- 27 May, 2016 1 commit
-
-
mvstanton authored
We get less "pollution" of type feedback if we have one vector per native context, rather than one for the whole system. This CL moves the vector appropriately. BUG= Review-Url: https://codereview.chromium.org/1906823002 Cr-Commit-Position: refs/heads/master@{#36539}
-
- 23 May, 2016 1 commit
-
-
neis authored
Also use the inlined version of CreateIterResultObject in Ignition's VisitYield. BUG=v8:4907 TBR=littledan@chromium.org Review-Url: https://codereview.chromium.org/2006613002 Cr-Commit-Position: refs/heads/master@{#36444}
-
- 20 May, 2016 1 commit
-
-
neis authored
Introduce three new JS operators in Turbofan: - JSGeneratorStore is used in implementing Ignition's SuspendGenerator bytecode. - JSGeneratorRestoreContinuation and JSGeneratorRestoreRegister are used in implementing Ignition's ResumeGenerator bytecode. Remove the runtime functions that were used to implement these bytecodes before. BUG=v8:4907 Review-Url: https://codereview.chromium.org/1991203002 Cr-Commit-Position: refs/heads/master@{#36395}
-
- 03 May, 2016 3 commits
-
-
mlippautz authored
Reland of [turbofan] Restore basic write barrier elimination. (patchset #1 id:1 of https://codereview.chromium.org/1943743003/ ) Reason for revert: Jakob found the actual issue with the CL and is going to land the fix after relanding the WB elimination. Original issue's description: > Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ ) > > Reason for revert: > Breaks WBs that should be there ;) > > https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305 > > Will open repro bug asap. > > Original issue's description: > > [turbofan] Restore basic write barrier elimination. > > > > Restore the basic write barrier elimination that we used to run as part > > of the simplified lowering phase (in ChangeLowering actually) before, by > > moving the write barrier computation to SimplifiedLowering where we can > > still look at types and consider the heap/isolate, and just update the > > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when > > lowering to a machine Load/Store. > > > > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel > > R=mstarzinger@chromium.org > > BUG=v8:4969,chromium:608636 > > LOG=n > > > > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62 > > Cr-Commit-Position: refs/heads/master@{#35969} > > TBR=mstarzinger@chromium.org,bmeurer@chromium.org > # Skipping CQ checks because original CL landed less than 1 days ago. > NOPRESUBMIT=true > NOTREECHECKS=true > NOTRY=true > BUG=v8:4969,chromium:608636 > > Committed: https://crrev.com/a782e93c617e728cded5ad878de11137a67891b7 > Cr-Commit-Position: refs/heads/master@{#35983} TBR=mstarzinger@chromium.org,bmeurer@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:4969,chromium:608636 Review-Url: https://codereview.chromium.org/1943323002 Cr-Commit-Position: refs/heads/master@{#35984}
-
mlippautz authored
Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ ) Reason for revert: Breaks WBs that should be there ;) https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305 Will open repro bug asap. Original issue's description: > [turbofan] Restore basic write barrier elimination. > > Restore the basic write barrier elimination that we used to run as part > of the simplified lowering phase (in ChangeLowering actually) before, by > moving the write barrier computation to SimplifiedLowering where we can > still look at types and consider the heap/isolate, and just update the > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when > lowering to a machine Load/Store. > > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel > R=mstarzinger@chromium.org > BUG=v8:4969,chromium:608636 > LOG=n > > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62 > Cr-Commit-Position: refs/heads/master@{#35969} TBR=mstarzinger@chromium.org,bmeurer@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:4969,chromium:608636 Review-Url: https://codereview.chromium.org/1943743003 Cr-Commit-Position: refs/heads/master@{#35983}
-
bmeurer authored
Restore the basic write barrier elimination that we used to run as part of the simplified lowering phase (in ChangeLowering actually) before, by moving the write barrier computation to SimplifiedLowering where we can still look at types and consider the heap/isolate, and just update the WriteBarrierKind in the FieldAccess/ElementAccess that we later use when lowering to a machine Load/Store. CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel R=mstarzinger@chromium.org BUG=v8:4969,chromium:608636 LOG=n Review-Url: https://codereview.chromium.org/1938993002 Cr-Commit-Position: refs/heads/master@{#35969}
