- 26 Feb, 2018 31 commits
-
-
Gabriel Charette authored
This reverts commit c41c7a09. Reason for revert: relanding now that the perf waterfall has had a stab at this revert. Original change's description: > Revert "Use all available workers for concurrent marking." > > This reverts commit 3c62f7ae. > (and commit 4939463c) > > The goal of this revert is to contrast the effect on perf bots of > landing it vs reverting it to more easily attribute its impact. > > R=hpayer@chromium.org > > Bug: chromium:812178 > Change-Id: I7c977b1b0b587f787263272400d87f6aae7af634 > Reviewed-on: https://chromium-review.googlesource.com/936761 > Commit-Queue: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51546} TBR=gab@chromium.org,hpayer@chromium.org Change-Id: I1ecfc70867dc5424cba1a9ecd229ae031c3e9aa4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:812178 Reviewed-on: https://chromium-review.googlesource.com/937725Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Gabriel Charette <gab@chromium.org> Cr-Commit-Position: refs/heads/master@{#51577}
-
Mike Stanton authored
This introduces masking of loads with speculation bit during code generation. At the moment, this is done only under the --branch-load-poisoning flag, and this CL enlarges the set of supported platforms from {x64, arm} to {x64, arm, arm64}. Overview of changes: - new register configuration configuration with one register reserved for the speculation poison/mask (kSpeculationPoisonRegister). - in codegen, we introduce an update to the poison register at the starts of all successors of branches (and deopts) that are marked as safety branches (deopts). - in memory optimizer, we lower all field and element loads to PoisonedLoads. - poisoned loads are then masked in codegen with the poison register. * only integer loads are masked at the moment. Bug: chromium:798964 Change-Id: Ie6bc9c3bdac9998b0ef81f050a9c844399ca3ae4 Reviewed-on: https://chromium-review.googlesource.com/928724 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:Martyn Capewell <martyn.capewell@arm.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#51576}
-
sreten.kovacevic authored
Implement Load and Store instructions for liftoff on MIPS. Function CallTrapCallbackForTesting also implemented to prevent test from failing when address is out of range. Bug: v8:6600 Change-Id: I85e48334d171ad6d86a02eeba51e4f07edaf9648 Reviewed-on: https://chromium-review.googlesource.com/934133 Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Cr-Commit-Position: refs/heads/master@{#51575}
-
Peter Marshall authored
Previously, Strings without an iterator would go to the runtime path and fail on because it expected a JSReceiver type. This was in-line with what the elements accessor expected. We can actually handle all object types in the final slow path (using LookupIterator) so it is no problem to change the accept types. Bug: chromium:816289 Change-Id: Iebb8de0bb7551aee3894c8a23836d079c93726a7 Reviewed-on: https://chromium-review.googlesource.com/937461Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#51574}
-
Clemens Hammacher authored
This is a reland of e7f9fb4a. Original change's description: > [Assembler][x64] Make Operand immutable > > This CL removes all setters from the Operand and removes the friendship > relation between Assembler and Operand. All data fields of the Operand > are set exactly once in the constructor, the Operand is immutable > afterwards. > In order to construct the data of an Operand easily, the OperandBuilder > is introduced. After building an Operand, the data is copied to the > const field of the Operand. > > R=mstarzinger@chromium.org > > Bug: v8:7310 > Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b > Reviewed-on: https://chromium-review.googlesource.com/936741 > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51563} Bug: v8:7310 Change-Id: I84df5e11b1811585fbba7309e3bb9c6b17e18c0b Reviewed-on: https://chromium-review.googlesource.com/936628Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51573}
-
jgruber authored
These helpers support off-heap code objects, for which they return start, end, and size of the off-heap instruction stream. Bug: v8:6666 Change-Id: Ib5e819d976eee3073b0354b8d8ce324b691f1b15 Reviewed-on: https://chromium-review.googlesource.com/937281 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
jgruber authored
This is a reland of 087e9daa. Original change's description: > [builtins] Update off-heap-safe list > > TBR=yangguo@chromium.org > > Bug: v8:6666 > Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 > Reviewed-on: https://chromium-review.googlesource.com/937302 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51567} TBR=yangguo@chromium.org Bug: v8:6666 Change-Id: I9475c8e412f765623131f168e9fe25d8082d061e Reviewed-on: https://chromium-review.googlesource.com/937541Reviewed-by:
