- 30 Oct, 2015 1 commit
-
-
bmeurer authored
This adds optimized lowering for JSConvertReceiver (in the general case) and JSToObject in typed lowering. It also uses JSConvertReceiver for direct calls in typed lowering. R=mstarzinger@chromium.org BUG=v8:4493 LOG=n Review URL: https://codereview.chromium.org/1431543002 Cr-Commit-Position: refs/heads/master@{#31676}
-
- 28 Oct, 2015 2 commits
-
-
mstarzinger authored
This lowers JSCreateArguments nodes within inline (i.e. non-outermost) frames that create "mapped arguments objects" to inline allocations. The arguments count as well as each value is statically known and can be directly stored into the arguments object. Note that the object is still context-dependent and the map is loaded from the current context. The object size is not taken into account for now, we might want to limit it later though to keep code size bounded. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1403363004 Cr-Commit-Position: refs/heads/master@{#31619}
-
bmeurer authored
Typed lowering can lower JSConvertReceiver either based on the operator hints or the (statically) known receiver type. R=jarin@chromium.org BUG=chromium:548557, v8:4493, v8:4470 LOG=n Review URL: https://codereview.chromium.org/1426893002 Cr-Commit-Position: refs/heads/master@{#31618}
-
- 26 Oct, 2015 1 commit
-
-
mstarzinger authored
This lowers JSCreateArguments nodes within inline (i.e. non-outermost) frames that create "unmapped arguments objects" to inline allocations. The arguments count as well as each value is statically known and can be directly stored into the arguments object. Note that the object is still context-dependent and the map is loaded from the current context. The object size is not taken into account for now, we might want to limit it later though to keep code size bounded. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1412113004 Cr-Commit-Position: refs/heads/master@{#31550}
-
- 19 Oct, 2015 1 commit
-
-
mstarzinger authored
This removes all locally constructed SimplifiedOperatorBuilder instances and uses the one passed along the JSGraph. It ensures that the correct zone is used to allocate operators, no matter where the reducer is used. R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1410003002 Cr-Commit-Position: refs/heads/master@{#31355}
-
- 07 Oct, 2015 1 commit
-
-
bmeurer authored
Optimizing global constants such as "NaN", "Infinity" and "undefined" is best performed during graph building. Then the optimization and lowering passes only need to deal with real loads in case of JSLoadGlobal. R=mstarzinger@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1384953002 Cr-Commit-Position: refs/heads/master@{#31135}
-
- 02 Oct, 2015 1 commit
-
-
mstarzinger authored
This lowers JSCreateFunctionContext nodes to call the above stub for help with allocating function contexts when possible. It also contains an implementation for inlined allocations of such contexts, which is still behind a flag until inlined allocations are ready for prime time. TEST=unittests/JSTypedLoweringTest.JSCreateFunctionContext R=mvstanton@chromium.org Review URL: https://codereview.chromium.org/1380113002 Cr-Commit-Position: refs/heads/master@{#31068}
-
- 24 Sep, 2015 1 commit
-
-
mstarzinger authored
This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for help with materializing arguments objects when possible. Along the way this changes the calling convention of said stub to take parameters in registers instead of on the stack. R=mvstanton@chromium.org Review URL: https://codereview.chromium.org/1348773002 Cr-Commit-Position: refs/heads/master@{#30919}
-
- 13 Jul, 2015 1 commit
-
-
bmeurer authored
Optimize string "length" property access based on static type information if possible, but also optimistically optimize the access based on type feedback from the LoadIC. R=jarin@chromium.org Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40 Cr-Commit-Position: refs/heads/master@{#29543} Review URL: https://codereview.chromium.org/1216593003 Cr-Commit-Position: refs/heads/master@{#29588}
-
- 08 Jul, 2015 2 commits
-
-
adamk authored
