(expr, true)) {   // Drop function from environment.
         return;
       } else {
         call = PreProcessCall(New<HInvokeFunction>(function, expr->target(),
                                                    argument_count));
         Drop(1);  // The function.
       }
 
     } else {
       CHECK_ALIVE(VisitForValue(expr->expression()));
       HValue* function = Top();
-      HGlobalObject* global_object = Add<HGlobalObject>();
-      HGlobalReceiver* receiver = Add<HGlobalReceiver>(global_object);
+      HValue* receiver = graph()->GetConstantUndefined();
       Push(Add<HPushArgument>(receiver));
       CHECK_ALIVE(VisitArgumentList(expr->arguments()));
-
-      call = New<HCallFunction>(function, argument_count);
+      call = New<HCallFunction>(
+          function, argument_count, NORMAL_CONTEXTUAL_CALL);
       Drop(argument_count + 1);
     }
   }
 
   return ast_context()->ReturnInstruction(call, expr->id());
 }
 
 
 void HOptimizedGraphBuilder::BuildInlinedCallNewArray(CallNew* expr) {
   NoObservableSideEffectsScope no_effects(this);
 
   int argument_count = expr->arguments()->length();
   // We should at least have the constructor on the expression stack.
   HValue* constructor = environment()->ExpressionStackAt(argument_count);
 
   ElementsKind kind = expr->elements_kind();
   Handle<Cell> cell = expr->allocation_info_cell();
-  AllocationSite* site = AllocationSite::cast(cell->value());
+  Handle<AllocationSite> site(AllocationSite::cast(cell->value()));
 
   // Register on the site for deoptimization if the cell value changes.
-  site->AddDependentCompilationInfo(AllocationSite::TRANSITIONS, top_info());
+  AllocationSite::AddDependentCompilationInfo(
+      site, AllocationSite::TRANSITIONS, top_info());
   HInstruction* cell_instruction = Add<HConstant>(cell);
 
   // In the single constant argument case, we may have to adjust elements kind
   // to avoid creating a packed non-empty array.
   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
     HValue* argument = environment()->Top();
     if (argument->IsConstant()) {
       HConstant* constant_argument = HConstant::cast(argument);
       ASSERT(constant_argument->HasSmiValue());
       int constant_array_size = constant_argument->Integer32Value();
@@ skipping 842 matching lines @@
   }
   return number;
 }
 
 
 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Handle<Type>* expected) {
   if (value->IsConstant()) {
     HConstant* constant = HConstant::cast(value);
     Maybe<HConstant*> number = constant->CopyToTruncatedNumber(zone());
     if (number.has_value) {
-      *expected = handle(Type::Number(), isolate());
+      *expected = Type::Number(isolate());
       return AddInstruction(number.value);
     }
   }
 
   // We put temporary values on the stack, which don't correspond to anything
   // in baseline code. Since nothing is observable we avoid recording those
   // pushes with a NoObservableSideEffectsScope.
   NoObservableSideEffectsScope no_effects(this);
 
   Handle<Type> expected_type = *expected;
 
   // Separate the number type from the rest.
-  Handle<Type> expected_obj = handle(Type::Intersect(
-      expected_type, handle(Type::NonNumber(), isolate())), isolate());
-  Handle<Type> expected_number = handle(Type::Intersect(
-      expected_type, handle(Type::Number(), isolate())), isolate());
+  Handle<Type> expected_obj = Type::Intersect(
+      expected_type, Type::NonNumber(isolate()), isolate());
+  Handle<Type> expected_number = Type::Intersect(
+      expected_type, Type::Number(isolate()), isolate());
 
   // We expect to get a number.
   // (We need to check first, since Type::None->Is(Type::Any()) == true.
   if (expected_obj->Is(Type::None())) {
     ASSERT(!expected_number->Is(Type::None()));
     return value;
   }
 
   if (expected_obj->Is(Type::Undefined())) {
     // This is already done by HChange.
-    *expected = handle(Type::Union(
-          expected_number, handle(Type::Double(), isolate())), isolate());
+    *expected = Type::Union(
+          expected_number, Type::Double(isolate()), isolate());
     return value;
   }
 
   return value;
 }
 
 
 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
     BinaryOperation* expr,
     HValue* left,
@@ skipping 41 matching lines @@
 
   bool maybe_string_add = op == Token::ADD &&
                           (left_type->Maybe(Type::String()) ||
                            right_type->Maybe(Type::String()));
 
