- 29 Sep, 2017 1 commit
-
-
Tobias Tebbi authored
This is a reland of e1cdda25 Original change's description: > [turbofan] eagerly prune None types and deadness from the graph > > In addition to using the {Dead} node to prune dead control nodes and nodes that > depend on them, we introduce a {DeadValue} node representing an impossible value > that can occur at any position in the graph. The extended {DeadCodeElimination} > prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into > the effect chain when possible. The remaining uses of {DeadValue} are handled > in {EffectControlLinearizer}, where we always have access to the effect chain. > In addition to explicitly introduced {DeadValue} nodes, we consider any value use > of a node with type {None} as dead. > > Bug: chromium:741225 > Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655 > Reviewed-on: https://chromium-review.googlesource.com/641250 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48208} Bug: chromium:741225 Change-Id: I21316913dae02864f7a6d7c9269405a79f054138 Reviewed-on: https://chromium-review.googlesource.com/692034Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#48232}
-
- 28 Sep, 2017 2 commits
-
-
Clemens Hammacher authored
This reverts commit e1cdda25. Reason for revert: Fails 'constructor-inlining' on GC-Stress bot: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/15270 Original change's description: > [turbofan] eagerly prune None types and deadness from the graph > > In addition to using the {Dead} node to prune dead control nodes and nodes that > depend on them, we introduce a {DeadValue} node representing an impossible value > that can occur at any position in the graph. The extended {DeadCodeElimination} > prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into > the effect chain when possible. The remaining uses of {DeadValue} are handled > in {EffectControlLinearizer}, where we always have access to the effect chain. > In addition to explicitly introduced {DeadValue} nodes, we consider any value use > of a node with type {None} as dead. > > Bug: chromium:741225 > Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655 > Reviewed-on: https://chromium-review.googlesource.com/641250 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48208} TBR=jarin@chromium.org,tebbi@chromium.org Change-Id: I9c175d47e2ee4b11a36ed90421202f2354610398 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:741225 Reviewed-on: https://chromium-review.googlesource.com/690080Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48210}
-
Tobias Tebbi authored
In addition to using the {Dead} node to prune dead control nodes and nodes that depend on them, we introduce a {DeadValue} node representing an impossible value that can occur at any position in the graph. The extended {DeadCodeElimination} prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into the effect chain when possible. The remaining uses of {DeadValue} are handled in {EffectControlLinearizer}, where we always have access to the effect chain. In addition to explicitly introduced {DeadValue} nodes, we consider any value use of a node with type {None} as dead. Bug: chromium:741225 Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655 Reviewed-on: https://chromium-review.googlesource.com/641250 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#48208}
-
- 08 Sep, 2017 1 commit
-
-
Jaroslav Sevcik authored
The advantage of an explicit Abort that the interpreter and the compiler know that aborting cannot continue or throw or deopt. As a result we generate less code and we do not confuse the compiler if the environment is not set up for throwing (as in the generator dispatch that fails validation in crbug.com/762057). Bug: chromium:762057 Change-Id: I3e88f78be32f31ac49b1845595255f802c405ed7 Reviewed-on: https://chromium-review.googlesource.com/657025 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47922}
-
- 04 Sep, 2017 1 commit
-
-
Michael Starzinger authored
This adds support for the backing store of mapped arguments objects to escape analysis. It also unifies two simplified operators representing allocations of these backing stores into a single {NewArgumentsElements} operator and threads through the "mapped count" to the deoptimizer. R=tebbi@chromium.org Change-Id: I1864e29a5703348597b7b2e41deaf5fab73e2c93 Reviewed-on: https://chromium-review.googlesource.com/643208 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47800}
-
- 01 Sep, 2017 2 commits