-
- 14 Apr, 2016 1 commit
-
-
mstarzinger authored
This changes closure creation to lower to inline allocations when possible instead of going through the FastNewClosureStub. It allows us to leverage all advantages of inline allocations on closures. Note that it is only safe to embed the raw entry point of the compile lazy stub into the code, because that stub is immortal and immovable. R=mvstanton@chromium.org Review URL: https://codereview.chromium.org/1573153002 Cr-Commit-Position: refs/heads/master@{#35499}
-
- 05 Feb, 2016 1 commit
-
-
mvstanton authored
Revert of Type Feedback Vector lives in the closure (patchset #2 id:40001 of https://codereview.chromium.org/1668103002/ ) Reason for revert: Must revert for now due to chromium api natives issues. Original issue's description: > Type Feedback Vector lives in the closure > > (RELAND: the problem before was a missing write barrier for adding the code > entry to the new closure. It's been addressed with a new macro instruction > and test. The only change to this CL is the addition of two calls to > __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.) > > We get less "pollution" of type feedback if we have one vector per native > context, rather than one for the whole system. This CL moves the vector > appropriately. > > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The > vector actually lives in the first slot of the literals array (indeed there is > great commonality between those arrays, they can be thought of as the same > thing). So we make greater effort to ensure there is a valid literals array > after compilation. > > This meant, for performance reasons, that we needed to extend > FastNewClosureStub to support creating closures with literals. And ultimately, > it drove us to move the optimized code map lookup out of FastNewClosureStub > and into the compile lazy builtin. > > The heap change is trivial so I TBR Hannes for it... > Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too. > And Benedikt reviewed it as well. > > TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org > > BUG= > > Committed: https://crrev.com/bb31db3ad6de16f86a61f6c7bbfd3274e3d957b5 > Cr-Commit-Position: refs/heads/master@{#33741} TBR=bmeurer@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG= Review URL: https://codereview.chromium.org/1670813005 Cr-Commit-Position: refs/heads/master@{#33766}
-
- 04 Feb, 2016 1 commit
-
-
mvstanton authored
(RELAND: the problem before was a missing write barrier for adding the code entry to the new closure. It's been addressed with a new macro instruction and test. The only change to this CL is the addition of two calls to __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.) We get less "pollution" of type feedback if we have one vector per native context, rather than one for the whole system. This CL moves the vector appropriately. We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The vector actually lives in the first slot of the literals array (indeed there is great commonality between those arrays, they can be thought of as the same thing). So we make greater effort to ensure there is a valid literals array after compilation. This meant, for performance reasons, that we needed to extend FastNewClosureStub to support creating closures with literals. And ultimately, it drove us to move the optimized code map lookup out of FastNewClosureStub and into the compile lazy builtin. The heap change is trivial so I TBR Hannes for it... Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too. And Benedikt reviewed it as well. TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org BUG= Review URL: https://codereview.chromium.org/1668103002 Cr-Commit-Position: refs/heads/master@{#33741}
-
- 27 Jan, 2016 2 commits
-
-
mvstanton authored
Revert of Type Feedback Vector lives in the closure (patchset #2 id:20001 of https://codereview.chromium.org/1642613002/ ) Reason for revert: Bug: failing to use write barrier when writing code entry into closure. Original issue's description: > Reland of Type Feedback Vector lives in the closure > > (Fixed a bug found by nosnap builds.) > > We get less "pollution" of type feedback if we have one vector per native > context, rather than one for the whole system. This CL moves the vector > appropriately. > > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The > vector actually lives in the first slot of the literals array (indeed there is > great commonality between those arrays, they can be thought of as the same > thing). So we make greater effort to ensure there is a valid literals array > after compilation. > > This meant, for performance reasons, that we needed to extend > FastNewClosureStub to support creating closures with literals. And ultimately, > it drove us to move the optimized code map lookup out of FastNewClosureStub > and into the compile lazy builtin. > > The heap change is trivial so I TBR Hannes for it... > > TBR=hpayer@chromium.org > BUG= > > Committed: https://crrev.com/d984b3b0ce91e55800f5323b4bb32a06f8a5aab1 > Cr-Commit-Position: refs/heads/master@{#33548} TBR=bmeurer@chromium.org,yangguo@chromium.org # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG= Review URL: https://codereview.chromium.org/1643533003 Cr-Commit-Position: refs/heads/master@{#33556}