   if (left_type->Is(Type::None())) {
     Add<HDeoptimize>("Insufficient type feedback for LHS of binary operation",
                      Deoptimizer::SOFT);
     // TODO(rossberg): we should be able to get rid of non-continuous
     // defaults.
-    left_type = handle(Type::Any(), isolate());
+    left_type = Type::Any(isolate());
   } else {
     if (!maybe_string_add) left = TruncateToNumber(left, &left_type);
     left_rep = Representation::FromType(left_type);
   }
 
   if (right_type->Is(Type::None())) {
     Add<HDeoptimize>("Insufficient type feedback for RHS of binary operation",
                      Deoptimizer::SOFT);
-    right_type = handle(Type::Any(), isolate());
+    right_type = Type::Any(isolate());
   } else {
     if (!maybe_string_add) right = TruncateToNumber(right, &right_type);
     right_rep = Representation::FromType(right_type);
   }
 
   // Special case for string addition here.
   if (op == Token::ADD &&
       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
     // Validate type feedback for left argument.
     if (left_type->Is(Type::String())) {
@@ skipping 32 matching lines @@
     // Inline the string addition into the stub when creating allocation
     // mementos to gather allocation site feedback.
     if (graph()->info()->IsStub() &&
         allocation_mode.CreateAllocationMementos()) {
       return BuildStringAdd(left, right, allocation_mode);
     }
 
     // Register the dependent code with the allocation site.
     if (!allocation_mode.feedback_site().is_null()) {
       ASSERT(!graph()->info()->IsStub());
-      allocation_mode.feedback_site()->AddDependentCompilationInfo(
-          AllocationSite::TENURING, top_info());
+      Handle<AllocationSite> site(allocation_mode.feedback_site());
+      AllocationSite::AddDependentCompilationInfo(
+          site, AllocationSite::TENURING, top_info());
     }
 
     // Inline string addition if we know that we'll create a cons string.
     if (left->IsConstant()) {
       HConstant* c_left = HConstant::cast(left);
       if (c_left->HasStringValue()) {
         int c_left_length = c_left->StringValue()->length();
         if (c_left_length == 0) {
           return right;
         } else if (c_left_length + 1 >= ConsString::kMinLength) {
@@ skipping 423 matching lines @@
     Handle<Type> combined_type,
     int left_position,
     int right_position,
     BailoutId bailout_id) {
   // Cases handled below depend on collected type feedback. They should
   // soft deoptimize when there is no type feedback.
   if (combined_type->Is(Type::None())) {
     Add<HDeoptimize>("Insufficient type feedback for combined type "
                      "of binary operation",
                      Deoptimizer::SOFT);
-    combined_type = left_type = right_type = handle(Type::Any(), isolate());
+    combined_type = left_type = right_type = Type::Any(isolate());
   }
 
   Representation left_rep = Representation::FromType(left_type);
   Representation right_rep = Representation::FromType(right_type);
   Representation combined_rep = Representation::FromType(combined_type);
 
   if (combined_type->Is(Type::Receiver())) {
     if (Token::IsEqualityOp(op)) {
       // Can we get away with map check and not instance type check?
       HValue* operand_to_check =
@@ skipping 76 matching lines @@
   if (expr->op() == Token::EQ_STRICT) {
     HConstant* nil_constant = nil == kNullValue
         ? graph()->GetConstantNull()
         : graph()->GetConstantUndefined();
     HCompareObjectEqAndBranch* instr =
         New<HCompareObjectEqAndBranch>(value, nil_constant);
     return ast_context()->ReturnControl(instr, expr->id());
   } else {
     ASSERT_EQ(Token::EQ, expr->op());
     Handle<Type> type = expr->combined_type()->Is(Type::None())
-        ? handle(Type::Any(), isolate_)
-        : expr->combined_type();
+        ? Type::Any(isolate_) : expr->combined_type();
     HIfContinuation continuation;
     BuildCompareNil(value, type, &continuation);
     return ast_context()->ReturnContinuation(&continuation, expr->id());
   }
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
   // If we share optimized code between different closures, the
   // this-function is not a constant, except inside an inlined body.
@@ skipping 11 matching lines @@
     AllocationSiteUsageContext* site_context) {
   NoObservableSideEffectsScope no_effects(this);
   InstanceType instance_type = boilerplate_object->map()->instance_type();
   ASSERT(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
 
   HType type = instance_type == JS_ARRAY_TYPE
       ? HType::JSArray() : HType::JSObject();
   HValue* object_size_constant = Add<HConstant>(
       boilerplate_object->map()->instance_size());
 
