- 10 May, 2022 1 commit
-
-
Tobias Tebbi authored
UnsafePointerAdd is unnecessary as long as a proper bitcast is used before the addition. The bitcast is already in the effect chain and prevents the addition from floating before a GC operation. Change-Id: Ieadb8a51d2d24eaa1132a62c77c674954f7e2644 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616727Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#80457}
-
- 06 Apr, 2022 1 commit
-
-
Jakob Gruber authored
With kLazy deopts gone, we can remove the stored DeoptimizeKind from Deoptimize nodes and all related spots - all Deoptimize nodes are eager deopts. Bug: v8:12765 Change-Id: I8e727e046c498198e50d9b7dba25442fb54f5da9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568456 Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79830}
-
- 25 Mar, 2022 1 commit
-
-
jameslahm authored
We could optimize String#startsWith in JSCallReducer for three conditions: - If search_element is definitely not a string, we make no change. - If search_element is definitely a string and its length is less or equal than max inline matching sequence threshold, we could inline the entire matching sequence. - Else we try to inline, and have a runtime deopt if search_element is not a string. Bug: v8:8400 Change-Id: I505090b91d35fbc2c91cdf985717c68135cba807 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517936Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79621}
-
- 21 Mar, 2022 1 commit
-
-
Jakob Gruber authored
This CL removes: - Dynamic map checks aka minimorphic property loads (TF support, builtins). - "Bailout" deopts (= drop to the interpreter once, but don't throw out optimized code). - "EagerWithResume" deopts (= part of dynamic map check functionality, we call a builtin for the deopt check and deopt or resume based on the result). Fixed: v8:12552 Change-Id: I492cf1667e0f54586690b2f72a65ea804224b840 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401585 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#79544}
-
- 20 Jan, 2022 1 commit
-
-
Jakob Gruber authored
Bug: v8:12552 Change-Id: I99e4d8e8aeba5460f11e54cc1b2bcaea98a5276d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400964Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78698}
-
- 01 Dec, 2021 1 commit
-
-
Manos Koukoutos authored
This fixes operators in wasm Turbofan that were mixing up integer sizes and pointers with tagged pointers. Additional changes: - Remove unused (and non-compiling if V8_MAP_PACKING) GraphAssembler::StoreMap. - Factor out WasmGraphBuilder::IsNull. Change-Id: I9d99827e35507adc0af391bd39975d55371b98cf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3306981Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78196}
-
- 19 Oct, 2021 1 commit
-
-
Nico Hartmann authored
This CL adds support for BigInt.asIntN, the necessary operations and extensions of the compiler's type system to allow lowering of BigInts to word64 representations that are interpreted as signed 64 bit BigInts. Bug: v8:9407 Change-Id: Id4f1f45437c1caf94e01c7b4e063c2ae2386c88a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3198070 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/main@{#77458}
-
- 12 Aug, 2021 1 commit
-
-
Ross McIlroy authored
These are no longer enabled, so remove the code mitigation logic from the codebase. BUG=chromium:1003890 Change-Id: I536bb1732e8463281c21da446bbba8f47ede8ebe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3045704 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#76256}
-
- 20 Jul, 2021 1 commit
-
-
Jakob Kummerow authored
Avoiding the builtin call, and potentially enabling other Turbofan optimizations to apply. This required teaching the MemoryLowering pass how to produce Wasm-style isolate-independent code, where external references won't work, and builtin calls have to be encoded differently. Bug: v8:7748 Change-Id: Ib6d87da644330e7c3623c11aa333b23074aeae19 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3038524 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#75824}
-
- 08 Jul, 2021 1 commit
-
-
Georg Neis authored
Optimize JSCallWithArrayLike with diamond speculation when probable arguments list is empty literal array The JSCallWithArraylike can be replaced with a JSCall if its probable arguments list is empty literal array. This replacement will introduce a deoptimization check to make sure the length of arguments list is 0 at runtime. This CL change this optimization to a diamond speculation which may help avoid deoptimization once and keep the fast path. This change may benefit a following usecase, function calcMax(testArray) { Array.max = function(array) { return Math.max.apply(Math, array); }; var result = []; for (var i = 0; i < testArray.length - 3; i++) { var positiveNumbers = []; for (var j = 0; j < 3; j++) { if (testArray[i + j] > 0) { positiveNumbers.push(testArray[i + j]); } } result.push(Array.max(positiveNumbers)); } return result; } testArray = [-1, 2, 3, -4, -5, -6, -7, -8, -9, 10]; for (var i = 0; i < 1000000; i++) { calcMax(testArray); } Bug: v8:9974 Change-Id: I595627e2fd937527350c8f8652d701c791b41dd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2967757 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#75636}