-
mvstanton authored
(Fixed a bug found by nosnap builds.) We get less "pollution" of type feedback if we have one vector per native context, rather than one for the whole system. This CL moves the vector appropriately. We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The vector actually lives in the first slot of the literals array (indeed there is great commonality between those arrays, they can be thought of as the same thing). So we make greater effort to ensure there is a valid literals array after compilation. This meant, for performance reasons, that we needed to extend FastNewClosureStub to support creating closures with literals. And ultimately, it drove us to move the optimized code map lookup out of FastNewClosureStub and into the compile lazy builtin. The heap change is trivial so I TBR Hannes for it... TBR=hpayer@chromium.org BUG= Review URL: https://codereview.chromium.org/1642613002 Cr-Commit-Position: refs/heads/master@{#33548}
-
- 26 Jan, 2016 2 commits
-
-
mvstanton authored
Revert of Type Feedback Vector lives in the closure (patchset #12 id:260001 of https://codereview.chromium.org/1563213002/ ) Reason for revert: FAilure on win32 bot, need to investigate webkit failures. Original issue's description: > Type Feedback Vector lives in the closure > > We get less "pollution" of type feedback if we have one vector per native > context, rather than one for the whole system. This CL moves the vector > appropriately. > > We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The > vector actually lives in the first slot of the literals array (indeed there is > great commonality between those arrays, they can be thought of as the same > thing). So we make greater effort to ensure there is a valid literals array > after compilation. > > This meant, for performance reasons, that we needed to extend > FastNewClosureStub to support creating closures with literals. And ultimately, > it drove us to move the optimized code map lookup out of FastNewClosureStub > and into the compile lazy builtin. > > The heap change is trivial so I TBR Hannes for it... > > TBR=hpayer@chromium.org > > BUG= > > Committed: https://crrev.com/a5200f7ed4d11c6b882fa667da7a1864226544b4 > Cr-Commit-Position: refs/heads/master@{#33518} TBR=bmeurer@chromium.org,akos.palfi@imgtec.com # Skipping CQ checks because original CL landed less than 1 days ago. NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG= Review URL: https://codereview.chromium.org/1632993003 Cr-Commit-Position: refs/heads/master@{#33520}
-
mvstanton authored
We get less "pollution" of type feedback if we have one vector per native context, rather than one for the whole system. This CL moves the vector appropriately. We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The vector actually lives in the first slot of the literals array (indeed there is great commonality between those arrays, they can be thought of as the same thing). So we make greater effort to ensure there is a valid literals array after compilation. This meant, for performance reasons, that we needed to extend FastNewClosureStub to support creating closures with literals. And ultimately, it drove us to move the optimized code map lookup out of FastNewClosureStub and into the compile lazy builtin. The heap change is trivial so I TBR Hannes for it... TBR=hpayer@chromium.org BUG= Review URL: https://codereview.chromium.org/1563213002 Cr-Commit-Position: refs/heads/master@{#33518}
-
- 16 Dec, 2015 2 commits
-
-
cbruni authored
We can no longer just walk the prototype chain without doing proper access-checks. When installing a proxy as the __proto__ of the global object we might accidentally end up invoking cross-realm code without access-checks (see proxies-cross-realm-ecxeption.js). Review URL: https://codereview.chromium.org/1521953002 Cr-Commit-Position: refs/heads/master@{#32903}
-
bmeurer authored
