- 19 Mar, 2018 1 commit
-
-
Georg Neis authored
This reverts commit c94dcb21. Reason for revert: several performances regressions. Original change's description: > [compiler] Don't infer receiver maps for stores. > > This avoids a deopt loop. > > Bug: v8:7254 > Change-Id: I9ab1dfc754c5ad63c451a9e2276aa1d7eb4c27b1 > Reviewed-on: https://chromium-review.googlesource.com/966065 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51994} TBR=jarin@chromium.org,neis@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:7254 Change-Id: Iff9c6fb61a559e48ad11d2db9e559de61cc0f5ef Reviewed-on: https://chromium-review.googlesource.com/968302Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52012}
-
- 16 Mar, 2018 1 commit
-
-
Georg Neis authored
This avoids a deopt loop. Bug: v8:7254 Change-Id: I9ab1dfc754c5ad63c451a9e2276aa1d7eb4c27b1 Reviewed-on: https://chromium-review.googlesource.com/966065Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#51994}
-
- 02 Mar, 2018 1 commit
-
-
Georg Neis authored
... and use it in the implementation of array literal spreads, replacing calls to %AppendElement. Array spreads in destructuring will be taken care of in a separate CL. Bug: v8:5940, v8:7446 Change-Id: Idec52398902a7fd3c1244852cf73246f142404f0 Reviewed-on: https://chromium-review.googlesource.com/915364 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#51709}
-
- 20 Feb, 2018 1 commit
-
-
Benedikt Meurer authored
This CL introduces new operators JSFulfillPromise and JSPromiseResolve, corresponding to the specification operations with the same name, and uses that to lower calls to Promise.resolve() builtin to JSPromiseResolve. We also optimize JSPromiseResolve and JSResolvePromise further based on information found about the value/resolution in the graph. This applies to both Promise.resolve() builtin calls and implicit resolve operations in async functions and async generators. On a very simple microbenchmark like console.time('resolve'); for (let i = 0; i < 1e8; ++i) Promise.resolve({i}); console.timeEnd('resolve'); this CL reduces the execution time from around 3049ms to around 947ms, which is a pretty significant 3x improvement. On the wikipedia benchmark we observe an improvement around 2% with this CL. Bug: v8:7253 Change-Id: Ic69086cdc1b724f35dbe83305795539c562ab817 Reviewed-on: https://chromium-review.googlesource.com/913488Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51387}
-
- 31 Jan, 2018 1 commit
-
-
Mike Stanton authored
The FeedbackNexus classes initially were one-to-one with IC classes, but over time this got out of date. We also found Nexus' useful, so we made more classes even for cases that weren't ICs. The inheritence and polymorphism became confusing and led to duplication. Better, to just talk about a (single) FeedbackNexus. Bug: v8:7344 Change-Id: I509dc9657895d56c3859de6e6589695cdff9e73e Reviewed-on: https://chromium-review.googlesource.com/890452 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Franziska Hinkelmann <franzih@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#50997}
-
- 03 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
This extends the support in TurboFan and the ICs for OOB loads to also apply to typed arrays and receivers whose prototype chain is protected by the "no elements" protector (aka the Array protector). TurboFan will generate code to materialize undefined instead when it sees a load that has the OOB bit set and add an appropriate code dependency on the global protector. For typed arrays it doesn't even need to check the global protector since elements are never looked up in the prototype chain for typed arrays. In the simple micro-benchmark from the bug we go from testInBounds: 103 ms. testOutOfBounds: 289 ms. to testInBounds: 103 ms. testOutOfBounds: 102 ms. which fixes the 3x slowdown and thus addresses the performance cliff. In general it's still beneficial to make sure that you don't access out of bounds, especially once we introduce a bounds check elimination pass to TurboFan. This also seems to improve the jQuery benchmark on the Speedometer test suite by like 1-2% on average. And the SixSpeed rest benchmarks go from rest-es5: 25 ms. rest-es6: 23 ms. to rest-es5: 6 ms. rest-es6: 4 ms. so a solid 5.7x improvement there. Bug: v8:6936, v8:7014, v8:7027 Change-Id: Ie99699c69cc40057512e72fd40ae28107216c423 Reviewed-on: https://chromium-review.googlesource.com/750089 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#49095}
