- 23 Feb, 2018 3 commits
-
-
Sigurd Schneider authored
This is a reland of 3ff4b447. Original version did not handle V8_INTL_SUPPORT. Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} Bug: v8:7250, v8:7340 Change-Id: Id908cbcfaa9e9cf5459d6d3289e6ec00e387d287 Reviewed-on: https://chromium-review.googlesource.com/934268Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51514}
-
Sigurd Schneider authored
This reverts commit 3ff4b447. Reason for revert: Does not handle V8_INTL_SUPPORT correctly Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} TBR=sigurds@chromium.org,bmeurer@chromium.org Change-Id: I6efb3b758b0fcadc012a90c4175de3c1ebccee95 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7250, v8:7340 Reviewed-on: https://chromium-review.googlesource.com/934267Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51507}
-
Sigurd Schneider authored
Bug: v8:7250, v8:7340 Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c Reviewed-on: https://chromium-review.googlesource.com/913208 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51505}
-
- 04 Jan, 2018 1 commit
-
-
Mostyn Bramley-Moore authored
Bug: v8:7127, v8:7204, v8:7205 Change-Id: Iedea388590991e4d0edcf59e02c767b6c04460e7 Reviewed-on: https://chromium-review.googlesource.com/849216Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com> Cr-Commit-Position: refs/heads/master@{#50351}
-
- 29 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
The two helper functions CanBePrimitive and NeedsConvertReceiver did essentially the same, just in a slightly different way, and both weren't really robust wrt. to the list of JSConstruct* and JSCreate* operators that they were handling. There's now a single helper in the NodeProperties and a couple of extra macro lists to keep this list up to date more easily. Drive-by-fix: Also moved the CanBeNullOrUndefined helper to the NodeProperties class. Bug: v8:5267, v8:7109 Change-Id: Ibbf387040e3f424ee224c53fac15c2b3207b1926 Reviewed-on: https://chromium-review.googlesource.com/793734Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49695}
-
- 27 Oct, 2017 1 commit
-
-
Andreas Rossberg authored
R=titzer@chromium.org Change-Id: Ie8c361efb48b56dc65719f09dfc79d505e0f3459 Reviewed-on: https://chromium-review.googlesource.com/735610 Commit-Queue: Andreas Rossberg <rossberg@chromium.org> Reviewed-by: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49000}
-
- 07 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
Introduce NodeProperties::NoObservableSideEffectBetween to check if there's any observable side effect between two nodes in the effect chain. Use this to guard the insertion of potentially redundant map checks in the lowering of Object.prototype.hasOwnProperty and keyed accesses within a for..in loop. This gives another boost on the for..in performance front. Bug: v8:6702 Change-Id: I68133f14ad388a1a7422714319c9b323d5cf8bc4 Reviewed-on: https://chromium-review.googlesource.com/654640Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47869}
-
- 31 Jul, 2017 1 commit
-
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/591667/, removing thread-local variable Bug: Change-Id: Ia9bc73be4a46a6bf052220726193c8b6634eb73e Reviewed-on: https://chromium-review.googlesource.com/593559Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#47001}
-
- 28 Jul, 2017 4 commits
-
-
Tobias Tebbi authored
This reverts commit ccd8bb69. Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Mac%20Release%20%28Intel%29/builds/2643 Original change's description: > Reland: [turbofan] staging new implementation of escape analysis > > Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. > > Bug: > Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe > Reviewed-on: https://chromium-review.googlesource.com/591667 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46975} TBR=jarin@chromium.org,tebbi@chromium.org Change-Id: I30016fd8d71535c02bab8678b02147195c3e97a6 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591672Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46980}
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. Bug: Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe Reviewed-on: https://chromium-review.googlesource.com/591667Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46975}
-
Tobias Tebbi authored
This reverts commit d230b44f. Reason for revert: compile errors on the waterfall Original change's description: > [turbofan] staging new implementation of escape analysis > > Bug: > Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 > Reviewed-on: https://chromium-review.googlesource.com/565720 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46966} TBR=mstarzinger@chromium.org,jarin@chromium.org,tebbi@chromium.org Change-Id: I73c3cb270d498aeb181e31bad04f1c73d5ca6741 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591370Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46968}
-
Tobias Tebbi authored