Revert of [turbofan] Optimize string "length" property access based on types. (patchset #2 id:20001 of https://codereview.chromium.org/1216593003/) Reason for revert: Causes crash when running benchmarks/octane/regexp.js on ARM: http://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/2492/steps/Benchmarks/logs/regexp Original issue's description: > [turbofan] Optimize string "length" property access based on types. > > Optimize string "length" property access based on static type > information if possible, but also optimistically optimize the access > based on type feedback from the LoadIC. > > R=jarin@chromium.org > > Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40 > Cr-Commit-Position: refs/heads/master@{#29543} TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Review URL: https://codereview.chromium.org/1224083002 Cr-Commit-Position: refs/heads/master@{#29544}
-
bmeurer authored
Optimize string "length" property access based on static type information if possible, but also optimistically optimize the access based on type feedback from the LoadIC. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1216593003 Cr-Commit-Position: refs/heads/master@{#29543}
-
- 03 Jul, 2015 1 commit
-
-
bmeurer authored
Currently we lower shifts directly to machine operators, and add an appropriate Word32And to implement the & 0x1F operation on the right hand side required by the specification. However for Word32And we assume Int32 in simplified lowering, which is basically changes the right hand side bit interpretation for the shifts from Uint32 to Int32, which is obviously wrong. So now we represent that explicitly by proper simplified operators for the shifts, which are lowered to machine in simplified lowering. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1213803008 Cr-Commit-Position: refs/heads/master@{#29465}
-
- 23 Jun, 2015 1 commit
-
-
mstarzinger authored
This is a precursor to using specialized LoadIC and StoreIC stubs for global variable access. It also removes the need to keep track of the global object in the type system, hence freeing up one bit. R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1205473004 Cr-Commit-Position: refs/heads/master@{#29231}
-
- 15 Jun, 2015 1 commit
-
-
bmeurer authored
The TryLowerDirectJSCall method tried to lower to a direct JavaScript function call depending on the type of the receiver, but only if the target is a cosntant JSFunction. Since this depends on types and is not required for correctness, it shouldn't be part of generic lowering anyway. So this functionality was moved to typed lowering instead, and we use proper types for the target instead. R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/1182193005 Cr-Commit-Position: refs/heads/master@{#29028}
-
- 08 Jun, 2015 1 commit
-
-
mstarzinger authored
This adds handling of JSLoadDynamicContext nodes to JSTypedLowering to perform extension checks and an inline fast path. The fast path is a context slot load targeting a specific context. R=bmeurer@chromium.org BUG=v8:4131 LOG=N Review URL: https://codereview.chromium.org/1155543003 Cr-Commit-Position: refs/heads/master@{#28823}
-
- 03 Jun, 2015 1 commit
-
-
bmeurer authored
The IC for modulus is usually way faster than converting the inputs to numbers and doing a Float64Mod on them. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1170433002 Cr-Commit-Position: refs/heads/master@{#28787}
-
- 02 Jun, 2015 2 commits
-
-
mstarzinger authored
This adds handling of JSLoadDynamicGlobal nodes to JSTypedLowering to perform extension checks and an inline fast path. The fast path is a global variable load from the global object. R=bmeurer@chromium.org BUG=v8:4131 LOG=N Review URL: https://codereview.chromium.org/1150723005 Cr-Commit-Position: refs/heads/master@{#28750}
-
bmeurer authored
Unfortunately StringAdd is not pure in V8 because we might throw an exception if the resulting string length is outside the valid bounds, so there's no point in having a simplified StringAdd operator. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1164743002 Cr-Commit-Position: refs/heads/master@{#28747}
-
- 01 Jun, 2015 1 commit
-
-
bmeurer authored
This is basically a port of the majority of optimizations that are applied to for-in in full codegen. But it is not done during graph building, but instead during typed lowering, which way less adhoc than what the other compilers do. Review URL: https://codereview.chromium.org/1155313008 Cr-Commit-Position: refs/heads/master@{#28726}
