- 19 Jul, 2021 1 commit
-
-
Jakob Gruber authored
This wraps up the transition away from kSerialized ref kinds. Since JSFunctionRef is a complex type, we don't attempt full consistency on the background thread. Instead, we serialize functions on the background in a partially-racy manner, in which consistency between different JSFunction fields is *not* guaranteed. Consistency is later verified through a new compilation dependency kind during finalization. Bug: v8:7790, v8:12004 Change-Id: Ic2b78af9c9fe183c8769d323132bb304b151dc75 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968404 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#75789}
-
- 22 Oct, 2019 3 commits
-
-
Victor Gomes authored
Original change's description: > [runtime] Remove extension slots from context objects > > Context objects have an extension slot, which contains further > additional data that depends on the type of the context. > > This CL removes the extension slot from contexts that don't need > them, hence reducing memory. > > The following contexts will still have an extension slot: native, > module, await, block and with contexts. See objects/contexts.h for > what the slot is used for. > The following contexts will not have an extension slot anymore (they > were not used before): script, catch and builtin contexts. > Eval and function contexts only have the extension slot if they > contain a sloppy eval. > > Bug: v8:9744 > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > Commit-Queue: Victor Gomes <victorgomes@google.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Auto-Submit: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64372} TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org Bug: v8:9744 Change-Id: I8700ed2fa62c89e86c39bb16ac3167f38ea8d63f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1873695 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#64477}
-
Clemens Backes authored
This reverts commit 392a1217. Reason for revert: Several failures on mac64 gc stress: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/9747 Original change's description: > Reland "Reland "[runtime] Remove extension slots from context objects"" > > This is a reland of c48096d4 > > Original change's description: > > Reland "[runtime] Remove extension slots from context objects" > > > > This is a reland of c07c02e1 > > > > Original change's description: > > > [runtime] Remove extension slots from context objects > > > > > > Context objects have an extension slot, which contains further > > > additional data that depends on the type of the context. > > > > > > This CL removes the extension slot from contexts that don't need > > > them, hence reducing memory. > > > > > > The following contexts will still have an extension slot: native, > > > module, await, block and with contexts. See objects/contexts.h for > > > what the slot is used for. > > > The following contexts will not have an extension slot anymore (they > > > were not used before): script, catch and builtin contexts. > > > Eval and function contexts only have the extension slot if they > > > contain a sloppy eval. > > > > > > Bug: v8:9744 > > > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > > > Commit-Queue: Victor Gomes <victorgomes@google.com> > > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > > Cr-Commit-Position: refs/heads/master@{#64372} > > > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > > > Bug: v8:9744 > > Change-Id: I0749cc2d8f59940c25841736634a70047116d647 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869192 > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > Cr-Commit-Position: refs/heads/master@{#64380} > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > Bug: v8:9744 > Change-Id: I621ffe98722f8c4defaf277b8d1666484ba2963f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872400 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64451} TBR=ulan@chromium.org,jgruber@chromium.org,petermarshall@chromium.org,leszeks@chromium.org,verwaest@chromium.org,victorgomes@google.com Change-Id: I99a71180c6a00a87478867a8210ff9ceb46cb3ee No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9744 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872405Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#64453}
-
Victor Gomes authored