-
-
Benedikt Meurer authored
This CL adds support to optimize for..in in fast enum-cache mode to the same degree that it was optimized in Crankshaft, without adding the same deoptimization loop that Crankshaft had with missing enum cache indices. That means code like for (var k in o) { var v = o[k]; // ... } and code like for (var k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) { var v = o[k]; // ... } } which follows the https://eslint.org/docs/rules/guard-for-in linter rule, can now utilize the enum cache indices if o has only fast properties on the receiver, which speeds up the access o[k] significantly and reduces the pollution of the global megamorphic stub cache. For example the micro-benchmark in the tracking bug v8:6702 now runs faster than ever before: forIn: 1516 ms. forInHasOwnProperty: 1674 ms. forInHasOwnPropertySafe: 1595 ms. forInSum: 2051 ms. forInSumSafe: 2215 ms. Compared to numbers from V8 5.8 which is the last version running with Crankshaft forIn: 1641 ms. forInHasOwnProperty: 1719 ms. forInHasOwnPropertySafe: 1802 ms. forInSum: 2226 ms. forInSumSafe: 2409 ms. and V8 6.0 which is the current stable version with TurboFan: forIn: 1713 ms. forInHasOwnProperty: 5417 ms. forInHasOwnPropertySafe: 5324 ms. forInSum: 7556 ms. forInSumSafe: 11067 ms. It also improves the throughput on the string-fasta benchmark by around 7-10%, and there seems to be a ~5% improvement on the Speedometer/React benchmark locally. For this to work, the ForInPrepare bytecode was split into ForInEnumerate and ForInPrepare, which is very similar to how it was handled in Fullcodegen initially. In TurboFan we introduce a new operator LoadFieldByIndex that does the dynamic property load. This also removes the CheckMapValue operator again in favor of just using LoadField, ReferenceEqual and CheckIf, which work automatically with the EscapeAnalysis and the BranchConditionElimination. Bug: v8:6702 Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a Reviewed-on: https://chromium-review.googlesource.com/645949 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#47768}
-
Michael Starzinger authored
This adds support for lowering {JSCreateArguments} within outermost frames of type {CreateArgumentsType::kMappedArguments}. It will hence enable escape analysis to work with such objects and allow for further optimization. This also adds a new {NewMappedArgumentsElements} simplfied operator. Note that escape analysis support for this new operator will be done as a follow-up. R=tebbi@chromium.org Change-Id: I0e2fac25c654f796433f57b116964053b6b68635 Reviewed-on: https://chromium-review.googlesource.com/641454 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#47761}
-
- 28 Aug, 2017 3 commits
-
-
Jaroslav Sevcik authored
This is just a refactoring in preparation for typing the speculative integer operation as safe integers. Bug: v8:5267 Change-Id: I56da91a72655a0733b2cf04afcf33cb1d2aa1415 Reviewed-on: https://chromium-review.googlesource.com/637830Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47640}
-
Benedikt Meurer authored
Instead of introducing a lot of explicit branching in the JSNativeContextSpecialization for polymorphic property accesses that cannot be folded into a single LoadField/StoreField, and which are mostly invisible and not optimizable for later passes, we now have a single CompareMaps operator that takes a set of maps (like the CheckMaps operator) and produces a boolean indicating the result of the comparison. R=jarin@chromium.org Bug: v8:6761 Change-Id: Iee8788e915b762d542acb54feb9931346e442dc0 Reviewed-on: https://chromium-review.googlesource.com/636365Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47635}
-
Benedikt Meurer authored
Optimize the common pattern for (var i in o) { if (Object.prototype.hasOwnProperty.call(o, i)) { // do something } } which is part of the guard-for-in style in ESLint (see the documentation at https://eslint.org/docs/rules/guard-for-in for details). This pattern also shows up in React and Ember applications quite a lot (and is tested by the appropriate Speedometer benchmarks, although not dominating those benchmarks, since they spent a lot of time in non-TurboFan'ed code). This improves the forInHasOwnProperty and forInHasOwnPropertySafe micro- benchmarks in v8:6702, which look like this function forInHasOwnProperty(o) { var result = 0; for (var i in o) { if (o.hasOwnProperty(i)) { result += 1; } } return result; } function