-
- 31 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
This adds support to the KeyedLoadIC to ignore out of bounds accesses for Strings and return undefined instead. We add a dedicated bit to the Smi handler to encode the OOB state and have TurboFan generate appropriate code for that case as well. This is mostly useful when programs accidentially access past the length of a string, which was observed and fixed for example in Babel recently, see https://github.com/babel/babel/pull/6589 for details. The idea is to also extend this mechanism to Arrays and maybe other receivers, as reading beyond the length is also often used in jQuery and other popular libraries. Note that this is considered a mitigation for a performance cliff and not a general optimization of OOB accesses. These should still be avoided and handled properly instead. This seems to further improve the babel test on the web-tooling-benchmark by around 1%, because the OOB access no longer turns the otherwise MONOMORPHIC access into MEGAMORPHIC state. Bug: v8:6936, v8:7014 Change-Id: I9df03304e056d7001a65da8e9621119f8e9bb55b Reviewed-on: https://chromium-review.googlesource.com/744022 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49049}
-
- 30 Oct, 2017 2 commits
-
-
Toon Verwaest authored
The bytecode interpreter nor TF rely on the explicit return value of store ICs anymore, so we can just return whatever is in the result slot. It won't be visible to JS anyway. Bug: Change-Id: I389615d1d77c5b050832f23a08e3d3bc07d9cbc6 Reviewed-on: https://chromium-review.googlesource.com/743366Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#49027}
-
Toon Verwaest authored
Remove distinction between lazy and non-lazy CallApiCallback, always explicitly set up target context Bug: Change-Id: I0cb751a0415433fdfec21451e2fac3e0726bf26e Reviewed-on: https://chromium-review.googlesource.com/743019 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49024}
-
- 20 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
In the special case of KeyedLoadIC, where the key that is passed in is a Name that is always the same we only checked for identity in both the stub and the TurboFan case, which works fine for symbols and internalized strings, but doesn't really work with non-internalized strings, where the identity check will fail, the runtime will internalize the string, and the IC will then see the original internalized string again and not progress in the feedback lattice. This leads to tricky deoptimization loops in TurboFan and constantly missing ICs. This adds fixes the stub to always try to internalize strings first when the identity check fails and then doing the check again. If the name is not found in the string table we miss, since in that case the string cannot match the previously recorded feedback name (which is always a unique name). In TurboFan we represent this checks with new CheckEqualsSymbol and CheckEqualsInternalizedString operators, which validate the previously recorded feedback, and the CheckEqualsInternalizedString operator does the attempt to internalize the input. Bug: v8:6936, v8:6948, v8:6969 Change-Id: I3f3b4a587c67f00f7c4b60d239eb98a9626fe04a Reviewed-on: https://chromium-review.googlesource.com/730224Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48784}
-
- 07 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
Introduce NodeProperties::NoObservableSideEffectBetween to check if there's any observable side effect between two nodes in the effect chain. Use this to guard the insertion of potentially redundant map checks in the lowering of Object.prototype.hasOwnProperty and keyed accesses within a for..in loop. This gives another boost on the for..in performance front. Bug: v8:6702 Change-Id: I68133f14ad388a1a7422714319c9b323d5cf8bc4 Reviewed-on: https://chromium-review.googlesource.com/654640Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47869}
-
- 05 Sep, 2017 1 commit
-
-
Jakob Kummerow authored
Only the error cases of overwriting readonly properties need the language_mode to decide whether to throw or be silent. Reading it from the feedback vector's metadata (just like the C++ code in ic.cc does) removes the need to duplicate each stub for each language_mode ("StoreIC" + "StoreICStrict" etc.). Change-Id: Ic0c67f9d40ca36c65e41b4f162b2ab70d155e549 Reviewed-on: https://chromium-review.googlesource.com/647373Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#47836}