Introduce JSCreateIterResultObject operator, as a way to optimize the %_CreateIterResultObject intrinsic, which is used to provide uniform, non-polymorphic result objects for iterators (and generators). We cannot utilize the existing JSCreate operator here, because there's no constructor function for iterator result objects (as required by the spec). R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/1531753002 Cr-Commit-Position: refs/heads/master@{#32901}
-
- 11 Dec, 2015 1 commit
-
-
bmeurer authored
Remove unused obsolete %_StringGetStringLength intrinsic, and properly optimize the %_SubString, %_RegExpExec, %_RegExpFlags, %_RegExpSource and %_RegExpConstructResult intrinsics. Review URL: https://codereview.chromium.org/1516753006 Cr-Commit-Position: refs/heads/master@{#32782}
-
- 10 Dec, 2015 1 commit
-
-
mstarzinger authored
This is deprecating the ability of TurboFan to access FP-based slots via LoadField and StoreField nodes. The corresponding constructors for FieldAccess tuples are being removed. R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1512243003 Cr-Commit-Position: refs/heads/master@{#32760}
-
- 24 Nov, 2015 1 commit
-
-
bmeurer authored
Add support for using inline allocations for arrays in lowering of JSCreateArray when target equals new.target. Currently we are only concerend with the straight-forward Array() and Array(length) cases, but at some point TurboFan should also be able to support the more complex initializing cases. R=mvstanton@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1465203002 Cr-Commit-Position: refs/heads/master@{#32191}
-
- 18 Nov, 2015 2 commits
-
-
bmeurer authored
Retrieve the native context/global object from the Node being specialized in the JSNativeContextSpecialization and the JSGlobalObjectSpecialization classes. For this we introduce two new methods NodeProperties::GetSpecializationNativeContext and NodeProperties::GetSpecializationGlobalObject, which walk up the context chain and might in the end take the native context from the outermost activation (if native context specialization is enabled). This allows us to run the native context specialization pass as part of the inlining phase without hacking some of that into the JSInliner. Also refactor the NodeProperties::GetSpecializationContext method that was previously local to the JSContextSpecialization. Also refactor two other oddities in JSNativeContextSpecialization. R=jarin@chromium.org BUG=v8:4470, v8:4493 LOG=n Review URL: https://codereview.chromium.org/1451143005 Cr-Commit-Position: refs/heads/master@{#32076}
-
bmeurer authored
Lower access to byteOffset and byteLength getters on JSArrayBufferViews and to length on JSTypedArrays. This requires a check to see whether the backing JSArrayBuffer was neutered. R=mstarzinger@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1453653003 Cr-Commit-Position: refs/heads/master@{#32070}
-
- 17 Nov, 2015 1 commit
-
-
jarin authored
Review URL: https://codereview.chromium.org/1453103002 Cr-Commit-Position: refs/heads/master@{#32034}
-
- 12 Nov, 2015 1 commit
-
-
bmeurer authored
This adds initial support for fast inline allocations of JSObject instances. It currently has exactly the same limitations as Crankshaft. R=mstarzinger@chromium.org BUG=v8:4544 LOG=n Review URL: https://codereview.chromium.org/1441573004 Cr-Commit-Position: refs/heads/master@{#31957}
-
- 10 Nov, 2015 1 commit
-
-
sigurds authored
This patch extends the typed lowering with a specialized version of 'instanceof' that is used if the "class", i.e. the constructor function, is a known constant. Unittests check that replacement occurs as intended. Functional correctness is ensured by extensive unit tests covering instanceof already in the testsuite. TESTS=unittests/JSTypedLoweringTest.{JSInstanceOfSpecializationWithSmiCheck,JSInstanceOfSpecializationWithoutSmiCheck,JSInstanceOfNoSpecialization} Review URL: https://codereview.chromium.org/1407413014 Cr-Commit-Position: refs/heads/master@{#31916}
-
- 02 Nov, 2015 1 commit
-
-
yangguo authored
R=jkummerow@chromium.org, mstarzinger@chromium.org Review URL: https://codereview.chromium.org/1406113007 Cr-Commit-Position: refs/heads/master@{#31714}
-
- 30 Oct, 2015 1 commit
-
-
bmeurer authored
This introduces an AllocateMutableHeapNumberStub for the boxed double field case, where we need to allocate a box in case of a transitioning store first. We cannot use our inline allocations for this currently, because mutable HeapNumber objects have certain alignment constraints, and I don't want to mess up Allocate/AllocateInNewSpace eagerly. Also refactor the PropertyAccessInfoFactory slightly to split the long methods into simpler parts. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1419173007 Cr-Commit-Position: refs/heads/master@{#31695}
-