forInHasOwnPropertySafe(o) { var result = 0; for (var i in o) { if (Object.prototype.hasOwnProperty.call(o, i)) { result += 1; } } return result; } by around 4x and allows for additional optimizations in the future, by also elimiating the megamorphic load when accessing the enumerated properties. This changes the interpreter ForInNext bytecode to collect more precise feedback about the for-in state, which now consists of three individual states: UNINITIALIZED, MEGAMORPHIC and GENERIC. The MEGAMORPHIC state means that the ForInNext has only seen objects with a usable enum cache thus far, whereas GENERIC means that we have seen some slow-mode for..in objects as well. R=jarin@chromium.org Bug: v8:6702 Change-Id: Ibcd75ea9b58c3b4f9219f11bc37eb04a2b985604 Reviewed-on: https://chromium-review.googlesource.com/636964 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47632}
-
- 24 Aug, 2017 1 commit
-
-
Michael Starzinger authored
This introduces a {DebugAbort} machine-level operator as well as the corresponding {ArchDebugAbort} backend instruction. The goal of this is to speed up snapshot generation due to cheaper "CSA-asserts". R=jgruber@chromium.org BUG=v8:6688 Bug: v8:6688 Change-Id: If45f7da0652d4bb920c51ab7a7c41f9670434bbb Also-By: jgruber@chromium.org Reviewed-on: https://chromium-review.googlesource.com/628560Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47568}
-
- 21 Aug, 2017 2 commits
-
-
Albert Mingkun Yang authored
The new node behave the same as its counterpart, CallCFunction, with the additional saving and restoring caller saved registers before and after the function call. Bug: chromium:749486 Change-Id: I0a1dfb2e4e55f7720541a00e6d16fd20220f39ed Reviewed-on: https://chromium-review.googlesource.com/620709 Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#47479}
-
Camillo Bruni authored
The quite common empty object literal doesn't need an AllocationSite since it starts off with the general ElementsKind. By using a separate bytecode we can directly instantiate the empty object without jumping to the runtime first. Note: this experimentally disables pretenuring for empty object literals. Depending on the outcome of our benchmarks pretenuring will be enabled again or fully removed for empty object literals. Bug: v8:6211 Change-Id: I2fee81cbefc70865fc436dbd3bc5fc8de04db91c Reviewed-on: https://chromium-review.googlesource.com/577555 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#47467}
-
- 18 Aug, 2017 1 commit
-
-
Benedikt Meurer authored
The MapGuard node sits in the effect chain as a hint for other optimization passes that a certain value has a certain (set of) map(s) guarded by checks on the control chain. This is useful to learn from explicit control flow inserted for polymorphic property accesses, and then used as part of the polymorphic inlining. This change improves the score on the Octane/DeltaBlue benchmark by around 7-8% and the score on the Octane/Richards benchmark by like 3% on average. Bug: v8:5267 Change-Id: Id0b0b2c72e6a9342d5750a0d62cf6be6fb8c5916 Also-By: jarin@chromium.org Reviewed-on: https://chromium-review.googlesource.com/620586 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47417}
-
- 11 Aug, 2017 1 commit
-
-
Benedikt Meurer authored
These operators were only used by the old asm.js pipeline (with fullcodegen and the AstGraphBuilder). When going through the new pipeline, accesses to TypedArrays are handled by the native context specialization during inlining. Bug: v8:6409 Change-Id: Ib9b888c0b96f297a335580ee42dfa951bde566be Reviewed-on: https://chromium-review.googlesource.com/612347Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47322}
-
- 31 Jul, 2017 1 commit
-
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/591667/, removing thread-local variable Bug: Change-Id: Ia9bc73be4a46a6bf052220726193c8b6634eb73e Reviewed-on: https://chromium-review.googlesource.com/593559Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#47001}
-
- 28 Jul, 2017 4 commits
-
-
Tobias Tebbi authored
This reverts commit ccd8bb69. Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Mac%20Release%20%28Intel%29/builds/2643 Original change's description: > Reland: [turbofan] staging new implementation of escape analysis > > Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. > > Bug: > Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe > Reviewed-on: https://chromium-review.googlesource.com/591667 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46975} TBR=jarin@chromium.org,tebbi@chromium.org Change-Id: I30016fd8d71535c02bab8678b02147195c3e97a6 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591672Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46980}
