- 19 Jul, 2017 1 commit
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
- 14 Jul, 2017 1 commit
-
-
Caitlin Potter authored
SuspendFlags was originally used by the suspend operation to determine which field to record the bytecode offset of a suspended generator, and the value the generator was resumed with. For async generators, await operations would use a separate field, in order to preserve the previous yield input value. This was important to ensure `function.sent` continued to function correctly. As function.sent is being retired, this allows the removal of support for that. Given that this was the only real need for SuspendFlags in the first place (with other uses tacked on as a hack), this involves several other changes as well: - Modification of MacroAssembler AssertGeneratorObject. No longer accepts a SuspendFlags parameter to determine which type of check to perform. - Removal of `flags` operand from SuspendGenerator bytecode, and the GeneratorStore js-operator. - Removal of `flags` parameter from ResumeGeneratorTrampoline builtins. - Removal of Runtime functions, interpreter intrinsics and AccessBuilders associated with the [[await_input_or_debug_pos]] field in JSAsyncGeneratorObject, as this field no longer exists. - Addition of a new `Yield` AST node (subclass of Suspend) in order to prevent the need for the other SuspendFlag values. BUG=v8:5855 TBR=bmeurer@chromium.org Change-Id: Iff2881e4742497fe5b774915e988c3d9d8fbe487 Reviewed-on: https://chromium-review.googlesource.com/570485 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#46683}
-
- 13 Jul, 2017 1 commit
-
-
Adam Klein authored
The tail call implementation is hidden behind the --harmony-tailcalls flag, which is off-by-default (and has been unstaged since February). It is known to be broken in a variety of cases, including clusterfuzz security issues (see sample Chromium issues below). To avoid letting the implementation bitrot further on trunk, this patch removes it. Bug: v8:4698, chromium:636914, chromium:724746 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c Reviewed-on: https://chromium-review.googlesource.com/569069 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#46651}
-
- 12 Jul, 2017 1 commit
-
-
Alexandre Talon authored
The JSTypedLowering reducer was returning Changed(node) when it did not change the node, in case the node was a speculative number comparison node. Bug: Change-Id: I2082e4c2e45078b343e427f54d61d4e0a323a64f Reviewed-on: https://chromium-review.googlesource.com/568036Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Alexandre Talon <alexandret@google.com> Cr-Commit-Position: refs/heads/master@{#46600}
-
- 29 Jun, 2017 1 commit
-
-
Michael Starzinger authored
This adds support for lowering of nodes having the {JSToObject} operator even if they have exceptional control projections (e.g. are inside of a try-block). R=bmeurer@chromium.org TEST=mjsunit/compiler/optimized-with Change-Id: I711ff4935db68c43243a971a8b21989487c86317 Reviewed-on: https://chromium-review.googlesource.com/554628Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#46318}
-
- 21 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Adds typed lowering of JSStringConcat to ConsString allocation if the following conditions hold: - All concatinations will result in a ConsString of >= ConString::kMinLength - No concatinations will result in a empty string in the RHS unless there is a sequential string in the LHS. This also means JSStringConcat needs an eager checkpoint since it can deopt if throwing a RangeError when the string length protector is valid. BUG=v8:6243 Change-Id: I01ca79f884df467c10f2c032c72d51b5199c1a3c Reviewed-on: https://chromium-review.googlesource.com/526636 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46093}
-
- 19 Jun, 2017 1 commit
-
-
bmeurer authored
We need to constant-fold JSHasInPrototypeChain nodes early during inlining, otherwise we already miss a couple of optimization opportunities if we wait until after typing. This moves the constant-folding part of the JSHasInPrototypeChain lowering back to JSNativeContextSpecialization, where it was before the changes in https://codereview.chromium.org/2934893002 (part of JSOrdinaryHasInstance lowering back then). BUG=v8:5269,v8:5989,v8:6483,chromium:733158 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2943293002 Cr-Commit-Position: refs/heads/master@{#45989}
-
- 13 Jun, 2017 1 commit
-
-
bmeurer authored