Bug: Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 Reviewed-on: https://chromium-review.googlesource.com/565720 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46966}
-
- 10 Jul, 2017 1 commit
-
-
Jaroslav Sevcik authored
This introduces a new builtin (MapLookupHashIndex) and uses it in Turbofan to compute Map.p.get and Map.p.has. I have also refactored the existing CSA builtins for Map.p.get and Map.p.has to use the new builtin under the hood. The code for the lookup has been also improved. - Specialized lookups for smis, strings, heap numbers and everything else. - the advantage is that we can use fast equalities for the lookup. - strings can likely be optimized further if we care about the internalized string fast case. - Instead of a call to runtime to get the hash code, we now call C directly. In the Turbofan implementation itself, there are no special optimizations yet. The next step is to teach load elimination to reuse the indexes from previous calls of MapLookupHashIndex. BUG=v8:6410 Change-Id: I0b1a70493eb031d444e51002f6b2cc1f30ea2b68 Reviewed-on: https://chromium-review.googlesource.com/560169Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46510}
-
- 10 May, 2017 1 commit
-
-
Tobias Tebbi authored
[turbofan] [builtins] Unify construct builtins for JS functions and classes and add inlining and deoptimizer support BUG=v8:6180 R=mstarzinger@chromium.org Change-Id: Iac5782a0f6b0ff92293421656d907073cfc3f5dd Reviewed-on: https://chromium-review.googlesource.com/489525 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#45232}
-
- 04 May, 2017 1 commit
-
-
neis authored
1. Generalize context specialization such that the provided context can be any outer context of the function, not necessarily the immediate outer context. 2. Based on this: if function specialization is disabled, then specialize for the module context if there is one. 3. Extend typed lowering of module loads and stores such that if the operand is a Module constant, we constant-fold the cell load. That is, a JSLoadModule with a Module HeapConstant input becomes a LoadField with a Cell HeapConstant input, and similarly for JSStoreModule. BUG=v8:1569 Review-Url: https://codereview.chromium.org/2841613002 Cr-Commit-Position: refs/heads/master@{#45083}
-
- 12 Apr, 2017 1 commit
-
-
bmeurer authored
Add the notion of reliable vs. unreliable receiver map information to the NodeProperties::InferReceiverMaps machinery. The information is considered reliable here if the maps are known to be valid based on the effect chain, and unreliable if there was a side-effect in between that might have changed the receiver map. Use this unreliable information for Array.prototype.push, guarded by either stability dependencies or map checks, which might present a potential deoptimization loop, which is very unlikely, but still needs fixing in the future. This is important to optimize calls to push even in cases like this array.push(something.func()); where we have a side-effect (the call to something.func) between the load of array.push and the actual call. R=jarin@chromium.org BUG=v8:5267,v8:6241 Review-Url: https://codereview.chromium.org/2812233002 Cr-Commit-Position: refs/heads/master@{#44595}
-
- 02 Mar, 2017 1 commit
-
-
Michael Starzinger authored
This unifies the search for a potential {IfException} projection with the existing predicate on {NodeProperties} used by the rest of the system. Also contains a related drive-by change to graph builders. This is in preparation of eliding {IfSuccess} projections when possible. R=jarin@chromium.org Change-Id: I8ba0ae9e9fdb69a77bce01578200ceea434535f7 Reviewed-on: https://chromium-review.googlesource.com/448039Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43540}
-
- 20 Feb, 2017 1 commit
-
-
bmeurer authored
Unify the three different implementations of InferReceiverMaps, which were basically copy&paste with slightly different optimizations applied later into a single NodeProperties::InferReceiverMaps helper, which also returns a ZoneHandleSet of maps, rather than only a single map. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2703133003 Cr-Commit-Position: refs/heads/master@{#43318}
-
- 18 Jan, 2017 1 commit
-
-
epertoso authored
BUG= Review-Url: https://codereview.chromium.org/2635243002 Cr-Commit-Position: refs/heads/master@{#42439}
-
- 13 Jan, 2017 1 commit
-
-
neis authored
With this CL, context loads and stores are "strengthened" by reducing the incoming context chain and decreasing the depth accordingly, whenever possible. This enables more opportunities for specialization and will let us easily add module context specialization later. BUG= Review-Url: https://codereview.chromium.org/2559173003 Cr-Commit-Position: refs/heads/master@{#42334}
-
- 17 Oct, 2016 1 commit
-
-
jochen authored