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. Bug: Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe Reviewed-on: https://chromium-review.googlesource.com/591667Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46975}
-
Tobias Tebbi authored
This reverts commit d230b44f. Reason for revert: compile errors on the waterfall Original change's description: > [turbofan] staging new implementation of escape analysis > > Bug: > Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 > Reviewed-on: https://chromium-review.googlesource.com/565720 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46966} TBR=mstarzinger@chromium.org,jarin@chromium.org,tebbi@chromium.org Change-Id: I73c3cb270d498aeb181e31bad04f1c73d5ca6741 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591370Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46968}
-
Tobias Tebbi authored
Bug: Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 Reviewed-on: https://chromium-review.googlesource.com/565720 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46966}
-
- 27 Jul, 2017 1 commit
-
-
Michael Starzinger authored
This fixes the second-order Array.prototype function {forEach} and {map} to now perform a callability check of the given callback function. For empty arrays it is observable whether such a check outside the loop has been elided or not. R=mvstanton@chromium.org TEST=mjsunit/regress/regress-crbug-747062 BUG=chromium:747062 Change-Id: I1bbe7f44b3b3d18e9b41ad0436975434adf84321 Reviewed-on: https://chromium-review.googlesource.com/588893Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#46942}
-
- 25 Jul, 2017 1 commit
-
-
Camillo Bruni authored
Empty Array literals are amongst the most commonly used literal types on our top25 page list. Using a custom bytecode we can drop the boilerplate for empty Array literals alltogether. However, we still need a proper AllocationSite to track ElementsKind transitions. Bug: v8:6211, chromium:746935 Change-Id: I891eaa778e4e81e138e483a65f04ae00ae30bd28 Reviewed-on: https://chromium-review.googlesource.com/580932Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#46875}
-
- 20 Jul, 2017 1 commit
-
-
Adam Klein authored
This reverts commit 4851745f. Reason for revert: Top crasher on Canary, see https://crbug.com/746935 Original change's description: > [literals] Introduce CreateEmptyArrayLiteral Bytecode > > Empty Array literals are amongst the most commonly used literal types on our > top25 page list. Using a custom bytecode we can drop the boilerplate for empty > Array literals alltogether. However, we still need a proper AllocationSite to > track ElementsKind transitions. > > Bug: v8:6211 > Change-Id: Id5dbdac0ea8e24dd474e679c902c6e4a2957af1d > Reviewed-on: https://chromium-review.googlesource.com/567079 > Commit-Queue: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46752} TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,cbruni@chromium.org,ishell@chromium.org,rmcilroy@google.com Bug: v8:6211, chromium:746935 Change-Id: Ibf19a923688c071d03bad8661a10e08f8414db56 Reviewed-on: https://chromium-review.googlesource.com/580193 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/master@{#46804}
-
- 19 Jul, 2017 2 commits
-
-
Ross McIlroy authored
There remained a few of regressions and we didn't see any significant improvement in the real world with this turned on. This CL reverts all the StringConcat bytecode work which landed. BUG=v8:6243 Change-Id: I832eb72e880ad41411dbec8fe29f71ef0f2025c8 Reviewed-on: https://chromium-review.googlesource.com/575130 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46769}
-
Camillo Bruni authored
Empty Array literals are amongst the most commonly used literal types on our top25 page list. Using a custom bytecode we can drop the boilerplate for empty Array literals alltogether. However, we still need a proper AllocationSite to track ElementsKind transitions. Bug: v8:6211 Change-Id: Id5dbdac0ea8e24dd474e679c902c6e4a2957af1d Reviewed-on: https://chromium-review.googlesource.com/567079 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#46752}
-
- 13 Jul, 2017 1 commit
-
-
Mike Stanton authored
Bug: v8:1956 Change-Id: I41af0cf5eb2fbb9f1d9d4172f3f546bcc2a715dc Reviewed-on: https://chromium-review.googlesource.com/548639 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#46618}