-
Yang Guo authored
R=jgruber@chromium.org Change-Id: I8328fdaf5d53850b87dd16867255d4325ab9cd9c Reviewed-on: https://chromium-review.googlesource.com/936644Reviewed-by:
-
Jakob Gruber authored
This reverts commit 087e9daa. Reason for revert: https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/15549 Original change's description: > [builtins] Update off-heap-safe list > > TBR=yangguo@chromium.org > > Bug: v8:6666 > Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 > Reviewed-on: https://chromium-review.googlesource.com/937302 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51567} TBR=yangguo@chromium.org,jgruber@chromium.org Change-Id: If37f28e0bfbd1fe495ec425d8306aa081e75eca4 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:6666 Reviewed-on: https://chromium-review.googlesource.com/937303Reviewed-by:
-
Clemens Hammacher authored
Refactor EmitUnOp to be templatized in the type and the emit function, similar to EmitBinOp. This simplified adding f32 and f64 unops. R=ahaas@chromium.org Bug: v8:6600 Change-Id: Iaab473a3bbcc45673ff6190d6b56244c48bfa5a6 Reviewed-on: https://chromium-review.googlesource.com/937201 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#51568}
-
jgruber authored
TBR=yangguo@chromium.org Bug: v8:6666 Change-Id: I70ba2ecbc259431b571a2e5611494dd7725f2aa6 Reviewed-on: https://chromium-review.googlesource.com/937302Reviewed-by:
-
Peter Marshall authored
I loosened the DCHECKs here but I think they are still fundamentally safe: `length` must be <= the actual length of the source (so that there are actually enough elements to copy), and `length` must also be <= the destination length, minus the offset (so there is enough space to copy the elements into). Bug: chromium:816317 Change-Id: Ice00ac60f4884363f6065ffee71f6ab1d1b32dbc Reviewed-on: https://chromium-review.googlesource.com/937209Reviewed-by:
-
Marja Hölttä authored
BUG=v8:5402,v8:7310 Change-Id: Ic3ee7d2dec0403e7831f51735365c26caadc6a7b Reviewed-on: https://chromium-review.googlesource.com/934136 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This reverts commit e7f9fb4a. Reason for revert: msvc compile error: https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/1573 Original change's description: > [Assembler][x64] Make Operand immutable > > This CL removes all setters from the Operand and removes the friendship > relation between Assembler and Operand. All data fields of the Operand > are set exactly once in the constructor, the Operand is immutable > afterwards. > In order to construct the data of an Operand easily, the OperandBuilder > is introduced. After building an Operand, the data is copied to the > const field of the Operand. > > R=mstarzinger@chromium.org > > Bug: v8:7310 > Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b > Reviewed-on: https://chromium-review.googlesource.com/936741 > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51563} TBR=mstarzinger@chromium.org,clemensh@chromium.org Change-Id: I8ae40de35e81765549f93ffe58f1b12286de6333 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7310 Reviewed-on: https://chromium-review.googlesource.com/936627Reviewed-by:
-
Clemens Hammacher authored
This CL removes all setters from the Operand and removes the friendship relation between Assembler and Operand. All data fields of the Operand are set exactly once in the constructor, the Operand is immutable afterwards. In order to construct the data of an Operand easily, the OperandBuilder is introduced. After building an Operand, the data is copied to the const field of the Operand. R=mstarzinger@chromium.org Bug: v8:7310 Change-Id: I1628052b8a0c47cbfbc3645dfdac5a0e9705977b Reviewed-on: https://chromium-review.googlesource.com/936741Reviewed-by:
-
jgruber authored
With this, `Builtins::IsBuiltinId(code->builtin_index())` turns into `Builtins::IsBuiltin(code)`. Bug: v8:6666 Change-Id: Id731299cf5eb3f213933d3a9b3ae78d9bb95e757 Reviewed-on: https://chromium-review.googlesource.com/937205 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#51562}
-
jgruber authored
There's two considerations involving off-heap code and safepoint tables. 1. Since the safepoint table is embedded within the instructions area of code objects, we need to ensure that the actual instruction size (i.e. safepoint_table_offset if a code object has safepoints) is large enough for the off-heap trampoline. 2. The pc-relative calculation in SafepointTable::FindEntry must be able to handle off-heap pcs. Bug: v8:6666 Change-Id: I92a5ecc49d0a78755b89c3c5774523afb21cd724 Reviewed-on: https://chromium-review.googlesource.com/934242Reviewed-by:
-
Predrag Rudic authored
Change-Id: I9185b17c73ad4486b81538a8ce2f84271b820919 Reviewed-on: https://chromium-review.googlesource.com/936763Reviewed-by:
