1. 04 Feb, 2019 1 commit
  2. 17 Sep, 2018 2 commits
    • Benedikt Meurer's avatar
      [cleanup] Cleanup JSArrayBuffer and TurboFan's handling of neutering. · beebb236
      Benedikt Meurer authored
      Cleanup the JSArrayBuffer bit fields to use the proper object macros
      that are now otherwise used consistently across the code base. Also
      change TurboFan to consistently bailout when it sees an array buffer
      that was previously neutered, so that the generic path / builtins are
      again the chokepoints for the spec violations (the fact that we don't
      always raise exceptions when we see a neutered array buffer), except
      for the ArrayBufferView accessor inlining in the JSCallReducer, where
      we still turn the values into zero (because we don't have access to
      a CALL_IC speculation guard in the common case).
      
      This also removes the ArrayBufferWasNeutered simplified operator, and
      does regular LoadField + Number bitwise operations instead, which is
      good enough and allows us to get rid of a lot of unnecessary complexity.
      
      Bug: v8:4153, v8:7881, v8:8015, v8:8171, v8:8178
      Change-Id: I4ce79ece762c632e6318f2ab7bcc6b2f82383947
      Reviewed-on: https://chromium-review.googlesource.com/1226887Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#55958}
      beebb236
    • Florian Sattler's avatar
      [cleanup] Refactor compiler to use default members. · 2c97e145
      Florian Sattler authored
      Fixing clang-tidy warning.
      
      Bug: v8:8015
      Change-Id: I7d885f0e2ba3cdf97de190166dc4cdd24dc0c11e
      Reviewed-on: https://chromium-review.googlesource.com/1224091
      Commit-Queue: Florian Sattler <sattlerf@google.com>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#55956}
      2c97e145
  3. 23 Jul, 2018 1 commit
  4. 15 Jun, 2018 1 commit
  5. 13 Mar, 2018 1 commit
  6. 25 Oct, 2017 1 commit
    • Jaroslav Sevcik's avatar
      Revert "[turbofan] Prune control flow based on failed map checks and comparisons." · f3b4841d
      Jaroslav Sevcik authored
      This reverts commit 37b4b2f1.
      
      Reason for revert: Likely breaking canary.
      
      Original change's description:
      > [turbofan] Prune control flow based on failed map checks and comparisons.
      > 
      > This introduces unreachable state into load elimination. We mark state
      > as unreachable if we know statically that a map check would fail.
      > When processing effect phis, we disconnect unreachable state's
      > control from the effect phi's merge, and point it to RuntimeAbort.
      > The control input to the merge is then updated with Dead. Dead
      > code elimination prunes the merge, phis and effect phis.
      > 
      > Bug: v8:6396
      > Change-Id: I01874b576e548747a915c7b645b96ebaa6f6700d
      > Reviewed-on: https://chromium-review.googlesource.com/730754
      > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#48810}
      
      TBR=jarin@chromium.org,bmeurer@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      Bug: v8:6396, chromium:777843
      Change-Id: I6fac6f86e138f33756e688ec30424cb940690dae
      Reviewed-on: https://chromium-review.googlesource.com/737829Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48918}
      f3b4841d
  7. 23 Oct, 2017 2 commits
  8. 22 Oct, 2017 1 commit
  9. 20 Oct, 2017 1 commit
  10. 19 Oct, 2017 2 commits
    • Jaroslav Sevcik's avatar
      Revert "[turbofan] Load elimination prunes control flow based on instance type." · 8f09a751
      Jaroslav Sevcik authored
      This reverts commit 71bcc1d9.
      
      Reason for revert: Regresses Octane/Box2D, among other things.
      
