- 19 Jul, 2017 1 commit
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
- 11 Jul, 2017 1 commit
-
-
Alexandre Talon authored
Each reducer now has a virtual reducer_name function, returning its name (the name of the class containing this reducer). This gets displayed when using the --trace_turbo_reduction flag. Also when using this flags more messages are displayed. Actually when a node is replaced in-place (which is called an update of the node), other reducers can still update it right after the in-place replacement. When a node is really replaced (not in-place), then we stop trying to apply reducers to it before we propagate the reduction through the relevant nodes. Before a message got printed only for the last reduction it went through. So in case a node was reduced in-place several times in a row, only the last update was printed, or none at all if after being reduced in-place it got reduced by being replaced by another node: only the non-in-place replacement was showed. Now each time an in-place reduction is applied to a node, a message gets printed. Bug: Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa Reviewed-on: https://chromium-review.googlesource.com/563365Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Alexandre Talon <alexandret@google.com> Cr-Commit-Position: refs/heads/master@{#46552}
-
- 21 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Adds typed lowering of JSStringConcat to ConsString allocation if the following conditions hold: - All concatinations will result in a ConsString of >= ConString::kMinLength - No concatinations will result in a empty string in the RHS unless there is a sequential string in the LHS. This also means JSStringConcat needs an eager checkpoint since it can deopt if throwing a RangeError when the string length protector is valid. BUG=v8:6243 Change-Id: I01ca79f884df467c10f2c032c72d51b5199c1a3c Reviewed-on: https://chromium-review.googlesource.com/526636 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46093}
-
- 19 Jun, 2017 1 commit
-
-
bmeurer authored
We need to constant-fold JSHasInPrototypeChain nodes early during inlining, otherwise we already miss a couple of optimization opportunities if we wait until after typing. This moves the constant-folding part of the JSHasInPrototypeChain lowering back to JSNativeContextSpecialization, where it was before the changes in https://codereview.chromium.org/2934893002 (part of JSOrdinaryHasInstance lowering back then). BUG=v8:5269,v8:5989,v8:6483,chromium:733158 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2943293002 Cr-Commit-Position: refs/heads/master@{#45989}
-
- 13 Jun, 2017 1 commit
-
-
bmeurer authored
Port the baseline implementation of Object.prototype.isPrototypeOf to the CodeStubAssembler, sharing the existing prototype chain lookup logic with the instanceof / OrdinaryHasInstance implementation. Based on that, do the same in TurboFan, introducing a new JSHasInPrototypeChain operator, which encapsulates the central prototype chain walk logic. This speeds up Object.prototype.isPrototypeOf by more than a factor of four, so that the code A.prototype.isPrototypeOf(a) is now performance-wise on par with a instanceof A for the case where A is a regular constructor function and a is an instance of A. Since instanceof does more than just the fundamental prototype chain lookup, it was discovered in Node core that O.p.isPrototypeOf would be a more appropriate alternative for certain sanity checks, since it's less vulnerable to monkey-patching. In addition, the Object builtin would also avoid the performance-cliff associated with instanceof (due to the Symbol.hasInstance hook), as for example hit by https://github.com/nodejs/node/pull/13403#issuecomment-305915874. The main blocker was the missing performance of isPrototypeOf, since it was still a JS builtin backed by a runtime call. This CL also adds more test coverage for the Object.prototype.isPrototypeOf builtin, especially when called from optimized code. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng BUG=v8:5269,v8:5989,v8:6483 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2934893002 Cr-Commit-Position: refs/heads/master@{#45925}
-
