1. 05 Sep, 2017 1 commit
  2. 01 Sep, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Optimize fast enum cache driven for..in. · f1ec44e2
      Benedikt Meurer authored
      This CL adds support to optimize for..in in fast enum-cache mode to the
      same degree that it was optimized in Crankshaft, without adding the same
      deoptimization loop that Crankshaft had with missing enum cache indices.
      That means code like
      
        for (var k in o) {
          var v = o[k];
          // ...
        }
      
      and code like
      
        for (var k in o) {
          if (Object.prototype.hasOwnProperty.call(o, k)) {
            var v = o[k];
            // ...
          }
        }
      
      which follows the https://eslint.org/docs/rules/guard-for-in linter
      rule, can now utilize the enum cache indices if o has only fast
      properties on the receiver, which speeds up the access o[k]
      significantly and reduces the pollution of the global megamorphic
      stub cache.
      
      For example the micro-benchmark in the tracking bug v8:6702 now runs
      faster than ever before:
      
       forIn: 1516 ms.
       forInHasOwnProperty: 1674 ms.
       forInHasOwnPropertySafe: 1595 ms.
       forInSum: 2051 ms.
       forInSumSafe: 2215 ms.
      
      Compared to numbers from V8 5.8 which is the last version running with
      Crankshaft
      
       forIn: 1641 ms.
       forInHasOwnProperty: 1719 ms.
       forInHasOwnPropertySafe: 1802 ms.
       forInSum: 2226 ms.
       forInSumSafe: 2409 ms.
      
      and V8 6.0 which is the current stable version with TurboFan:
      
       forIn: 1713 ms.
       forInHasOwnProperty: 5417 ms.
       forInHasOwnPropertySafe: 5324 ms.
       forInSum: 7556 ms.
       forInSumSafe: 11067 ms.
      
      It also improves the throughput on the string-fasta benchmark by
      around 7-10%, and there seems to be a ~5% improvement on the
      Speedometer/React benchmark locally.
      
      For this to work, the ForInPrepare bytecode was split into
      ForInEnumerate and ForInPrepare, which is very similar to how it was
      handled in Fullcodegen initially. In TurboFan we introduce a new
      operator LoadFieldByIndex that does the dynamic property load.
      
      This also removes the CheckMapValue operator again in favor of
      just using LoadField, ReferenceEqual and CheckIf, which work
      automatically with the EscapeAnalysis and the
      BranchConditionElimination.
      
      Bug: v8:6702
      Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a
      Reviewed-on: https://chromium-review.googlesource.com/645949
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47768}
      f1ec44e2
  3. 28 Aug, 2017 1 commit
    • Georg Neis's avatar
      Revert "Remove obsolete kNumber binop feedback." · b4712d52
      Georg Neis authored
      This reverts commit 1169f55b.
      
      Reason for revert: http://crbug.com/758994
      
      Original change's description:
      > Remove obsolete kNumber binop feedback.
      > 
      > With the removal of Crankshaft, kNumber has become obsolete as
      > BinaryOperationFeedback. Turbofan uses kNumberOrOddball.
      > 
      > Bug: 
      > Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c
      > Reviewed-on: https://chromium-review.googlesource.com/628376
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Mythri Alle <mythria@chromium.org>
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#47555}
      
      TBR=jkummerow@chromium.org,jarin@chromium.org,neis@chromium.org,mythria@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      Change-Id: I1b33f572f3e6865e00d2468bffcce2ea466814b3
      Reviewed-on: https://chromium-review.googlesource.com/637711Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Commit-Queue: Georg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47642}
      b4712d52
  4. 23 Aug, 2017 1 commit
  5. 11 Aug, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Collect and use SignedSmall input feedback for Divide. · 622852e5
      Benedikt Meurer authored
      For Divide operations like
      
        r = a / b
      
      where r has only truncated uses (i.e. only used in bitwise operations),
      we used to generate a Float64Div unless we statically knew something
      about a and b, even if a and b have always been integers so far.
      Crankshaft was able to generate an integer division here, because
      Fullcodegen collected feedback independently for inputs and outputs of
      binary operations.
      
      This adds new BinaryOperationFeedback::kSignedSmallInputs, which is used
      specifically for Divide to state that we have seen only SignedSmall
      inputs thus far, but the outputs weren't always in the SignedSmall
      range.
      
      The issue was discovered in a WebGL Triangulation library and reported
      via https://twitter.com/mourner/status/895708603117518848 after Node
      8.3.0 was released with I+TF.
      