-
- 30 Jun, 2021 1 commit
-
-
Ross McIlroy authored
Adds support for a seperate dynamic map checks trampoline that takes the feedback vector as an argument rather than reading it from the stack frame, to enable it to work for inlined functions. Plumbs the logic through the compiler to select between these trampolines based on the framestate. BUG=v8:9684,chromium:1224367 Change-Id: Ibc7facdc78930aedec4a102693a926f64f6de7e2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2992724 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#75461}
-
- 26 Apr, 2021 1 commit
-
-
Ross McIlroy authored
Instead of running a second pass of the scheduled graph after effect control linearization to do machine lowering, integrate the machine lowering reducers (MemoryLowering and SelectLowering) into the graph assembler used by the effect control linearization. This saves running through the graph and re-maintaining the schedule for the second time, reducing overhead in Turboprop. BUG=v8:9684 Change-Id: Ib0fed19089287c8e801a063333cb8404181411db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848474 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#74178}
-
- 12 Apr, 2021 1 commit
-
-
Wenyu Zhao authored
This CL adds features to pack/unpack map words. Currently V8 cannot store extra metadata in object headers -- because V8 objects do not have a proper header, but only a map pointer at the start of the object. To store per-object metadata like marking data, a side table is required as the per-object metadata storage. This CL enables V8 to use higher unused bits in a 64-bit map word as per-object metadata storage. Map pointer stores come with an extra step to encode the metadata into the pointer (we call it "map packing"). Map pointer loads will also remove the metadata bits as well (we call it "map packing"). Since the map word is no longer a valid pointer after packing, we also change the tag of the packed map word to make it looks like a Smi. This helps various GC and barrier code to correctly skip them instead of blindly dereferencing this invalid pointer. A ninja flag `v8_enable_map_packing` is provided to turn this map-packing feature on and off. It is disabled by default. * Only works on x64 platform, with `v8_enable_pointer_compression` set to `false` Bug: v8:11624 Change-Id: Ia2bdf79553945e5fc0b0874c87803d2cc733e073 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247561Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#73915}
-
- 23 Feb, 2021 1 commit
-
-
Manos Koukoutos authored
WasmGraphBuilder often failed to use GraphAssembler infrastructure and went with directly invoking graph()->NewNode(). This made the code more verbose, especially in cases where effect() and control() had to be passes directly to NewNode(). This CL eliminates these invocations in obvious cases. It does not try to refactor complicated code with branches, diamond patterns, etc. Additional changes: - Define a few more operators in GraphAssembler. - Move Branch() helper in WasmGraphAssembler. - Define NumberConstant() helper in WasmGraphAssembler. - Define Merge() helper with varargs in WasmGraphBuilder. - Omit IntPtrConstant() wrapper for constant offsets of Load and Store. Change-Id: I571d5286be8881504cb2060195fbd181d1fce67d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712804Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/master@{#72975}
-
- 22 Feb, 2021 1 commit
-
-
Manos Koukoutos authored
Bug: v8:7748 Change-Id: I32c87d4e3b98ab44699c1b7bf952aedef3e27002 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704667 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#72890}
-
- 15 Feb, 2021 1 commit
-
-
Gus Caplan authored
Bug: chromium:1052746 Change-Id: I79f58aa3f732f8569654f0d5751ae89a5b6f547d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2686667 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#72733}
-
- 11 Jan, 2021 1 commit
-
-
Clemens Backes authored
In memory64, the index is a 64-bit value even on 32 bit. Thus the bounds check needs to check explicitly that the high word is zero. The (pointer sized) low word is then checked against the actual memory size. R=manoskouk@chromium.org Bug: v8:10949 Change-Id: I311664ccadaec44a6c88777a60b1a3b45b6c0642 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2617088 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#72016}
-
- 16 Dec, 2020 1 commit
-
-
Manos Koukoutos authored
