- 11 Sep, 2018 2 commits
-
-
Caitlin Potter authored
The CSA implementation is a separate handler so that TF has the opportunity to reduce to a direct call, skipping some of the dispatching in the CloneObjectIC stub. This patch moves the looping over a source object's keys and values into the base CodeStubAssembler, so that it can be shared between ObjectAssignFast and CloneObjectIC_Slow. During each step of the loop, storing is delegated to a new SetPropertyInLiteral helper in KeyedStoreGenericGenerator, which performs a store without consulting the prototype chain, and automatically reconfigures accessors into data properties regardless of their attributes. BUG=v8:8067, v8:7611 R=ishell@chromium.org, jkummerow@chromium.org Change-Id: I06ae89f37e9b4265aab67389cf68a96529f90578 Reviewed-on: https://chromium-review.googlesource.com/1182122 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#55806}
-
Benedikt Meurer authored
We had an optimization in Crankshaft where we would call into the megamorphic handler stub directly if an inline cache was already found to be megamorphic when it hit the optimizing compiler. This way we could avoid the dispatch overhead when we know that there's no point in checking for the other states anyways. However we somehow missed to port this optimization to TurboFan. Now this change introduces support to call into LoadIC_Megamorphic and KeyedLoadIC_Megamorphic directly (plus the trampoline versions), which saves quite a lot of overhead for the cases where the map/name pair is found in the megamorphic stub cache, and it's quite a simple change. We can later extend this to also handle the StoreIC and KeyedStoreIC cases if that turns out to be beneficial. This improves the score on the Octane/TypeScript test by around ~2% and the TypeScript test in the web-tooling-benchmark by around ~4%. On the ARES-6 Air test the steady state mean improves by 2-4%, and on the ARES-6 ML test the steady state mean seems to also improve by 1-2%, but that might be within noise. On a micro-benchmark that just runs `o.x` in a hot loop on a set of 9 different objects, which all have `x` as the first property and are all in fast mode, we improve by around ~30%, and are now almost on par with JavaScriptCore. Bug: v8:6344, v8:6936 Change-Id: Iaa4c6e34c37e78da217ee75f32f6acc95a834250 Reviewed-on: https://chromium-review.googlesource.com/1215623Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55803}
-
- 20 Jul, 2018 1 commit
-
-
Caitlin Potter authored
As discussed in https://docs.google.com/document/d/1sBdGe8RHgeYP850cKSSgGABTyfMdvaEWLy-vertuTCo/edit?ts=5b3ba5cc#, this CL introduces a new bytecode (CloneObject), and a new IC type. In this prototype implementation, the type feedback looks like the following: Uninitialized case: { uninitialized_sentinel, uninitialized_sentinel } Monomorphic case: { weak 'source' map, strong 'result' map } Polymorphic case: { WeakFixedArray with { weak 'source' map, strong 'result' map }, cleared value } Megamorphic case: { megamorphic_sentinel, cleared_Value } In the fast case, Object cloning is done by allocating an object with the saved result map, and a shallow clone of the fast properties from the source object, as well as cloned fast elements from the source object. If at any point the fast case can't be taken, the IC transitions to the slow case and remains there. This prototype CL does not include any TurboFan optimization, and the CloneObject operation is merely reduced to a stub call. It may still be possible to get some further improvements by somehow incorporating compile-time boilerplate elements into the cloned object, or simplifying how the boilerplate elements are inserted into the object. In terms of performance, we improve the ObjectSpread score in JSTests/ObjectLiteralSpread/ by about 8x, with substantial improvements over the Babel and ObjectAssign scores. R=gsathya@chromium.org, mvstanton@chromium.org, rmcilroy@chromium.org, neis@chromium.org, bmeurer@chromium.org BUG=v8:7611 Change-Id: I79e1796eb77016fb4feba0e1d3bb9abb348c183e Reviewed-on: https://chromium-review.googlesource.com/1127472 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#54595}
-
- 11 Apr, 2018 1 commit
-
-
Igor Sheludko authored
Bug: v8:7570 Change-Id: I8b15d6e9f4991d0a6884277a5d67090f24270fcc Reviewed-on: https://chromium-review.googlesource.com/1005261Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#52549}
-
- 02 Mar, 2018 1 commit
-
-
Georg Neis authored
... and use it in the implementation of array literal spreads, replacing calls to %AppendElement. Array spreads in destructuring will be taken care of in a separate CL. Bug: v8:5940, v8:7446 Change-Id: Idec52398902a7fd3c1244852cf73246f142404f0 Reviewed-on: https://chromium-review.googlesource.com/915364 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#51709}
-
- 14 Dec, 2017 1 commit
-
-
Igor Sheludko authored
This CL also removes LoadICProtoArray* builtins which are no longer necessary. Bug: v8:7206, v8:5561 Change-Id: Ic5d9a3d4d21c4bd5e5e1cd110bd029ced157a000 Reviewed-on: https://chromium-review.googlesource.com/819252 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50104}
-
- 13 Dec, 2017 1 commit
-
-