      R=jarin@chromium.org
      
      Bug: v8:6698
      Change-Id: I830e421a3bf91fc8fa3665cbb706bc13675a6d2b
      Reviewed-on: https://chromium-review.googlesource.com/612063
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47302}
      622852e5
  6. 03 Aug, 2017 2 commits
  7. 02 Aug, 2017 3 commits
  8. 01 Aug, 2017 3 commits
  9. 29 Jul, 2017 2 commits
    • Georg Neis's avatar
      Revert "[Memory] Add an OnCriticalMemoryPressure method to V8::Platform." · 53db0584
      Georg Neis authored
      This reverts commit 3f90d9f9.
      
      Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/16510
      
      Original change's description:
      > [Memory] Add an OnCriticalMemoryPressure method to V8::Platform.
      > 
      > Adds virtual V8::Platform::OnCriticalMemoryPressure method, default
      > implementation does nothing.
      > 
      > Calls this method on first allocation failures in NewArray, Malloced,
      > and zone AccountingAllocator and adds retry logic.
      > 
      > Adds utility functions for allocating base::VirtualMemory to functions
      > in allocation.h, which call this method and add retry logic.
      > 
      > Calls these utility functions in heap CodeRange, Spaces, StoreBuffer
      > and SequentialMarkingDeque.
      > 
      > Bug: v8:6635
      > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
      > Change-Id: I38afd394f3be556aca037d16675e9884658158cb
      > Reviewed-on: https://chromium-review.googlesource.com/583543
      > Commit-Queue: Bill Budge <bbudge@chromium.org>
      > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#46988}
      
      TBR=bbudge@chromium.org,ulan@chromium.org,mlippautz@chromium.org
      
      Change-Id: I79afea5982e62db1462cc5a5585a226f0ddbe752
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:6635
      Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
      Reviewed-on: https://chromium-review.googlesource.com/592887Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Commit-Queue: Georg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46989}
      53db0584
    • Bill Budge's avatar
      [Memory] Add an OnCriticalMemoryPressure method to V8::Platform. · 3f90d9f9
      Bill Budge authored
      Adds virtual V8::Platform::OnCriticalMemoryPressure method, default
      implementation does nothing.
      
      Calls this method on first allocation failures in NewArray, Malloced,
      and zone AccountingAllocator and adds retry logic.
      
      Adds utility functions for allocating base::VirtualMemory to functions
      in allocation.h, which call this method and add retry logic.
      
      Calls these utility functions in heap CodeRange, Spaces, StoreBuffer
      and SequentialMarkingDeque.
      
      Bug: v8:6635
      Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
      Change-Id: I38afd394f3be556aca037d16675e9884658158cb
      Reviewed-on: https://chromium-review.googlesource.com/583543
      Commit-Queue: Bill Budge <bbudge@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46988}
      3f90d9f9
  10. 28 Jul, 2017 2 commits
    • Juliana Patricia Vicente Franco's avatar
      Revert "Changing the return address on the stack." · a193fde9
      Juliana Patricia Vicente Franco authored
      This reverts commit e15f5544.
      
      Reason for revert: it breaks the GC stress. 
      
      Original change's description:
      > Changing the return address on the stack.
      > 
      > Rather than patching code, the deoptimizer now replaces the
      > return address in the frames with respective trampolines. 
      > This change required to change the way we search for Safepoint 
      > entries and for Exception Handlers. 
      > It's working in architectures: x64, ia32, arm, arm64 and mips. 
      > 
      > Bug: V8:6563
      > Change-Id: I3cbd4d192c3513f307b3a6a2ac99e60d03c753d3
      > Reviewed-on: https://chromium-review.googlesource.com/586707
      > Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#46967}
      
      TBR=jarin@chromium.org,bmeurer@chromium.org,jupvfranco@google.com
      
      Change-Id: I430fa9123beef2e0723b38cdef9537181203f7e7
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: V8:6563
      Reviewed-on: https://chromium-review.googlesource.com/591371
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46969}
      a193fde9
    • Juliana Franco's avatar
      Changing the return address on the stack. · e15f5544
      Juliana Franco authored
      Rather than patching code, the deoptimizer now replaces the
      return address in the frames with respective trampolines. 
      This change required to change the way we search for Safepoint 
      entries and for Exception Handlers. 
      It's working in architectures: x64, ia32, arm, arm64 and mips. 
      
