1. 07 May, 2018 1 commit
    • jgruber's avatar
      [builtins] Convert CEntry/GetProperty/StringAdd stubs to builtins · d8131cd6
      jgruber authored
      Stubs and builtins are very similar. The main differences are that
      stubs can be parameterized and may be generated at runtime, whereas
      builtins are generated at mksnapshot-time and shipped with the snapshot
      (or embedded into the binary).
      
      My main motivation for these conversions is that we can generate
      faster calls and jumps to (embedded) builtins callees from (embedded)
      builtin callers. Instead of going through the builtins constants table
      indirection, we can simply do a pc-relative call/jump.
      
      This also unlocks other refactorings, e.g. removal of
      CallRuntimeDelayed.
      
      TBR=mlippautz@chromium.org
      
      Bug: v8:6666
      Change-Id: I4cd63477f19a330ec70bbf20e2af8a42fb05fabb
      Reviewed-on: https://chromium-review.googlesource.com/1044245Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#53027}
      d8131cd6
  2. 19 Dec, 2017 1 commit
  3. 12 Dec, 2017 1 commit
  4. 20 Nov, 2017 1 commit
  5. 01 Sep, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Optimize fast enum cache driven for..in. · f1ec44e2
      Benedikt Meurer authored
      This CL adds support to optimize for..in in fast enum-cache mode to the
      same degree that it was optimized in Crankshaft, without adding the same
      deoptimization loop that Crankshaft had with missing enum cache indices.
      That means code like
      
        for (var k in o) {
          var v = o[k];
          // ...
        }
      
      and code like
      
        for (var k in o) {
          if (Object.prototype.hasOwnProperty.call(o, k)) {
            var v = o[k];
            // ...
          }
        }
      
      which follows the https://eslint.org/docs/rules/guard-for-in linter
      rule, can now utilize the enum cache indices if o has only fast
      properties on the receiver, which speeds up the access o[k]
      significantly and reduces the pollution of the global megamorphic
      stub cache.
      
      For example the micro-benchmark in the tracking bug v8:6702 now runs
      faster than ever before:
      
       forIn: 1516 ms.
       forInHasOwnProperty: 1674 ms.
       forInHasOwnPropertySafe: 1595 ms.
       forInSum: 2051 ms.
       forInSumSafe: 2215 ms.
      
      Compared to numbers from V8 5.8 which is the last version running with
      Crankshaft
      
       forIn: 1641 ms.
       forInHasOwnProperty: 1719 ms.
       forInHasOwnPropertySafe: 1802 ms.
       forInSum: 2226 ms.
       forInSumSafe: 2409 ms.
      
      and V8 6.0 which is the current stable version with TurboFan:
      
       forIn: 1713 ms.
       forInHasOwnProperty: 5417 ms.
       forInHasOwnPropertySafe: 5324 ms.
       forInSum: 7556 ms.
       forInSumSafe: 11067 ms.
      
      It also improves the throughput on the string-fasta benchmark by
      around 7-10%, and there seems to be a ~5% improvement on the
      Speedometer/React benchmark locally.
      
      For this to work, the ForInPrepare bytecode was split into
      ForInEnumerate and ForInPrepare, which is very similar to how it was
      handled in Fullcodegen initially. In TurboFan we introduce a new
      operator LoadFieldByIndex that does the dynamic property load.
      
      This also removes the CheckMapValue operator again in favor of
      just using LoadField, ReferenceEqual and CheckIf, which work
      automatically with the EscapeAnalysis and the
      BranchConditionElimination.
      
      Bug: v8:6702
      Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a
      Reviewed-on: https://chromium-review.googlesource.com/645949
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47768}
      f1ec44e2
  6. 28 Aug, 2017 1 commit
    • Georg Neis's avatar
      Revert "Remove obsolete kNumber binop feedback." · b4712d52
      Georg Neis authored
      This reverts commit 1169f55b.
      