- 08 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Add the ability for the typer to track whether a string could be the empty string. This is needed for typed lowering of JSStringConcat since we can't create cons string chain with the empty string in arbitrary positions. The ToPrimitiveToString bytecode handler is modified to collect feedback on whether it has ever seen the empty string, which is used by SpeculativeToPrimitiveToString to ensure that the output is non-empty (or depot) which will subsiquently be used to enable inline cons-string creation for the JSStringConcat operator in typed lowering in a subsiquent CL. BUG=v8:6243 Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52 Reviewed-on: https://chromium-review.googlesource.com/522122 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#45786}
-
- 07 Jun, 2017 1 commit
-
-
Ross McIlroy authored
Adds support for lowering of ToPrimitiveToString and StringConcat bytecodes to the corresponding builtins. As part of this, moves the interpreter implementation of these operations into the appropriate builtin generators and add builtin support for them. Also adds TailCallRuntimeN operator to code-assembler which enables tail calling a runtime function when the arguments have already been pushed onto the stack. BUG=v8:6243 Change-Id: Id5c851bc42e4ff490d9a23a8990ae331c7eac73e Reviewed-on: https://chromium-review.googlesource.com/515362 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#45756}
-
- 18 May, 2017 2 commits
-
-
bmeurer authored
For additions like a+'' or ''+a where we have String feedback on the JSAdd, we can drop the concatenation and just check that a is a valid String already (via CheckString). BUG=v8:6259 R=petermarshall@chromium.org Review-Url: https://codereview.chromium.org/2894563002 Cr-Commit-Position: refs/heads/master@{#45395}
-
bmeurer authored
We already had an optimization to turn Function.prototype.apply with arguments object, i.e. function foo() { return bar.apply(this, arguments); } into a special operator JSCallForwardVarargs, which avoids the allocation and deconstruction of the arguments object, but just passes along the incoming parameters. We can do the same for rest parameters and spread calls/constructs, i.e. class A extends B { constructor(...args) { super(...args); } } or function foo(...args) { return bar(1, 2, 3, ...args); } where we basically pass along the parameters (plus maybe additional statically known parameters). For this, we introduce a new JSConstructForwardVarargs operator and generalize the CallForwardVarargs builtins that are backing this. BUG=v8:6407,v8:6278,v8:6344 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2890023004 Cr-Commit-Position: refs/heads/master@{#45388}
-
- 03 May, 2017 1 commit
-
-
neis authored
This is just a refactoring, no changes in behavior. BUG=v8:1569 Review-Url: https://codereview.chromium.org/2839623003 Cr-Commit-Position: refs/heads/master@{#45071}
-
- 07 Apr, 2017 1 commit
-
-
bmeurer authored
Add a dedicated operator for ToNumber(x) with feedback instead of translating to SpeculativeNumberMultiply(x,1), which allows us to treat the case where x is already a Number specially, ignoring the feedback on the operator. This recovers most of the regression in the crypto benchmark. BUG=chromium:709398,v8:6214,v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2802113003 Cr-Commit-Position: refs/heads/master@{#44484}
-
- 29 Mar, 2017 1 commit
-
-
bmeurer authored
Now that Ignition has the dedicated TestTypeOf operator, there's not really a point in doing the typeof with abstract/strict equal combining in TurboFan anymore. In fact it's counter-productive to do so, as it might try to cover typeof comparisons in cases where it's better to just compute the typeof once, i.e.: let x = typeof a, y = typeof b; if (x === y) { if (x === 'string') { ... } } Here we would combine the second comparison into an ObjectIsString, and still compute the typeof a. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2780953003 Cr-Commit-Position: refs/heads/master@{#44220}
-
- 07 Mar, 2017 1 commit
-
-
Michael Starzinger authored
The parser already changes all negative equality comparison operations to their positive pendants in {ParserBase::ParseBinaryExpression}. No other source of the Token::NE exists in the system. We can remove all handling from the compiler and interpreter backends. R=bmeurer@chromium.org Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10 Reviewed-on: https://chromium-review.googlesource.com/449716Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43627}