- 28 Oct, 2015 3 commits
-
-
bmeurer authored
Rename ZoneTypeCache to TypeCache and use a single shared (immutable) instance consistently to cache the most commonly used types. Also serves as a chokepoint for defining those types, so we don't repeat the definition (and possible bugs) in various places. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1409763004 Cr-Commit-Position: refs/heads/master@{#31631}
-
mstarzinger authored
This lowers JSCreateArguments nodes within inline (i.e. non-outermost) frames that create "mapped arguments objects" to inline allocations. The arguments count as well as each value is statically known and can be directly stored into the arguments object. Note that the object is still context-dependent and the map is loaded from the current context. The object size is not taken into account for now, we might want to limit it later though to keep code size bounded. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1403363004 Cr-Commit-Position: refs/heads/master@{#31619}
-
bmeurer authored
Typed lowering can lower JSConvertReceiver either based on the operator hints or the (statically) known receiver type. R=jarin@chromium.org BUG=chromium:548557, v8:4493, v8:4470 LOG=n Review URL: https://codereview.chromium.org/1426893002 Cr-Commit-Position: refs/heads/master@{#31618}
-
- 27 Oct, 2015 1 commit
-
-
bmeurer authored
Currently we still (mis)used some machine operators in typed lowering (namely Word32Or, Word32Xor and Word32And). But these operators are "polymorphic" in the signedness of their inputs and output, hence the representation selection (and thereby simplified lowering) was unable to figure out whether a bitwise operation that was seen would produce an unsigned or a signed result. If such nodes also have frame state uses, the only safe choice was float64, which was not only a lot less ideal, but also the main cause of the for-in related deoptimizer loops. Adding dedicated NumberBitwiseOr, NumberBitwiseAnd and NumberBitwiseXor simplified operators not only gives us precise (and correct) typing for the bitwise operations, but also allows us to actually verify the graph properly after typed lowering. Drive-by-fix: Remove the double-to-smi magic from the Deoptimizer, which is responsible for various deopt-loops in TurboFan, and is no longer needed with the addition of the NumberBitwise operators. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1422213002 Cr-Commit-Position: refs/heads/master@{#31594}
-
- 26 Oct, 2015 1 commit
-
-
mstarzinger authored
This lowers JSCreateArguments nodes within inline (i.e. non-outermost) frames that create "unmapped arguments objects" to inline allocations. The arguments count as well as each value is statically known and can be directly stored into the arguments object. Note that the object is still context-dependent and the map is loaded from the current context. The object size is not taken into account for now, we might want to limit it later though to keep code size bounded. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1412113004 Cr-Commit-Position: refs/heads/master@{#31550}
-
- 07 Oct, 2015 3 commits
-
-
bmeurer authored
Introduce a new JSGlobalSpecialization advanced reducer that runs during the initial inlining and context specialization, and specializes the graph to the globals of the native context. Currently we assume that we do not inline cross native context, but long-term we will grab the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the new global load/store ICs that are currently in the workings), and then this whole specialization will be fully compositional even across cross-context inlining. Note that we cannot really handle most of the stores to global object property cells because TurboFan doesn't have a mechanism to enforce certain representations. Also note that we cannot yet fully benefit from the type feedback collected on the global object property cells, because the type system cannot deal with maps in a reasonable way. CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel R=jarin@chromium.org BUG=v8:4470 LOG=n Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb Cr-Commit-Position: refs/heads/master@{#31139} Review URL: https://codereview.chromium.org/1387393002 Cr-Commit-Position: refs/heads/master@{#31148}
-
bmeurer authored