      Reason for revert: http://crbug.com/758994
      
      Original change's description:
      > Remove obsolete kNumber binop feedback.
      > 
      > With the removal of Crankshaft, kNumber has become obsolete as
      > BinaryOperationFeedback. Turbofan uses kNumberOrOddball.
      > 
      > Bug: 
      > Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c
      > Reviewed-on: https://chromium-review.googlesource.com/628376
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Mythri Alle <mythria@chromium.org>
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#47555}
      
      TBR=jkummerow@chromium.org,jarin@chromium.org,neis@chromium.org,mythria@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      Change-Id: I1b33f572f3e6865e00d2468bffcce2ea466814b3
      Reviewed-on: https://chromium-review.googlesource.com/637711Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Commit-Queue: Georg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47642}
      b4712d52
  7. 23 Aug, 2017 1 commit
  8. 11 Aug, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Collect and use SignedSmall input feedback for Divide. · 622852e5
      Benedikt Meurer authored
      For Divide operations like
      
        r = a / b
      
      where r has only truncated uses (i.e. only used in bitwise operations),
      we used to generate a Float64Div unless we statically knew something
      about a and b, even if a and b have always been integers so far.
      Crankshaft was able to generate an integer division here, because
      Fullcodegen collected feedback independently for inputs and outputs of
      binary operations.
      
      This adds new BinaryOperationFeedback::kSignedSmallInputs, which is used
      specifically for Divide to state that we have seen only SignedSmall
      inputs thus far, but the outputs weren't always in the SignedSmall
      range.
      
      The issue was discovered in a WebGL Triangulation library and reported
      via https://twitter.com/mourner/status/895708603117518848 after Node
      8.3.0 was released with I+TF.
      
      R=jarin@chromium.org
      
      Bug: v8:6698
      Change-Id: I830e421a3bf91fc8fa3665cbb706bc13675a6d2b
      Reviewed-on: https://chromium-review.googlesource.com/612063
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47302}
      622852e5
  9. 19 Jul, 2017 1 commit
  10. 08 Jun, 2017 1 commit
    • Ross McIlroy's avatar
      [TurboFan] Add typing for the EmptyString and use this for JSToPrimitiveToString · 2c296b7e
      Ross McIlroy authored
      Add the ability for the typer to track whether a string could be the empty
      string. This is needed for typed lowering of JSStringConcat since we can't
      create cons string chain with the empty string in arbitrary positions.
      
      The ToPrimitiveToString bytecode handler is modified to collect feedback on
      whether it has ever seen the empty string, which is used by
      SpeculativeToPrimitiveToString to ensure that the output is non-empty (or
      depot) which will subsiquently be used to enable inline cons-string creation
      for the JSStringConcat operator in typed lowering in a subsiquent CL.
      
      BUG=v8:6243
      
      Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52
      Reviewed-on: https://chromium-review.googlesource.com/522122
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45786}
      2c296b7e
  11. 06 Jun, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Properly support Number feedback for binary operators. · 8a150262
      bmeurer authored
      Previously Ignition would collect precise Number feedback for binary
      operators, but TurboFan would just ignore that and treat it the same as
      NumberOrOddball. That however generates a lot of unnecessary code, plus
      it defeats redundancy elimination if the same input is also used by
      compare operations, which do properly distinguish feedback Number and
      NumberOrOddball.
      
      This CL adds the missing bits to connect the existing functionality
      properly, i.e. adding the missing BinaryOperationHint and using the
      NumberOperationHint::kNumber in the representation selection for tagged
      inputs.
      
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2923543003
      Cr-Commit-Position: refs/heads/master@{#45732}
      8a150262
  12. 22 May, 2017 2 commits
  13. 14 Feb, 2017 1 commit
  14. 13 Feb, 2017 4 commits
  15. 18 Jan, 2017 1 commit
  16. 02 Jan, 2017 1 commit
  17. 07 Dec, 2016 1 commit
    • lpy's avatar
      [Tracing] Implement IC statistics in tracing. · 0a3c8fc3
      lpy authored
      This patch introduces:
      
      1. ICStats class to store ic statistics items produced by V8,
      2. A disabled by default tracing category v8.ic_stats,
      3. An trace event V8.ICStats that contains ic statistics items in args,
      
      We store ic statistics items in an array until the array is full to reduce
      the number of trace events.
      
      TBR=jkummerow@chromium.org,ishell@chromium.org
      
      Review-Url: https://codereview.chromium.org/2503183002
      Cr-Commit-Position: refs/heads/master@{#41559}
      0a3c8fc3
  18. 17 Nov, 2016 1 commit
    • rmcilroy's avatar
      [Interpreter] Collect String feedback on CompareOps. · 53698740
      rmcilroy authored
      Collect string feedback for compare operations. Without this,
      functions which have a lot of string compare operations end up with
      a high generic type percentage, and don't get optimized until very
      late.
      
