1. 27 May, 2016 1 commit
  2. 23 May, 2016 1 commit
  3. 20 May, 2016 1 commit
  4. 03 May, 2016 3 commits
    • mlippautz's avatar
      Reland of [turbofan] Restore basic write barrier elimination. (patchset #1... · 95b8f3b0
      mlippautz authored
      Reland of [turbofan] Restore basic write barrier elimination. (patchset #1 id:1 of https://codereview.chromium.org/1943743003/ )
      
      Reason for revert:
      Jakob found the actual issue with the CL and is going to land the fix after relanding the WB elimination.
      
      Original issue's description:
      > Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )
      >
      > Reason for revert:
      > Breaks WBs that should be there ;)
      >
      > https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305
      >
      > Will open repro bug asap.
      >
      > Original issue's description:
      > > [turbofan] Restore basic write barrier elimination.
      > >
      > > Restore the basic write barrier elimination that we used to run as part
      > > of the simplified lowering phase (in ChangeLowering actually) before, by
      > > moving the write barrier computation to SimplifiedLowering where we can
      > > still look at types and consider the heap/isolate, and just update the
      > > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
      > > lowering to a machine Load/Store.
      > >
      > > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
      > > R=mstarzinger@chromium.org
      > > BUG=v8:4969,chromium:608636
      > > LOG=n
      > >
      > > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
      > > Cr-Commit-Position: refs/heads/master@{#35969}
      >
      > TBR=mstarzinger@chromium.org,bmeurer@chromium.org
      > # Skipping CQ checks because original CL landed less than 1 days ago.
      > NOPRESUBMIT=true
      > NOTREECHECKS=true
      > NOTRY=true
      > BUG=v8:4969,chromium:608636
      >
      > Committed: https://crrev.com/a782e93c617e728cded5ad878de11137a67891b7
      > Cr-Commit-Position: refs/heads/master@{#35983}
      
      TBR=mstarzinger@chromium.org,bmeurer@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=v8:4969,chromium:608636
      
      Review-Url: https://codereview.chromium.org/1943323002
      Cr-Commit-Position: refs/heads/master@{#35984}
      95b8f3b0
    • mlippautz's avatar
      Revert of [turbofan] Restore basic write barrier elimination. (patchset #2... · a782e93c
      mlippautz authored
      Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )
      
      Reason for revert:
      Breaks WBs that should be there ;)
      
      https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305
      
      Will open repro bug asap.
      
      Original issue's description:
      > [turbofan] Restore basic write barrier elimination.
      >
      > Restore the basic write barrier elimination that we used to run as part
      > of the simplified lowering phase (in ChangeLowering actually) before, by
      > moving the write barrier computation to SimplifiedLowering where we can
      > still look at types and consider the heap/isolate, and just update the
      > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
      > lowering to a machine Load/Store.
      >
      > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
      > R=mstarzinger@chromium.org
      > BUG=v8:4969,chromium:608636
      > LOG=n
      >
      > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
      > Cr-Commit-Position: refs/heads/master@{#35969}
      
      TBR=mstarzinger@chromium.org,bmeurer@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=v8:4969,chromium:608636
      
      Review-Url: https://codereview.chromium.org/1943743003
      Cr-Commit-Position: refs/heads/master@{#35983}
      a782e93c
    • bmeurer's avatar
      [turbofan] Restore basic write barrier elimination. · 7dcb6ad3
      bmeurer authored
      Restore the basic write barrier elimination that we used to run as part
      of the simplified lowering phase (in ChangeLowering actually) before, by
      moving the write barrier computation to SimplifiedLowering where we can
      still look at types and consider the heap/isolate, and just update the
      WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
      lowering to a machine Load/Store.
      
      CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
      R=mstarzinger@chromium.org
      BUG=v8:4969,chromium:608636
      LOG=n
      
      Review-Url: https://codereview.chromium.org/1938993002
      Cr-Commit-Position: refs/heads/master@{#35969}
      7dcb6ad3
  5. 14 Apr, 2016 1 commit
    • mstarzinger's avatar
      [turbofan] Use inline allocation for closures. · 43c7c76f
      mstarzinger authored
      This changes closure creation to lower to inline allocations when
      possible instead of going through the FastNewClosureStub. It allows us
      to leverage all advantages of inline allocations on closures. Note that
      it is only safe to embed the raw entry point of the compile lazy stub
      into the code, because that stub is immortal and immovable.
      
      R=mvstanton@chromium.org
      
      Review URL: https://codereview.chromium.org/1573153002
      
      Cr-Commit-Position: refs/heads/master@{#35499}
      43c7c76f
  6. 05 Feb, 2016 1 commit
    • mvstanton's avatar
      Revert of Type Feedback Vector lives in the closure (patchset #2 id:40001 of... · 3f36e658
      mvstanton authored
      Revert of Type Feedback Vector lives in the closure (patchset #2 id:40001 of https://codereview.chromium.org/1668103002/ )
      
      Reason for revert:
      Must revert for now due to chromium api natives issues.
      
      Original issue's description:
      > Type Feedback Vector lives in the closure
      >
      > (RELAND: the problem before was a missing write barrier for adding the code
      > entry to the new closure. It's been addressed with a new macro instruction
      > and test. The only change to this CL is the addition of two calls to
      > __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)
      >
      > We get less "pollution" of type feedback if we have one vector per native
      > context, rather than one for the whole system. This CL moves the vector
      > appropriately.
      >
      > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      > vector actually lives in the first slot of the literals array (indeed there is
      > great commonality between those arrays, they can be thought of as the same
      > thing). So we make greater effort to ensure there is a valid literals array
      > after compilation.
      >
      > This meant, for performance reasons, that we needed to extend
      > FastNewClosureStub to support creating closures with literals. And ultimately,
      > it drove us to move the optimized code map lookup out of FastNewClosureStub
      > and into the compile lazy builtin.
      >
      > The heap change is trivial so I TBR Hannes for it...
      > Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
      > And Benedikt reviewed it as well.
      >
      > TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org
      >
      > BUG=
      >
      > Committed: https://crrev.com/bb31db3ad6de16f86a61f6c7bbfd3274e3d957b5
      > Cr-Commit-Position: refs/heads/master@{#33741}
      
      TBR=bmeurer@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=
      
      Review URL: https://codereview.chromium.org/1670813005
      
      Cr-Commit-Position: refs/heads/master@{#33766}
      3f36e658
  7. 04 Feb, 2016 1 commit
    • mvstanton's avatar
      Type Feedback Vector lives in the closure · bb31db3a
      mvstanton authored
      (RELAND: the problem before was a missing write barrier for adding the code
      entry to the new closure. It's been addressed with a new macro instruction
      and test. The only change to this CL is the addition of two calls to
      __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)
      
      We get less "pollution" of type feedback if we have one vector per native
      context, rather than one for the whole system. This CL moves the vector
      appropriately.
      
      We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      vector actually lives in the first slot of the literals array (indeed there is
      great commonality between those arrays, they can be thought of as the same
      thing). So we make greater effort to ensure there is a valid literals array
      after compilation.
      
      This meant, for performance reasons, that we needed to extend
      FastNewClosureStub to support creating closures with literals. And ultimately,
      it drove us to move the optimized code map lookup out of FastNewClosureStub
      and into the compile lazy builtin.
      
      The heap change is trivial so I TBR Hannes for it...
      Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
      And Benedikt reviewed it as well.
      
      TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org
      
      BUG=
      
      Review URL: https://codereview.chromium.org/1668103002
      
      Cr-Commit-Position: refs/heads/master@{#33741}
      bb31db3a
  8. 27 Jan, 2016 2 commits
    • mvstanton's avatar
      Revert of Type Feedback Vector lives in the closure (patchset #2 id:20001 of... · a7027851
      mvstanton authored
      Revert of Type Feedback Vector lives in the closure (patchset #2 id:20001 of https://codereview.chromium.org/1642613002/ )
      
      Reason for revert:
      Bug: failing to use write barrier when writing code entry into closure.
      
      Original issue's description:
      > Reland of Type Feedback Vector lives in the closure
      >
      > (Fixed a bug found by nosnap builds.)
      >
      > We get less "pollution" of type feedback if we have one vector per native
      > context, rather than one for the whole system. This CL moves the vector
      > appropriately.
      >
      > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      > vector actually lives in the first slot of the literals array (indeed there is
      > great commonality between those arrays, they can be thought of as the same
      > thing). So we make greater effort to ensure there is a valid literals array
      > after compilation.
      >
      > This meant, for performance reasons, that we needed to extend
      > FastNewClosureStub to support creating closures with literals. And ultimately,
      > it drove us to move the optimized code map lookup out of FastNewClosureStub
      > and into the compile lazy builtin.
      >
      > The heap change is trivial so I TBR Hannes for it...
      >
      > TBR=hpayer@chromium.org
      > BUG=
      >
      > Committed: https://crrev.com/d984b3b0ce91e55800f5323b4bb32a06f8a5aab1
      > Cr-Commit-Position: refs/heads/master@{#33548}
      
      TBR=bmeurer@chromium.org,yangguo@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=
      
      Review URL: https://codereview.chromium.org/1643533003
      
      Cr-Commit-Position: refs/heads/master@{#33556}
      a7027851
    • mvstanton's avatar
      Reland of Type Feedback Vector lives in the closure · d984b3b0
      mvstanton authored
      (Fixed a bug found by nosnap builds.)
      
      We get less "pollution" of type feedback if we have one vector per native
      context, rather than one for the whole system. This CL moves the vector
      appropriately.
      
      We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      vector actually lives in the first slot of the literals array (indeed there is
      great commonality between those arrays, they can be thought of as the same
      thing). So we make greater effort to ensure there is a valid literals array
      after compilation.
      
      This meant, for performance reasons, that we needed to extend
      FastNewClosureStub to support creating closures with literals. And ultimately,
      it drove us to move the optimized code map lookup out of FastNewClosureStub
      and into the compile lazy builtin.
      
      The heap change is trivial so I TBR Hannes for it...
      
      TBR=hpayer@chromium.org
      BUG=
      
      Review URL: https://codereview.chromium.org/1642613002
      
      Cr-Commit-Position: refs/heads/master@{#33548}
      d984b3b0
  9. 26 Jan, 2016 2 commits
    • mvstanton's avatar
      Revert of Type Feedback Vector lives in the closure (patchset #12 id:260001 of... · e2e7dc32
      mvstanton authored
      Revert of Type Feedback Vector lives in the closure (patchset #12 id:260001 of https://codereview.chromium.org/1563213002/ )
      
      Reason for revert:
      FAilure on win32 bot, need to investigate webkit failures.
      
      Original issue's description:
      > Type Feedback Vector lives in the closure
      >
      > We get less "pollution" of type feedback if we have one vector per native
      > context, rather than one for the whole system. This CL moves the vector
      > appropriately.
      >
      > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      > vector actually lives in the first slot of the literals array (indeed there is
      > great commonality between those arrays, they can be thought of as the same
      > thing). So we make greater effort to ensure there is a valid literals array
      > after compilation.
      >
      > This meant, for performance reasons, that we needed to extend
      > FastNewClosureStub to support creating closures with literals. And ultimately,
      > it drove us to move the optimized code map lookup out of FastNewClosureStub
      > and into the compile lazy builtin.
      >
      > The heap change is trivial so I TBR Hannes for it...
      >
      > TBR=hpayer@chromium.org
      >
      > BUG=
      >
      > Committed: https://crrev.com/a5200f7ed4d11c6b882fa667da7a1864226544b4
      > Cr-Commit-Position: refs/heads/master@{#33518}
      