-
- 10 Jul, 2017 1 commit
-
-
Jaroslav Sevcik authored
This introduces a new builtin (MapLookupHashIndex) and uses it in Turbofan to compute Map.p.get and Map.p.has. I have also refactored the existing CSA builtins for Map.p.get and Map.p.has to use the new builtin under the hood. The code for the lookup has been also improved. - Specialized lookups for smis, strings, heap numbers and everything else. - the advantage is that we can use fast equalities for the lookup. - strings can likely be optimized further if we care about the internalized string fast case. - Instead of a call to runtime to get the hash code, we now call C directly. In the Turbofan implementation itself, there are no special optimizations yet. The next step is to teach load elimination to reuse the indexes from previous calls of MapLookupHashIndex. BUG=v8:6410 Change-Id: I0b1a70493eb031d444e51002f6b2cc1f30ea2b68 Reviewed-on: https://chromium-review.googlesource.com/560169Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46510}
-
- 26 Jun, 2017 1 commit
-
-
Jaroslav Sevcik authored
This is mainly to enable optimization of case-insensitive maps, where we see the pattern if (m.has(key.toLowerCase())) { return m.get(key.toLowerCase()) } ... Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I8c78a185401c51e8a53ae2932a158eaafa169495 Reviewed-on: https://chromium-review.googlesource.com/547057 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46206}
-
- 21 Jun, 2017 1 commit
-
-
bmeurer authored
Add a new JSConstructWithArrayLike operator that is backed by the ConstructWithArrayLike builtin (similar to what was done before for the JSCallWithArrayLike operator), and use that operator to optimize Reflect.construct inlining in TurboFan. This is handled uniformly with JSConstructWithSpread in the JSCallReducer. Also add missing test coverage for Reflect.construct in optimized code, especially for some interesting corner cases. R=petermarshall@chromium.org BUG=v8:4587,v8:5269 Review-Url: https://codereview.chromium.org/2949813002 Cr-Commit-Position: refs/heads/master@{#46087}
-
- 20 Jun, 2017 1 commit
-
-
bmeurer authored
Add a new JSCallWithArrayLike operator that is backed by the CallWithArrayLike builtin, and use that operator for both Function.prototype.apply and Reflect.apply inlining. Also unify the handling of JSCallWithArrayLike and JSCallWithSpread in the JSCallReducer to reduce the copy&paste overhead. Drive-by-fix: Add a lot of test coverage for Reflect.apply and Function.prototype.apply in optimized code, especially for some corner cases, which was missing so far. BUG=v8:4587,v8:5269 R=petermarshall@chromium.org Review-Url: https://codereview.chromium.org/2950773002 Cr-Commit-Position: refs/heads/master@{#46041}
-
- 13 Jun, 2017 2 commits
-
-
bbudge authored
- Eliminates S32x4Shuffle, S16x8Shuffle opcodes. All shuffles are subsumed by S8x16Shuffle. This aligns us with the latest WASM SIMD spec. LOG=N BUG=v8:6020 Review-Url: https://codereview.chromium.org/2923103003 Cr-Commit-Position: refs/heads/master@{#45929}
-
bmeurer authored
Port the baseline implementation of Object.prototype.isPrototypeOf to the CodeStubAssembler, sharing the existing prototype chain lookup logic with the instanceof / OrdinaryHasInstance implementation. Based on that, do the same in TurboFan, introducing a new JSHasInPrototypeChain operator, which encapsulates the central prototype chain walk logic. This speeds up Object.prototype.isPrototypeOf by more than a factor of four, so that the code A.prototype.isPrototypeOf(a) is now performance-wise on par with a instanceof A for the case where A is a regular constructor function and a is an instance of A. Since instanceof does more than just the fundamental prototype chain lookup, it was discovered in Node core that O.p.isPrototypeOf would be a more appropriate alternative for certain sanity checks, since it's less vulnerable to monkey-patching. In addition, the Object builtin would also avoid the performance-cliff associated with instanceof (due to the Symbol.hasInstance hook), as for example hit by https://github.com/nodejs/node/pull/13403#issuecomment-305915874. The main blocker was the missing performance of isPrototypeOf, since it was still a JS builtin backed by a runtime call. This CL also adds more test coverage for the Object.prototype.isPrototypeOf builtin, especially when called from optimized code. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng BUG=v8:5269,v8:5989,v8:6483 R=jgruber@chromium.org Review-Url: https://codereview.chromium.org/2934893002 Cr-Commit-Position: refs/heads/master@{#45925}