This is a reland of c48096d4 Original change's description: > Reland "[runtime] Remove extension slots from context objects" > > This is a reland of c07c02e1 > > Original change's description: > > [runtime] Remove extension slots from context objects > > > > Context objects have an extension slot, which contains further > > additional data that depends on the type of the context. > > > > This CL removes the extension slot from contexts that don't need > > them, hence reducing memory. > > > > The following contexts will still have an extension slot: native, > > module, await, block and with contexts. See objects/contexts.h for > > what the slot is used for. > > The following contexts will not have an extension slot anymore (they > > were not used before): script, catch and builtin contexts. > > Eval and function contexts only have the extension slot if they > > contain a sloppy eval. > > > > Bug: v8:9744 > > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > > Commit-Queue: Victor Gomes <victorgomes@google.com> > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > Cr-Commit-Position: refs/heads/master@{#64372} > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > Bug: v8:9744 > Change-Id: I0749cc2d8f59940c25841736634a70047116d647 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869192 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Auto-Submit: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64380} TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org Bug: v8:9744 Change-Id: I621ffe98722f8c4defaf277b8d1666484ba2963f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872400Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Victor Gomes <victorgomes@google.com> Cr-Commit-Position: refs/heads/master@{#64451}
-
- 24 May, 2019 1 commit
-
-
Yang Guo authored
TBR=mvstanton@chromium.org,neis@chromium.org,ahaas@chromium.org Bug: v8:9247 Change-Id: I5433c863a54f3412d73df0d38aba3fdbcfac7ebe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627973 Commit-Queue: Yang Guo <yangguo@chromium.org> Auto-Submit: Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#61830}
-
- 18 Apr, 2019 1 commit
-
-
Georg Neis authored
We see crashes in the wild that we suspect are caused by these changes. This is a manual revert because of conflicts. Revert "[turbofan] Fix incorrect CheckNonEmptyString lowering." This reverts commit b3b70118. Revert "[turbofan] Fix incorrect lowering of CheckNonEmptyString." This reverts commit 57582090. Revert "[turbofan] Significantly improve ConsString creation performance." This reverts commit d6a60a0e. Bug: v8:9147 Change-Id: I262c21e5406a9c4c8ad0e0f995582c5802f0fa1e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1571613Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#60919}
-
- 19 Mar, 2019 1 commit
-
-
Benedikt Meurer authored
This change significantly improves the performance of string concatenation in optimized code for the case where the resulting string is represented as a ConsString. On the relevant test cases we go from serializeNaive: 10762 ms. serializeClever: 7813 ms. serializeConcat: 10271 ms. to serializeNaive: 10278 ms. serializeClever: 5533 ms. serializeConcat: 10310 ms. which represents a 30% improvement on the "clever" benchmark, which tests specifically the ConsString creation performance. This was accomplished via a couple of different steps, which are briefly outlined here: 1. The empty_string gets its own map, so that we can easily recognize and handle it appropriately in the TurboFan type system. This allows us to express (and assert) that the inputs to NewConsString are non-empty strings, making sure that TurboFan no longer creates "crippled ConsStrings" with empty left or right hand sides. 2. Further split the existing String types in TurboFan to be able to distinguish between OneByte and TwoByte strings on the type system level. This allows us to avoid having to dynamically lookup the resulting ConsString map in case of ConsString creation (i.e. when we know that both input strings are OneByte strings or at least one of the input strings is TwoByte). 3. We also introduced more finegrained feedback for the Add bytecode in the interpreter, having it collect feedback about ConsStrings, specifically ConsOneByteString and ConsTwoByteString. This feedback can be used by TurboFan to only inline the relevant code for what was seen so far. This allows us to remove the Octane/Splay specific magic in JSTypedLowering to detect ConsString creation, and instead purely rely on the feedback of what was seen so far (also making it possible to change the semantics of NewConsString to be a low-level operator, which is only introduced in SimplifiedLowering by looking at the input types of StringConcat). 4. On top of the before mentioned type and interpreter changes we added new operators CheckNonEmptyString, CheckNonEmptyOneByteString, and CheckNonEmptyTwoByteString, which perform the appropriate (dynamic) checks. There are several more improvements that are possible based on this, but since the change was already quite big, we decided not to put everything into the first change, but do some follow up tweaks to the type system, and builtin optimizations later. Tbr: mstarzinger@chromium.org Bug: v8:8834, v8:8931, v8:8939, v8:8951 Change-Id: Ia24e17c6048bf2b04df966d3cd441f0edda05c93 Cq-Include-Trybots: luci.chromium.try:linux-blink-rel Doc: https://bit.ly/fast-string-concatenation-in-javascript Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1499497 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#60318}