      Original change's description:
      > [turbofan] Load elimination prunes control flow based on instance type.
      > 
      > Changes:
      > - introduce the notion of unreachable abstract states.
      > 
      > - reconnect unreachables states to runtime abort in effect phis (so that
      >   the merged states are not polluted by unreachable branches while
      >   preserving SSA).
      > 
      > - mark states with failed map checks, unreachable map guars as unreachable.
      > 
      > - add instance type to AbstractMaps, only invalidate instance type on
      >   mismatched effect merges.
      > 
      > 
      > This results in 2-3% improvement on ARES/ML steady state.
      > 
      > Bug: v8:6396
      > Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
      > Reviewed-on: https://chromium-review.googlesource.com/727761
      > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
      > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#48742}
      
      TBR=jarin@chromium.org,bmeurer@chromium.org
      
      Change-Id: I6302b37dbf5ea781c64815ef1900681531ad7d71
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:6396
      Reviewed-on: https://chromium-review.googlesource.com/728440Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48763}
      8f09a751
    • Jaroslav Sevcik's avatar
      [turbofan] Load elimination prunes control flow based on instance type. · 71bcc1d9
      Jaroslav Sevcik authored
      Changes:
      - introduce the notion of unreachable abstract states.
      
      - reconnect unreachables states to runtime abort in effect phis (so that
        the merged states are not polluted by unreachable branches while
        preserving SSA).
      
      - mark states with failed map checks, unreachable map guars as unreachable.
      
      - add instance type to AbstractMaps, only invalidate instance type on
        mismatched effect merges.
      
      
      This results in 2-3% improvement on ARES/ML steady state.
      
      Bug: v8:6396
      Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
      Reviewed-on: https://chromium-review.googlesource.com/727761Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48742}
      71bcc1d9
  11. 06 Oct, 2017 1 commit
    • Jaroslav Sevcik's avatar
      [turbofan] Load elimination - use maps to avoid state invalidation. · ea891e87
      Jaroslav Sevcik authored
      Currently, the transition elements kind operation invalidates the
      elements of all other arrays. In particular, if we loop over matrix 
      elements using two nested loops, and do possibly transitioning access 
      a[i][j] in every iteration, we invalidate the load elimination state 
      for the array 'a' because a[i][j] might transition elements kind 
      for the 'a[i]' array. As a result, the 'a[i]' access cannot be 
      hoisted from the inner loop.
      
      With this CL, we figure out that transitioning 'a[i]' cannot affect 'a'
      because we know that 'a' does not have the transition's source map.
      
      In the micro-benchmark below, the time for summing up the elements of
      100x100 matrix improves by factor of 1.7 (from ~340ms to ~190ms).
      
      function matrixSum(a) {
        let s = 0;
        let rowCount = a.length;
        let columnCount = a[0].length;
        for (let i = 0; i < rowCount; i++) {
          for (let j = 0; j < columnCount ; j++) {
            s += a[i][j];
          }
        }
        return s;
      }
      
      // Setup the matrices:
      // Smi elements.
      var ma = [[1, 2], [3, 4]];
      // Holey double elements.
      var b = Array(100);
      for (let i = 0; i < 100; i++) b[i] = 1.1;
      var mb = [];
      for (let i = 0; i < 100; i++) mb[i] = b;
      
      // Warmup.
      matrixSum(mb);
      matrixSum(mb);
      matrixSum(ma);
      matrixSum(mb);
      matrixSum(ma);
      
      %OptimizeFunctionOnNextCall(matrixSum);
      
      function runner(m) {
        let s = 0;
        for (let i = 0; i < 1e4; i++) {
          s += matrixSum(m);
        }
        return s;
      }
      // Make sure the runner does not know the elements kinds.
      %NeverOptimizeFunction(runner);
      
      // Measure.
      console.time("Sum");
      runner(mb);
      console.timeEnd("Sum");
      
      
      Bug: v8:6344
      Change-Id: Ie0642d8693ed63116b1aaed7d2f261fcb64729fe
      Reviewed-on: https://chromium-review.googlesource.com/704634
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48334}
      ea891e87
  12. 28 Aug, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Introduce a dedicated CompareMaps operator. · 8f1a92ce
      Benedikt Meurer authored
      Instead of introducing a lot of explicit branching in the
      JSNativeContextSpecialization for polymorphic property accesses
      that cannot be folded into a single LoadField/StoreField, and which
      are mostly invisible and not optimizable for later passes, we now
      have a single CompareMaps operator that takes a set of maps (like the
      CheckMaps operator) and produces a boolean indicating the result of
      the comparison.
      