-
- 19 May, 2015 1 commit
-
-
mstarzinger authored
This in turn allows usage of AdvancedReducer::ReplaceWithValue which has access to the underlying graph reducer. It will allow us to deal with exception continuations correctly. R=titzer@chromium.org Review URL: https://codereview.chromium.org/1134303003 Cr-Commit-Position: refs/heads/master@{#28468}
-
- 13 May, 2015 1 commit
-
-
bmeurer authored
Use these check points to optimize comparisons where we already know that one side cannot be a String (or turn into a string via ToPrimitive). Also remove bunch of useless DoNotCrash tests for the scheduler that are painful to maintain and add almost no value. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1140583004 Cr-Commit-Position: refs/heads/master@{#28383}
-
- 08 May, 2015 1 commit
-
-
bmeurer authored
This should not be done during typed lowering, but should be part of a dedicated truncation/conversion analysis. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1132773002 Cr-Commit-Position: refs/heads/master@{#28314}
-
- 04 May, 2015 1 commit
-
-
mstarzinger authored
This introduces a simplified allocation operator which can be used to model inline allocations in TurboFan. It is currently used for context allocations, but still disabled because change lowering introduces floating allocations outside the effect chain that interfere. R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1109773002 Cr-Commit-Position: refs/heads/master@{#28195}
-
- 27 Apr, 2015 2 commits
-
-
mstarzinger authored
This uses explicit operators instead of intrinsic runtime calls to create literals froms boilerplates. It allows for easier access of static parameters and syncs it with other allocating operators. R=svenpanne@chromium.org Review URL: https://codereview.chromium.org/1104453006 Cr-Commit-Position: refs/heads/master@{#28062}
-
mstarzinger authored
This introduces a JSCreateClosure operator which can be lowered by the typed pipeline to the aforementioned stub. It also allows for further optimizations of closure creation. R=titzer@chromium.org Review URL: https://codereview.chromium.org/1105513002 Cr-Commit-Position: refs/heads/master@{#28058}
-
- 20 Apr, 2015 1 commit
-
-
Ross McIlroy authored
R=jochen@chromium.org Review URL: https://codereview.chromium.org/1088993003 Cr-Commit-Position: refs/heads/master@{#27937}
-
- 16 Apr, 2015 1 commit
-
-
Benedikt Meurer authored
TBR=svenpanne@chromium.org Review URL: https://codereview.chromium.org/1091723002 Cr-Commit-Position: refs/heads/master@{#27861}
-
- 13 Apr, 2015 1 commit
-
-
titzer authored
R=mstarzinger@chromium.org,verwaest@chromium.org BUG= Review URL: https://codereview.chromium.org/1077343002 Cr-Commit-Position: refs/heads/master@{#27792}
-
- 09 Mar, 2015 1 commit
-
-
jarin authored
This slightly hacky change provides lazy deopt points for to-number conversions in binops: When we deopt from a to-number conversion, we create a frame state with the already-converted value(s) so that we do not repeat the side effect of the conversion. Embenchen numbers are below. It is not quite clear what happened to fasta - the hot code looks nearly identical. Current: EmbenchenBox2d(RunTime): 12746 ms. d8-master: EmbenchenBox2d(RunTime): 13861 ms. ----------- bullet.js Current: EmbenchenBullet(RunTime): 17680 ms. d8-master: EmbenchenBullet(RunTime): 19170 ms. ----------- copy.js Current: EmbenchenCopy(RunTime): 4939 ms. d8-master: EmbenchenCopy(RunTime): 4943 ms. ----------- corrections.js Current: EmbenchenCorrections(RunTime): 6639 ms. d8-master: EmbenchenCorrections(RunTime): 6728 ms. ----------- fannkuch.js Current: EmbenchenFannkuch(RunTime): 4630 ms. d8-master: EmbenchenFannkuch(RunTime): 4872 ms. ----------- fasta.js Current: EmbenchenFasta(RunTime): 10209 ms. d8-master: EmbenchenFasta(RunTime): 9673 ms. ----------- lua_binarytrees.js Current: EmbenchenLuaBinaryTrees(RunTime): 12936 ms. d8-master: EmbenchenLuaBinaryTrees(RunTime): 15529 ms. ----------- memops.js Current: EmbenchenMemOps(RunTime): 7357 ms. d8-master: EmbenchenMemOps(RunTime): 7340 ms. ----------- primes.js Current: EmbenchenPrimes(RunTime): 7530 ms. d8-master: EmbenchenPrimes(RunTime): 7457 ms. ----------- skinning.js Current: EmbenchenSkinning(RunTime): 15832 ms. d8-master: EmbenchenSkinning(RunTime): 15630 ms. ----------- zlib.js Current: EmbenchenZLib(RunTime): 11176 ms. d8-master: EmbenchenZLib(RunTime): 11324 ms. BUG= Review URL: https://codereview.chromium.org/985713003 Cr-Commit-Position: refs/heads/master@{#27071}