-
- 02 Jan, 2019 1 commit
-
-
Clemens Hammacher authored
Apart from being more in-line with the style guide, this allows to use DEFINE_LAZY_LEAKY_OBJECT_GETTER for defining {TypeCache::Get}. R=tebbi@chromium.org Bug: v8:8562 Change-Id: I016b28624950ce9404180fc1ca1a232551f75cd0 Reviewed-on: https://chromium-review.googlesource.com/c/1392201Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#58500}
-
- 22 Nov, 2018 1 commit
-
-
Sigurd Schneider authored
This CL moves optimization capabilities from typed lowering to typed optimization. In particular, this allows retyping of Speculative to number optimizations depending on their input types. This can save type checks if we know that inputs are already in SafeIntegerRange and uses are truncating to 32bit integers. This change recovers the performance lost to 31bit Smis on Octane/crypto on x64: 32bit nosmis avg 30,984.84 stddev 180.52 31bit smis (w/o patch) avg 29,438.52 stddev 120.30 -4.99% 31bit smis avg 31,274.52 stddev 176.26 +0.93% +6.24% Change-Id: I86d6e37305262336f4f7bd46aac0d2cbca11e8c1 Bug: v8:8344 Reviewed-on: https://chromium-review.googlesource.com/c/1323729 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#57717}
-
- 18 Oct, 2018 1 commit
-
-
Benedikt Meurer authored
We can strength-reduce JSResolvePromise(p,v) to JSFulfillPromise(p,v) if the v is known to be a primitive. This not only avoids the dynamic checks for v inside JSResolvePromise, but also removes the need to have a frame state, as the JSFulfillPromise operation cannot call back into arbitrary JavaScript, and thus cannot deoptimize lazily. This triggers for example for async functions where the return value is known (to TurboFan) to be a primitive value. Bug: v8:7253 Change-Id: I4698d6026e0632ab3e2fef6c7f4aaacf6c2a508c Reviewed-on: https://chromium-review.googlesource.com/c/1288449 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56758}
-
- 15 Oct, 2018 1 commit
-
-
Georg Neis authored
There's no ambiguity and the shorter name makes things easier to read. Bug: v8:7790 Change-Id: Ibcf3fd7f38a91e26a83cd335fad0ec80a5fe9be1 Reviewed-on: https://chromium-review.googlesource.com/c/1278392 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#56623}
-
- 21 Sep, 2018 1 commit
-
-
Benedikt Meurer authored
The JSToInteger operator is not used anywhere in TurboFan nowadays, so no point in keeping the dead code in the tree. Bug: v8:8015 Change-Id: If03ba63c4b932ba0aac60b9bbc89fee3909a93c6 Reviewed-on: https://chromium-review.googlesource.com/1238238Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56126}
-
- 17 Sep, 2018 1 commit
-
-
Florian Sattler authored
Fixing clang-tidy warning. Bug: v8:8015 Change-Id: I7d885f0e2ba3cdf97de190166dc4cdd24dc0c11e Reviewed-on: https://chromium-review.googlesource.com/1224091 Commit-Queue: Florian Sattler <sattlerf@google.com> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#55956}
-
- 07 Sep, 2018 1 commit
-
-
Benedikt Meurer authored
This replaces the previous CheckStringAdd operator which deopts in case the combined length overflows with a dedicated pure StringConcat operator. This operator is similar to NewConsString in that it takes the resulting length plus the two input strings. The operator relies on the length being checked explicitly by the surrounding code instead of baking the check into the operator itself. This way TurboFan can eliminate redundant/unnecessary StringConcat operations, since they are pure now. This also unifies the treatment of string addition in JSTypedLowering, and generalizes the StringLength constant-folding to apply to more cases not just the JSAdd cases inside JSTypedLowering. Bug: v8:7902, v8:8015 Change-Id: I987ec39815a9464fd5fd9c4f7b26b709f94f2b3f Reviewed-on: https://chromium-review.googlesource.com/1213205Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55725}
-
- 30 Aug, 2018 1 commit
-
-
Benedikt Meurer authored
This addresses a TODO in JSTypedLowering and generally makes the more easier to follow since the methods deal only with one kind of Node now. Bug: v8:8015 Change-Id: I8c3521b8d630dbe272264dc01e9ab3a5b0a8f682 Reviewed-on: https://chromium-review.googlesource.com/1196883Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55530}