      R=jarin@chromium.org
      
      Bug: v8:6761
      Change-Id: Iee8788e915b762d542acb54feb9931346e442dc0
      Reviewed-on: https://chromium-review.googlesource.com/636365Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47635}
      8f1a92ce
  13. 21 Aug, 2017 1 commit
    • Jaroslav Sevcik's avatar
      [turbofan] Merge map information for phis when merging effects. · f88eb5f2
      Jaroslav Sevcik authored
      When merging effect phis, we currently do not try to merge information
      for any variables that are merged by phis on the same control merge.
      
      This CL implements a very limited version of merging map information
      for nodes: If all the map information for all inputs of the phi
      is the same, we assign that map information to the phi itself. This
      is somewhat consistent with merging map information for a node:
      there we also combine the information only if in all incoming
      paths we have teh same set of maps.
      
      In theory, we could union the sets of maps. Also, we could consider
      merging other information (such as abstract fields).
      
      This yields some small improvement (~2%) on the Octane deltablue
      benchmark.
      
      Bug: v8:5267
      Change-Id: I9447732e3f0d06eb44632db492782fa35529f9fd
      Reviewed-on: https://chromium-review.googlesource.com/622792
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47475}
      f88eb5f2
  14. 18 Aug, 2017 2 commits
    • Benedikt Meurer's avatar
      [turbofan] Consider field name for aliasing. · 4dd3d061
      Benedikt Meurer authored
      In LoadElimination, don't consider two fields as potentially
      aliasing if they have different names.
      
      This gives another 5% boost on the Octane/DeltaBlue benchmark,
      since the redundant loads and checks on the elms of the
      OrderedCollection can be properly eliminated in the chainTest.
      
      Bug: v8:5267
      Change-Id: Id2dbb8cac02f9c95a85e5cc8acac3f66b679fd06
      Reviewed-on: https://chromium-review.googlesource.com/620727Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47424}
      4dd3d061
    • Benedikt Meurer's avatar
      [turbofan] Introduce a new MapGuard operator. · af4f1520
      Benedikt Meurer authored
      The MapGuard node sits in the effect chain as a hint for other
      optimization passes that a certain value has a certain (set of)
      map(s) guarded by checks on the control chain. This is useful
      to learn from explicit control flow inserted for polymorphic
      property accesses, and then used as part of the polymorphic
      inlining.
      
      This change improves the score on the Octane/DeltaBlue benchmark
      by around 7-8% and the score on the Octane/Richards benchmark by
      like 3% on average.
      
      Bug: v8:5267
      Change-Id: Id0b0b2c72e6a9342d5750a0d62cf6be6fb8c5916
      Also-By: jarin@chromium.org
      Reviewed-on: https://chromium-review.googlesource.com/620586
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#47417}
      af4f1520
  15. 02 Aug, 2017 1 commit
  16. 27 Jul, 2017 1 commit
  17. 13 Jul, 2017 1 commit
  18. 11 Jul, 2017 2 commits
  19. 09 May, 2017 1 commit
    • bmeurer's avatar
      [turbofan] Don't mix element accesses with incompatible representations. · d412cade
      bmeurer authored
      Due to speculative optimizations, the compiler can run into situations
      where it's asked perform impossible operations, like loading a tagged
      element as a float64 instead. All of this is guaranteed to be in dead
      code (unless there's a bug), but leads to confusion and violates
      assumptions in the compiler (that make perfect sense for code that is
      not dead). So teach LoadElimination not to mix up element accesses with
      incompatible representations.
      