-  // We should pull pre-tenure mode from the allocation site.
-  // For now, just see what it says, and remark on it if it sez
-  // we should pretenure. That means the rudimentary counting in the garbage
-  // collector is having an effect.
   PretenureFlag pretenure_flag = isolate()->heap()->GetPretenureMode();
   if (FLAG_allocation_site_pretenuring) {
-    pretenure_flag = site_context->current()->GetPretenureMode()
-        ? TENURED
-        : NOT_TENURED;
+    pretenure_flag = site_context->current()->GetPretenureMode();
+    Handle<AllocationSite> site(site_context->current());
+    AllocationSite::AddDependentCompilationInfo(
+        site, AllocationSite::TENURING, top_info());
   }
 
   HInstruction* object = Add<HAllocate>(object_size_constant, type,
       pretenure_flag, instance_type, site_context->current());
 
   BuildEmitObjectHeader(boilerplate_object, object);
 
   Handle<FixedArrayBase> elements(boilerplate_object->elements());
   int elements_size = (elements->length() > 0 &&
       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
@@ skipping 712 matching lines @@
 void HOptimizedGraphBuilder::GenerateGetFromCache(CallRuntime* call) {
   return Bailout(kInlinedRuntimeFunctionGetFromCache);
 }
 
 
 // Fast support for number to string.
 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
   ASSERT_EQ(1, call->arguments()->length());
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   HValue* number = Pop();
-  HValue* result = BuildNumberToString(
-      number, handle(Type::Number(), isolate()));
+  HValue* result = BuildNumberToString(number, Type::Number(isolate()));
   return ast_context()->ReturnValue(result);
 }
 
 
 // Fast call for custom callbacks.
 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
   // 1 ~ The function to call is not itself an argument to the call.
   int arg_count = call->arguments()->length() - 1;
   ASSERT(arg_count >= 1);  // There's always at least a receiver.
 
@@ skipping 311 matching lines @@
   new_env->ClearHistory();
   return new_env;
 }
 
 
 HEnvironment* HEnvironment::CopyForInlining(
     Handle<JSFunction> target,
     int arguments,
     FunctionLiteral* function,
     HConstant* undefined,
-    InliningKind inlining_kind,
-    bool undefined_receiver) const {
+    InliningKind inlining_kind) const {
   ASSERT(frame_type() == JS_FUNCTION);
 
   // Outer environment is a copy of this one without the arguments.
   int arity = function->scope()->num_parameters();
 
   HEnvironment* outer = Copy();
   outer->Drop(arguments + 1);  // Including receiver.
   outer->ClearHistory();
 
   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
@@ skipping 17 matching lines @@
   }
 
   HEnvironment* inner =
       new(zone()) HEnvironment(outer, function->scope(), target, zone());
   // Get the argument values from the original environment.
   for (int i = 0; i <= arity; ++i) {  // Include receiver.
     HValue* push = (i <= arguments) ?
         ExpressionStackAt(arguments - i) : undefined;
     inner->SetValueAt(i, push);
   }
-  // If the function we are inlining is a strict mode function or a
-  // builtin function, pass undefined as the receiver for function
-  // calls (instead of the global receiver).
-  if (undefined_receiver) {
-    inner->SetValueAt(0, undefined);
-  }
   inner->SetValueAt(arity + 1, context());
   for (int i = arity + 2; i < inner->length(); ++i) {
     inner->SetValueAt(i, undefined);
   }
 
   inner->set_ast_id(BailoutId::FunctionEntry());
   return inner;
 }
 
 
@@ skipping 84 matching lines @@
     } else  {
       PrintIndent();
       trace_.Add("successors");
       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
         trace_.Add(" \"B%d\"", it.Current()->block_id());
       }
       trace_.Add("\n");
     }
 
     PrintEmptyProperty("xhandlers");
-    const char* flags = current->IsLoopSuccessorDominator()
-        ? "dom-loop-succ"
-        : "";
-    PrintStringProperty("flags", flags);
+
+    {
+      PrintIndent();
+      trace_.Add("flags");
+      if (current->IsLoopSuccessorDominator()) {
+        trace_.Add(" \"dom-loop-succ\"");
+      }
+      if (current->IsUnreachable()) {
+        trace_.Add(" \"dead\"");
+      }
+      if (current->is_osr_entry()) {
+        trace_.Add(" \"osr\"");
+      }
+      trace_.Add("\n");
+    }
 
     if (current->dominator() != NULL) {
       PrintBlockProperty("dominator", current->dominator()->block_id());
     }
 
     PrintIntProperty("loop_depth", current->LoopNestingDepth());
 
     if (chunk != NULL) {
       int first_index = current->first_instruction_index();
       int last_index = current->last_instruction_index();
@@ skipping 227 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal