- 23 Nov, 2018 1 commit
-
-
Yang Guo authored
This reverts commit e64f7c0a. Reason for revert: this breaks chromedriver_py_test on Mac and Windows. This blocks the roll. Details: - DEPS roll with V8 pointing to this commit fails: https://chromium-review.googlesource.com/c/chromium/src/+/1349251 - DEPS roll with V8 pointing to the parent of this commit succeeds: https://chromium-review.googlesource.com/c/chromium/src/+/1349214 Original change's description: > Reland "[turbofan] Use feedback when reducing global loads/stores." > > This is a reland of 9c91b687 after > fixing undefined behavior in numeric conversion that caused trouble > on arm32. > > Original change's description: > > [turbofan] Use feedback when reducing global loads/stores. > > > > We already record the script context location or the property cell > > as feedback of the global load/store IC, so Turbofan doesn't need > > to do the lookups again. > > > > Change-Id: I6cbd2937de344729cd8e146b4ff85ddf3de6a56e > > Reviewed-on: https://chromium-review.googlesource.com/c/1335691 > > Commit-Queue: Georg Neis <neis@chromium.org> > > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#57555} > > Change-Id: Ic2d09025de02f92199755ac860bb9e91fa08f4ec > Reviewed-on: https://chromium-review.googlesource.com/c/1340043 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57649} TBR=neis@chromium.org,bmeurer@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Change-Id: I7c9364d6a0bea6681fe9e25b28206cfc2c8557a7 Reviewed-on: https://chromium-review.googlesource.com/c/1349272Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#57768}
-
- 20 Nov, 2018 1 commit
-
-
Georg Neis authored
This is a reland of 9c91b687 after fixing undefined behavior in numeric conversion that caused trouble on arm32. Original change's description: > [turbofan] Use feedback when reducing global loads/stores. > > We already record the script context location or the property cell > as feedback of the global load/store IC, so Turbofan doesn't need > to do the lookups again. > > Change-Id: I6cbd2937de344729cd8e146b4ff85ddf3de6a56e > Reviewed-on: https://chromium-review.googlesource.com/c/1335691 > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57555} Change-Id: Ic2d09025de02f92199755ac860bb9e91fa08f4ec Reviewed-on: https://chromium-review.googlesource.com/c/1340043Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#57649}
-
- 16 Nov, 2018 1 commit
-
-
Jakob Gruber authored
This reverts commit 9c91b687. Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Arm%20GC%20Stress/8864 Original change's description: > [turbofan] Use feedback when reducing global loads/stores. > > We already record the script context location or the property cell > as feedback of the global load/store IC, so Turbofan doesn't need > to do the lookups again. > > Change-Id: I6cbd2937de344729cd8e146b4ff85ddf3de6a56e > Reviewed-on: https://chromium-review.googlesource.com/c/1335691 > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#57555} TBR=neis@chromium.org,ishell@chromium.org,bmeurer@chromium.org Change-Id: I99d72075e01348733fecdffc6b5572b96eb577b4 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/1339860Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#57559}
-
- 15 Nov, 2018 1 commit
-
-
Georg Neis authored
We already record the script context location or the property cell as feedback of the global load/store IC, so Turbofan doesn't need to do the lookups again. Change-Id: I6cbd2937de344729cd8e146b4ff85ddf3de6a56e Reviewed-on: https://chromium-review.googlesource.com/c/1335691 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57555}
-
- 15 Oct, 2018 1 commit
-
-
Georg Neis authored
There's no ambiguity and the shorter name makes things easier to read. Bug: v8:7790 Change-Id: Ibcf3fd7f38a91e26a83cd335fad0ec80a5fe9be1 Reviewed-on: https://chromium-review.googlesource.com/c/1278392 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56623}
-
- 12 Oct, 2018 1 commit
-
-
Georg Neis authored
We don't need to store the native context explicitly anymore, the broker already has it. Bug: v8:7790 Change-Id: I1096953e3c56bed9d3a8d7d37b108888ef4ac7ec Reviewed-on: https://chromium-review.googlesource.com/c/1270594 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56586}
-
- 10 Oct, 2018 1 commit
-
-
Benedikt Meurer authored
This change introduces new intrinsics used to desugar async functions in the Parser and the BytecodeGenerator, namely we introduce a new %_AsyncFunctionEnter intrinsic that constructs the generator object for the async function (and in the future will also create the outer promise for the async function). This generator object is internal and never escapes to user code, plus since async functions don't have a "prototype" property, we can just a single map here instead of tracking the prototype/initial_map on every async function. This saves one word per async function plus one initial_map per async function that was invoked at least once. We also introduce two new intrinsics %_AsyncFunctionReject, which rejects the outer promise with the caught exception, and another %_AsyncFunctionResolve, which resolves the outer promise with the right hand side of the `return` statement. These functions also perform the DevTools part of the job (aka popping from the promise stack and sending the debug event). This allows us to get rid of the implicit try-finally from async functions completely; because the finally block only called to the %AsyncFunctionPromiseRelease builtin, which was used to inform DevTools. In essence we now turn an async function like ```js async function f(x) { return await bar(x); } ``` into something like this (in Parser and BytecodeGenerator respectively): ``` function f(x) { .generator_object = %_AsyncFunctionEnter(.closure, this); .promise = %AsyncFunctionCreatePromise(); try { .tmp = await bar(x); return %_AsyncFunctionResolve(.promise, .tmp); } catch (e) { return %_AsyncFunctionReject(.promise, e); } } ``` Overall the bytecode for async functions gets significantly shorter already (and will get even shorter once we put the outer promise into the async function generator object). For example the bytecode for a simple async function ```js async function f(x) { return await x; } ``` goes from 175 bytes to 110 bytes (a ~38% reduction in size), which is in particular due to the simplification around the try-finally removal. Overall this seems to improve the doxbee-async-es2017-native test by around 2-3%. On the test case mentioned in v8:8276 we go from 1124ms to 441ms, which corresponds to a 60% reduction in total execution time! Tbr: marja@chromium.org Bug: v8:7253, v8:7522, v8:8276 Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Id29dc92de7490b387ff697860c900cee44c9a7a4 Reviewed-on: https://chromium-review.googlesource.com/c/1269041 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#56502}
-
- 09 Oct, 2018 1 commit
-
-
Georg Neis authored
Change-Id: I9e5eb7132da7e11ab4427fc07bacee667df3ef41 Reviewed-on: https://chromium-review.googlesource.com/c/1270587Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56479}
-
- 01 Oct, 2018 1 commit
-
-
Georg Neis authored
Picking a few low-hanging fruits. Bug: v8:7790 Change-Id: I798d579b1f1a08fab821e159d08f453d2dad89c1 Reviewed-on: https://chromium-review.googlesource.com/1254124Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56320}
-
- 21 Sep, 2018 1 commit
-
-
Marja Hölttä authored
Also fixing DEPS include rules for heap-write-barrier.h BUG=v8:5402,v8:8015 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ia785da321bc6c6f4c375ae8c866a0bf294e64f5b Reviewed-on: https://chromium-review.googlesource.com/1238453Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#56138}
-
- 19 Sep, 2018 1 commit
-
-
Maya Lekova authored
This CL implements the following design doc: https://docs.google.com/document/d/1h5kdfemMQMpUd15PSKW1lqikJW5hsGwrmOvoqhGFRts/edit?ts=5b978756#heading=h.urs7r34mx9p Bug: v8:7790 Change-Id: I5f758c6d906ea9275c30b28f339063c64a2dc8d8 Reviewed-on: https://chromium-review.googlesource.com/1221807Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56021}
-
- 07 Sep, 2018 1 commit
-
-
Maya Lekova authored
This optimization addresses a case triggered by the Templates/Untagged js-perf-test, in which template literals get compiled to a cascade of JSAdd(JSAdd, JSToString) nodes. Before the optimization in https://chromium-review.googlesource.com/c/v8/v8/+/1193342 JSToString no-ops used to get optimized away during typed lowering together with constant folding of string concatenation. This change allows us to get rid of a no-op JSToString call during native context specialization, thus allowing for constant folding of JSAdd to kick in and CheckStringAdd nodes to not be generated at all. This change also removes the NumberToString optimization from typed lowering, as it's being executed during earlier stage. Bug: chromium:879083 Change-Id: I1d8155ed969b6959fbb86fca21e4714b88a2695a Reviewed-on: https://chromium-review.googlesource.com/1202622 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#55724}
-
- 14 Aug, 2018 1 commit
-
-
Benedikt Meurer authored
We don't need to keep JSToObject operations in the graph if there's some preceeding map check that already provides information that the input is indeed already a receiver. Change-Id: I2d04895831ff561624fbe91a2fe03bb6e5d918a5 Reviewed-on: https://chromium-review.googlesource.com/1174259Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55120}
-
- 23 Jul, 2018 1 commit
-
-
Georg Neis authored
We'll soon start collecting data from the JS heap prior to the typed lowering pass, and then refrain from reading the heap in that pass. This CL prepares the broker machinery by introducing a hash table that maps an object (handle) to the corresponding cached data. For the time being, that cached data is essentially just the handle itself. Bug: v8:7790 Change-Id: I830e9c72faafb7ae1d10e8a111636b3a3762bbc6 Reviewed-on: https://chromium-review.googlesource.com/1143405 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#54618}
-
- 06 Jul, 2018 1 commit
-
-
Georg Neis authored
- Move the CompilationDependencies member of OptimizedCompilationInfo to Turbofan's PipelineData (and thus into the compiler namespace). - Move compilation-dependencies.{cc,h} to the compiler directory. Bug: v8:7902 Change-Id: I5471d0923daf83abe975357325db5bc5ad0a8571 Reviewed-on: https://chromium-review.googlesource.com/1127793 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#54295}
-
- 19 Jun, 2018 1 commit
-
-
Georg Neis authored
This encapuslates some of the heap accesses done by JSNativeContextSpecialization::ReduceJSLoadGlobal and JSNativeContextSpecialization::ReduceJSStoreGlobal. Bug: v8:7790 Change-Id: Ib6c63903809927d6094af22519285cb9d0bbff7a Reviewed-on: https://chromium-review.googlesource.com/1106141Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#53845}
-
- 07 Jun, 2018 1 commit
-
-
Jaroslav Sevcik authored
As a first step towards moving accesses to the broker, this moves heap accesses from BitsetType::Lub to the broker. Bug: v8:7790 Change-Id: Ie240b84b979717caae42cb8aa06ee8d9877a446d Reviewed-on: https://chromium-review.googlesource.com/1088695 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53571}
-
- 19 Mar, 2018 1 commit
-
-
Georg Neis authored
This reverts commit c94dcb21. Reason for revert: several performances regressions. Original change's description: > [compiler] Don't infer receiver maps for stores. > > This avoids a deopt loop. > > Bug: v8:7254 > Change-Id: I9ab1dfc754c5ad63c451a9e2276aa1d7eb4c27b1 > Reviewed-on: https://chromium-review.googlesource.com/966065 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51994} TBR=jarin@chromium.org,neis@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7254 Change-Id: Iff9c6fb61a559e48ad11d2db9e559de61cc0f5ef Reviewed-on: https://chromium-review.googlesource.com/968302Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52012}
-
- 16 Mar, 2018 1 commit
-
-
Georg Neis authored
This avoids a deopt loop. Bug: v8:7254 Change-Id: I9ab1dfc754c5ad63c451a9e2276aa1d7eb4c27b1 Reviewed-on: https://chromium-review.googlesource.com/966065Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#51994}
-
- 02 Mar, 2018 1 commit
-
-
Georg Neis authored
... and use it in the implementation of array literal spreads, replacing calls to %AppendElement. Array spreads in destructuring will be taken care of in a separate CL. Bug: v8:5940, v8:7446 Change-Id: Idec52398902a7fd3c1244852cf73246f142404f0 Reviewed-on: https://chromium-review.googlesource.com/915364 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#51709}
-
- 20 Feb, 2018 1 commit
-
-
Benedikt Meurer authored
This CL introduces new operators JSFulfillPromise and JSPromiseResolve, corresponding to the specification operations with the same name, and uses that to lower calls to Promise.resolve() builtin to JSPromiseResolve. We also optimize JSPromiseResolve and JSResolvePromise further based on information found about the value/resolution in the graph. This applies to both Promise.resolve() builtin calls and implicit resolve operations in async functions and async generators. On a very simple microbenchmark like console.time('resolve'); for (let i = 0; i < 1e8; ++i) Promise.resolve({i}); console.timeEnd('resolve'); this CL reduces the execution time from around 3049ms to around 947ms, which is a pretty significant 3x improvement. On the wikipedia benchmark we observe an improvement around 2% with this CL. Bug: v8:7253 Change-Id: Ic69086cdc1b724f35dbe83305795539c562ab817 Reviewed-on: https://chromium-review.googlesource.com/913488Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51387}
-
- 31 Jan, 2018 1 commit
-
-
Mike Stanton authored
The FeedbackNexus classes initially were one-to-one with IC classes, but over time this got out of date. We also found Nexus' useful, so we made more classes even for cases that weren't ICs. The inheritence and polymorphism became confusing and led to duplication. Better, to just talk about a (single) FeedbackNexus. Bug: v8:7344 Change-Id: I509dc9657895d56c3859de6e6589695cdff9e73e Reviewed-on: https://chromium-review.googlesource.com/890452 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Franziska Hinkelmann <franzih@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#50997}
-
- 03 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
This extends the support in TurboFan and the ICs for OOB loads to also apply to typed arrays and receivers whose prototype chain is protected by the "no elements" protector (aka the Array protector). TurboFan will generate code to materialize undefined instead when it sees a load that has the OOB bit set and add an appropriate code dependency on the global protector. For typed arrays it doesn't even need to check the global protector since elements are never looked up in the prototype chain for typed arrays. In the simple micro-benchmark from the bug we go from testInBounds: 103 ms. testOutOfBounds: 289 ms. to testInBounds: 103 ms. testOutOfBounds: 102 ms. which fixes the 3x slowdown and thus addresses the performance cliff. In general it's still beneficial to make sure that you don't access out of bounds, especially once we introduce a bounds check elimination pass to TurboFan. This also seems to improve the jQuery benchmark on the Speedometer test suite by like 1-2% on average. And the SixSpeed rest benchmarks go from rest-es5: 25 ms. rest-es6: 23 ms. to rest-es5: 6 ms. rest-es6: 4 ms. so a solid 5.7x improvement there. Bug: v8:6936, v8:7014, v8:7027 Change-Id: Ie99699c69cc40057512e72fd40ae28107216c423 Reviewed-on: https://chromium-review.googlesource.com/750089 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#49095}
-
- 31 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
This adds support to the KeyedLoadIC to ignore out of bounds accesses for Strings and return undefined instead. We add a dedicated bit to the Smi handler to encode the OOB state and have TurboFan generate appropriate code for that case as well. This is mostly useful when programs accidentially access past the length of a string, which was observed and fixed for example in Babel recently, see https://github.com/babel/babel/pull/6589 for details. The idea is to also extend this mechanism to Arrays and maybe other receivers, as reading beyond the length is also often used in jQuery and other popular libraries. Note that this is considered a mitigation for a performance cliff and not a general optimization of OOB accesses. These should still be avoided and handled properly instead. This seems to further improve the babel test on the web-tooling-benchmark by around 1%, because the OOB access no longer turns the otherwise MONOMORPHIC access into MEGAMORPHIC state. Bug: v8:6936, v8:7014 Change-Id: I9df03304e056d7001a65da8e9621119f8e9bb55b Reviewed-on: https://chromium-review.googlesource.com/744022 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49049}
-
- 30 Oct, 2017 2 commits
-
-
Toon Verwaest authored
The bytecode interpreter nor TF rely on the explicit return value of store ICs anymore, so we can just return whatever is in the result slot. It won't be visible to JS anyway. Bug: Change-Id: I389615d1d77c5b050832f23a08e3d3bc07d9cbc6 Reviewed-on: https://chromium-review.googlesource.com/743366Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#49027}
-
Toon Verwaest authored
Remove distinction between lazy and non-lazy CallApiCallback, always explicitly set up target context Bug: Change-Id: I0cb751a0415433fdfec21451e2fac3e0726bf26e Reviewed-on: https://chromium-review.googlesource.com/743019 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49024}
-
- 20 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
In the special case of KeyedLoadIC, where the key that is passed in is a Name that is always the same we only checked for identity in both the stub and the TurboFan case, which works fine for symbols and internalized strings, but doesn't really work with non-internalized strings, where the identity check will fail, the runtime will internalize the string, and the IC will then see the original internalized string again and not progress in the feedback lattice. This leads to tricky deoptimization loops in TurboFan and constantly missing ICs. This adds fixes the stub to always try to internalize strings first when the identity check fails and then doing the check again. If the name is not found in the string table we miss, since in that case the string cannot match the previously recorded feedback name (which is always a unique name). In TurboFan we represent this checks with new CheckEqualsSymbol and CheckEqualsInternalizedString operators, which validate the previously recorded feedback, and the CheckEqualsInternalizedString operator does the attempt to internalize the input. Bug: v8:6936, v8:6948, v8:6969 Change-Id: I3f3b4a587c67f00f7c4b60d239eb98a9626fe04a Reviewed-on: https://chromium-review.googlesource.com/730224Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48784}
-
- 07 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
Introduce NodeProperties::NoObservableSideEffectBetween to check if there's any observable side effect between two nodes in the effect chain. Use this to guard the insertion of potentially redundant map checks in the lowering of Object.prototype.hasOwnProperty and keyed accesses within a for..in loop. This gives another boost on the for..in performance front. Bug: v8:6702 Change-Id: I68133f14ad388a1a7422714319c9b323d5cf8bc4 Reviewed-on: https://chromium-review.googlesource.com/654640Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47869}
-
- 05 Sep, 2017 1 commit
-
-
Jakob Kummerow authored
Only the error cases of overwriting readonly properties need the language_mode to decide whether to throw or be silent. Reading it from the feedback vector's metadata (just like the C++ code in ic.cc does) removes the need to duplicate each stub for each language_mode ("StoreIC" + "StoreICStrict" etc.). Change-Id: Ic0c67f9d40ca36c65e41b4f162b2ab70d155e549 Reviewed-on: https://chromium-review.googlesource.com/647373Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#47836}
-
- 01 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
This CL adds support to optimize for..in in fast enum-cache mode to the same degree that it was optimized in Crankshaft, without adding the same deoptimization loop that Crankshaft had with missing enum cache indices. That means code like for (var k in o) { var v = o[k]; // ... } and code like for (var k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) { var v = o[k]; // ... } } which follows the https://eslint.org/docs/rules/guard-for-in linter rule, can now utilize the enum cache indices if o has only fast properties on the receiver, which speeds up the access o[k] significantly and reduces the pollution of the global megamorphic stub cache. For example the micro-benchmark in the tracking bug v8:6702 now runs faster than ever before: forIn: 1516 ms. forInHasOwnProperty: 1674 ms. forInHasOwnPropertySafe: 1595 ms. forInSum: 2051 ms. forInSumSafe: 2215 ms. Compared to numbers from V8 5.8 which is the last version running with Crankshaft forIn: 1641 ms. forInHasOwnProperty: 1719 ms. forInHasOwnPropertySafe: 1802 ms. forInSum: 2226 ms. forInSumSafe: 2409 ms. and V8 6.0 which is the current stable version with TurboFan: forIn: 1713 ms. forInHasOwnProperty: 5417 ms. forInHasOwnPropertySafe: 5324 ms. forInSum: 7556 ms. forInSumSafe: 11067 ms. It also improves the throughput on the string-fasta benchmark by around 7-10%, and there seems to be a ~5% improvement on the Speedometer/React benchmark locally. For this to work, the ForInPrepare bytecode was split into ForInEnumerate and ForInPrepare, which is very similar to how it was handled in Fullcodegen initially. In TurboFan we introduce a new operator LoadFieldByIndex that does the dynamic property load. This also removes the CheckMapValue operator again in favor of just using LoadField, ReferenceEqual and CheckIf, which work automatically with the EscapeAnalysis and the BranchConditionElimination. Bug: v8:6702 Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a Reviewed-on: https://chromium-review.googlesource.com/645949 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#47768}
-
- 08 Aug, 2017 1 commit
-
-
Michael Starzinger authored
This makes sure we perform a proper holder lookup when trying to inline API accessors calls in TurboFan. Inlining is completely disabled in case the holder is not found, otherwise the appropriate holder is passed via the {PropertyAccessInfo} structure (if different from the receiver). R=bmeurer@chromium.org TEST=cctest/test-api/ReceiverSignature BUG=chromium:752149 Change-Id: I7b192724afd99d651b6477b2f2c8b403a10efb9d Reviewed-on: https://chromium-review.googlesource.com/603615 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47216}
-
- 19 Jul, 2017 1 commit
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
- 11 Jul, 2017 1 commit
-
-
Alexandre Talon authored
Each reducer now has a virtual reducer_name function, returning its name (the name of the class containing this reducer). This gets displayed when using the --trace_turbo_reduction flag. Also when using this flags more messages are displayed. Actually when a node is replaced in-place (which is called an update of the node), other reducers can still update it right after the in-place replacement. When a node is really replaced (not in-place), then we stop trying to apply reducers to it before we propagate the reduction through the relevant nodes. Before a message got printed only for the last reduction it went through. So in case a node was reduced in-place several times in a row, only the last update was printed, or none at all if after being reduced in-place it got reduced by being replaced by another node: only the non-in-place replacement was showed. Now each time an in-place reduction is applied to a node, a message gets printed. Bug: Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa Reviewed-on: https://chromium-review.googlesource.com/563365Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Alexandre Talon <alexandret@google.com> Cr-Commit-Position: refs/heads/master@{#46552}
-
- 06 Jul, 2017 1 commit
-
-
Ross McIlroy authored
Adds constant folding for the StringConcat bytecode to NativeContextSpecialization. Can reduce operator to either a fully folded constant string, or a JSAdd or a StringConcat with a reduced number of operators. BUG=v8:6243, chromium:738312 Change-Id: I6b2be6a3d95230a23f3c7390a4f7be5181c49a2a Reviewed-on: https://chromium-review.googlesource.com/559146 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46461}
-
- 05 Jul, 2017 2 commits
-
-
machenbach authored
Revert of Set the current context to the function's context when entering to LAP. (patchset #14 id:540001 of https://codereview.chromium.org/2770003002/ ) Reason for revert: Speculative: Seems to break webkit_unit_tests: https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247 https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038 Original issue's description: > Set the current context to the function's context when entering to LAP. > > In case of LAP(lazy accessor pair), the function's creation context > must be equal to the accessor holder's creation context, so this CL > changes the current context to the accessor holder's creation context. > > BUG=v8:6156 > > Review-Url: https://codereview.chromium.org/2770003002 > Cr-Commit-Position: refs/heads/master@{#46406} > Committed: https://chromium.googlesource.com/v8/v8/+/18e73287dc65452bc2f952fc005b2251fc32c15a TBR=jochen@chromium.org,verwaest@chromium.org,mstarzinger@chromium.org,tebbi@google.com,yukishiino@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:6156 Review-Url: https://codereview.chromium.org/2973593002 Cr-Commit-Position: refs/heads/master@{#46408}
-
yukishiino authored
In case of LAP(lazy accessor pair), the function's creation context must be equal to the accessor holder's creation context, so this CL changes the current context to the accessor holder's creation context. BUG=v8:6156 Review-Url: https://codereview.chromium.org/2770003002 Cr-Commit-Position: refs/heads/master@{#46406}
-
- 26 Jun, 2017 1 commit
-
-
Georg Neis authored
R=mstarzinger@chromium.org Bug: Change-Id: Ica169da6e095abb79967687ae9a18db5c833f72e Reviewed-on: https://chromium-review.googlesource.com/546356Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#46203}
-
- 19 Jun, 2017 1 commit
-
-
bmeurer authored
We need to constant-fold JSHasInPrototypeChain nodes early during inlining, otherwise we already miss a couple of optimization opportunities if we wait until after typing. This moves the constant-folding part of the JSHasInPrototypeChain lowering back to JSNativeContextSpecialization, where it was before the changes in https://codereview.chromium.org/2934893002 (part of JSOrdinaryHasInstance lowering back then). BUG=v8:5269,v8:5989,v8:6483,chromium:733158 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2943293002 Cr-Commit-Position: refs/heads/master@{#45989}
-
- 16 Jun, 2017 1 commit
-
-
jarin authored
This is in preparation for lowering monomorphic loads during graph building. This essentially moves the parts that will be shared to a separate class/file (proparty-access-builder.(cc|h)). I should say that we will not want to do accessor inlining during graph building because that would require us to create frame states (which is the thing we would like to avoid doing). Review-Url: https://codereview.chromium.org/2936673005 Cr-Commit-Position: refs/heads/master@{#45973}
-
- 13 Jun, 2017 1 commit
-
-
bmeurer authored
Port the baseline implementation of Object.prototype.isPrototypeOf to the CodeStubAssembler, sharing the existing prototype chain lookup logic with the instanceof / OrdinaryHasInstance implementation. Based on that, do the same in TurboFan, introducing a new JSHasInPrototypeChain operator, which encapsulates the central prototype chain walk logic. This speeds up Object.prototype.isPrototypeOf by more than a factor of four, so that the code A.prototype.isPrototypeOf(a) is now performance-wise on par with a instanceof A for the case where A is a regular constructor function and a is an instance of A. Since instanceof does more than just the fundamental prototype chain lookup, it was discovered in Node core that O.p.isPrototypeOf would be a more appropriate alternative for certain sanity checks, since it's less vulnerable to monkey-patching. In addition, the Object builtin would also avoid the performance-cliff associated with instanceof (due to the Symbol.hasInstance hook), as for example hit by https://github.com/nodejs/node/pull/13403#issuecomment-305915874. The main blocker was the missing performance of isPrototypeOf, since it was still a JS builtin backed by a runtime call. This CL also adds more test coverage for the Object.prototype.isPrototypeOf builtin, especially when called from optimized code. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng BUG=v8:5269,v8:5989,v8:6483 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2934893002 Cr-Commit-Position: refs/heads/master@{#45925}
-