-
- 03 Mar, 2017 1 commit
-
-
bmeurer authored
We don't need the JSStrictNotEqual operator in the compiler, because this is never generated by the BytecodeGraphBuilder, and the code in the AstGraphBuilder was dead code. Also remove the backing builtin StrictNotEqual. R=mstarzinger@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2727003006 Cr-Commit-Position: refs/heads/master@{#43594}
-
- 28 Feb, 2017 1 commit
-
-
Michael Starzinger authored
This handles relational comparison operations (no equality yet) having number feedback during the early type-hint lowering (i.e. during graph construction). R=jarin@chromium.org Change-Id: Ia276d1d7c5931f1e92f31e4e24c181d82d48a138 Reviewed-on: https://chromium-review.googlesource.com/446762Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43471}
-
- 22 Feb, 2017 2 commits
-
-
Michael Starzinger authored
This reverts commit 14de196a. Reason for revert: Tanks Mandreel, fix is in flight, but we want a stable baseline first. Will reland again next week. Original change's description: > [turbofan] Handle comparison operations in early lowering. > > This handles relational comparison operations (no equality yet) having > number feedback during the early type-hint lowering (i.e. during graph > construction). > > R=bmeurer@chromium.org > > Change-Id: I0ac1539f85de1770c3d518855754550932f6fcd3 > Reviewed-on: https://chromium-review.googlesource.com/445716 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#43365} TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org,rmcilroy@chromium.org,v8-reviews@googlegroups.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Change-Id: I103d976c9b9b73ca67af6f6a32ea47a52d04c123 Reviewed-on: https://chromium-review.googlesource.com/446358Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43375}
-
Michael Starzinger authored
This handles relational comparison operations (no equality yet) having number feedback during the early type-hint lowering (i.e. during graph construction). R=bmeurer@chromium.org Change-Id: I0ac1539f85de1770c3d518855754550932f6fcd3 Reviewed-on: https://chromium-review.googlesource.com/445716Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43365}
-
- 20 Feb, 2017 2 commits
-
-
Michael Starzinger authored
This reverts commit f967d3e9. Reason for revert: Tanks Mandreel again. Needs investigation. Original change's description: > [turbofan] Handle comparison operations in early lowering. > > This handles comparison operations (equality and relational) having > number feedback during the early type-hint lowering (i.e. during graph > construction). > > R=bmeurer@chromium.org > > Change-Id: I97afd6c0d78a790ce38b731f2532ca18d812a32c > Reviewed-on: https://chromium-review.googlesource.com/444766 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#43315} TBR=mstarzinger@chromium.org,bmeurer@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true Change-Id: Iec335827fe841ac6f1bd45ce095d0a741b2ff5b5 Reviewed-on: https://chromium-review.googlesource.com/445177Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43326}
-
Michael Starzinger authored
This handles comparison operations (equality and relational) having number feedback during the early type-hint lowering (i.e. during graph construction). R=bmeurer@chromium.org Change-Id: I97afd6c0d78a790ce38b731f2532ca18d812a32c Reviewed-on: https://chromium-review.googlesource.com/444766Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43315}
-
- 16 Feb, 2017 1 commit
-
-
Michael Starzinger authored
This handles arithmetic addition operations during the early type-hint lowering (i.e. during graph construction). The string addition case is still handled by {JSTypedLowering} as it needs static type information. R=bmeurer@chromium.org Change-Id: I9df47dfc5bf7613c51f6d803ab43d5d3f6c21be8 Reviewed-on: https://chromium-review.googlesource.com/443185Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43235}
-
- 15 Feb, 2017 1 commit
-
-
Michael Starzinger authored
This handles all arithmetic binary operations except addition during the early type-hint lowering (i.e. during graph construction). We still use static type information to potentially further reduce the speculative operations down to pure operations during the typed lowering phase. R=bmeurer@chromium.org Change-Id: I8b93fd7c46ec8e5b81234a49624d503520c3d082 Reviewed-on: https://chromium-review.googlesource.com/443105Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43218}