-
Ulan Degenbaev authored
The key -> value edge is shown as "<index> / WeakMap", where <index> is the index of the edge in the key. Bug: chromium:778739, chromium:749502 Change-Id: I657051695f2a171372788dbb777543a55a35d554 Reviewed-on: https://chromium-review.googlesource.com/926524 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Alexei Filippov <alph@chromium.org> Cr-Commit-Position: refs/heads/master@{#51559}
-
Yang Guo authored
R=jgruber@chromium.org Bug: v8:5530 Change-Id: I1680beaa665b6937df2e26d20cb69cc8577a21a9 Reviewed-on: https://chromium-review.googlesource.com/937203Reviewed-by:
-
Yang Guo authored
TBR=jgruber@chromium.org NOTREECHECKS=true NOTRY=true Change-Id: Id5d81f863fa6d14ac86d49b6516e577c2da7a999 Reviewed-on: https://chromium-review.googlesource.com/936543Reviewed-by:
-
Sigurd Schneider authored
This CL changes the builtin StringSubstring(string, start, end) to take start and end as untagged IntPtr values. Bug: v8:7250, v8:7340 Change-Id: I39700d087da903f076a6ca163a8f880d31eea3a0 Reviewed-on: https://chromium-review.googlesource.com/923961 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51556}
-
Clemens Hammacher authored
The Operand class is small enough to be efficiently passed by value. This saves binary size and performance because the Operand does not need to be emitted to the caller's frame and loaded in the callee. Binary saving is 37kB in release mode on ia32. R=mstarzinger@chromium.org Bug: v8:7310 Change-Id: Ibc103622ec216725c762c2ba4bb96451c99db556 Reviewed-on: https://chromium-review.googlesource.com/934264 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Nico Weber authored
Snapshots don't yet work in 64-bit win/cross builds, so disable them until they do. No behavior change in builds that aren't 64-bit win/cross builds. Bug: chromium:803591 Change-Id: I7a04c7e01a58a95a2bfb78c7d2593c7c5c5041cf Reviewed-on: https://chromium-review.googlesource.com/936668Reviewed-by:
-
Michael Starzinger authored
This adds support for poisoning the stack pointer and implicit register arguments like the context register and the function register in the prologue of generated code with JavaScript linkage. The speculation poison is computed similarly to the interpreter by matching expected with actual code start addresses. R=jarin@chromium.org,rmcilroy@chromium.org BUG=chromium:798964 Change-Id: I5fa48844745459cf7b3d00c407a7b835f61c857b Reviewed-on: https://chromium-review.googlesource.com/919167 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Yang Guo authored
R=herhut@chromium.org, jgruber@chromium.org Bug: v8:7310, v8:5510 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Icefd10b6cc210e5bb2684d18b091179ead387326 Reviewed-on: https://chromium-review.googlesource.com/934445 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
Currently we didn't always consistently use the String feedback on JSAdd, but only if JSTypedLowering would already figure out statically that one of the inputs is already a String. That leads to some odd performance cliffs, as highlighted in the referenced bug. This CL fixes the JSTypedLowering::ReduceJSAdd to always bake in the String feedback. This improves the relevant performance tests from the bug from console.timeEnd: Runtime join3, 967.512000 console.timeEnd: Runtime join, 1004.599000 console.timeEnd: Runtime join3, 1124.764000 console.timeEnd: Runtime join, 966.164000 console.timeEnd: Runtime join3, 1145.296000 console.timeEnd: Runtime join, 966.176000 console.timeEnd: Runtime join3, 1145.272000 console.timeEnd: Runtime join, 931.266000 to console.timeEnd: Runtime join3, 903.050000 console.timeEnd: Runtime join, 856.509000 console.timeEnd: Runtime join3, 945.144000 console.timeEnd: Runtime join, 840.038000 console.timeEnd: Runtime join3, 927.965000 console.timeEnd: Runtime join, 841.263000 console.timeEnd: Runtime join3, 929.342000 console.timeEnd: Runtime join, 858.143000 which corresponds to an 8-18% improvement. Bug: v8:7415 Change-Id: I62e008298e4ee0864885b37817c91d055acf2a09 Reviewed-on: https://chromium-review.googlesource.com/936643Reviewed-by:
-
Marja Hölttä authored
Removing includes which are not needed and also not indirectly pulled in. BUG=v8:7490, v8:7310 Change-Id: I219ba92c3281c3c245cc6c5574c85c2d51a217a9 Reviewed-on: https://chromium-review.googlesource.com/934722Reviewed-by:
-
jgruber authored
Bug: v8:7310 Change-Id: Ib9c40bababbb688305be7bea262a4348805a1f18 Reviewed-on: https://chromium-review.googlesource.com/936762Reviewed-by:
-
Benedikt Meurer authored