      Currently TurboFan doesn't use this String feedback for compare
      operations, but this could be done in future work if it is useful.
      
      BUG=chromium:660947
      
      Review-Url: https://codereview.chromium.org/2506013005
      Cr-Commit-Position: refs/heads/master@{#41078}
      53698740
  19. 11 Nov, 2016 1 commit
  20. 20 Sep, 2016 2 commits
    • mvstanton's avatar
      [TypeFeedbackVector] special ic slots for interpreter compare/binary ops. · b88d132f
      mvstanton authored
      Full code uses patching ICs for this feedback, and the interpreter uses
      the type feedback vector. It's a good idea to code the vector slots
      appropriately as ICs so that the runtime profiler can better gauge if
      the function is ready for tiering up from Ignition to TurboFan.
      
      As is, the feedback is stored in "general" slots which can't be
      characterized by the runtime profiler into feedback states.
      
      This CL addresses that problem. Note that it's also important to
      carefully exclude these slots from the profiler's consideration when
      determining if you want to optimize from Full code.
      
      BUG=
      
      Review-Url: https://codereview.chromium.org/2342853002
      Cr-Commit-Position: refs/heads/master@{#39555}
      b88d132f
    • bmeurer's avatar
      [turbofan] Lower ConsString creation in JSTypedLowering. · 29dd7fc5
      bmeurer authored
      Extract String feedback on Add operation and utilize to lower ConsString
      creation in JSTypedLowering when we know that a String addition will
      definitely result in the creation of a ConsString.
      
      Note that Crankshaft has to guard the potential length overflow of the
      resulting string with an eager deoptimization exit, while we can safely
      throw an exception in that case.
      
      Also note that the bytecode pipeline does not currently provide the
      String feedback for the addition, which has to be added.
      
      BUG=v8:5267
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2354853002
      Cr-Commit-Position: refs/heads/master@{#39540}
      29dd7fc5
  21. 09 Aug, 2016 1 commit
  22. 08 Aug, 2016 1 commit
  23. 13 Jul, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Extend undefined-to-number truncation to all oddballs. · 04b4df2c
      bmeurer authored
      Extends the truncation and type checks for NumberOrUndefined in
      representation selection and truncation analysis to deal with all
      oddballs not just undefined. Also extend the type hints to always
      report NumberOrOddball. This is necessary for the bitwise and shift
      operators where NUMBER feedback actually means NUMBER or ODDBALL.
      
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2149583002
      Cr-Commit-Position: refs/heads/master@{#37711}
      04b4df2c
  24. 16 Jun, 2016 1 commit
  25. 02 Jun, 2016 1 commit
    • jarin's avatar
      [turbofan] Initial version of number type feedback. · 216bcf9f
      jarin authored
      This introduces optimized number operations based on type feedback.
      
      Summary of changes:
      
      1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
         there is suitable feedback. The speculative nodes are connected to both the
         effect chain and the control chain and they retain the eager frame state.
      
      2. Simplified lowering now executes in three phases:
        a. Propagation phase computes truncations by traversing the graph from uses to
           definitions until checkpoint is reached. It also records type-check decisions
           for later typing phase, and computes representation.
        b. The typing phase computes more precise types base on the speculative types (and recomputes
           representation for affected nodes).
        c. The lowering phase performs lowering and inserts representation changes and/or checks.
      
      3. Effect-control linearization lowers the checks to machine graphs.
      
      Notes:
      
      - SimplifiedLowering will be refactored to have handling of each operation one place and
        with clearer input/output protocol for each sub-phase. I would prefer to do this once
        we have more operations implemented, and the pattern is clearer.
      
      - The check operations (Checked<A>To<B>) should have some flags that would affect
        the kind of truncations that they can handle. E.g., if we know that a node produces
        a number, we can omit the oddball check in the CheckedTaggedToFloat64 lowering.
      
      - In future, we want the typer to reuse the logic from OperationTyper.
      
      BUG=v8:4583
      LOG=n
      
      Review-Url: https://codereview.chromium.org/1921563002
      Cr-Commit-Position: refs/heads/master@{#36674}
      216bcf9f
  26. 03 Dec, 2015 1 commit
  27. 01 Dec, 2015 1 commit