-
- 08 Jun, 2017 3 commits
-
-
bbudge authored
- Eliminates b1x4, b1x8, and b1x16 as distinct WASM types. - All vector comparisons return v128 type. - Eliminates b1xN and, or, xor, not. - Selects take a v128 mask vector and are now bit-wise. - Adds a new test for Select, where mask is non-canonical (not 0's and -1's). LOG=N BUG=v8:6020 Review-Url: https://codereview.chromium.org/2919203002 Cr-Commit-Position: refs/heads/master@{#45795}
-
Ross McIlroy authored
Add the ability for the typer to track whether a string could be the empty string. This is needed for typed lowering of JSStringConcat since we can't create cons string chain with the empty string in arbitrary positions. The ToPrimitiveToString bytecode handler is modified to collect feedback on whether it has ever seen the empty string, which is used by SpeculativeToPrimitiveToString to ensure that the output is non-empty (or depot) which will subsiquently be used to enable inline cons-string creation for the JSStringConcat operator in typed lowering in a subsiquent CL. BUG=v8:6243 Change-Id: I41b99b59798993f756aada8cff90fb137d65ea52 Reviewed-on: https://chromium-review.googlesource.com/522122 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#45786}
-
Mythri authored
ThrowIfHole bytecodes were handled by introducing deopt points to check for a hole. To avoid deopt loops a hole check protector was used to generate control flow if there was a deopt due to a hole. However, the normal control flow version should be as fast as the deopt version in general. The deopt version could potentially consume less compile time but it may not be worth the complexity added. Hence simplifying it to only construct the control flow. Bug: v8:6383 Change-Id: Icace11f7a6e21e64e1cebd104496e3f559bc85f7 Reviewed-on: https://chromium-review.googlesource.com/525573Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#45783}
-
- 07 Jun, 2017 2 commits
-
-
Mythri authored
This cl: https://chromium-review.googlesource.com/509613 changed CheckNotTaggedHole to not produce any value output. This would mean that in some cases, we could leak hole on value edges. This violates the assumption that we cannot see a hole on several operators. Fixing this back to the original state. Bug: chromium:730254 Change-Id: I3512930e88dbe15e9d9b4b0d276868f354cc2ae2 Reviewed-on: https://chromium-review.googlesource.com/527033Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#45757}
-
Ross McIlroy authored
Adds support for lowering of ToPrimitiveToString and StringConcat bytecodes to the corresponding builtins. As part of this, moves the interpreter implementation of these operations into the appropriate builtin generators and add builtin support for them. Also adds TailCallRuntimeN operator to code-assembler which enables tail calling a runtime function when the arguments have already been pushed onto the stack. BUG=v8:6243 Change-Id: Id5c851bc42e4ff490d9a23a8990ae331c7eac73e Reviewed-on: https://chromium-review.googlesource.com/515362 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#45756}
-
- 06 Jun, 2017 1 commit
-
-
Mythri authored
Introduces ThrowReferenceErrorIfHole / ThrowSuperNotCalledIfHole / ThrowSuperAlreadyCalledIfNotHole bytecodes to handle hole checks. In the bytecode-graph builder they are handled by introducing a deopt point instead of adding explicit control flow. JumpIfNotHole / JumpIfNotHoleConstant bytecodes are removed since they are no longer required. Bug: v8:4280, v8:6383 Change-Id: I58b70c556b0ffa30e41a0cd44016874c3e9c5fe1 Reviewed-on: https://chromium-review.googlesource.com/509613 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#45720}
-
- 29 May, 2017 1 commit
-
-
Peter Marshall authored
Bug: v8:6391 Change-Id: If63078c756d9cfb00e515fae005755c4ed8b12f7 Reviewed-on: https://chromium-review.googlesource.com/512803Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#45549}
-
- 24 May, 2017 1 commit
-
-
Peter Marshall authored
Add a sequential string type to the compiler, and transform charCodeAt on SeqString into SeqStringCharCodeAt. SeqStringCharCodeAt can handle one and two byte strings. Bug: v8:6391 Change-Id: I2785257522c28f3b268c9833f5313e9630cb982a Reviewed-on: https://chromium-review.googlesource.com/509573Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#45508}
-