-
- 01 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
This CL adds support to optimize for..in in fast enum-cache mode to the same degree that it was optimized in Crankshaft, without adding the same deoptimization loop that Crankshaft had with missing enum cache indices. That means code like for (var k in o) { var v = o[k]; // ... } and code like for (var k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) { var v = o[k]; // ... } } which follows the https://eslint.org/docs/rules/guard-for-in linter rule, can now utilize the enum cache indices if o has only fast properties on the receiver, which speeds up the access o[k] significantly and reduces the pollution of the global megamorphic stub cache. For example the micro-benchmark in the tracking bug v8:6702 now runs faster than ever before: forIn: 1516 ms. forInHasOwnProperty: 1674 ms. forInHasOwnPropertySafe: 1595 ms. forInSum: 2051 ms. forInSumSafe: 2215 ms. Compared to numbers from V8 5.8 which is the last version running with Crankshaft forIn: 1641 ms. forInHasOwnProperty: 1719 ms. forInHasOwnPropertySafe: 1802 ms. forInSum: 2226 ms. forInSumSafe: 2409 ms. and V8 6.0 which is the current stable version with TurboFan: forIn: 1713 ms. forInHasOwnProperty: 5417 ms. forInHasOwnPropertySafe: 5324 ms. forInSum: 7556 ms. forInSumSafe: 11067 ms. It also improves the throughput on the string-fasta benchmark by around 7-10%, and there seems to be a ~5% improvement on the Speedometer/React benchmark locally. For this to work, the ForInPrepare bytecode was split into ForInEnumerate and ForInPrepare, which is very similar to how it was handled in Fullcodegen initially. In TurboFan we introduce a new operator LoadFieldByIndex that does the dynamic property load. This also removes the CheckMapValue operator again in favor of just using LoadField, ReferenceEqual and CheckIf, which work automatically with the EscapeAnalysis and the BranchConditionElimination. Bug: v8:6702 Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a Reviewed-on: https://chromium-review.googlesource.com/645949 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#47768}
-
- 08 Aug, 2017 1 commit
-
-
Michael Starzinger authored
This makes sure we perform a proper holder lookup when trying to inline API accessors calls in TurboFan. Inlining is completely disabled in case the holder is not found, otherwise the appropriate holder is passed via the {PropertyAccessInfo} structure (if different from the receiver). R=bmeurer@chromium.org TEST=cctest/test-api/ReceiverSignature BUG=chromium:752149 Change-Id: I7b192724afd99d651b6477b2f2c8b403a10efb9d Reviewed-on: https://chromium-review.googlesource.com/603615 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47216}
-
- 19 Jul, 2017 1 commit
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
- 11 Jul, 2017 1 commit
-
-
Alexandre Talon authored
Each reducer now has a virtual reducer_name function, returning its name (the name of the class containing this reducer). This gets displayed when using the --trace_turbo_reduction flag. Also when using this flags more messages are displayed. Actually when a node is replaced in-place (which is called an update of the node), other reducers can still update it right after the in-place replacement. When a node is really replaced (not in-place), then we stop trying to apply reducers to it before we propagate the reduction through the relevant nodes. Before a message got printed only for the last reduction it went through. So in case a node was reduced in-place several times in a row, only the last update was printed, or none at all if after being reduced in-place it got reduced by being replaced by another node: only the non-in-place replacement was showed. Now each time an in-place reduction is applied to a node, a message gets printed. Bug: Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa Reviewed-on: https://chromium-review.googlesource.com/563365Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Alexandre Talon <alexandret@google.com> Cr-Commit-Position: refs/heads/master@{#46552}
-
- 06 Jul, 2017 1 commit
-
-
Ross McIlroy authored