      TBR=bmeurer@chromium.org,akos.palfi@imgtec.com
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=
      
      Review URL: https://codereview.chromium.org/1632993003
      
      Cr-Commit-Position: refs/heads/master@{#33520}
      e2e7dc32
    • mvstanton's avatar
      Type Feedback Vector lives in the closure · a5200f7e
      mvstanton authored
      We get less "pollution" of type feedback if we have one vector per native
      context, rather than one for the whole system. This CL moves the vector
      appropriately.
      
      We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
      vector actually lives in the first slot of the literals array (indeed there is
      great commonality between those arrays, they can be thought of as the same
      thing). So we make greater effort to ensure there is a valid literals array
      after compilation.
      
      This meant, for performance reasons, that we needed to extend
      FastNewClosureStub to support creating closures with literals. And ultimately,
      it drove us to move the optimized code map lookup out of FastNewClosureStub
      and into the compile lazy builtin.
      
      The heap change is trivial so I TBR Hannes for it...
      
      TBR=hpayer@chromium.org
      
      BUG=
      
      Review URL: https://codereview.chromium.org/1563213002
      
      Cr-Commit-Position: refs/heads/master@{#33518}
      a5200f7e
  10. 16 Dec, 2015 2 commits
  11. 11 Dec, 2015 1 commit
  12. 10 Dec, 2015 1 commit
  13. 24 Nov, 2015 1 commit
    • bmeurer's avatar
      [turbofan] Initial support for inline allocations of arrays. · e3905047
      bmeurer authored
      Add support for using inline allocations for arrays in lowering of
      JSCreateArray when target equals new.target.  Currently we are only
      concerend with the straight-forward Array() and Array(length) cases,
      but at some point TurboFan should also be able to support the more
      complex initializing cases.
      
      R=mvstanton@chromium.org
      BUG=v8:4470
      LOG=n
      
      Review URL: https://codereview.chromium.org/1465203002
      
      Cr-Commit-Position: refs/heads/master@{#32191}
      e3905047
  14. 18 Nov, 2015 2 commits
    • bmeurer's avatar
      [turbofan] Decouple inlining and native context specialization. · 9b14e5bb
      bmeurer authored
      Retrieve the native context/global object from the Node being
      specialized in the JSNativeContextSpecialization and the
      JSGlobalObjectSpecialization classes. For this we introduce two
      new methods NodeProperties::GetSpecializationNativeContext and
      NodeProperties::GetSpecializationGlobalObject, which walk up
      the context chain and might in the end take the native context
      from the outermost activation (if native context specialization
      is enabled). This allows us to run the native context specialization
      pass as part of the inlining phase without hacking some of that into
      the JSInliner.
      
      Also refactor the NodeProperties::GetSpecializationContext method
      that was previously local to the JSContextSpecialization.
      
      Also refactor two other oddities in JSNativeContextSpecialization.
      
      R=jarin@chromium.org
      BUG=v8:4470, v8:4493
      LOG=n
      
      Review URL: https://codereview.chromium.org/1451143005
      
      Cr-Commit-Position: refs/heads/master@{#32076}
      9b14e5bb
    • bmeurer's avatar
      [turbofan] Add support for special JSArrayBufferView accessors. · 3e328bf2
      bmeurer authored
      Lower access to byteOffset and byteLength getters on JSArrayBufferViews
      and to length on JSTypedArrays. This requires a check to see whether the
      backing JSArrayBuffer was neutered.
      