LoopExitValue nodes can be used as inputs to Phis in loop optimizations. To do this, we need to know the machine representation that needs to be passed to the new Phi node. This CL adds a MachineRepresentation argument to LoopExitValue nodes, as well as a helper to extract it. Since the MachineRepresentation is not used by JS compilation, nodes generated during JS compilation are passed kTagged as a default value. Change-Id: I925f382d5e6988d8fad3de7a6db231e871d6ed36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578983 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Georg Neis (ooo until January 5) <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71798}
-
- 02 Dec, 2020 1 commit
-
-
Ross McIlroy authored
Unifies various operators for dynamic map checks with the naming scheme of DynamicCheckMaps (to be similar to CheckMaps. BUG=v8:10582 Change-Id: I8ac842f55fe31cdc7b84968d077017a86ddf4442 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567952 Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#71559}
-
- 01 Dec, 2020 1 commit
-
-
Ross McIlroy authored
In order to reduce the codegen size of dynamic map checks, add the ability to have an eager with resume deopt point, which can call a given builitin to perform a more detailed check than can be done in codegen, and then either deoptimizes itself (as if the calling code had performed an eager deopt) or resumes execution in the calling code after the check. In addition, support for adding extra arguments to a deoptimization continuation is added to enable us to pass the necessary arguments to the DynamicMapChecks builtin. Finally, a trampoline is added to the DynamicMapChecks which saves the registers that might be clobbered by that builtin, to avoid having to save them in the generated code. This trampoline also performs the deoptimization based on the result of the DynamicMapChecks builtin. In order to ensure both the trampoline and DynamicMapChecks builtin have the same call interface, and to limit the number of registers that need saving in the trampoline, the DynamicMapChecks builtin is moved to be a CSA builtin with a custom CallInterfaceDescriptor, that calls an exported Torque macro that implements the actual functionality. All told, this changes the codegen for a monomorphic dynamic map check from: movl rbx,<expected_map> cmpl [<object>-0x1],rbx jnz <deferred_call> resume_point: ... deferred_call: <spill registers> movl rax,<slot> movq rbx,<object> movq rcx,<handler> movq r10,<DynamicMapChecks> call r10 cmpq rax,0x0 jz <restore_regs> cmpq rax,0x1 jz <deopt_point_1> cmpq rax,0x2 jz <deopt_point_2> int3l restore_regs: <restore_regs> jmp <resume_point> ... deopt_point_1: call Deoptimization_Eager deopt_point_2: call Deoptimization_Bailout To: movl rax,<slot> movl rcx,<expected_map> movq rdx,<handler> cmpl [<object>-0x1],rcx jnz <deopt_point> resume_point: ... deopt_point: call DynamicMapChecksTrampoline jmp <resume_point> BUG=v8:10582 Change-Id: Ica4927b9acc963b9b73dc62d9379a7815335650f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560197 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#71545}
-
- 27 Nov, 2020 1 commit
-
-
Maya Lekova authored
This CL extends the TruncateFloat64ToInt64 machine operator with a TruncateKind, allowing EffectControlLinearizer to request truncating to INT64_MIN in case of overflow. The CL adds the necessary low-level support when generating code for kArm64Float64ToInt64. It also enables relevant tests as part of the fast API call suite. Bug: v8:11121 Change-Id: I0cb9964cc3c2ff49e6b0bbfe4a20f280e4aab337 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560718Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#71449}
-
- 26 Nov, 2020 1 commit
-
-
Santiago Aboy Solanes authored
Scopes in V8 are used to guarantee one or more properties during its lifetimes. If a scope is not named e.g MyClassScope(args) instead of MyClassScope scope(args) it will get created and automatically destroyed and therefore, being useless as a scope. This CL would produce a compiling warning when that happens to ward off this developer error. Follow-up to ccrev.com/2552415 in which it was introduced and implemented for Guard classes. Change-Id: Ifa0fb89cc3d9bdcdee0fd8150a2618af5ef45cbf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2555001 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#71425}
-
- 06 Oct, 2020 1 commit
-
-
Clemens Backes authored
This rewrites some more code to use GraphAssembler methods instead of manually creating and adding the nodes. To this end, we add three more methods to the GraphAssembler: UintPtrConstant, ProtectedStore, and ProtectedLoad. R=ahaas@chromium.org, tebbi@chromium.org Bug: v8:10123 Change-Id: I825137d4355d117d88e29063ab2ac68340883f77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2445512 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#70338}
-
- 02 Oct, 2020 1 commit
-
-
Maya Lekova authored