R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org BUG= CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe Review-Url: https://codereview.chromium.org/2416243002 Cr-Commit-Position: refs/heads/master@{#40350}
-
- 10 Oct, 2016 1 commit
-
-
bmeurer authored
There were once plans to generate cross-context code with TurboFan, however that doesn't fit into the model anymore, and so all of this is essentially dead untested code (and thus most likely already broken in subtle ways). With this mode still in place it would also be a lot harder to make inlining based on SharedFunctionInfo work. BUG=v8:2206,v8:5499 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2406803002 Cr-Commit-Position: refs/heads/master@{#40109}
-
- 05 Sep, 2016 1 commit
-
-
mvstanton authored
BUG= Review-Url: https://codereview.chromium.org/2309823002 Cr-Commit-Position: refs/heads/master@{#39181}
-
- 03 Aug, 2016 1 commit
-
-
mstarzinger authored
This completely removes the ability from nodes to point directly to the frame state representing their eager bailout point. All nodes now either have zero or one frame state inputs. These frame states can by now be found via checkpoints in the graph. R=bmeurer@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2020323004 Cr-Commit-Position: refs/heads/master@{#38282}
-
- 02 Jun, 2016 1 commit
-
-
mstarzinger authored
This removes the frame state input representing the before-state from nodes having the {JSCallFunction} or {JSCallConstruct} operator. These frame states can by now be found via checkpoints in the graph. R=bmeurer@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2025573003 Cr-Commit-Position: refs/heads/master@{#36669}
-
- 25 Apr, 2016 1 commit
-
-
jarin authored
Review URL: https://codereview.chromium.org/1921483002 Cr-Commit-Position: refs/heads/master@{#35747}
-
- 11 Jan, 2016 1 commit
-
-
titzer authored
R=bmeurer@chromium.org BUG= Review URL: https://codereview.chromium.org/1578723002 Cr-Commit-Position: refs/heads/master@{#33202}
-
- 20 Nov, 2015 1 commit
-
-
bmeurer authored
Introduce a JSCreateArray operator that represents the Array constructor, and lower call and construct calls to the Array constructor to JSCreateArray. Currently we don't yet replace that with an inline allocation, but always use the specialized stubs for the Array constructor. This saves a lot of unnecessary deopts and elements transitions because now we can actually consume the allocation site feedback for the transitions. R=mstarzinger@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1466643002 Cr-Commit-Position: refs/heads/master@{#32145}
-
- 18 Nov, 2015 1 commit
-
-
bmeurer authored
Retrieve the native context/global object from the Node being specialized in the JSNativeContextSpecialization and the JSGlobalObjectSpecialization classes. For this we introduce two new methods NodeProperties::GetSpecializationNativeContext and NodeProperties::GetSpecializationGlobalObject, which walk up the context chain and might in the end take the native context from the outermost activation (if native context specialization is enabled). This allows us to run the native context specialization pass as part of the inlining phase without hacking some of that into the JSInliner. Also refactor the NodeProperties::GetSpecializationContext method that was previously local to the JSContextSpecialization. Also refactor two other oddities in JSNativeContextSpecialization. R=jarin@chromium.org BUG=v8:4470, v8:4493 LOG=n Review URL: https://codereview.chromium.org/1451143005 Cr-Commit-Position: refs/heads/master@{#32076}
-
- 17 Nov, 2015 1 commit
-
-
bmeurer authored
This is the first part to refactoring the JSNativeContextSpecialization class, which has grown way too big recently. Also don't collect cross context feedback for the CallIC in general. Neither TurboFan nor Crankshaft can make any use of cross context JSFunction feedback that is collected by the CallIC, so there's no point in gathering that feedback at all (it just complicates the checking that is necessary in the compilers). What we should do instead at some point (when Crankshaft becomes less important) is to collect the SharedFunctionInfo as feedback for those cases. R=yangguo@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1451273002 Cr-Commit-Position: refs/heads/master@{#32022}
-
- 30 Oct, 2015 2 commits
-
-
bmeurer authored
Adds new Guard[Type] common operator, which takes value and control inputs and records a guaranty that a certain value has a certain type in that control path. This is some kind of ad-hoc SSI similar to what we have to do in Crankshaft in some places. Also introduces an ObjectIsNumber simplified operator, which checks whether a certain value is a number (either a Smi or a HeapNumber). This doesn't yet support transitioning stores to double fields, which require support for allocating mutable heap numbers. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1420283009 Cr-Commit-Position: refs/heads/master@{#31675}
-