Igor Sheludko authored
The dispatcher is responsible for handling stores to lexical environment variables and for storing directly to the JSGlobalObject. In the latter case the dispatcher also ensures that JSGlobalProxy is provided as a receiver if a setter function has to be called. Unlike StoreIC the calling convention for the StoreGlobalIC does not include receiver. Bug: v8:7206, chromium:576312, v8:5561 Change-Id: Ifa896c7b41bf440785b757c2272ec91211e79c98 Reviewed-on: https://chromium-review.googlesource.com/818965 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50081}
-
- 20 Oct, 2017 1 commit
-
-
Benedikt Meurer authored
In the special case of KeyedLoadIC, where the key that is passed in is a Name that is always the same we only checked for identity in both the stub and the TurboFan case, which works fine for symbols and internalized strings, but doesn't really work with non-internalized strings, where the identity check will fail, the runtime will internalize the string, and the IC will then see the original internalized string again and not progress in the feedback lattice. This leads to tricky deoptimization loops in TurboFan and constantly missing ICs. This adds fixes the stub to always try to internalize strings first when the identity check fails and then doing the check again. If the name is not found in the string table we miss, since in that case the string cannot match the previously recorded feedback name (which is always a unique name). In TurboFan we represent this checks with new CheckEqualsSymbol and CheckEqualsInternalizedString operators, which validate the previously recorded feedback, and the CheckEqualsInternalizedString operator does the attempt to internalize the input. Bug: v8:6936, v8:6948, v8:6969 Change-Id: I3f3b4a587c67f00f7c4b60d239eb98a9626fe04a Reviewed-on: https://chromium-review.googlesource.com/730224Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48784}
-
- 05 Sep, 2017 1 commit
-
-
Jakob Kummerow authored
Only the error cases of overwriting readonly properties need the language_mode to decide whether to throw or be silent. Reading it from the feedback vector's metadata (just like the C++ code in ic.cc does) removes the need to duplicate each stub for each language_mode ("StoreIC" + "StoreICStrict" etc.). Change-Id: Ic0c67f9d40ca36c65e41b4f162b2ab70d155e549 Reviewed-on: https://chromium-review.googlesource.com/647373Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#47836}
-
- 16 Mar, 2017 1 commit
-
-
jkummerow authored
This is in preparation for linking the former only into mksnapshot. Just shuffling code around, no changes in functionality. BUG=v8:6055 Review-Url: https://codereview.chromium.org/2752143004 Cr-Commit-Position: refs/heads/master@{#43858}
-
- 07 Mar, 2017 1 commit
-
-
jgruber authored
This inlines common LoadIC cases into the LdaNamedProperty bytecode handler. Smi handlers resulting in constant/field loads for monomorphic ICs omit frame construction. The same counts for the polymorphic case as long as the target handler is in the first two vector slots. Other cases (megamorphic, uninitialized) call the new LoadIC_Noninlined stub. Local benchmarks show up to 6% improvement on Sunspider with --future. BUG=v8:5917 Review-Url: https://codereview.chromium.org/2733563002 Cr-Commit-Position: refs/heads/master@{#43630}
-
- 02 Mar, 2017 1 commit
-
-
Igor Sheludko authored
... instead of inlining the dispatchers' code. This should reduce the size of the generated builtins code. BUG= Change-Id: Ia3f68ea8b398f049bad87f6ce93c818f0af4674f Reviewed-on: https://chromium-review.googlesource.com/447938Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#43542}
-
- 28 Feb, 2017 1 commit
-
-
jkummerow authored
Avoiding runtime call overhead. There's a fast path for Function.prototype loads, which are very common. BUG=v8:5269 Review-Url: https://codereview.chromium.org/2711353002 Cr-Commit-Position: refs/heads/master@{#43474}
-
- 23 Feb, 2017 1 commit
-
-
Marja Hölttä authored
BUG=v8:5294 Change-Id: If45f25aae8de526027b7851cb4efe0ccf4a7c4b1 Reviewed-on: https://chromium-review.googlesource.com/444226 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43388}
-
- 19 Jan, 2017 1 commit
-
-
jkummerow authored
- builtins-ic.cc takes the place of the AccessorAssembler shim - AccessorAssemblerImpl can then be renamed - some cleanup in code-factory.cc - drop old _TF name suffixes - fix Generate##Name##Impl in TF_BUILTIN macro Review-Url: https://codereview.chromium.org/2647493002 Cr-Commit-Position: refs/heads/master@{#42520}
-
- 30 Dec, 2016 2 commits
-
-
mvstanton authored
Following in the footsteps of the other load/store ICs. R=epertoso@chromium.org BUG= Review-Url: https://codereview.chromium.org/2608893002 Cr-Commit-Position: refs/heads/master@{#42002}
-
mvstanton authored
This CL is from danno@chromium.org. Moves code stubs LoadIC KeyedLoadICTF StoreIC KeyedStoreICTF LoadICTrampoline KeyedLoadICTrampolineTF StoreICTrampoline KeyedStoreICTrampolineTF into builtins. TBR Yang for serializer changes. R=epertoso@chromium.org TBR=yangguo@chromium.org BUG= Review-Url: https://codereview.chromium.org/2608883002 Cr-Commit-Position: refs/heads/master@{#42001}
-