      Bug: V8:6563
      Change-Id: I3cbd4d192c3513f307b3a6a2ac99e60d03c753d3
      Reviewed-on: https://chromium-review.googlesource.com/586707
      Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46967}
      e15f5544
  11. 19 Jul, 2017 1 commit
  12. 18 Jul, 2017 1 commit
  13. 14 Jul, 2017 2 commits
    • Caitlin Potter's avatar
      [generators] remove SuspendFlags enum and related code · 53553f5d
      Caitlin Potter authored
      SuspendFlags was originally used by the suspend operation to determine
      which field to record the bytecode offset of a suspended generator, and
      the value the generator was resumed with. For async generators, await
      operations would use a separate field, in order to preserve the previous
      yield input value. This was important to ensure `function.sent`
      continued to function correctly.
      
      As function.sent is being retired, this allows the removal of support
      for that. Given that this was the only real need for SuspendFlags in the
      first place (with other uses tacked on as a hack), this involves several
      other changes as well:
      
      - Modification of MacroAssembler AssertGeneratorObject. No longer
        accepts a SuspendFlags parameter to determine which type of check to
        perform.
      - Removal of `flags` operand from SuspendGenerator bytecode, and the
        GeneratorStore js-operator.
      - Removal of `flags` parameter from ResumeGeneratorTrampoline builtins.
      - Removal of Runtime functions, interpreter intrinsics and
        AccessBuilders associated with the [[await_input_or_debug_pos]] field
        in JSAsyncGeneratorObject, as this field no longer exists.
      - Addition of a new `Yield` AST node (subclass of Suspend) in order to
        prevent the need for the other SuspendFlag values.
      
      BUG=v8:5855
      TBR=bmeurer@chromium.org
      
      Change-Id: Iff2881e4742497fe5b774915e988c3d9d8fbe487
      Reviewed-on: https://chromium-review.googlesource.com/570485
      Commit-Queue: Caitlin Potter <caitp@igalia.com>
      Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46683}
      53553f5d
    • Caitlin Potter's avatar
      [async-await] desugar Await in BytecodeGenerator · 8b5b444a
      Caitlin Potter authored
      This includes several changes. From most to least interesting:
      
      - No longer implement AwaitExpressions using a do-expression.
      - Reduces frame-size of async generators by not allocating temporary
        variables to hold results of Await epxressions.
      - Streamline and reduce generated bytecodes for Await.
      - Debugger no longer emits a debug::kCallBreakLocation breakpoint for
      the JS-builtin call performed for Await, and instead only emits such
      a breakpoint if the operand of Await is actually a call.
      - Push fewer parameters to Await* builtins, using the receiver for the
        first parameter (possible now that the CallRuntime invocation not
        part of the AST).
      - Adds a new Await AST node. No new members or anything, but it seemed
        palatable to avoid having `if (is_await())` in a number of
        VisitSuspend functions.
      
      BUG=v8:5855, v8:5099, v8:4483
      R=rmcilroy@chromium.org, kozyatinskiy@chromium.org, yangguo@chromium.org
      TBR=bmeurer@chromium.org
      
      Change-Id: I9cd3fda99cd40295c04fdf1aea01b5d83fac6caf
      Reviewed-on: https://chromium-review.googlesource.com/558806
      Commit-Queue: Georg Neis <neis@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarAleksey Kozyatinskiy <kozyatinskiy@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46666}
      8b5b444a
  14. 13 Jul, 2017 1 commit
  15. 12 Jul, 2017 2 commits
  16. 23 Jun, 2017 1 commit
  17. 22 Jun, 2017 1 commit
    • Daniel Ehrenberg's avatar
      [scopes] Fix sloppy-mode block-scoped function hoisting edge case · d54ffadf
      Daniel Ehrenberg authored
      In edge cases such as the following, sloppy-mode block-scoped function
      hoisting is expected to occur:
      
        eval(`
          with({a: 1}) {
            function a() {}
          }
        `)
      
      In this case, there should be the equivalent of a var declaration
      outside of the eval, which gets set to the value of the local function
      a when the body of the with is executed.
      
      Previously, the way that var declarations are hoisted out of eval
      meant that the assignment to that var was an ordinary DYNAMIC_GLOBAL
      assignment. However, such a lookup mode meant that the object in the
      with scope received the assignment!
      
      This patch fixes that error by marking the assignments produced by
      the sloppy mode block scoped function hoisting desugaring so as to
      generate a different runtime call which skips with scopes.
      
      Bug: chromium:720247, v8:5135
      Change-Id: Ie36322ddc9ca848bf680163e8c016f50d4597748
      Reviewed-on: https://chromium-review.googlesource.com/529230
      Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarAdam Klein <adamk@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#46116}
      d54ffadf
  18. 19 Jun, 2017 1 commit
    • Leszek Swirski's avatar
      [compiler] Drive optimizations with feedback vector (reland) · 24b7026d
      Leszek Swirski authored
      For interpreted functions, use the optimized code slot in the feedback
      vector to store an optimization marker (optimize/in optimization queue)
      rather than changing the JSFunction's code object. Then, adapt the
      self-healing mechanism to also dispatch based on this optimization
      marker. Similarly, replace SFI marking with optimization marker checks
      in CompileLazy.
      
