1. 27 Feb, 2016 1 commit
  2. 26 Feb, 2016 2 commits
    • bmeurer's avatar
      [turbofan] Don't use the CompareIC in JSGenericLowering. · d00da47b
      bmeurer authored
      The CompareICStub produces an untagged raw word value, which has to be
      translated to true or false manually in the TurboFan code. But for lazy
      bailout after the CompareIC, we immediately go back to fullcodegen or
      Ignition with the raw value, to a location where both fullcodegen and
      Ignition expect a boolean value, which might crash or in the worst case
      (depending on the exact computation inside the CompareIC) could lead to
      arbitrary memory access.
      
      Short-term fix is to use the proper runtime functions (unified with the
      interpreter now) for comparisons. Next task is to provide optimized
      versions of these based on the CodeStubAssembler, which can then be used
      via code stubs in TurboFan or directly in handlers in the interpreter.
      
      R=mstarzinger@chromium.org
      BUG=v8:4788
      LOG=n
      
      Review URL: https://codereview.chromium.org/1738153002
      
      Cr-Commit-Position: refs/heads/master@{#34335}
      d00da47b
    • adamk's avatar
      Revert of [compiler] Drop the CompareNilIC. (patchset #4 id:60001 of... · fca68bac
      adamk authored
      Revert of [compiler] Drop the CompareNilIC. (patchset #4 id:60001 of https://codereview.chromium.org/1722193002/ )
      
      Reason for revert:
      Speculative revert in attempt to fix #2 crasher on canary.
      
      Original issue's description:
      > [compiler] Drop the CompareNilIC.
      >
      > Since both null and undefined are also marked as undetectable now, we
      > can just test that bit instead of having the CompareNilIC try to collect
      > feedback to speed up the general case (without the undetectable bit
      > being used).
      >
      > Drive-by-fix: Update the type system to match the new handling of
      > undetectable in the runtime.
      >
      > R=danno@chromium.org
      >
      > Committed: https://crrev.com/666aec0348c8793e61c8633dee7ad29a514239ba
      > Cr-Commit-Position: refs/heads/master@{#34237}
      
      TBR=danno@chromium.org,verwaest@chromium.org,bmeurer@chromium.org
      LOG=y
      BUG=chromium:589897
      NOTRY=true
      
      Review URL: https://codereview.chromium.org/1743433002
      
      Cr-Commit-Position: refs/heads/master@{#34308}
      fca68bac
  3. 25 Feb, 2016 1 commit
    • bmeurer's avatar
      [runtime] Unify comparison operator runtime entries. · 55b4df73
      bmeurer authored
      Only use one set of %StrictEquals/%StrictNotEquals and
      %Equals/%NotEquals runtime entries for both the interpreter
      and the old-style CompareICStub. The long-term plan is to
      update the CompareICStub to also return boolean values, and
      even allow some more code sharing with the interpreter there.
      
      R=mstarzinger@chromium.org
      
      Review URL: https://codereview.chromium.org/1738883002
      
      Cr-Commit-Position: refs/heads/master@{#34303}
      55b4df73
  4. 24 Feb, 2016 4 commits
    • mstarzinger's avatar
      [fullcodegen] Factor out EmitNamedPropertyLoad. · 9c53fcad
      mstarzinger authored
      This makes the FullCodeGenerator::EmitNamedPropertyLoad be architecture
      independent by adding MacroAssembler::Move helpers.
      
      R=bmeurer@chromium.org
      
      Review URL: https://codereview.chromium.org/1734643002
      
      Cr-Commit-Position: refs/heads/master@{#34259}
      9c53fcad
    • mythria's avatar
      Revert of [Interpreter] Implements calls through CallICStub in the... · eb358178
      mythria authored
      Revert of [Interpreter] Implements calls through CallICStub in the interpreter. (patchset #15 id:270001 of https://codereview.chromium.org/1688283003/ )
      
      Reason for revert:
      It is not a good idea to call CallICStub from the builtin. It might be sensitive to the frame structure. Constructing a internal frame might cause problems. It is much better to inline the code  related to the type feedback vector into the builtin.
      