      R=mstarzinger@chromium.org
      BUG=v8:4470
      LOG=n
      
      Review URL: https://codereview.chromium.org/1453653003
      
      Cr-Commit-Position: refs/heads/master@{#32070}
      3e328bf2
  15. 17 Nov, 2015 1 commit
  16. 12 Nov, 2015 1 commit
  17. 10 Nov, 2015 1 commit
    • sigurds's avatar
      [turbofan] Pseudo-inline 'instanceof' · 45787501
      sigurds authored
      This patch extends the typed lowering with a specialized version of 'instanceof' that is used if the "class", i.e. the constructor function, is a known constant.
      
      Unittests check that replacement occurs as intended. Functional correctness is ensured by extensive unit tests covering instanceof already in the testsuite.
      
      TESTS=unittests/JSTypedLoweringTest.{JSInstanceOfSpecializationWithSmiCheck,JSInstanceOfSpecializationWithoutSmiCheck,JSInstanceOfNoSpecialization}
      
      Review URL: https://codereview.chromium.org/1407413014
      
      Cr-Commit-Position: refs/heads/master@{#31916}
      45787501
  18. 02 Nov, 2015 1 commit
  19. 30 Oct, 2015 1 commit
    • bmeurer's avatar
      [turbofan] Add support for transitioning stores to double fields. · 17a65191
      bmeurer authored
      This introduces an AllocateMutableHeapNumberStub for the boxed double
      field case, where we need to allocate a box in case of a transitioning
      store first. We cannot use our inline allocations for this currently,
      because mutable HeapNumber objects have certain alignment constraints,
      and I don't want to mess up Allocate/AllocateInNewSpace eagerly.
      
      Also refactor the PropertyAccessInfoFactory slightly to split the long
      methods into simpler parts.
      
      R=jarin@chromium.org
      BUG=v8:4470
      LOG=n
      
      Review URL: https://codereview.chromium.org/1419173007
      
      Cr-Commit-Position: refs/heads/master@{#31695}
      17a65191
  20. 28 Oct, 2015 3 commits
  21. 27 Oct, 2015 1 commit
    • bmeurer's avatar
      [turbofan] Introduce simplified NumberBitwise{Or,Xor,And} operators. · d08f9045
      bmeurer authored
      Currently we still (mis)used some machine operators in typed lowering
      (namely Word32Or, Word32Xor and Word32And). But these operators are
      "polymorphic" in the signedness of their inputs and output, hence the
      representation selection (and thereby simplified lowering) was unable to
      figure out whether a bitwise operation that was seen would produce an
      unsigned or a signed result. If such nodes also have frame state uses,
      the only safe choice was float64, which was not only a lot less ideal,
      but also the main cause of the for-in related deoptimizer loops.
      
      Adding dedicated NumberBitwiseOr, NumberBitwiseAnd and NumberBitwiseXor
      simplified operators not only gives us precise (and correct) typing for
      the bitwise operations, but also allows us to actually verify the graph
      properly after typed lowering.
      
      Drive-by-fix: Remove the double-to-smi magic from the Deoptimizer, which
      is responsible for various deopt-loops in TurboFan, and is no longer
      needed with the addition of the NumberBitwise operators.
      
      R=jarin@chromium.org
      
      Review URL: https://codereview.chromium.org/1422213002
      
      Cr-Commit-Position: refs/heads/master@{#31594}
      d08f9045
  22. 26 Oct, 2015 1 commit
    • mstarzinger's avatar
      [turbofan] Lower unmapped arguments objects in inline frame. · 0af58d24
      mstarzinger authored
      This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
      frames that create "unmapped arguments objects" to inline allocations.
      
      The arguments count as well as each value is statically known and can be
      directly stored into the arguments object. Note that the object is still
      context-dependent and the map is loaded from the current context. The
      object size is not taken into account for now, we might want to limit it
      later though to keep code size bounded.
      