Port the baseline implementation of Object.prototype.isPrototypeOf to the CodeStubAssembler, sharing the existing prototype chain lookup logic with the instanceof / OrdinaryHasInstance implementation. Based on that, do the same in TurboFan, introducing a new JSHasInPrototypeChain operator, which encapsulates the central prototype chain walk logic. This speeds up Object.prototype.isPrototypeOf by more than a factor of four, so that the code A.prototype.isPrototypeOf(a) is now performance-wise on par with a instanceof A for the case where A is a regular constructor function and a is an instance of A. Since instanceof does more than just the fundamental prototype chain lookup, it was discovered in Node core that O.p.isPrototypeOf would be a more appropriate alternative for certain sanity checks, since it's less vulnerable to monkey-patching. In addition, the Object builtin would also avoid the performance-cliff associated with instanceof (due to the Symbol.hasInstance hook), as for example hit by https://github.com/nodejs/node/pull/13403#issuecomment-305915874. The main blocker was the missing performance of isPrototypeOf, since it was still a JS builtin backed by a runtime call. This CL also adds more test coverage for the Object.prototype.isPrototypeOf builtin, especially when called from optimized code. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng BUG=v8:5269,v8:5989,v8:6483 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2934893002 Cr-Commit-Position: refs/heads/master@{#45925}
-
- 12 Jun, 2017 1 commit
-
-
Jakob Gruber authored
Callables for TF builtins are autogenerated and accessible through Builtins::CallableFor. This removes the manually written accessors from CodeFactory. Bug: v8:6474,v8:5737 Change-Id: I9d8dec97995471c1bb258147220c190bf72e5de8 Reviewed-on: https://chromium-review.googlesource.com/530745Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#45839}
-
- 08 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Add the ability for the typer to track whether a string could be the empty string. This is needed for typed lowering of JSStringConcat since we can't create cons string chain with the empty string in arbitrary positions. The ToPrimitiveToString bytecode handler is modified to collect feedback on whether it has ever seen the empty string, which is used by SpeculativeToPrimitiveToString to ensure that the output is non-empty (or depot) which will subsiquently be used to enable inline cons-string creation for the JSStringConcat operator in typed lowering in a subsiquent CL. BUG=v8:6243 Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52 Reviewed-on: https://chromium-review.googlesource.com/522122 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#45786}
-
- 07 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Adds support for lowering of ToPrimitiveToString and StringConcat bytecodes to the corresponding builtins. As part of this, moves the interpreter implementation of these operations into the appropriate builtin generators and add builtin support for them. Also adds TailCallRuntimeN operator to code-assembler which enables tail calling a runtime function when the arguments have already been pushed onto the stack. BUG=v8:6243 Change-Id: Id5c851bc42e4ff490d9a23a8990ae331c7eac73e Reviewed-on: https://chromium-review.googlesource.com/515362 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#45756}
-
- 06 Jun, 2017 1 commit
-
-
bmeurer authored
Previously Ignition would collect precise Number feedback for binary operators, but TurboFan would just ignore that and treat it the same as NumberOrOddball. That however generates a lot of unnecessary code, plus it defeats redundancy elimination if the same input is also used by compare operations, which do properly distinguish feedback Number and NumberOrOddball. This CL adds the missing bits to connect the existing functionality properly, i.e. adding the missing BinaryOperationHint and using the NumberOperationHint::kNumber in the representation selection for tagged inputs. R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2923543003 Cr-Commit-Position: refs/heads/master@{#45732}
-
- 31 May, 2017 1 commit
-
-
jgruber authored
BUG=v8:5737 Review-Url: https://codereview.chromium.org/2913783002 Cr-Commit-Position: refs/heads/master@{#45629}
-
- 22 May, 2017 2 commits
-
-
Wiktor Garbacz authored
Change-Id: I20ed35a7fb5104a9cc66bb54fa8966589c43d7f9 Reviewed-on: https://chromium-review.googlesource.com/507287Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Jochen Eisinger <jochen@chromium.org> Commit-Queue: Wiktor Garbacz <wiktorg@google.com> Cr-Commit-Position: refs/heads/master@{#45458}
-
bmeurer authored
Introduce a new Symbol comparison feedback bit in the lattice and collect that feedback on Equal/StrictEqual in Ignition. Utilize this feedback in TurboFan by adding a dedicated CheckSymbol operator to check for symbol inputs. This way we can optimize Symbol comparison where TurboFan doesn't know anything statically about either side, or abstract equality comparisons where TurboFan doesn't statically know anything about one side. BUG=v8:6278,v8:6344,v8:6423 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2893263002 Cr-Commit-Position: refs/heads/master@{#45455}
-
- 18 May, 2017 2 commits
-
-
bmeurer authored