      Original issue's description:
      > [Interpreter] Implements calls through CallICStub in the interpreter.
      >
      > Calls are implemented through CallICStub to collect type feedback. Adds
      > a new builtin called InterpreterPushArgsAndCallIC that pushes the
      > arguments onto stack and calls CallICStub.
      >
      > Also adds two new bytecodes CallIC and CallICWide to indicate calls have to
      > go through CallICStub.
      >
      > MIPS port contributed by balazs.kilvady.
      >
      > BUG=v8:4280, v8:4680
      > LOG=N
      >
      > Committed: https://crrev.com/20362a2214c11a0f2ea5141b6a79e09458939cec
      > Cr-Commit-Position: refs/heads/master@{#34244}
      
      TBR=rmcilroy@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=v8:4280, v8:4680
      
      Review URL: https://codereview.chromium.org/1731253003
      
      Cr-Commit-Position: refs/heads/master@{#34252}
      eb358178
    • mythria's avatar
      [Interpreter] Implements calls through CallICStub in the interpreter. · 20362a22
      mythria authored
      Calls are implemented through CallICStub to collect type feedback. Adds
      a new builtin called InterpreterPushArgsAndCallIC that pushes the
      arguments onto stack and calls CallICStub.
      
      Also adds two new bytecodes CallIC and CallICWide to indicate calls have to
      go through CallICStub.
      
      MIPS port contributed by balazs.kilvady.
      
      BUG=v8:4280, v8:4680
      LOG=N
      
      Review URL: https://codereview.chromium.org/1688283003
      
      Cr-Commit-Position: refs/heads/master@{#34244}
      20362a22
    • bmeurer's avatar
      [compiler] Drop the CompareNilIC. · 666aec03
      bmeurer authored
      Since both null and undefined are also marked as undetectable now, we
      can just test that bit instead of having the CompareNilIC try to collect
      feedback to speed up the general case (without the undetectable bit
      being used).
      
      Drive-by-fix: Update the type system to match the new handling of
      undetectable in the runtime.
      
      R=danno@chromium.org
      
      Review URL: https://codereview.chromium.org/1722193002
      
      Cr-Commit-Position: refs/heads/master@{#34237}
      666aec03
  5. 22 Feb, 2016 1 commit
  6. 19 Feb, 2016 2 commits
    • rmcilroy's avatar
      [Interpreter] Enable runtime profiler support for Ignition. · b62bf1e6
      rmcilroy authored
      Adds a profiling counter to each BytecodeArray object, and adds
      code to Jump and Return bytecode handlers to update this
      counter by the size of the jump or the distance from the return
      to the start of the function. This is more accurate than fullcodegen's
      approach since it takes forward jumps into account as well as back-edges.
      
      Modifies RuntimeProfiler to track ticks for interpreted frames.
      Currently we use the SharedFunctionInfo::profiler_ticks() instead
      of adding another to tick field to avoid adding another field to
      BytecodeArray since SharedFunctionInfo::profiler_ticks() is only
      used by Crankshaft otherwise so we shouldn't need both for
      
      BUG=v8:4689
      LOG=N
      
      Review URL: https://codereview.chromium.org/1707693003
      
      Cr-Commit-Position: refs/heads/master@{#34166}
      b62bf1e6
    • bmeurer's avatar
      [stubs] Introduce a dedicated FastNewObjectStub. · ba2077aa
      bmeurer authored
      Move the already existing fast case for %NewObject into a dedicated
      FastNewObjectStub that we can utilize in places where we would otherwise
      fallback to %NewObject immediately, which is rather expensive.
      
      Also use FastNewObjectStub as the generic implementation of JSCreate,
      which should make constructor inlining based on SharedFunctionInfo (w/o
      specializing to a concrete closure) viable soon.
      