Adds constant folding for the StringConcat bytecode to NativeContextSpecialization. Can reduce operator to either a fully folded constant string, or a JSAdd or a StringConcat with a reduced number of operators. BUG=v8:6243, chromium:738312 Change-Id: I6b2be6a3d95230a23f3c7390a4f7be5181c49a2a Reviewed-on: https://chromium-review.googlesource.com/559146 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46461}
-
- 05 Jul, 2017 2 commits
-
-
machenbach authored
Revert of Set the current context to the function's context when entering to LAP. (patchset #14 id:540001 of https://codereview.chromium.org/2770003002/ ) Reason for revert: Speculative: Seems to break webkit_unit_tests: https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247 https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038 Original issue's description: > Set the current context to the function's context when entering to LAP. > > In case of LAP(lazy accessor pair), the function's creation context > must be equal to the accessor holder's creation context, so this CL > changes the current context to the accessor holder's creation context. > > BUG=v8:6156 > > Review-Url: https://codereview.chromium.org/2770003002 > Cr-Commit-Position: refs/heads/master@{#46406} > Committed: https://chromium.googlesource.com/v8/v8/+/18e73287dc65452bc2f952fc005b2251fc32c15a TBR=jochen@chromium.org,verwaest@chromium.org,mstarzinger@chromium.org,tebbi@google.com,yukishiino@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:6156 Review-Url: https://codereview.chromium.org/2973593002 Cr-Commit-Position: refs/heads/master@{#46408}
-
yukishiino authored
In case of LAP(lazy accessor pair), the function's creation context must be equal to the accessor holder's creation context, so this CL changes the current context to the accessor holder's creation context. BUG=v8:6156 Review-Url: https://codereview.chromium.org/2770003002 Cr-Commit-Position: refs/heads/master@{#46406}
-
- 26 Jun, 2017 1 commit
-
-
Georg Neis authored
R=mstarzinger@chromium.org Bug: Change-Id: Ica169da6e095abb79967687ae9a18db5c833f72e Reviewed-on: https://chromium-review.googlesource.com/546356Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#46203}
-
- 19 Jun, 2017 1 commit
-
-
bmeurer authored
We need to constant-fold JSHasInPrototypeChain nodes early during inlining, otherwise we already miss a couple of optimization opportunities if we wait until after typing. This moves the constant-folding part of the JSHasInPrototypeChain lowering back to JSNativeContextSpecialization, where it was before the changes in https://codereview.chromium.org/2934893002 (part of JSOrdinaryHasInstance lowering back then). BUG=v8:5269,v8:5989,v8:6483,chromium:733158 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2943293002 Cr-Commit-Position: refs/heads/master@{#45989}
-
- 16 Jun, 2017 1 commit
-
-
jarin authored
This is in preparation for lowering monomorphic loads during graph building. This essentially moves the parts that will be shared to a separate class/file (proparty-access-builder.(cc|h)). I should say that we will not want to do accessor inlining during graph building because that would require us to create frame states (which is the thing we would like to avoid doing). Review-Url: https://codereview.chromium.org/2936673005 Cr-Commit-Position: refs/heads/master@{#45973}
-
- 13 Jun, 2017 1 commit
-
-
bmeurer authored
Port the baseline implementation of Object.prototype.isPrototypeOf to the CodeStubAssembler, sharing the existing prototype chain lookup logic with the instanceof / OrdinaryHasInstance implementation. Based on that, do the same in TurboFan, introducing a new JSHasInPrototypeChain operator, which encapsulates the central prototype chain walk logic. This speeds up Object.prototype.isPrototypeOf by more than a factor of four, so that the code A.prototype.isPrototypeOf(a) is now performance-wise on par with a instanceof A for the case where A is a regular constructor function and a is an instance of A. Since instanceof does more than just the fundamental prototype chain lookup, it was discovered in Node core that O.p.isPrototypeOf would be a more appropriate alternative for certain sanity checks, since it's less vulnerable to monkey-patching. In addition, the Object builtin would also avoid the performance-cliff associated with instanceof (due to the Symbol.hasInstance hook), as for example hit by https://github.com/nodejs/node/pull/13403#issuecomment-305915874. The main blocker was the missing performance of isPrototypeOf, since it was still a JS builtin backed by a runtime call. This CL also adds more test coverage for the Object.prototype.isPrototypeOf builtin, especially when called from optimized code. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng BUG=v8:5269,v8:5989,v8:6483 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2934893002 Cr-Commit-Position: refs/heads/master@{#45925}
