1. 19 Jul, 2017 1 commit
  2. 11 Jul, 2017 1 commit
    • Alexandre Talon's avatar
      [Turbofan] Enable reducers to report their name to make reducer tracing clearer · 7a75da34
      Alexandre Talon authored
      Each reducer now has a virtual reducer_name function, returning its name
      (the name of the class containing this reducer). This gets displayed when
      using the --trace_turbo_reduction flag. Also when using this flags more
      messages are displayed.
      
      Actually when a node is replaced in-place (which is called an update
      of the node), other reducers can still update it right after the
      in-place replacement. When a node is really replaced (not in-place),
      then we stop trying to apply reducers to it before we propagate the
      reduction through the relevant nodes.
      
      Before a message got printed only for the last reduction it went
      through. So in case a node was reduced in-place several times
      in a row, only the last update was printed, or none at all if after
      being reduced in-place it got reduced by being replaced by another
      node: only the non-in-place replacement was showed. 
      
      Now each time an in-place reduction is applied to a node, a message
      gets printed.
      
      Bug: 
      Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa
      Reviewed-on: https://chromium-review.googlesource.com/563365Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Commit-Queue: Alexandre Talon <alexandret@google.com>
      Cr-Commit-Position: refs/heads/master@{#46552}
      7a75da34
  3. 21 Jun, 2017 1 commit
  4. 19 Jun, 2017 1 commit
  5. 13 Jun, 2017 1 commit
    • bmeurer's avatar
      [builtins] Properly optimize Object.prototype.isPrototypeOf. · b11c557d
      bmeurer authored
      Port the baseline implementation of Object.prototype.isPrototypeOf to
      the CodeStubAssembler, sharing the existing prototype chain lookup logic
      with the instanceof / OrdinaryHasInstance implementation. Based on that,
      do the same in TurboFan, introducing a new JSHasInPrototypeChain
      operator, which encapsulates the central prototype chain walk logic.
      
      This speeds up Object.prototype.isPrototypeOf by more than a factor of
      four, so that the code
      
        A.prototype.isPrototypeOf(a)
      
      is now performance-wise on par with
      
        a instanceof A
      
      for the case where A is a regular constructor function and a is an
      instance of A.
      
      Since instanceof does more than just the fundamental prototype chain
      lookup, it was discovered in Node core that O.p.isPrototypeOf would
      be a more appropriate alternative for certain sanity checks, since
      it's less vulnerable to monkey-patching. In addition, the Object
      builtin would also avoid the performance-cliff associated with
      instanceof (due to the Symbol.hasInstance hook), as for example hit
      by https://github.com/nodejs/node/pull/13403#issuecomment-305915874.
      The main blocker was the missing performance of isPrototypeOf, since
      it was still a JS builtin backed by a runtime call.
      
      This CL also adds more test coverage for the
      Object.prototype.isPrototypeOf builtin, especially when called from
      optimized code.
      
      CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng
      BUG=v8:5269,v8:5989,v8:6483
      R=jgruber@chromium.org
      
      Review-Url: https://codereview.chromium.org/2934893002
      Cr-Commit-Position: refs/heads/master@{#45925}
      b11c557d
  6. 08 Jun, 2017 1 commit
    • Ross McIlroy's avatar
      [TurboFan] Add typing for the EmptyString and use this for JSToPrimitiveToString · 2c296b7e
      Ross McIlroy authored
      Add the ability for the typer to track whether a string could be the empty
      string. This is needed for typed lowering of JSStringConcat since we can't
      create cons string chain with the empty string in arbitrary positions.
      
      The ToPrimitiveToString bytecode handler is modified to collect feedback on
      whether it has ever seen the empty string, which is used by
      SpeculativeToPrimitiveToString to ensure that the output is non-empty (or
      depot) which will subsiquently be used to enable inline cons-string creation
      for the JSStringConcat operator in typed lowering in a subsiquent CL.
      
      BUG=v8:6243
      
      Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52
      Reviewed-on: https://chromium-review.googlesource.com/522122
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#45786}
      2c296b7e
  7. 07 Jun, 2017 1 commit
  8. 18 May, 2017 2 commits
    • bmeurer's avatar
      [turbofan] Eliminate empty string addition. · cd1325a8
      bmeurer authored
      For additions like a+'' or ''+a where we have String feedback on the
      JSAdd, we can drop the concatenation and just check that a is a valid
      String already (via CheckString).
      