This CL implements passing float parameters to fast API calls by using the existing representation conversions for double parameters and then truncating the double to a float. It also adds float/double tests for fast API calls. Bug: chromium:1052746 Change-Id: Ibb3ccd173b3807a515adbf38cebaa1cf8e2784b6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436333Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#70277}
-
- 29 Sep, 2020 1 commit
-
-
Mike Stanton authored
Here is an alternate fix for chromium:1123379, which addresses a TODO. A callback is provided to the GraphAssembler when it's working on an unscheduled graph. In such cases, changed nodes in the main graph need to be revisited after change. The callback ensures that the GraphAssembler kicks that process off when necessary. Bug: chromium:1123379 Change-Id: I9d864c3390fbe670ee450152a67555dcbfa8f581 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2433924 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#70192}
-
- 28 Sep, 2020 1 commit
-
-
Santiago Aboy Solanes authored
Previously ToNumber could be called with an empty context. In a previous CL (https://crrev.com/c/v8/v8/+/2078580) we added DCHECKS to make sure that some paths were not using the empty context. Now we are doing the next step of adding a primitive to separate the cases. Small update from delphick@ to get the builtin descriptor right. Bug: v8:6949, v8:10933 Change-Id: Ie40b169f680f60a08eb26fac1fcfcef7d6169e65 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2428863 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#70162}
-
- 10 Sep, 2020 2 commits
-
-
Jakob Gruber authored
This is the final part of the tier-up commit series. It implements: - A prologue in NCI code objects that checks and acts upon the optimization marker. - Currently, handling is deferred to the InterpreterEntryTrampoline but this will change in the future. - The lifecycle is otherwise like Ignition-to-Turbofan; the runtime profiler marks a function for optimization, the next call to that function triggers optimization by calling into runtime, and the finished code object is installed both on the JSFunction and the optimized code cache. - The feedback vector's kOptimizedCodeWeakOrSmiOffset slot is currently reused for the mid-to-top tier up. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:8888 Change-Id: Iff50b05ddcc68b25d7ed0f1e0d20af076a1522a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2361466Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69808}
-
Sathya Gunasekaran authored
The dynamic map checks operator loads the feedback vector and performs map checks against each map and handler entry in the feedback against the incoming map and handler. Instead of emitting code to iterate over this feedback vector at runtime, we unroll this loop at compile time. The generated code is similar to this pseudocode: length = feedback_slot.length if length >= 4: goto labels[3] if length == 3: goto labels[2] if length == 2: goto labels[1] if length == 1: goto labels[0] labels[3]: map = load(feedback_slot, 6) if incoming_map == map goto handler_check(7) goto labels[2] labels[2]: map = load(feedback_slot, 4) if incoming_map == map goto handler_check(5) goto labels[1] labels[1]: map = load(feedback_slot, 2) if incoming_map == map goto handler_check(3) goto labels[0] labels[0]: map = load(feedback_slot, 0) if incoming_map == map goto handler_check(1) bailout handler_check (index): handler = load(feedback_slot, index) if incoming_handler == handler goto done deoptimize Bug: v8:10582, v8:9684 Change-Id: I64d64ff8eda664e4d476bf1b2612e26a344e98a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339960 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69797}
-
- 24 Aug, 2020 1 commit
-
-
Jakob Gruber authored
Prior to this CL, one had to artificially insert a basic-block-terminating node after Unreachable. The common pattern was Unreachable(); Goto(&some_label); // Never reached but generates useless code. This CL improves usability by automatically merging Unreachable nodes to the end node, and terminating current effect/control. The updated pattern is just Unreachable(); or in cases where Turboprop must maintain a schedule: Unreachable(&some_label); Bug: v8:8888 Change-Id: I26a0b11b5e67252a6dc3584ae09ed06370f1eacc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362690 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#69531}
-
- 11 Aug, 2020 1 commit
-
-
Mythri A authored
We shouldn't spill weak pointers onto the stack when calling functions that can trigger GC. DynamicMapChecks operator was using feedback loaded from the feedback vector across the TryMigrateInstance function call. The feedback can be a weak pointer to receiver map for monomorphic cases and TryMigrateInstance can trigger a GC. This cl fixes it by holding a holding a strong reference to the feedback. Bug: v8:10774,v8:10582,v8:9684 Change-Id: Ia36f4d8ad46421ae570f41439bc1f0875081deee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336804Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#69338}