-
- 14 Jan, 2015 2 commits
-
-
bmeurer authored
Revert of [turbofan] Improve typed lowering of JSBitwiseAnd. (patchset #1 id:1 of https://codereview.chromium.org/811653004/) Reason for revert: Breaks SQLite Original issue's description: > [turbofan] Improve typed lowering of JSBitwiseAnd. > > TEST=unittests > R=jarin@chromium.org > > Committed: https://crrev.com/284e1108182995abe85f580bc813d26491642b8c > Cr-Commit-Position: refs/heads/master@{#26046} TBR=jarin@chromium.org NOTREECHECKS=true NOTRY=true Review URL: https://codereview.chromium.org/795833006 Cr-Commit-Position: refs/heads/master@{#26048}
-
Benedikt Meurer authored
TEST=unittests R=jarin@chromium.org Review URL: https://codereview.chromium.org/811653004 Cr-Commit-Position: refs/heads/master@{#26046}
-
- 05 Jan, 2015 1 commit
-
-
Benedikt Meurer authored
Introduce a new AnyToBoolean simplified operator to handle the later lowering of boolean conversions. Previously we tried to hack that with the generic JSToBoolean, having its context set to zero, but that lead to various problems/bugs and did not handle all cases. TEST=cctest,unittests R=jarin@chromium.org Review URL: https://codereview.chromium.org/800833003 Cr-Commit-Position: refs/heads/master@{#25958}
-
- 16 Dec, 2014 1 commit
-
-
Benedikt Meurer authored
This greatly reduces the number of nodes in the graph (by more than 20x in some extreme cases) for the Emscripten python interpreter main function. BUG=v8:3763 LOG=y TEST=cctest,mjsunit,unittests R=svenpanne@chromium.org Review URL: https://codereview.chromium.org/802353003 Cr-Commit-Position: refs/heads/master@{#25840}
-
- 12 Dec, 2014 1 commit
-
-
Benedikt Meurer authored
- Decouple JSBuiltinReducer from JSTypedLowering. - Unify JSTypedLowering::ReduceJSToXXX() lowering. - Cleanup several includes and forward declarations. - Unify helper methods. TEST=cctest R=svenpanne@chromium.org Review URL: https://codereview.chromium.org/797903003 Cr-Commit-Position: refs/heads/master@{#25790}
-
- 09 Dec, 2014 1 commit
-
-
bmeurer authored
Also fix the pushing of JSToBoolean into Phis and generalize it to also include pushing into Selects. TEST=cctest,unittests Review URL: https://codereview.chromium.org/792463003 Cr-Commit-Position: refs/heads/master@{#25718}
-
- 04 Dec, 2014 1 commit
-
-
Benedikt Meurer authored
TEST=unittests R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/776243002 Cr-Commit-Position: refs/heads/master@{#25656}
-
- 02 Dec, 2014 1 commit
-
-
Benedikt Meurer authored
TEST=mjsunit,cctest,unittests R=jarin@chromium.org Review URL: https://codereview.chromium.org/763963002 Cr-Commit-Position: refs/heads/master@{#25591}
-
- 18 Nov, 2014 1 commit
-
-
Benedikt Meurer authored
This essentially performs the following transformation JSToNumber(phi(x1,...,xn,control):primitive) => phi(JSToNumber(x1),...,JSToNumber(xn),control):number which is similar to what we already do for JSToBoolean. TEST=mjsunit/asm R=svenpanne@chromium.org BUG= Review URL: https://codereview.chromium.org/732463003 Cr-Commit-Position: refs/heads/master@{#25390}
-
- 17 Nov, 2014 1 commit
-
-
Benedikt Meurer authored
Now we actually implement it the way it is meant to be, that is: JSToBoolean(Phi(x1,...,xn):primitive) => Phi(JSToBoolean(x1),...,JSToBoolean(xn)):boolean This also fixes the endless recursion within JSTypedLowering when the GraphReducer does all possible reductions instead of using the generic algorithm. R=dcarney@chromium.org Review URL: https://codereview.chromium.org/730043002 Cr-Commit-Position: refs/heads/master@{#25376}
-
- 13 Nov, 2014 1 commit
-
-
Benedikt Meurer authored
There's no need to apply the 0x1f mask to right hand sides of shifts if the input is already in range [0,31]. TEST=cctest,unittests R=jarin@chromium.org Review URL: https://codereview.chromium.org/718193003 Cr-Commit-Position: refs/heads/master@{#25313}
-