-
- 09 Feb, 2017 1 commit
-
-
bmeurer authored
Since the empty string is canonical HeapObject now, we can use this fact to optimize - strict equality comparisons with the empty string to a simple ReferenceEqual operation, and - optimize ToBoolean to avoid instance type checks completely. Drive-by-fix: Allow InternalizedString for Type::HeapConstant in the type system. This is safe, since InternalizedStrings can be compared to other heap constants by reference (except for non-InternalizedStrings, which are excluded from the HeapConstant type). BUG=v8:5267 R=yangguo@chromium.org Review-Url: https://codereview.chromium.org/2681273002 Cr-Commit-Position: refs/heads/master@{#43050}
-
- 01 Feb, 2017 2 commits
-
-
petermarshall authored
Review-Url: https://codereview.chromium.org/2666783007 Cr-Commit-Position: refs/heads/master@{#42847}
-
petermarshall authored
Review-Url: https://codereview.chromium.org/2662263002 Cr-Commit-Position: refs/heads/master@{#42836}
-
- 26 Jan, 2017 1 commit
-
-
bmeurer authored
We turn a JSCallFunction node for f.apply(receiver, arguments) into a JSCallForwardVarargs node, when the arguments refers to the arguments of the outermost optimized code object, i.e. not an inlined arguments, and the apply method refers to Function.prototype.apply, and there's no other user of arguments except in frame states. We also replace the arguments node in the graph with a marker for the Deoptimizer similar to Crankshaft to make sure we don't materialize unused arguments just for the sake of deoptimization. We plan to replace this with a saner EscapeAnalysis based solution soon. R=jarin@chromium.org BUG=v8:5267,v8:5726 Review-Url: https://codereview.chromium.org/2655233002 Cr-Commit-Position: refs/heads/master@{#42680}
-
- 18 Jan, 2017 1 commit
-
-
bmeurer authored
Lower JSLoadMessage and JSStoreMessage in JSTypedLowering to allow for optimizations across try-catch, try-finally, for-of, destructuring, etc. BUG=v8:5448 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2641843002 Cr-Commit-Position: refs/heads/master@{#42453}
-
- 09 Jan, 2017 1 commit
-
-
bmeurer authored
If one input to JSStrictEqual/JSNotStrictEqual is Unique (except InternalizedString) or the hole, then we can turn that into a direct pointer comparison, as such values are only equal to exactly the same unique value. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2611363002 Cr-Commit-Position: refs/heads/master@{#42122}
-
- 18 Nov, 2016 1 commit
-
-
bmeurer authored
This is the TurboFan counterpart of http://crrev.com/2504263004, but it is a bit more involved, since in TurboFan we always inline the appropriate call to the @@hasInstance handler, and by that we can optimize a lot more patterns of instanceof than Crankshaft, and even yield fast instanceof for custom @@hasInstance handlers (which we can now properly inline as well). Also we now properly optimize Function.prototype[@@hasInstance], even if the right hand side of an instanceof doesn't have the Function.prototype as its direct prototype. For the baseline case, we still rely on the global protector cell, but we can address that in a follow-up as well, and make it more robust in general. TEST=mjsunit/compiler/instanceof BUG=v8:5640 R=yangguo@chromium.org Review-Url: https://codereview.chromium.org/2511223003 Cr-Commit-Position: refs/heads/master@{#41092}
-
- 11 Nov, 2016 1 commit
-
-
franzih authored
ToName conversion, i.e., ToPropertykey() is the identify for strings and symbols. BUG=v8:5623 Review-Url: https://codereview.chromium.org/2494073002 Cr-Commit-Position: refs/heads/master@{#40924}
-
- 10 Nov, 2016 1 commit
-
-
neis authored
With this CL, the bytecode graph builder no longer translates module loads/stores as runtime calls but in terms of two new JS operators. These are lowered in typed-lowering to a sequence of LoadField's. R=bmeurer@chromium.org CC=adamk@chromium.org BUG=v8:1569 Review-Url: https://codereview.chromium.org/2489863003 Cr-Commit-Position: refs/heads/master@{#40881}
-
- 17 Oct, 2016 1 commit
-
-
jochen authored
R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org BUG= CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe Review-Url: https://codereview.chromium.org/2416243002 Cr-Commit-Position: refs/heads/master@{#40350}