bmeurer authored
In order to properly (lazy) bailout when converting the receiver for sloppy mode functions (using the newly added JSConvertReceiver operator), we need to have a bailout location right before every call (also right before every %_Call and %_CallFunction), otherwise if the JSConvertReceiver just reuses the lazy bailout frame state from the JSCallFunction node, it will skip the whole function in case of lazy bailout. Note it should be impossible to trigger this currently because we do not yet support AllocationSite code dependencies in TurboFan, which can trigger this kind of lazy bailout; therefore it's not possible to write a regression test (yet). R=yangguo@chromium.org BUG=v8:4493 LOG=n Review URL: https://codereview.chromium.org/1425883004 Cr-Commit-Position: refs/heads/master@{#31668}
-
- 26 Oct, 2015 1 commit
-
-
bmeurer authored
Currently we (mostly) infer FunctionType for JSFunction constants, and match the FunctionType in the typing rule for JSCallFunction. This has several drawbacks for JavaScript, especially we don't have Constant types for global functions (i.e. String, Object, Reflect and friends). Plus the FunctionType magic doesn't actually buy us anything. So this changes the typing rule for HeapConstant constant to actually infer Constant types for JSFunction objects and moves the recognition of builtin functions to the typing rule for JSCallFunction. Also adapts the specialized lowering in JSTypedLowering to Constant functions instead of FunctionType, which has the additional advantage that we can do the receiver wrapping/converting based on the (known) SharedFunctionInfo. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1420093005 Cr-Commit-Position: refs/heads/master@{#31553}
-
- 15 Oct, 2015 1 commit
-
-
mstarzinger authored
This is in preparation to enabling --turbo-inlining by default, fixing various issues when general purpose inlining is running against our entire test suite. R=bmeurer@chromium.org BUG=v8:4493 LOG=n Review URL: https://codereview.chromium.org/1407533004 Cr-Commit-Position: refs/heads/master@{#31294}
-
- 28 Sep, 2015 1 commit
-
-
jarin authored
Review URL: https://codereview.chromium.org/1367423002 Cr-Commit-Position: refs/heads/master@{#30962}
-
- 25 Sep, 2015 1 commit
-
-
jarin authored
Verifies consistency of node inputs and uses: - node inputs should agree with the input count computed from the node's operator. - effect inputs should have effect outputs (or be a sentinel). - control inputs should have control outputs (or be a sentinel). - frame state inputs should be frame states (or be a sentinel). - if the node has control uses, it should produce control. - if the node has effect uses, it should produce effect. - if the node has frame state uses, it must be a frame state. I also removed some tests, either because they did not seem to be useful (scheduler) or they tested dead functionality (diamond effect phi). Review URL: https://codereview.chromium.org/1368913002 Cr-Commit-Position: refs/heads/master@{#30927}
-
- 24 Sep, 2015 1 commit
-
-
mstarzinger authored
This introduces the NodeProperties::ChangeOp helper which guards node operator changes so that additional checking can be done without any additional dependencies being pulled into the Node class. For now only the input count is checked, but additional checking might follow. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1366753003 Cr-Commit-Position: refs/heads/master@{#30916}
-
- 16 Sep, 2015 1 commit
-
-
jarin authored
Review URL: https://codereview.chromium.org/1348073002 Cr-Commit-Position: refs/heads/master@{#30764}
-
- 10 Jun, 2015 1 commit
-
-
mstarzinger authored
This deprecates the aforementioned mutator in favor of a simpler NodeProperties::ReplaceUses that doesn't perform any relaxation. Preparation for enabling support for try-catch statements. R=bmeurer@chromium.org TEST=unittests/NodePropertiesTest Review URL: https://codereview.chromium.org/1172773003 Cr-Commit-Position: refs/heads/master@{#28897}
-
- 30 Apr, 2015 1 commit
-
-
svenpanne authored
This CL contains the first steps towards tail call optimization: * Structurally detect tail calls during instruction selection, looking for special return/call combinations. * Added new architecture-specific instructions for tail calls which jump instead of call and take care of frame adjustment. * Moved some code around. Currently we restrict tail calls to callees which only use registers for arguments/return value and to call sites which are explicitly marked as being OK for tail calls. This excludes, among other things, call sites in sloppy JS functions and our IC machinery (both need in general to be able to access the caller's frame). All this is behind a flag --turbo-tail-calls, which is currently off by default, so it can easily be toggled. Review URL: https://codereview.chromium.org/1108563002 Cr-Commit-Position: refs/heads/master@{#28150}
-