-
- 22 Jul, 2020 1 commit
-
-
Sathya Gunasekaran authored
This is used by the DynamicCheckMaps operator to indicate that the optimized code should not be thrown away, but instead should be re-run again, after healing the feedback. Bug: v8:10582, v8:9684 Change-Id: Ib2408ba0d1d1a6bf50b2031a5312c7a8cca08730 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2308334 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68997}
-
- 20 Jul, 2020 1 commit
-
-
Sathya Gunasekaran authored
This CL introduces a new operator that loads the feedback vector and checks against maps at runtime, rather than embedding the map directly in the generated code. A follow on CL will use this operator when generating code for named property access. Bug: v8:10582, v8:9684 Change-Id: I372a01586d3048427760f0cb27619a59afc3f59e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241518Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#68930}
-
- 15 Jul, 2020 1 commit
-
-
Maya Lekova authored
This change adds a has_error parameter on the stack which allows the fast callback to report an error. In case this parameter is set to non-zero, the generated code calls the slow (default) callback, which can throw the exception. Bug: chromium:1052746 Change-Id: Ib11f6b0bef37d5eb1d04cd6d0a3ef59028dcc448 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183929Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#68871}
-
- 30 Jun, 2020 1 commit
-
-
Jakob Kummerow authored
This patch does not include support for RTTs for i31ref yet. Bug: v8:7748 Change-Id: Ifbeb8e305c2d0a57e4d5d6be761d046e330e0da1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2273135 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#68613}
-
- 25 Jun, 2020 1 commit
-
-
Jakob Gruber authored
... and extend JS node wrapper functionality. Node wrappers now have accessors for value inputs and context/control/effect/frame-state inputs. Accessors are typed, although types aren't very meaningful so far (in current examples we only distinguish between Object/HeapObject). The following node kinds now take an additional feedback vector input, and use the new node wrapper functionality above: - CloneObject - CreateLiteralArray - CreateLiteralObject - CreateLiteralRegExp - GetIterator - GetTemplateObject - HasProperty - LoadProperty - StoreProperty Bug: v8:8888 Change-Id: I1eb33c078b11725a72ec983bbaa848b9a3c7b0d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259936 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68538}
-
- 22 Jun, 2020 1 commit
-
-
Jakob Gruber authored
In native context independent code we cannot embed the (native context dependent) feedback vector as a constant. Instead, we will load it from the JSFunction once and pass it to all users. This CL makes this change for all unary operators. All other {binary,compare} operators will need similar work in the future. Bug: v8:8888 Change-Id: I4d49a6e0effc84dcdf3599814e5c2708b16bcc44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246576Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#68448}
-
- 08 Jun, 2020 1 commit
-
-
Clemens Backes authored
This is a little cleanup to use the {GraphAssembler} for implementing {TraceMemoryOperation}. The {GraphAssembler} needs to be extended by a straight-forward {StackSlot} method. R=tebbi@chromium.org CC=arobin@google.com Bug: v8:10123 Change-Id: Ic872870bfd8609bb09383a0458b5c08fd7586993 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2232556 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#68238}
-
- 15 May, 2020 1 commit
-
-
Georg Neis authored
GraphAssembler creates Phi nodes and creates additional inputs to them depending on how many jumps go there. If the typer decorator is active, it will type the Phi node at creation time. GraphAssembler was not aware of types (until recently it was not used while the graph is typed) and did not update the Phi type with each new input. This CL fixes that. Bug: chromium:1082704 Change-Id: Id94bcda752c7b3dc836eb2b6c6b55b1690185a09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202978Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#67823}
-
- 07 May, 2020 1 commit
-
-
Nico Hartmann authored
The code generated by TurboFan was incorrect when comparing to non-oddball undetectables using abstract equality. In particular, %GetUndetectable() == %GetUndetectable() did not return false. Bug: chromium:1051008 Change-Id: Ib62adc72a20aa6cca9ef6499d5fe7429f04623cf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187498 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67647}
-
- 29 Apr, 2020 1 commit
-
-
Igor Sheludko authored
... and bottlenecks for C++, CSA, Torque, TurboFan and hand-written assembly. Bug: v8:10391 Change-Id: I62f8c6f9c934b2cd492e550b7c25f1078c2c6a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134140 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#67479}
-