      BUG=v8:6259
      R=petermarshall@chromium.org
      
      Review-Url: https://codereview.chromium.org/2894563002
      Cr-Commit-Position: refs/heads/master@{#45395}
      cd1325a8
    • bmeurer's avatar
      [turbofan] Avoid allocating rest parameters for spread calls. · bfa319e5
      bmeurer authored
      We already had an optimization to turn Function.prototype.apply with
      arguments object, i.e.
      
        function foo() { return bar.apply(this, arguments); }
      
      into a special operator JSCallForwardVarargs, which avoids the
      allocation and deconstruction of the arguments object, but just passes
      along the incoming parameters. We can do the same for rest parameters
      and spread calls/constructs, i.e.
      
        class A extends B {
          constructor(...args) { super(...args); }
        }
      
      or
      
        function foo(...args) { return bar(1, 2, 3, ...args); }
      
      where we basically pass along the parameters (plus maybe additional
      statically known parameters).
      
      For this, we introduce a new JSConstructForwardVarargs operator and
      generalize the CallForwardVarargs builtins that are backing this.
      
      BUG=v8:6407,v8:6278,v8:6344
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2890023004
      Cr-Commit-Position: refs/heads/master@{#45388}
      bfa319e5
  9. 03 May, 2017 1 commit
  10. 07 Apr, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Introduce a SpeculativeToNumber operator. · e6ca0146
      bmeurer authored
      Add a dedicated operator for ToNumber(x) with feedback instead of
      translating to SpeculativeNumberMultiply(x,1), which allows us to
      treat the case where x is already a Number specially, ignoring the
      feedback on the operator. This recovers most of the regression in
      the crypto benchmark.
      
      BUG=chromium:709398,v8:6214,v8:5267
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2802113003
      Cr-Commit-Position: refs/heads/master@{#44484}
      e6ca0146
  11. 29 Mar, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Remove typeof optimization from typed lowering. · 0554e36b
      bmeurer authored
      Now that Ignition has the dedicated TestTypeOf operator, there's not
      really a point in doing the typeof with abstract/strict equal combining
      in TurboFan anymore. In fact it's counter-productive to do so, as it
      might try to cover typeof comparisons in cases where it's better to just
      compute the typeof once, i.e.:
      
        let x = typeof a, y = typeof b;
        if (x === y) {
          if (x === 'string') {
            ...
          }
        }
      
      Here we would combine the second comparison into an ObjectIsString, and
      still compute the typeof a.
      
      R=jarin@chromium.org
      BUG=v8:5267
      
      Review-Url: https://codereview.chromium.org/2780953003
      Cr-Commit-Position: refs/heads/master@{#44220}
      0554e36b
  12. 07 Mar, 2017 1 commit
  13. 03 Mar, 2017 1 commit
  14. 28 Feb, 2017 1 commit
  15. 22 Feb, 2017 2 commits
  16. 20 Feb, 2017 2 commits
  17. 16 Feb, 2017 1 commit
  18. 15 Feb, 2017 1 commit
  19. 09 Feb, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Utilize the fact that empty string is canonicalized. · cd9724d4
      bmeurer authored
      Since the empty string is canonical HeapObject now, we can use
      this fact to optimize
      
        - strict equality comparisons with the empty string to a
          simple ReferenceEqual operation, and
        - optimize ToBoolean to avoid instance type checks completely.
      
      Drive-by-fix: Allow InternalizedString for Type::HeapConstant
      in the type system. This is safe, since InternalizedStrings
      can be compared to other heap constants by reference (except
      for non-InternalizedStrings, which are excluded from the
      HeapConstant type).
      
      BUG=v8:5267
      R=yangguo@chromium.org
      
      Review-Url: https://codereview.chromium.org/2681273002
      Cr-Commit-Position: refs/heads/master@{#43050}
      cd9724d4
  20. 01 Feb, 2017 2 commits
  21. 26 Jan, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Introduce JSCallForwardVarargs operator. · 69747e26
      bmeurer authored
      We turn a JSCallFunction node for
      
        f.apply(receiver, arguments)
      
      into a JSCallForwardVarargs node, when the arguments refers to the
      arguments of the outermost optimized code object, i.e. not an inlined
      arguments, and the apply method refers to Function.prototype.apply,
      and there's no other user of arguments except in frame states.
      
      We also replace the arguments node in the graph with a marker for
      the Deoptimizer similar to Crankshaft to make sure we don't materialize
      unused arguments just for the sake of deoptimization. We plan to replace
      this with a saner EscapeAnalysis based solution soon.
      