-
- 11 Oct, 2016 1 commit
-
-
mvstanton authored
We'll take expressions like typeof 'hello' and reduce it to 'string'. Neat! This CL moves the optimization to an explicit reduction in typed lowering that inserts a constant string, instead of relying on type matching. BUG= Review-Url: https://codereview.chromium.org/2411703002 Cr-Commit-Position: refs/heads/master@{#40175}
-
- 20 Sep, 2016 1 commit
-
-
bmeurer authored
Extract String feedback on Add operation and utilize to lower ConsString creation in JSTypedLowering when we know that a String addition will definitely result in the creation of a ConsString. Note that Crankshaft has to guard the potential length overflow of the resulting string with an eager deoptimization exit, while we can safely throw an exception in that case. Also note that the bytecode pipeline does not currently provide the String feedback for the addition, which has to be added. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2354853002 Cr-Commit-Position: refs/heads/master@{#39540}
-
- 29 Aug, 2016 2 commits
-
-
bmeurer authored
These JavaScript operators were special hacks to ensure that we always operate on Smis for the magic for-in index variable, but this never really worked in the OSR case, because the OsrValue for the index variable didn't have the proper information (that we have for the JSForInPrepare in the non-OSR case). Now that we have loop induction variable analysis and binary operation hints, we can just use JSLessThan and JSAdd instead with appropriate Smi hints, which handle the OSR case by inserting Smi checks (that are always true). Thanks to OSR deconstruction and loop peeling these Smi checks will be hoisted so they don't hurt the OSR case too much. Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since we have to lower it to JSLessThan to get the loop induction variable goodness. R=epertoso@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2289613002 Cr-Commit-Position: refs/heads/master@{#38968}
-
bmeurer authored
For asm.js we now have a dedicated AsmTyper, that uses it's own type system (which is tailored towards asm.js), and so we don't need the special asm.js types anymore in the TypeCache. This also moves the TypeCache into the src/compiler directory, because it doesn't make sense to use outside anyways. TBR=ahaas@chromium.org R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2289573002 Cr-Commit-Position: refs/heads/master@{#38964}
-
- 26 Aug, 2016 1 commit
-
-
bmeurer authored
Introduce a new TypedOptimization reducer that contains the type based optimization reduction steps, which are not (directly) related to lowering JavaScript operators based on types (which is what JSTypedLowering is supposed to do). This also addresses a chicken-and-egg problem that we see in the Octane/Mandreel benchmark where type based constant folding isn't applied to the numeric comparison operators introduced by the JSTypedLowering itself, and thus gives up to 10% speedup for the benchmark. BUG=v8:5267 Review-Url: https://codereview.chromium.org/2280673003 Cr-Commit-Position: refs/heads/master@{#38928}
-
- 25 Aug, 2016 1 commit
-
-
bmeurer authored
Try to narrow types of Phis further during JSTypedLowering, because lowering based on types might create further opportunities for improving the types. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2278903002 Cr-Commit-Position: refs/heads/master@{#38895}
-
- 18 Aug, 2016 1 commit
-
-
bmeurer authored
R=epertoso@chromium.org Review-Url: https://codereview.chromium.org/2259613003 Cr-Commit-Position: refs/heads/master@{#38705}
-
- 08 Aug, 2016 1 commit
-
-
bmeurer authored
Introduce a dedicated NumberOperationHint enum that represents the feedback we can use for speculative number operations. BUG=v8:4930 Review-Url: https://codereview.chromium.org/2220573002 Cr-Commit-Position: refs/heads/master@{#38411}
-
- 03 Aug, 2016 1 commit
-
-
mstarzinger authored
This removes the frame state input representing the before-state from nodes having any int32 bitwise operator. Lowering that inserts number conversions of the inputs has to be disabled when deoptimization is enabled, because the frame state layout is no longer known. R=epertoso@chromium.org BUG=v8:5021,v8:4746 Review-Url: https://codereview.chromium.org/2194383004 Cr-Commit-Position: refs/heads/master@{#38280}
-