-
- 23 Jul, 2018 1 commit
-
-
Georg Neis authored
We'll soon start collecting data from the JS heap prior to the typed lowering pass, and then refrain from reading the heap in that pass. This CL prepares the broker machinery by introducing a hash table that maps an object (handle) to the corresponding cached data. For the time being, that cached data is essentially just the handle itself. Bug: v8:7790 Change-Id: I830e9c72faafb7ae1d10e8a111636b3a3762bbc6 Reviewed-on: https://chromium-review.googlesource.com/1143405 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#54618}
-
- 12 Jul, 2018 1 commit
-
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I16a2fa9c37a8b00a067f8f7fd3a87cb747233132 Reviewed-on: https://chromium-review.googlesource.com/1128968 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#54416}
-
- 07 Jun, 2018 1 commit
-
-
Jaroslav Sevcik authored
As a first step towards moving accesses to the broker, this moves heap accesses from BitsetType::Lub to the broker. Bug: v8:7790 Change-Id: Ie240b84b979717caae42cb8aa06ee8d9877a446d Reviewed-on: https://chromium-review.googlesource.com/1088695 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53571}
-
- 28 Apr, 2018 1 commit
-
-
Jaroslav Sevcik authored
This is part of the effort to decrease the amount of undefined behavior. that v8 relies on. The main change here is to represent types with class Type rather than with pointer Type*. To make the CL smaller, I used an operator overload hack to separate the change from `->` to `.`. I am working on a CL that will remove the operator and change all those arrows to dots. Bug: v8:3770 Change-Id: I71a197cb739a1467937bc95c2a757fab0469aa22 Reviewed-on: https://chromium-review.googlesource.com/1032551 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#52872}
-
- 26 Apr, 2018 1 commit
-
-
Sigurd Schneider authored
This CL also removes the JSBuiltinReducer, which is no longer needed. Bug: v8:7340, v8:7250 Change-Id: I28896f6ce0d352047ea1cb7ea6de490818840faf Reviewed-on: https://chromium-review.googlesource.com/1027853 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52799}
-
- 24 Apr, 2018 1 commit
-
-
Sigurd Schneider authored
This CL introduces a JSOperator for Array.isArray and moves the corresponding lowering to JSCallReducer and JSTypedLowering. Bug: v8:7340, v8:7250 Change-Id: Iaa7ced2ad34bec8cccc9da1041007261168cf4b3 Reviewed-on: https://chromium-review.googlesource.com/1025092 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52757}
-
- 20 Feb, 2018 1 commit
-
-
Adam Klein authored
Also delete a bit of dead code depending on dead types. Change-Id: I6cfc7e2f6c8fd006bd0de054bfc3e9f725996741 Reviewed-on: https://chromium-review.googlesource.com/923083Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#51403}
-
- 24 Jan, 2018 1 commit
-
-
Leszek Swirski authored
The SwitchOnGeneratorState bytecode now also falls through if the generator object is undefined (so that we don't need that jump) and restores generator context (so that we don't need that PushContext). This saves 10 bytes per generator. Change-Id: Ie0872c827119b9f1d1e9244d3be6496a30cd9620 Reviewed-on: https://chromium-review.googlesource.com/867051 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#50845}
-
- 11 Jan, 2018 1 commit
-
-
Leszek Swirski authored
This makes RestoreGeneratorRegisters do a fuller resume process: update the state register to indicate that it is now executing, and update the accumulator with the input_or_debug_pos of the generator - i.e., perform the boilerplate generator resuming in one bytecode instead of several. Change-Id: Ia87b6766ac023064b40d3e9a143e7b32118ea3a0 Reviewed-on: https://chromium-review.googlesource.com/859770 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#50499}
-
- 30 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
Strings are immutable in JavaScript land (contrast with the runtime, where we can truncate strings that haven't escaped to JavaScript yet), so the length of a String is immutable. Thus loading the length of a String is a pure operation and should be expressed as such (i.e. doesn't depend on control or effect). The StringLength operator does exactly this and is hooked up to the effect chain in the EffectControlLinearizer. This will eventually allow us to simplify the optimization of string concatention and other operations that are a bit cumbersome in TurboFan currently, and it will also allow us to optimize string operations across effectful operations, for example combining multiple invocations to String#slice with the same inputs. Bug: v8:5269, v8:6936, v8:7109, v8:7137 Change-Id: Iffcccbb0c7fc4cfe1281c10e7af24b40eba4c987 Reviewed-on: https://chromium-review.googlesource.com/799690Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49731}