The CreateClosureMode introduced with 2ece046c is still not 100% fail-safe and doesn't scale. What we really need instead, especially when we might start removing the SharedFunctionInfo::code field eventually, is to tell the JSCreateClosure node which code object to use. So instead of adding magic around it, let's just pass it to the node. Bug: v8:2206, v8:7253, v8:7310 Change-Id: Iedb6ae468a763643617975f47d96854d1aeafbe9 Reviewed-on: https://chromium-review.googlesource.com/937121Reviewed-by:
-
Benedikt Meurer authored
We use JSCreateClosure to also constructs closures for builtins, i.e. for the callbacks created by the Promise constructor. For these builtins we cannot set code to CompileLazy builtin, but need to use the code from the SharedFunctionInfo. The explicit mode tells the lowering what it should do (instead of relying on SharedFunctionInfo::native(), which is not the right bit). Bug: v8:2206, v8:7253, v8:7310 Change-Id: Ic956814e137c57b36ebb5d7b4d964dde5ee51a0d Reviewed-on: https://chromium-review.googlesource.com/930964 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#51547}
-
- 25 Feb, 2018 3 commits
-
-
Gabriel Charette authored
This reverts commit 3c62f7ae. (and commit 4939463c) The goal of this revert is to contrast the effect on perf bots of landing it vs reverting it to more easily attribute its impact. R=hpayer@chromium.org Bug: chromium:812178 Change-Id: I7c977b1b0b587f787263272400d87f6aae7af634 Reviewed-on: https://chromium-review.googlesource.com/936761 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
This implements the full set of f32 comparisons (f32.eq, f32.ne, f32.lt, f32.gt, f32.le, f32.ge) on ia32 and x64. R=titzer@chromium.org Bug: v8:6600 Change-Id: I2be786431d01b4ed540b70f3e4a27c19b7d2649e Reviewed-on: https://chromium-review.googlesource.com/928982Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#51545}
-
Gabriel Charette authored
This is a follow-up to https://chromium-review.googlesource.com/904164 now that I've realized raw TRACE_EVENTs work in v8 (initially thought had to go through heap()->tracer()). After adding events to EvacuatePage(), the subitem event for evacuation tasks became redundant. Since this results in a better output this CL applies this approach to all paralell work items. Not using TRACE_BACKGROUND_GC also avoids polluting logs with subitems when using v8's tracing flags. R=mlippautz@chromium.org Bug: chromium:651354 Change-Id: I62efbde69da2a0a9bd255e34093d64924e339974 Reviewed-on: https://chromium-review.googlesource.com/934263 Commit-Queue: Gabriel Charette <gab@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#51544}
-
- 24 Feb, 2018 6 commits
-
-
Gabriel Charette authored
I think those are safe to keep and add useful information to highlight the type of evacuate copy step being performed. This is a prerequisite for https://chromium-review.googlesource.com/c/v8/v8/+/934263 as it will drop tracing individual work items and will leave it to top-level item trace events like these to highlight individual work item's work. Will reland after reverting them all however to confirm the re-adding these doesn't cause regressions as the fine grain trace events initially did. R=hpayer@chromium.org Bug: chromium:813824 Change-Id: I8e53b880ce0aeae08afa7a2c0f36a455f645bcfa Reviewed-on: https://chromium-review.googlesource.com/934248Reviewed-by:
-
Michael Achenbach authored
TBR=yangguo@chromium.org NOTRY=true Bug: chromium:813833 Change-Id: If9694bebc6576549feb00cbf035c4a5e92a70976 Reviewed-on: https://chromium-review.googlesource.com/936442Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#51542}
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/787ae8b..b1d6c28 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/13a8b37..8a42ad3 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7e69312..b3d3f59 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I7bf829336fd7ded9b95573fc9b95c4988d36d8f6 Reviewed-on: https://chromium-review.googlesource.com/936226 Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#51541}
-
jing.bao authored
Change lowering for Store to use input replacement type. Change-Id: Ic1fbbb37a3cc938fca7015d838933284bae6068e Reviewed-on: https://chromium-review.googlesource.com/903266 Commit-Queue: Jing Bao <jing.bao@intel.com> Reviewed-by:
Aseem Garg <aseemgarg@chromium.org> Cr-Commit-Position: refs/heads/master@{#51540}
-
Michael Achenbach authored
Fuzzers after switching to ToT mjsunit.js, which accesses Date.prototype, while for correctness fuzzing it's mocked out as a proxy. This makes the proxy return the property correctly. TBR=yangguo@chromium.org NOTRY=true Bug: chromium:813833 Change-Id: Ic4b6412063f42c4e75905fbd568b7f81bc54daff Reviewed-on: https://chromium-review.googlesource.com/936046 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Michael Achenbach authored
TBR=yangguo@chromium.org NOTRY=true Bug: chromium:813833 Change-Id: I8f687d27981a54234c37ba2e4b22060696f6dee7 Reviewed-on: https://chromium-review.googlesource.com/936006Reviewed-by:
-