For additions like a+'' or ''+a where we have String feedback on the JSAdd, we can drop the concatenation and just check that a is a valid String already (via CheckString). BUG=v8:6259 R=petermarshall@chromium.org Review-Url: https://codereview.chromium.org/2894563002 Cr-Commit-Position: refs/heads/master@{#45395}
-
bmeurer authored
We already had an optimization to turn Function.prototype.apply with arguments object, i.e. function foo() { return bar.apply(this, arguments); } into a special operator JSCallForwardVarargs, which avoids the allocation and deconstruction of the arguments object, but just passes along the incoming parameters. We can do the same for rest parameters and spread calls/constructs, i.e. class A extends B { constructor(...args) { super(...args); } } or function foo(...args) { return bar(1, 2, 3, ...args); } where we basically pass along the parameters (plus maybe additional statically known parameters). For this, we introduce a new JSConstructForwardVarargs operator and generalize the CallForwardVarargs builtins that are backing this. BUG=v8:6407,v8:6278,v8:6344 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2890023004 Cr-Commit-Position: refs/heads/master@{#45388}
-
- 04 May, 2017 2 commits
-
-
gdeepti authored
If an ArrayBuffer is setup through the WebAssembly.Memory constructor, identify these with a flag and avoid optimizations in js-typed-lowering.cc. This is needed becasue buffers associated with memory objects can be grown/detached leading to crashes. BUG=chromium:717194 Review-Url: https://codereview.chromium.org/2862763002 Cr-Commit-Position: refs/heads/master@{#45105}
-
neis authored
1. Generalize context specialization such that the provided context can be any outer context of the function, not necessarily the immediate outer context. 2. Based on this: if function specialization is disabled, then specialize for the module context if there is one. 3. Extend typed lowering of module loads and stores such that if the operand is a Module constant, we constant-fold the cell load. That is, a JSLoadModule with a Module HeapConstant input becomes a LoadField with a Cell HeapConstant input, and similarly for JSStoreModule. BUG=v8:1569 Review-Url: https://codereview.chromium.org/2841613002 Cr-Commit-Position: refs/heads/master@{#45083}
-
- 03 May, 2017 1 commit
-
-
neis authored
This is just a refactoring, no changes in behavior. BUG=v8:1569 Review-Url: https://codereview.chromium.org/2839623003 Cr-Commit-Position: refs/heads/master@{#45071}
-
- 19 Apr, 2017 1 commit
-
-
bmeurer authored
Move JSOrdinaryHasInstance lowering to JSNativeContextSpecialization, which was previously mostly done in JSTypedLowering (for no reason). Add new logic to the lowering to constant-fold OrdinaryHasInstance checks when the map of the left-hand side and the "prototype" of the right-hand side is known. This address the performance issue with the (base) class constructors generated by Babel, i.e.: function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } } var C = function C() { _classCallCheck(this, C); }; for class C {} Also ensure that a known constructor being used inside an instanceof get's a proper initial map on-demand. BUG=v8:6275 R=mstarzinger@chromium.org Review-Url: https://codereview.chromium.org/2827013002 Cr-Commit-Position: refs/heads/master@{#44727}
-
- 07 Apr, 2017 1 commit
-
-
jarin authored
This gives us more precise type information, so we can avoid some type guards to refine the type information back. The motivation for this is to help escape analysis by not introducing redundant type guards (which escape analysis cannot handle yet even though it could and should do). Motivating example: In the example below, the out-of-object property array for properties fld5 and fld6 gets type Any when it is created by "o.fld5 = 5" (for object literals, we store 4 properties in-objeca, the rest goes out of object). When we run load elimination for the load the out-of-object property array (to store 6 into o.fld6), load elimination inserts TypeGuard to enforce the Type::Internal() type. This makes escape analysis bail out on this object, and we do not eliminate the object creation. function f() { var o = {}; o.fld1 = 1; o.fld2 = 2; o.fld3 = 3; o.fld4 = 4; o.fld5 = 5; o.fld6 = 6; } f(); f(); %OptimizeFunctionOnNextCall(f); f(); Review-Url: https://codereview.chromium.org/2797993006 Cr-Commit-Position: refs/heads/master@{#44470}
-
- 29 Mar, 2017 2 commits
-
-
Caitlin Potter authored