Revert of [turbofan] Add initial support for global specialization. (patchset #4 id:60001 of https://codereview.chromium.org/1387393002/ ) Reason for revert: Breaks GC stress: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1984/steps/Bisect%20c5528ac1.Retry/logs/regress-crbug-450960 Original issue's description: > [turbofan] Add initial support for global specialization. > > Introduce a new JSGlobalSpecialization advanced reducer that runs > during the initial inlining and context specialization, and specializes > the graph to the globals of the native context. Currently we assume > that we do not inline cross native context, but long-term we will grab > the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the > new global load/store ICs that are currently in the workings), and then > this whole specialization will be fully compositional even across > cross-context inlining. > > Note that we cannot really handle most of the stores to global object > property cells because TurboFan doesn't have a mechanism to enforce > certain representations. Also note that we cannot yet fully benefit > from the type feedback collected on the global object property cells, > because the type system cannot deal with maps in a reasonable way. > > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel > R=jarin@chromium.org > BUG=v8:4470 > LOG=n > > Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb > Cr-Commit-Position: refs/heads/master@{#31139} TBR=jarin@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:4470 Review URL: https://codereview.chromium.org/1390073004 Cr-Commit-Position: refs/heads/master@{#31144}
-
bmeurer authored
Introduce a new JSGlobalSpecialization advanced reducer that runs during the initial inlining and context specialization, and specializes the graph to the globals of the native context. Currently we assume that we do not inline cross native context, but long-term we will grab the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the new global load/store ICs that are currently in the workings), and then this whole specialization will be fully compositional even across cross-context inlining. Note that we cannot really handle most of the stores to global object property cells because TurboFan doesn't have a mechanism to enforce certain representations. Also note that we cannot yet fully benefit from the type feedback collected on the global object property cells, because the type system cannot deal with maps in a reasonable way. CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1387393002 Cr-Commit-Position: refs/heads/master@{#31139}
-
- 03 Sep, 2015 1 commit
-
-
neis authored
BUG= Review URL: https://codereview.chromium.org/1312893010 Cr-Commit-Position: refs/heads/master@{#30559}
-
- 28 Jul, 2015 1 commit
-
-
jochen authored
Original issue's description: > Remove ExternalArray, derived types, and element kinds > > BUG=v8:3996 > R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org > LOG=y > > Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c > Cr-Commit-Position: refs/heads/master@{#29872} BUG=v8:3996 R=bmeurer@chromium.org LOG=y Review URL: https://codereview.chromium.org/1262583002 Cr-Commit-Position: refs/heads/master@{#29893}
-
- 27 Jul, 2015 2 commits
-
-
machenbach authored
Revert of Remove ExternalArray, derived types, and element kinds (patchset #5 id:80001 of https://codereview.chromium.org/1254623002/) Reason for revert: [Sheriff] Breaks several layout tests, e.g.: http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/1067 Several output lines change from PASS to FAIL. If the changes are intended, please land a needsmanualrebaseline change in blink first. Original issue's description: > Remove ExternalArray, derived types, and element kinds > > BUG=v8:3996 > R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org > LOG=y > > Committed: https://crrev.com/607ef7c6009a24ebf195b4cab7b0b436c5afd21c > Cr-Commit-Position: refs/heads/master@{#29872} TBR=bmeurer@chromium.org,hpayer@chromium.org,jarin@chromium.org,mvstanton@chromium.org,jochen@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:3996 Review URL: https://codereview.chromium.org/1257223002 Cr-Commit-Position: refs/heads/master@{#29883}
-
jochen authored
BUG=v8:3996 R=jarin@chromium.org, mvstanton@chromium.org, bmeurer@chromium.org LOG=y Review URL: https://codereview.chromium.org/1254623002 Cr-Commit-Position: refs/heads/master@{#29872}
-
- 11 Jun, 2015 1 commit
-
-
mstarzinger authored
R=bmeurer@chromium.org Review URL: https://codereview.chromium.org/1178103002 Cr-Commit-Position: refs/heads/master@{#28940}
-
- 08 Jun, 2015 1 commit
-
-
Benedikt Meurer authored
This only introduces better typing and lowering for access to the value field. R=jarin@chromium.org Review URL: https://codereview.chromium.org/1169723002 Cr-Commit-Position: refs/heads/master@{#28836}
-
- 05 Jun, 2015 1 commit
-
-
danno authored
Only optimized for TF R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/1146963002 Cr-Commit-Position: refs/heads/master@{#28812}
-