-
- 23 May, 2017 1 commit
-
-
bmeurer authored
Previously the inlining of accessors into try-blocks (i.e. try/catch, try/finally, for-of, etc.) was disabled in JSNativeContextSpecialization, which prevented a couple of interesting optimizations, i.e. we end up with a LOAD_IC in optimized code for this simple example: class A { get x() { return 1; } } function foo(a) { try { return a.x; } catch (e) { return 0; } } foo(new A) This is now fixed and the accessors are properly rewired into the handler chain. BUG=v8:6278,v8:6344,v8:6424 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2902533003 Cr-Commit-Position: refs/heads/master@{#45485}
-
- 17 May, 2017 1 commit
-
-
Marja Hölttä authored
Previous version was https://chromium-review.googlesource.com/502808 BUG=v8:5402 Change-Id: If327f4d7884577b7e5e6159372bf28a80cd21e51 Reviewed-on: https://chromium-review.googlesource.com/506073 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#45369}
-
- 15 May, 2017 2 commits
-
-
Marja Hölttä authored
This reverts commit 7be0159e. Reason for revert: Broke node by generating a broken debug-support.cc Original change's description: > [objects.h splitting] Move Map and related classes. > > BUG=v8:5402 > > Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59 > Reviewed-on: https://chromium-review.googlesource.com/502808 > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Marja Hölttä <marja@chromium.org> > Cr-Commit-Position: refs/heads/master@{#45305} TBR=marja@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,ishell@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:5402 Change-Id: Ifa65537447eb0a1ef947b9d0dae6f07a8b150968 Reviewed-on: https://chromium-review.googlesource.com/506011Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#45307}
-
Marja Hölttä authored
BUG=v8:5402 Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59 Reviewed-on: https://chromium-review.googlesource.com/502808Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#45305}
-
- 09 May, 2017 1 commit
-
-
danno authored
This CL introduces a new type, MapHandles, which is a STL vector of Handle<Map>. It is now used everywhere where lists of Handle<Maps> are required, replacing usages of V8's internal List type. Also-By: franzih@chromium.org BUG=v8:6333,v8:6325 LOG=N Review-Url: https://codereview.chromium.org/2809923002 Cr-Commit-Position: refs/heads/master@{#45211}
-
- 19 Apr, 2017 1 commit
-
-
bmeurer authored
Move JSOrdinaryHasInstance lowering to JSNativeContextSpecialization, which was previously mostly done in JSTypedLowering (for no reason). Add new logic to the lowering to constant-fold OrdinaryHasInstance checks when the map of the left-hand side and the "prototype" of the right-hand side is known. This address the performance issue with the (base) class constructors generated by Babel, i.e.: function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } } var C = function C() { _classCallCheck(this, C); }; for class C {} Also ensure that a known constructor being used inside an instanceof get's a proper initial map on-demand. BUG=v8:6275 R=mstarzinger@chromium.org Review-Url: https://codereview.chromium.org/2827013002 Cr-Commit-Position: refs/heads/master@{#44727}
-
- 10 Apr, 2017 1 commit
-
-
bmeurer authored
The Generic access info was introduced to handle transitioning stores that extend the properties backing store (by reusing the STORE_IC). But since crrev.com/2778133003 TurboFan handles these by just inlining the properties backing store (re)allocation, and thus this is now dead code. BUG=v8:5267 Review-Url: https://codereview.chromium.org/2811593002 Cr-Commit-Position: refs/heads/master@{#44505}
-
- 08 Apr, 2017 1 commit
-
-
bmeurer authored