      BUG=chromium:719479
      R=jarin@chromium.org
      
      Review-Url: https://codereview.chromium.org/2866233002
      Cr-Commit-Position: refs/heads/master@{#45185}
      d412cade
  20. 02 Jan, 2017 1 commit
  21. 07 Nov, 2016 1 commit
  22. 17 Oct, 2016 1 commit
  23. 02 Sep, 2016 1 commit
  24. 01 Sep, 2016 1 commit
  25. 31 Aug, 2016 1 commit
  26. 26 Aug, 2016 1 commit
  27. 08 Aug, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Add initial support for growing stores. · e6822a83
      bmeurer authored
      Introduce a dedicated MaybeGrowFastElements simplified operator, which
      tries to grow a fast elements backing store for a given element that
      should be added to an array/object. Use that to lower a growing keyed
      store to a sequence of
      
       1) check index is a valid array index,
       2) check stored value,
       3) maybe grow elements backing store (and deoptimize if it would
          normalize), and
       4) store the actual element.
      
      The actual growing is done by two dedicated GrowFastDoubleElements
      and GrowFastSmiOrObjectElements builtins, which are very similar to
      the GrowArrayElementsStub that is used by Crankshaft.
      
      Drive-by-fix: Turn CopyFixedArray into CopyFastSmiOrObjectElements
      builtin, similar to the new growing builtins, so we don't need to
      inline the store+write barrier for the elements into all optimized
      code objects anymore.
      
      Also fix a bug in the OperationTyper for NumberSilenceNaN, which was
      triggered by this change.
      
      BUG=v8:5272
      
      Review-Url: https://codereview.chromium.org/2227493002
      Cr-Commit-Position: refs/heads/master@{#38418}
      e6822a83
  28. 05 Aug, 2016 3 commits
  29. 02 Aug, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Introduce initial support for TypedArrays. · 66f2d3bd
      bmeurer authored
      This adds support for lowering keyed access to JSTypedArray objects to
      element loads and stores instead of IC calls. There's still a lot of
      room for improvement, but the improvements can be done incrementally
      later.
      
      We add a dedicated UnsafePointerAdd operator, which sits in the effect
      chain, and does the (GC invisible) computation of addresses that are
      potentially inside HeapObjects. Also there's now a dedicated Retain
      operator, which ensures that we retain a certain tagged value, which is
      necessary to ensure that we keep a JSArrayBuffer alive as long as we
      might still potentially access elements in its backing store.
      
      R=epertoso@chromium.org
      
      Review-Url: https://codereview.chromium.org/2203693002
      Cr-Commit-Position: refs/heads/master@{#38235}
      66f2d3bd
  30. 29 Jul, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Introduce a dedicated CheckMaps simplified operator. · 8201579e
      bmeurer authored
      So far we always create explicit control flow for map checks during
      JSNativeContextSpecialization, or in the monomorphic case we used a
      CheckIf combined with a map comparison. In either case we cannot
      currently effectively utilize the map check information during load
      elimination to optimize (polymorphic) map checks and elements kind
      transitions.
      
      With the introduction of CheckMaps, we can now start optimizing map
      checks in a more effective fashion. This CL doesn't change anything
      in that direction yet, but merely changes the fundamental mechanism.
      
      This also removes the stable map optimization from the Typer, where
      it was always a bit odd, and puts it into the typed lowering and
      the native context specialization instead.
      
      R=epertoso@chromium.org
      BUG=v8:4930,v8:5141
      
      Review-Url: https://codereview.chromium.org/2196653002
      Cr-Commit-Position: refs/heads/master@{#38166}
      8201579e
  31. 26 Jul, 2016 1 commit
  32. 25 Jul, 2016 1 commit
  33. 05 Jul, 2016 1 commit
    • bmeurer's avatar
      [turbofan] Initial version of the new LoadElimination. · d70dc1ac
      bmeurer authored
      This adds a new optimization phase to the TurboFan pipeline, which walks
      over the effect chain and tries to eliminate redundant loads (and even
      some stores) of object fields. We currently ignore element access, but
      that will probably need to be handled as well at some point. We also
      don't have any special treatment to properly track object maps, which is
      also on the list of things that will happen afterwards.
      
      The implementation is pretty simple currently, and probably way to
      inefficient. It's meant to be a proof-of-concept to iterate on.
      
      R=jarin@chromium.org
      BUG=v8:4930,v8:5141
      
      Review-Url: https://codereview.chromium.org/2120253002
      Cr-Commit-Position: refs/heads/master@{#37528}
      d70dc1ac