-
- 28 Nov, 2017 1 commit
-
-
Georg Neis authored
... in the same style as the previous CLs for negation and bitwise-not. R=jarin@chromium.org Bug: v8:6791 Change-Id: I0aa96a72421e90c8c82a39dd4264fdcf00967504 Reviewed-on: https://chromium-review.googlesource.com/779141 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49658}
-
- 21 Nov, 2017 3 commits
-
-
Georg Neis authored
This introduces a JSBitwiseNot operator and lowers it either to a speculative xor with -1 (when we have Number feedback) or to a stub call. The stub is also new. Bug: v8:6791 Change-Id: I362e52de8a741dc5db044c406543878e407eb2ed Reviewed-on: https://chromium-review.googlesource.com/778839 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49539}
-
Georg Neis authored
This introduces a JSNegate operator and lowers it either to a speculative multiplication with -1 (when we have Number feedback) or to a stub call. The stub is also new. R=jarin@chromium.org Bug: v8:6791 Change-Id: I8e20333fe49cc6088d2d10777be982e42eed2412 Reviewed-on: https://chromium-review.googlesource.com/774718 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49538}
-
Georg Neis authored
TBR: rmcilroy@chromium.org Bug: v8:6791 Change-Id: I4ac2bdce353d987a2fe45149d8556b6591569a01 Reviewed-on: https://chromium-review.googlesource.com/771191 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49528}
-
- 27 Oct, 2017 1 commit
-
-
Jaroslav Sevcik authored
This enables proper wiring into ithe control flow chain. Bug: v8:7002,chromium:777574 Change-Id: Idba59944ff6ab3c10c204bb74ace61d812e6297c Reviewed-on: https://chromium-review.googlesource.com/738183Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#48990}
-
- 19 Oct, 2017 1 commit
-
-
Mike Stanton authored
Because the toboolean operator may lower to a builtin call (which is effectful in turbofan parlance after effect control linearization), it really should be encoded as a simplified operator, which can be optimized with respect for the effect chain in linearization. No new functionality here, rather a furniture rearrangement in the TurboFan node structure. Bug: v8:6929 Change-Id: I371fd22941397d5c28d13bded2738161d8da8275 Reviewed-on: https://chromium-review.googlesource.com/725721Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#48727}
-
- 16 Oct, 2017 1 commit
-
-
Mike Stanton authored
Because the typeof operator may lower to a builtin call (which is effectful in turbofan parlance after effect control linearization), it really should be encoded as a simplified operator, which can be optimized with respect for the effect chain in linearization. No new functionality here, rather a furniture rearrangement in the TurboFan node structure. BUG=v8:6929 Change-Id: I38593e10956ebd57cecdd606c35f3f73efb1327e Reviewed-on: https://chromium-review.googlesource.com/718745Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#48613}
-
- 01 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
This CL adds support to optimize for..in in fast enum-cache mode to the same degree that it was optimized in Crankshaft, without adding the same deoptimization loop that Crankshaft had with missing enum cache indices. That means code like for (var k in o) { var v = o[k]; // ... } and code like for (var k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) { var v = o[k]; // ... } } which follows the https://eslint.org/docs/rules/guard-for-in linter rule, can now utilize the enum cache indices if o has only fast properties on the receiver, which speeds up the access o[k] significantly and reduces the pollution of the global megamorphic stub cache. For example the micro-benchmark in the tracking bug v8:6702 now runs faster than ever before: forIn: 1516 ms. forInHasOwnProperty: 1674 ms. forInHasOwnPropertySafe: 1595 ms. forInSum: 2051 ms. forInSumSafe: 2215 ms. Compared to numbers from V8 5.8 which is the last version running with Crankshaft forIn: 1641 ms. forInHasOwnProperty: 1719 ms. forInHasOwnPropertySafe: 1802 ms. forInSum: 2226 ms. forInSumSafe: 2409 ms. and V8 6.0 which is the current stable version with TurboFan: forIn: 1713 ms. forInHasOwnProperty: 5417 ms. forInHasOwnPropertySafe: 5324 ms. forInSum: 7556 ms. forInSumSafe: 11067 ms. It also improves the throughput on the string-fasta benchmark by around 7-10%, and there seems to be a ~5% improvement on the Speedometer/React benchmark locally. For this to work, the ForInPrepare bytecode was split into ForInEnumerate and ForInPrepare, which is very similar to how it was handled in Fullcodegen initially. In TurboFan we introduce a new operator LoadFieldByIndex that does the dynamic property load. This also removes the CheckMapValue operator again in favor of just using LoadField, ReferenceEqual and CheckIf, which work automatically with the EscapeAnalysis and the BranchConditionElimination. Bug: v8:6702 Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a Reviewed-on: https://chromium-review.googlesource.com/645949 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#47768}