      R=jarin@chromium.org
      
      Review URL: https://codereview.chromium.org/1708313002
      
      Cr-Commit-Position: refs/heads/master@{#34136}
      ba2077aa
  7. 18 Feb, 2016 1 commit
  8. 17 Feb, 2016 2 commits
  9. 16 Feb, 2016 3 commits
  10. 15 Feb, 2016 5 commits
  11. 12 Feb, 2016 2 commits
    • bmeurer's avatar
      [runtime] Kill %Arguments and %ArgumentsLength. · 98aec4a7
      bmeurer authored
      This removes support for the %Arguments and %ArgumentsLength runtime
      entries and their intrinsic counterparts. If you need variable arguments
      in any builtin, either use (strict) arguments object or rest parameters,
      which are both compositional across inlining (in TurboFan), and not that
      much slower compared to the %_Arguments hackery.
      
      R=jarin@chromium.org
      
      Review URL: https://codereview.chromium.org/1688163004
      
      Cr-Commit-Position: refs/heads/master@{#33943}
      98aec4a7
    • bmeurer's avatar
      [runtime] Introduce FastNewStrictArgumentsStub to optimize strict arguments. · 09d84535
      bmeurer authored
      The FastNewStrictArgumentsStub is very similar to the recently added
      FastNewRestParameterStub, it's actually almost a copy of it, except that
      it doesn't have the fast case we have for the empty rest parameter. This
      patch improves strict arguments in TurboFan and fullcodegen by up to 10x
      compared to the previous version.
      
      Also introduce proper JSSloppyArgumentsObject and JSStrictArgumentsObject
      for the in-object properties instead of having them as constants in the
      Heap class.
      
      Drive-by-fix: Use this stub and the FastNewRestParameterStub in the
      interpreter to avoid the runtime call overhead for strict arguments
      and rest parameter creation.
      
      R=jarin@chromium.org
      TBR=mstarzinger@chromium.org
      
      Review URL: https://codereview.chromium.org/1693513002
      
      Cr-Commit-Position: refs/heads/master@{#33925}
      09d84535
  12. 11 Feb, 2016 2 commits
  13. 10 Feb, 2016 5 commits
    • rmcilroy's avatar
      [Interpreter] Make InterpreterAssembler a subclass of CodeStubAssembler. · d1c28849
      rmcilroy authored
      Moves InterpreterAssembler out of the compiler directory and into the
      interpreter directory. Makes InterpreterAssembler as subclass of
      CodeStubAssembler.
      
      As part of this change, the special bytecode dispatch linkage type
      is removed and instead we use a InterfaceDispatchDescriptor and
      a normal CodeStub linkage type.
      
      Removes a bunch of duplicated logic in InterpreterAssembler and
      instead uses the CodeStubAssembler logic. Refactors Interpreter
      with these changes.
      
      Modifies CodeStubAssembler to add the extra operations required
      by the Interpreter (extra call types, raw memory access and some extra
      binary ops). Also adds the ability for subclasses to add extra
      prologue and epilogue operations around calls, which is required
      for the Interpreter.
      
      BUG=v8:4280
      LOG=N
      
      Review URL: https://codereview.chromium.org/1673333004
      
      Cr-Commit-Position: refs/heads/master@{#33873}
      d1c28849
    • yangguo's avatar
      [debugger] introduce abstract interface for break location. · 24b40f35
      yangguo authored
      The break location heavily relies on relocation info. This change
      abstracts that away. Currently there is only one implementation for
      this interface, for JIT code. Future changes will introduce an
      implementation to iterate bytecode arrays.
      
      R=rmcilroy@chromium.org, vogelheim@chromium.org
      BUG=v8:4690
      LOG=N
      
      Review URL: https://codereview.chromium.org/1682853003
      
      Cr-Commit-Position: refs/heads/master@{#33869}
      24b40f35
    • mvstanton's avatar
      Preserve argument count for calls. · 5de27c34
      mvstanton authored
      Calls use registers for target, new_target and argument count.
      We don't always respect argument count. It didn't bite us in the past
      because the code paths where we clobbered it never used it, though
      in future it could be an issue.
      