- Introduce new struct AsyncGeneratorRequest, which holds information pertinent to resuming execution of an AsyncGenerator, such as the Promise associated with the async generator request. It is intended to be used as a singly linked list, and holds a pointer to the next item in te queue. - Introduce JSAsyncGeneratorObject (subclass of JSGeneratorObject), which includes several new internal fields (`queue` which contains a singly linked list of AsyncGeneratorRequest objects, and `await_input` which contains the sent value from an Await expression (This is necessary to prevent function.sent (used by yield*) from having the sent value observably overwritten during execution). - Modify SuspendGenerator to accept a set of Flags, which indicate whether the suspend is for a Yield or Await, and whether it takes place on an async generator or ES6 generator. - Introduce interpreter intrinsics and TF intrinsic lowering for accessing the await input of an async generator - Modify the JSGeneratorStore operator to understand whether or not it's suspending for a normal yield, or an AsyncGenerator Await. This ensures appropriate registers are stored. - Add versions of ResumeGeneratorTrampoline which store the input value in a different field depending on wether it's an AsyncGenerator Await resume, or an ordinary resume. Also modifies whether debug code will assert that the generator object is a JSGeneratorObject or a JSAsyncGeneratorObject depending on the resume type. BUG=v8:5855 R=bmeurer@chromium.org, rmcilroy@chromium.org, jgruber@chromium.org, littledan@chromium.org, neis@chromium.org TBR=marja@chromium.org Change-Id: I9d58df1d344465fc937fe7eed322424204497187 Reviewed-on: https://chromium-review.googlesource.com/446961 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#44240}
-
bmeurer authored
Now that Ignition has the dedicated TestTypeOf operator, there's not really a point in doing the typeof with abstract/strict equal combining in TurboFan anymore. In fact it's counter-productive to do so, as it might try to cover typeof comparisons in cases where it's better to just compute the typeof once, i.e.: let x = typeof a, y = typeof b; if (x === y) { if (x === 'string') { ... } } Here we would combine the second comparison into an ObjectIsString, and still compute the typeof a. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2780953003 Cr-Commit-Position: refs/heads/master@{#44220}
-
- 20 Mar, 2017 1 commit
-
-
bmeurer authored
Don't ignore IfException (and IfSuccess) projections on JSForInNext nodes during JSTypedLowering::ReduceJSForInNext, but instead rewrire the IfException projection to the ForInFilter stub call, which can throw exceptions in case of proxies. R=yangguo@chromium.org BUG=v8:6121 Review-Url: https://codereview.chromium.org/2761703002 Cr-Commit-Position: refs/heads/master@{#43925}
-
- 15 Mar, 2017 2 commits
-
-
Michael Starzinger authored
This handles non-strict equality comparison operations having number feedback during the early type-hint lowering (i.e. during graph construction). R=jarin@chromium.org Change-Id: I1db67e78312934bbb20aee775979797420ff2581 Reviewed-on: https://chromium-review.googlesource.com/455796Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43824}
-
Michael Starzinger authored
This changes the IR to no longer require single {IfSuccess} projection nodes unless there is a corresponding {IfException} node that links the potentially throwing call to an exception handler. This reduces graph size as well as compilation time when exception handlers aren't present. The new invariant for potentially throwing nodes is: Nodes that can potentially throw either have both IfSuccess/IfException projections as the only control uses and no direct control uses, or no projections at all and solely direct control uses. R=jarin@chromium.org Change-Id: I3d9cd816d74ad5af13e0673da7ec7a98f1ecdc7e Reviewed-on: https://chromium-review.googlesource.com/449715 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#43814}
-
- 14 Mar, 2017 1 commit
-
-
Ross McIlroy authored
Used by ReduceJSEqualTypeOf, and will also be used to lower a new TestTypeof bytecode in a followup CL. BUG=v8:5267 Change-Id: I990aa6ac8ac0b9bd01080dda1764c5bfe3a4d7cf Reviewed-on: https://chromium-review.googlesource.com/454797Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#43802}
-
- 07 Mar, 2017 1 commit
-
-
Michael Starzinger authored
The parser already changes all negative equality comparison operations to their positive pendants in {ParserBase::ParseBinaryExpression}. No other source of the Token::NE exists in the system. We can remove all handling from the compiler and interpreter backends. R=bmeurer@chromium.org Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10 Reviewed-on: https://chromium-review.googlesource.com/449716Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43627}
-
- 03 Mar, 2017 2 commits
-
-
bmeurer authored
We don't need the JSStrictNotEqual operator in the compiler, because this is never generated by the BytecodeGraphBuilder, and the code in the AstGraphBuilder was dead code. Also remove the backing builtin StrictNotEqual. R=mstarzinger@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2727003006 Cr-Commit-Position: refs/heads/master@{#43594}
-
bmeurer authored