TurboFan didn't support transitioning stores that also need to grow the properties backing store so far. This CL adds support for re-allocating the properties backing store in-place, so these stores can participate properly in various optimizations like escape analysis and allocation folding. R=ishell@chromium.org BUG=v8:5267,chromium:708339 Review-Url: https://codereview.chromium.org/2778133003 Cr-Original-Commit-Position: refs/heads/master@{#44183} Committed: https://chromium.googlesource.com/v8/v8/+/88a7061a53ad200121f7ee2b2bdcc05d793de806 Review-Url: https://codereview.chromium.org/2778133003 Cr-Commit-Position: refs/heads/master@{#44499}
-
- 07 Apr, 2017 1 commit
-
-
Adam Klein authored
This reverts commit 88a7061a (with one manually-resolved merge conflict). It caused a spike of GC crashes on Canary. TBR=bmeurer@chromium.org Bug: chromium:708339, v8:5267 Change-Id: I8a5683bbdfb61c95d81a2ee7cdb913f39e553093 Reviewed-on: https://chromium-review.googlesource.com/471928 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#44496}
-
- 28 Mar, 2017 1 commit
-
-
bmeurer authored
TurboFan didn't support transitioning stores that also need to grow the properties backing store so far. This CL adds support for re-allocating the properties backing store in-place, so these stores can participate properly in various optimizations like escape analysis and allocation folding. R=ishell@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2778133003 Cr-Commit-Position: refs/heads/master@{#44183}
-
- 15 Mar, 2017 1 commit
-
-
bmeurer authored
For the old asm.js pipeline, there's no point in running either the JSCallReducer or the JSNativeContextSpecialization, as both will not kick in for any asm.js relevant code. So remove the kDeoptimizationEnabled flag from both of them and just run them on regular JavaScript only. Drive-by-fix: Slightly rearrange keyed access to String receivers in the JSNativeContextSpecialization::ReduceKeyedAccess method to access constant characters independent of the IC mode (as long as the constant index is within the range of the receiver). BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2743253002 Cr-Commit-Position: refs/heads/master@{#43813}
-
- 24 Feb, 2017 1 commit
-
-
bmeurer authored
For a + b, where both a and b are known strings at compile time, and the combined length of a and b doesn't overflow the maximum allowed string length, we can constant-fold the string concatenation during compilation. R=yangguo@chromium.org Review-Url: https://codereview.chromium.org/2713093003 Cr-Commit-Position: refs/heads/master@{#43401}
-
- 21 Feb, 2017 1 commit
-
-
Michael Starzinger authored
This fixes a missing name check for keyed property loads targeting the global object where the feedback was warmed up with a single name. This affects {JSLoadProperty} nodes only, syntactic global property loads via the {JSLoadGlobal} operator are not affected. R=bmeurer@chromium.org TEST=mjsunit/regress/regress-crbug-694416 BUG=chromium:694416 Change-Id: I54aa3f27eaa72630539f02602ec7642b04835b27 Reviewed-on: https://chromium-review.googlesource.com/445224Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43344}
-
- 20 Feb, 2017 1 commit
-
-
bmeurer authored
Unify the three different implementations of InferReceiverMaps, which were basically copy&paste with slightly different optimizations applied later into a single NodeProperties::InferReceiverMaps helper, which also returns a ZoneHandleSet of maps, rather than only a single map. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2703133003 Cr-Commit-Position: refs/heads/master@{#43318}
-
- 17 Feb, 2017 1 commit
-
-
Igor Sheludko authored
... which is used for initializing properties with non compile time values. Currently we use StoreOwnIC only for storing properties that already exist in the boilerplate therefore we can reuse StoreIC dispatcher. The proper StoreOwnIC dispatcher will be implemented in a separate CL. BUG=v8:5495, v8:4414 Change-Id: I9c33fdb8499ec5be2c7fce1ecb6ce7aa285e5844 Reviewed-on: https://chromium-review.googlesource.com/443588Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#43285}
-
- 07 Feb, 2017 2 commits
-
-
ishell@chromium.org authored
BUG= Change-Id: I31b8da09f4728d55c2da91966edcad49528b554b Reviewed-on: https://chromium-review.googlesource.com/439146Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#43003}
-
ishell@chromium.org authored
... and TypeFeedbackMetadata to FeedbackMetadata. BUG= Change-Id: I2556d1c2a8f37b8cf3d532cc98d973b6dc7e9e6c Reviewed-on: https://chromium-review.googlesource.com/439244 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#42999}
-