-
- 28 Aug, 2017 1 commit
-
-
Benedikt Meurer authored
There's no need to have the StringLengthProtector as a PropertyCell, since it's only used to guard against deoptimization loops. This also allows us to remove the use of the CompilationDependencies from the JSTypedLowering. R=jarin@chromium.org Bug: v8:6759 Change-Id: I54a37be6b8064ca3475e3b321f928b6a9903f209 Tbr: mstarzinger@chromium.org Reviewed-on: https://chromium-review.googlesource.com/637303 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47633}
-
- 11 Aug, 2017 1 commit
-
-
Benedikt Meurer authored
These operators were only used by the old asm.js pipeline (with fullcodegen and the AstGraphBuilder). When going through the new pipeline, accesses to TypedArrays are handled by the native context specialization during inlining. Bug: v8:6409 Change-Id: Ib9b888c0b96f297a335580ee42dfa951bde566be Reviewed-on: https://chromium-review.googlesource.com/612347Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47322}
-
- 10 Aug, 2017 1 commit
-
-
Ross McIlroy authored
Deletes AstGraphBuilder and associated classes now that it is unreachable. The following classes are also removed: - ControlBuilders - JSFrameSpecialization - AstLoopAssignmentAnalysis Also removes flags from compilation-info which are no longer used, and removes the no-deoptimization paths from TypedOptimization, JsTypedLowering, JSIntrinsicLowering and JSBuiltinLowering. BUG=v8:6409 Change-Id: I63986e8e3497bf63c4a27ea8ae827b8a633d4a26 Reviewed-on: https://chromium-review.googlesource.com/583652 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47284}
-
- 19 Jul, 2017 1 commit
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
- 11 Jul, 2017 1 commit
-
-
Alexandre Talon authored
Each reducer now has a virtual reducer_name function, returning its name (the name of the class containing this reducer). This gets displayed when using the --trace_turbo_reduction flag. Also when using this flags more messages are displayed. Actually when a node is replaced in-place (which is called an update of the node), other reducers can still update it right after the in-place replacement. When a node is really replaced (not in-place), then we stop trying to apply reducers to it before we propagate the reduction through the relevant nodes. Before a message got printed only for the last reduction it went through. So in case a node was reduced in-place several times in a row, only the last update was printed, or none at all if after being reduced in-place it got reduced by being replaced by another node: only the non-in-place replacement was showed. Now each time an in-place reduction is applied to a node, a message gets printed. Bug: Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa Reviewed-on: https://chromium-review.googlesource.com/563365Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Alexandre Talon <alexandret@google.com> Cr-Commit-Position: refs/heads/master@{#46552}
-
- 21 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Adds typed lowering of JSStringConcat to ConsString allocation if the following conditions hold: - All concatinations will result in a ConsString of >= ConString::kMinLength - No concatinations will result in a empty string in the RHS unless there is a sequential string in the LHS. This also means JSStringConcat needs an eager checkpoint since it can deopt if throwing a RangeError when the string length protector is valid. BUG=v8:6243 Change-Id: I01ca79f884df467c10f2c032c72d51b5199c1a3c Reviewed-on: https://chromium-review.googlesource.com/526636 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46093}
-
- 19 Jun, 2017 1 commit
-
-
bmeurer authored
We need to constant-fold JSHasInPrototypeChain nodes early during inlining, otherwise we already miss a couple of optimization opportunities if we wait until after typing. This moves the constant-folding part of the JSHasInPrototypeChain lowering back to JSNativeContextSpecialization, where it was before the changes in https://codereview.chromium.org/2934893002 (part of JSOrdinaryHasInstance lowering back then). BUG=v8:5269,v8:5989,v8:6483,chromium:733158 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2943293002 Cr-Commit-Position: refs/heads/master@{#45989}
-