      R=jarin@chromium.org
      BUG=v8:5267,v8:5726
      
      Review-Url: https://codereview.chromium.org/2655233002
      Cr-Commit-Position: refs/heads/master@{#42680}
      69747e26
  22. 18 Jan, 2017 1 commit
  23. 09 Jan, 2017 1 commit
  24. 18 Nov, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Properly optimize instanceof (even in the presence of @@hasInstance). · 241c024c
      bmeurer authored
      This is the TurboFan counterpart of http://crrev.com/2504263004, but it
      is a bit more involved, since in TurboFan we always inline the appropriate
      call to the @@hasInstance handler, and by that we can optimize a lot more
      patterns of instanceof than Crankshaft, and even yield fast instanceof
      for custom @@hasInstance handlers (which we can now properly inline as
      well).
      
      Also we now properly optimize Function.prototype[@@hasInstance], even if
      the right hand side of an instanceof doesn't have the Function.prototype
      as its direct prototype.
      
      For the baseline case, we still rely on the global protector cell, but
      we can address that in a follow-up as well, and make it more robust in
      general.
      
      TEST=mjsunit/compiler/instanceof
      BUG=v8:5640
      R=yangguo@chromium.org
      
      Review-Url: https://codereview.chromium.org/2511223003
      Cr-Commit-Position: refs/heads/master@{#41092}
      241c024c
  25. 11 Nov, 2016 1 commit
  26. 10 Nov, 2016 1 commit
  27. 17 Oct, 2016 1 commit
  28. 11 Oct, 2016 1 commit
  29. 20 Sep, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Lower ConsString creation in JSTypedLowering. · 29dd7fc5
      bmeurer authored
      Extract String feedback on Add operation and utilize to lower ConsString
      creation in JSTypedLowering when we know that a String addition will
      definitely result in the creation of a ConsString.
      
      Note that Crankshaft has to guard the potential length overflow of the
      resulting string with an eager deoptimization exit, while we can safely
      throw an exception in that case.
      
      Also note that the bytecode pipeline does not currently provide the
      String feedback for the addition, which has to be added.
      
      BUG=v8:5267
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2354853002
      Cr-Commit-Position: refs/heads/master@{#39540}
      29dd7fc5
  30. 29 Aug, 2016 2 commits
    • bmeurer's avatar
      [turbofan] Remove special JSForInStep and JSForInDone. · 1915762c
      bmeurer authored
      These JavaScript operators were special hacks to ensure that we always
      operate on Smis for the magic for-in index variable, but this never
      really worked in the OSR case, because the OsrValue for the index
      variable didn't have the proper information (that we have for the
      JSForInPrepare in the non-OSR case).
      
      Now that we have loop induction variable analysis and binary operation
      hints, we can just use JSLessThan and JSAdd instead with appropriate
      Smi hints, which handle the OSR case by inserting Smi checks (that are
      always true). Thanks to OSR deconstruction and loop peeling these Smi
      checks will be hoisted so they don't hurt the OSR case too much.
      
      Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
      we have to lower it to JSLessThan to get the loop induction variable
      goodness.
      
      R=epertoso@chromium.org
      BUG=v8:5267
      
      Review-Url: https://codereview.chromium.org/2289613002
      Cr-Commit-Position: refs/heads/master@{#38968}
      1915762c
    • bmeurer's avatar
      [turbofan] Remove the unused asm.js types from TypeCache. · f5a37d13
      bmeurer authored
      For asm.js we now have a dedicated AsmTyper, that uses it's own type
      system (which is tailored towards asm.js), and so we don't need the
      special asm.js types anymore in the TypeCache. This also moves the
      TypeCache into the src/compiler directory, because it doesn't make
      sense to use outside anyways.
      
      TBR=ahaas@chromium.org
      R=jarin@chromium.org
      BUG=v8:5267
      
      Review-Url: https://codereview.chromium.org/2289573002
      Cr-Commit-Position: refs/heads/master@{#38964}
      f5a37d13
  31. 26 Aug, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Separate typed optimizations from JSTypedLowering. · f154c75a
      bmeurer authored
      Introduce a new TypedOptimization reducer that contains the type
      based optimization reduction steps, which are not (directly)
      related to lowering JavaScript operators based on types (which is
      what JSTypedLowering is supposed to do).
      
      This also addresses a chicken-and-egg problem that we see in the
      Octane/Mandreel benchmark where type based constant folding isn't
      applied to the numeric comparison operators introduced by the
      JSTypedLowering itself, and thus gives up to 10% speedup for the
      benchmark.
      
      BUG=v8:5267
      
      Review-Url: https://codereview.chromium.org/2280673003
      Cr-Commit-Position: refs/heads/master@{#38928}
      f154c75a
  32. 25 Aug, 2016 1 commit
  33. 18 Aug, 2016 1 commit
  34. 08 Aug, 2016 1 commit
  35. 03 Aug, 2016 1 commit