      BUG=
      R=mstarzinger@chromium.org
      
      Review URL: https://codereview.chromium.org/1683593003
      
      Cr-Commit-Position: refs/heads/master@{#33865}
      5de27c34
    • verwaest's avatar
      Mark null and undefined as undetectable, and use it to handle abstract... · 3ce9e808
      verwaest authored
      Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic
      
      Marking as undetectable makes abstract equality of null, undefined, and
      other undetectable objects easier. Supporting it in the generic compare
      IC significantly speeds up dynamic comparison between those values and
      JSReceivers by not falling back to the runtime.
      
      MIPS port contributed by Balazs Kilvady <balazs.kilvady@imgtec.com>
      
      Review URL: https://codereview.chromium.org/1683643002
      
      Cr-Commit-Position: refs/heads/master@{#33858}
      3ce9e808
    • mlippautz's avatar
      [heap] Move to page lookups for SemiSpace, NewSpace, and Heap containment methods · cfbd2561
      mlippautz authored
      Preparing the young generation for (real) non-contiguous backing memory, this
      change removes object masks that are used to compute containment in semi and new
      space. The masks are replaced by lookups for object tags and page headers, where
      possible.
      
      Details:
      - Use the fast checks (page header lookups) for containment in regular code.
      - Use the slow version that masks out the page start adress and iterates all
        pages of a space for debugging/verification.
      - The slow version works for off-heap/unmapped memory.
      - Encapsulate all checks for the old->new barrier in Heap::RecordWrite().
      
      BUG=chromium:581412
      LOG=N
      
      Review URL: https://codereview.chromium.org/1632913003
      
      Cr-Commit-Position: refs/heads/master@{#33857}
      cfbd2561
  14. 09 Feb, 2016 1 commit
  15. 08 Feb, 2016 6 commits
    • mstarzinger's avatar
      Remove --stop-at flag from several backends. · 664110f8
      mstarzinger authored
      The flag in question is a debug-only flag supported by full-codegen and
      Crankshaft only. In it's current form there are some unresolved issues:
      - The flag is defeated by inlining in Crankshaft.
      - The flag is not supported by TurboFan.
      - The flag is not supported by Ignition.
      
      Instead of addressing the above issues and increasing maintenance cost
      for all backends and also given the "slim" test coverage, this CL fully
      removes the support from all backends.
      
      R=bmeurer@chromium.org,jkummerow@chromium.org
      
      Review URL: https://codereview.chromium.org/1676263002
      
      Cr-Commit-Position: refs/heads/master@{#33817}
      664110f8
    • verwaest's avatar
      Mark maps having a hidden prototype rather than maps of hidden prototypes. · d2503c4d
      verwaest authored
      Generally we only care whether the next object is a hidden prototype.
      It's simpler to check whether the current object has a hidden prototype
      instead of walking to the next prototype and checking its map.
      
      BUG=
      
      Review URL: https://codereview.chromium.org/1675223002
      
      Cr-Commit-Position: refs/heads/master@{#33816}
      d2503c4d
    • machenbach's avatar
      Revert of Do not eagerly instantiate accessors' JSFunction. (patchset #9... · 0e6f0964
      machenbach authored
      Revert of Do not eagerly instantiate accessors' JSFunction. (patchset #9 id:180001 of https://codereview.chromium.org/1609233002/ )
      
      Reason for revert:
      [Sheriff] Breaks gcmole:
      https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/6260
      
      Original issue's description:
      > Do not eagerly instantiate accessors' JSFunction.
      >
      > BUG=
      >
      > Committed: https://crrev.com/4d46b510caf534d770ce19a01a11b8796304471b
      > Cr-Commit-Position: refs/heads/master@{#33812}
      