      R=jarin@chromium.org
      
      Review URL: https://codereview.chromium.org/1412113004
      
      Cr-Commit-Position: refs/heads/master@{#31550}
      0af58d24
  23. 07 Oct, 2015 3 commits
    • bmeurer's avatar
      [turbofan] Add initial support for global specialization. · e16dd13d
      bmeurer authored
      Introduce a new JSGlobalSpecialization advanced reducer that runs
      during the initial inlining and context specialization, and specializes
      the graph to the globals of the native context.  Currently we assume
      that we do not inline cross native context, but long-term we will grab
      the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
      new global load/store ICs that are currently in the workings), and then
      this whole specialization will be fully compositional even across
      cross-context inlining.
      
      Note that we cannot really handle most of the stores to global object
      property cells because TurboFan doesn't have a mechanism to enforce
      certain representations.  Also note that we cannot yet fully benefit
      from the type feedback collected on the global object property cells,
      because the type system cannot deal with maps in a reasonable way.
      
      CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
      R=jarin@chromium.org
      BUG=v8:4470
      LOG=n
      
      Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
      Cr-Commit-Position: refs/heads/master@{#31139}
      
      Review URL: https://codereview.chromium.org/1387393002
      
      Cr-Commit-Position: refs/heads/master@{#31148}
      e16dd13d
    • bmeurer's avatar
      Revert of [turbofan] Add initial support for global specialization. (patchset... · 84065c5f
      bmeurer authored
      Revert of [turbofan] Add initial support for global specialization. (patchset #4 id:60001 of https://codereview.chromium.org/1387393002/ )
      
      Reason for revert:
      Breaks GC stress: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1984/steps/Bisect%20c5528ac1.Retry/logs/regress-crbug-450960
      
      Original issue's description:
      > [turbofan] Add initial support for global specialization.
      >
      > Introduce a new JSGlobalSpecialization advanced reducer that runs
      > during the initial inlining and context specialization, and specializes
      > the graph to the globals of the native context.  Currently we assume
      > that we do not inline cross native context, but long-term we will grab
      > the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
      > new global load/store ICs that are currently in the workings), and then
      > this whole specialization will be fully compositional even across
      > cross-context inlining.
      >
      > Note that we cannot really handle most of the stores to global object
      > property cells because TurboFan doesn't have a mechanism to enforce
      > certain representations.  Also note that we cannot yet fully benefit
      > from the type feedback collected on the global object property cells,
      > because the type system cannot deal with maps in a reasonable way.
      >
      > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
      > R=jarin@chromium.org
      > BUG=v8:4470
      > LOG=n
      >
      > Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
      > Cr-Commit-Position: refs/heads/master@{#31139}
      
      TBR=jarin@chromium.org
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=v8:4470
      
      Review URL: https://codereview.chromium.org/1390073004
      
      Cr-Commit-Position: refs/heads/master@{#31144}
      84065c5f
    • bmeurer's avatar
      [turbofan] Add initial support for global specialization. · 6fbf7903
      bmeurer authored
      Introduce a new JSGlobalSpecialization advanced reducer that runs
      during the initial inlining and context specialization, and specializes
      the graph to the globals of the native context.  Currently we assume
      that we do not inline cross native context, but long-term we will grab
      the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
      new global load/store ICs that are currently in the workings), and then
      this whole specialization will be fully compositional even across
      cross-context inlining.
      
      Note that we cannot really handle most of the stores to global object
      property cells because TurboFan doesn't have a mechanism to enforce
      certain representations.  Also note that we cannot yet fully benefit
      from the type feedback collected on the global object property cells,
      because the type system cannot deal with maps in a reasonable way.
      
      CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
      R=jarin@chromium.org
      BUG=v8:4470
      LOG=n
      
      Review URL: https://codereview.chromium.org/1387393002
      
      Cr-Commit-Position: refs/heads/master@{#31139}
      6fbf7903
  24. 03 Sep, 2015 1 commit
  25. 28 Jul, 2015 1 commit
  26. 27 Jul, 2015 2 commits
  27. 11 Jun, 2015 1 commit
  28. 08 Jun, 2015 1 commit
  29. 05 Jun, 2015 1 commit