- 19 Nov, 2015 1 commit
-
-
bmeurer authored
We currently assume that all prototype maps are stable, which is not guaranteed for certain keyed access patterns. So we explicitly disallow optimizing the element access there for now. BUG=chromium:557807, v8:4470 R=jarin@chromium.org LOG=n Review URL: https://codereview.chromium.org/1456973004 Cr-Commit-Position: refs/heads/master@{#32101}
-
- 18 Nov, 2015 2 commits
-
-
bmeurer authored
Retrieve the native context/global object from the Node being specialized in the JSNativeContextSpecialization and the JSGlobalObjectSpecialization classes. For this we introduce two new methods NodeProperties::GetSpecializationNativeContext and NodeProperties::GetSpecializationGlobalObject, which walk up the context chain and might in the end take the native context from the outermost activation (if native context specialization is enabled). This allows us to run the native context specialization pass as part of the inlining phase without hacking some of that into the JSInliner. Also refactor the NodeProperties::GetSpecializationContext method that was previously local to the JSContextSpecialization. Also refactor two other oddities in JSNativeContextSpecialization. R=jarin@chromium.org BUG=v8:4470, v8:4493 LOG=n Review URL: https://codereview.chromium.org/1451143005 Cr-Commit-Position: refs/heads/master@{#32076}
-
bmeurer authored
Lower access to byteOffset and byteLength getters on JSArrayBufferViews and to length on JSTypedArrays. This requires a check to see whether the backing JSArrayBuffer was neutered. R=mstarzinger@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1453653003 Cr-Commit-Position: refs/heads/master@{#32070}
-
- 17 Nov, 2015 1 commit
-
-
bmeurer authored
Also properly support loading from holey double element backing stores in JSNativeContextSpecialization. This adds a new simplified operator NumberIsHoleNaN, which checks whether a certain value is the special NaN that we use to encode "the hole" in holey double element backing stores. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1448343002 Cr-Commit-Position: refs/heads/master@{#32039}
-
- 16 Nov, 2015 2 commits
-
-
bmeurer authored
This adds support for load/store access to FAST_HOLEY_ELEMENTS and FAST_HOLEY_SMI_ELEMENTS backing stores. We don't currently fully support the double holes, because we make some difficult assumptions in Crankshaft there. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1448903002 Cr-Commit-Position: refs/heads/master@{#32012}
-
bmeurer authored
Extend the ElementAccessInfo machinery with support for elements kind transitions, which can be either in-place updates of the map (i.e. when going from FAST_SMI_ELEMENTS to FAST_ELEMENTS) or instance migrations utilizing the TransitionElementsKindStub. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1452563002 Cr-Commit-Position: refs/heads/master@{#32003}
-
- 11 Nov, 2015 1 commit
-
-
bmeurer authored
Extend the element access specialization to also allow non-JSArray fast packed elements, which now includes unaliased sloppy and strict arguments. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1433193003 Cr-Commit-Position: refs/heads/master@{#31943}
-
- 03 Nov, 2015 2 commits
-
-
bmeurer authored
TurboFan is actually able to generate property access to all prototypes of all primitives, except the special Oddball primitives that have no wrapper counterparts (namely null and undefined from the ES6 point of view). R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1409163007 Cr-Commit-Position: refs/heads/master@{#31739}
-
bmeurer authored
Implement the missing bits for named access to Number values, which is basically always done on the Number prototype. Crankshaft only deals with Number primitives in the polymorphic case, while we generally support Numbers even for monomorphic access. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1425293004 Cr-Commit-Position: refs/heads/master@{#31731}
-
- 02 Nov, 2015 2 commits
-
-
bmeurer authored
This adds some initial support for keyed element access to fast, non-holey JSArray objects. Also renames PropertyAccessInfoFactory to AccessInfoFactory and PropertyAccessMode to AccessMode. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1418213010 Cr-Commit-Position: refs/heads/master@{#31717}
-
bmeurer authored
Return undefined for missing properties (or throw an exception in strong mode). Also do a bit of code cleanup. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1427913003 Cr-Commit-Position: refs/heads/master@{#31700}
-
- 30 Oct, 2015 2 commits
-
-
bmeurer authored
This introduces an AllocateMutableHeapNumberStub for the boxed double field case, where we need to allocate a box in case of a transitioning store first. We cannot use our inline allocations for this currently, because mutable HeapNumber objects have certain alignment constraints, and I don't want to mess up Allocate/AllocateInNewSpace eagerly. Also refactor the PropertyAccessInfoFactory slightly to split the long methods into simpler parts. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1419173007 Cr-Commit-Position: refs/heads/master@{#31695}
-
bmeurer authored
Also changed the way that transitioning stores are represented in a PropertyAccessInfo: There's no dedicated kind, but DataFields have an optional transition map. R=jarin@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1416973014 Cr-Commit-Position: refs/heads/master@{#31692}
-