      TBR=verwaest@chromium.org,epertoso@chromium.org
      # Skipping CQ checks because original CL landed less than 1 days ago.
      NOPRESUBMIT=true
      NOTREECHECKS=true
      NOTRY=true
      BUG=
      
      Review URL: https://codereview.chromium.org/1679683004
      
      Cr-Commit-Position: refs/heads/master@{#33814}
      0e6f0964
    • epertoso's avatar
      Do not eagerly instantiate accessors' JSFunction. · 4d46b510
      epertoso authored
      BUG=
      
      Review URL: https://codereview.chromium.org/1609233002
      
      Cr-Commit-Position: refs/heads/master@{#33812}
      4d46b510
    • bmeurer's avatar
      [runtime] Optimize and unify rest parameters. · 3ef573e9
      bmeurer authored
      Replace the somewhat awkward RestParamAccessStub, which would always
      call into the runtime anyway with a proper FastNewRestParameterStub,
      which is basically based on the code that was already there for strict
      arguments object materialization. But for rest parameters we could
      optimize even further (leading to 8-10x improvements for functions with
      rest parameters), by fixing the internal formal parameter count:
      
      Every SharedFunctionInfo has a formal_parameter_count field, which
      specifies the number of formal parameters, and is used to decide whether
      we need to create an arguments adaptor frame when calling a function
      (i.e. if there's a mismatch between the actual and expected parameters).
      Previously the formal_parameter_count included the rest parameter, which
      was sort of unfortunate, as that meant that calling a function with only
      the non-rest parameters still required an arguments adaptor (plus some
      other oddities). Now with this CL we fix, so that we do no longer
      include the rest parameter in that count. Thereby checking for rest
      parameters is very efficient, as we only need to check whether there is
      an arguments adaptor frame, and if not create an empty array, otherwise
      check whether the arguments adaptor frame has more parameters than
      specified by the formal_parameter_count.
      
      The FastNewRestParameterStub is written in a way that it can be directly
      used by Ignition as well, and with some tweaks to the TurboFan backends
      and the CodeStubAssembler, we should be able to rewrite it as
      TurboFanCodeStub in the near future.
      
      Drive-by-fix: Refactor and unify the CreateArgumentsType which was
      different in TurboFan and Ignition; now we have a single enum class
      which is used in both TurboFan and Ignition.
      
      R=jarin@chromium.org, rmcilroy@chromium.org
      TBR=rossberg@chromium.org
      BUG=v8:2159
      LOG=n
      
      Review URL: https://codereview.chromium.org/1676883002
      
      Cr-Commit-Position: refs/heads/master@{#33809}
      3ef573e9
    • ulan's avatar
      New page local store buffer. · bb883395
      ulan authored
      This replaces the global remembered set with per-page remembered sets.
      
      Each page in the old space, map space, and large object space keeps track of
      the set of slots in the page pointing to the new space.
      
      The data structure for storing slot sets is a two-level bitmap, which allows
      us to remove the store buffer overflow and SCAN_ON_SCAVENGE logic.
      
      Design doc: https://goo.gl/sMKCf7
      
      BUG=chromium:578883
      LOG=NO
      
      Review URL: https://codereview.chromium.org/1608583002
      
      Cr-Commit-Position: refs/heads/master@{#33806}
      bb883395
  16. 06 Feb, 2016 1 commit
    • ishell's avatar
      [api] Make ObjectTemplate::SetNativeDataProperty() work even if the... · da213b6e
      ishell authored
      [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.
      
      Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
      When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
      ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.
      
      The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.
      
      BUG=chromium:579009
      LOG=Y
      
      Committed: https://crrev.com/6a118774244d087b5979e9291d628a994f21d59d
      Cr-Commit-Position: refs/heads/master@{#33674}
      
      Review URL: https://codereview.chromium.org/1642223003
      
      Cr-Commit-Position: refs/heads/master@{#33798}
      da213b6e
  17. 05 Feb, 2016 1 commit