We can compile a !== a and Number.isNaN(a) to ObjectIsNaN. The former is commonly used to check for NaN, i.e. in case of equals in AngularJS. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2722483003 Cr-Commit-Position: refs/heads/master@{#43572}
-
- 28 Feb, 2017 1 commit
-
-
Michael Starzinger authored
This handles relational comparison operations (no equality yet) having number feedback during the early type-hint lowering (i.e. during graph construction). R=jarin@chromium.org Change-Id: Ia276d1d7c5931f1e92f31e4e24c181d82d48a138 Reviewed-on: https://chromium-review.googlesource.com/446762Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43471}
-
- 27 Feb, 2017 1 commit
-
-
Michael Starzinger authored
Nodes having the {Throw} operator are just used as terminators for control-flow leaving the function body with an exception completion, they turn into basic-block terminators within the schedule. Actually raising an exception is done solely via runtime calls. Hence {Throw} nodes no longer need any value input. R=bmeurer@chromium.org Change-Id: Id6d8e46b12c4b84f4e7a8ac96623c8efb1f27b26 Reviewed-on: https://chromium-review.googlesource.com/446501 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#43445}
-
- 23 Feb, 2017 1 commit
-
-
Marja Hölttä authored
BUG=v8:5294 Change-Id: If45f25aae8de526027b7851cb4efe0ccf4a7c4b1 Reviewed-on: https://chromium-review.googlesource.com/444226 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43388}
-
- 22 Feb, 2017 2 commits
-
-
Michael Starzinger authored
This reverts commit 14de196a. Reason for revert: Tanks Mandreel, fix is in flight, but we want a stable baseline first. Will reland again next week. Original change's description: > [turbofan] Handle comparison operations in early lowering. > > This handles relational comparison operations (no equality yet) having > number feedback during the early type-hint lowering (i.e. during graph > construction). > > R=bmeurer@chromium.org > > Change-Id: I0ac1539f85de1770c3d518855754550932f6fcd3 > Reviewed-on: https://chromium-review.googlesource.com/445716 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#43365} TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org,rmcilroy@chromium.org,v8-reviews@googlegroups.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Change-Id: I103d976c9b9b73ca67af6f6a32ea47a52d04c123 Reviewed-on: https://chromium-review.googlesource.com/446358Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43375}
-
Michael Starzinger authored
This handles relational comparison operations (no equality yet) having number feedback during the early type-hint lowering (i.e. during graph construction). R=bmeurer@chromium.org Change-Id: I0ac1539f85de1770c3d518855754550932f6fcd3 Reviewed-on: https://chromium-review.googlesource.com/445716Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43365}
-
- 20 Feb, 2017 2 commits
-
-
Michael Starzinger authored
This reverts commit f967d3e9. Reason for revert: Tanks Mandreel again. Needs investigation. Original change's description: > [turbofan] Handle comparison operations in early lowering. > > This handles comparison operations (equality and relational) having > number feedback during the early type-hint lowering (i.e. during graph > construction). > > R=bmeurer@chromium.org > > Change-Id: I97afd6c0d78a790ce38b731f2532ca18d812a32c > Reviewed-on: https://chromium-review.googlesource.com/444766 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#43315} TBR=mstarzinger@chromium.org,bmeurer@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Change-Id: Iec335827fe841ac6f1bd45ce095d0a741b2ff5b5 Reviewed-on: https://chromium-review.googlesource.com/445177Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43326}
-
Michael Starzinger authored
This handles comparison operations (equality and relational) having number feedback during the early type-hint lowering (i.e. during graph construction). R=bmeurer@chromium.org Change-Id: I97afd6c0d78a790ce38b731f2532ca18d812a32c Reviewed-on: https://chromium-review.googlesource.com/444766Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43315}
-
- 18 Feb, 2017 1 commit
-
-
vabr authored
Currently, typeof o, where o is an undetectable callable object (such as document.all), returns 'function' if optimised. It should, however, return 'undefined'. This CL excludes undetectable objects from the optimization resulting in type 'function' and renames the related code to reflect that. BUG=v8:5972 R=bmeurer@chromium.org Review-Url: https://codereview.chromium.org/2697063002 Cr-Commit-Position: refs/heads/master@{#43298}
-
- 16 Feb, 2017 1 commit
-
-
neis authored
The SpeculativeNumberOp helper lives now in js-type-hint-lowering.cc and is no longer needed in js-typed-lowering.cc. R=mstarzinger@chromium.org BUG= Review-Url: https://codereview.chromium.org/2701643002 Cr-Commit-Position: refs/heads/master@{#43248}
-