      This allows JSFunctions to share optimization information (replacing
      shared function marking) without leaking this information across native
      contexts. Non I+TF functions (asm.js or --no-turbo) use a
      CheckOptimizationMarker shim which generalises the old
      CompileOptimized/InOptimizationQueue builtins and also checks the same
      optimization marker as CompileLazy and InterpreterEntryTrampoline.
      
      This is a reland of https://chromium-review.googlesource.com/c/509716
      
      Change-Id: I02b790544596562373da4c9c9f6afde5fb3bcffe
      Reviewed-on: https://chromium-review.googlesource.com/535460Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45997}
      24b7026d
  19. 16 Jun, 2017 1 commit
  20. 13 Jun, 2017 3 commits
    • Michael Lippautz's avatar
      [heap] Move AccessMode out from MarkBit into globals · 35b9776f
      Michael Lippautz authored
      Bug: 
      Change-Id: I5ea0e072c3ac100a6f3bed62a9a4d2c11d2b7c9a
      Reviewed-on: https://chromium-review.googlesource.com/533414
      Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45920}
      35b9776f
    • Leszek Swirski's avatar
      Revert "[compiler] Drive optimizations with feedback vector" · 58978da6
      Leszek Swirski authored
      This reverts commit e39c9e02.
      
      Reason for revert: Breaks https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/15561
      
      Original change's description:
      > [compiler] Drive optimizations with feedback vector
      > 
      > For interpreted functions, use the optimized code slot in the feedback vector
      > to store an optimization marker (optimize/in optimization queue) rather than
      > changing the JSFunction's code object. Then, adapt the self-healing mechanism
      > to also dispatch based on this optimization marker. Similarly, replace SFI
      > marking with optimization marker checks in CompileLazy.
      > 
      > This allows JSFunctions to share optimization information (replacing shared
      > function marking) without leaking this information across native contexts. Non
      > I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
      > generalises the old CompileOptimized/InOptimizationQueue builtins and also
      > checks the same optimization marker as CompileLazy and
      > InterpreterEntryTrampoline.
      > 
      > Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
      > Reviewed-on: https://chromium-review.googlesource.com/509716
      > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#45901}
      
      TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,leszeks@chromium.org
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      
      Change-Id: Ib6c2b4d90fc5f659a6dcaf3fd30321507ca9cb94
      Reviewed-on: https://chromium-review.googlesource.com/532916Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45903}
      58978da6
    • Leszek Swirski's avatar
      [compiler] Drive optimizations with feedback vector · e39c9e02
      Leszek Swirski authored
      For interpreted functions, use the optimized code slot in the feedback vector
      to store an optimization marker (optimize/in optimization queue) rather than
      changing the JSFunction's code object. Then, adapt the self-healing mechanism
      to also dispatch based on this optimization marker. Similarly, replace SFI
      marking with optimization marker checks in CompileLazy.
      
      This allows JSFunctions to share optimization information (replacing shared
      function marking) without leaking this information across native contexts. Non
      I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
      generalises the old CompileOptimized/InOptimizationQueue builtins and also
      checks the same optimization marker as CompileLazy and
      InterpreterEntryTrampoline.
      
      Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
      Reviewed-on: https://chromium-review.googlesource.com/509716
      Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45901}
      e39c9e02
  21. 08 Jun, 2017 1 commit
    • Ross McIlroy's avatar
      [TurboFan] Add typing for the EmptyString and use this for JSToPrimitiveToString · 2c296b7e
      Ross McIlroy authored
      Add the ability for the typer to track whether a string could be the empty
      string. This is needed for typed lowering of JSStringConcat since we can't
      create cons string chain with the empty string in arbitrary positions.
      
      The ToPrimitiveToString bytecode handler is modified to collect feedback on
      whether it has ever seen the empty string, which is used by
      SpeculativeToPrimitiveToString to ensure that the output is non-empty (or
      depot) which will subsiquently be used to enable inline cons-string creation
      for the JSStringConcat operator in typed lowering in a subsiquent CL.
      
      BUG=v8:6243
      
      Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52
      Reviewed-on: https://chromium-review.googlesource.com/522122
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45786}
      2c296b7e
  22. 07 Jun, 2017 1 commit
  23. 31 May, 2017 2 commits
  24. 22 May, 2017 4 commits
  25. 17 May, 2017 1 commit