1. 22 May, 2019 1 commit
  2. 21 May, 2019 3 commits
  3. 20 May, 2019 1 commit
  4. 15 May, 2019 1 commit
    • Tobias Tebbi's avatar
      Reland: [csa] verify skipped write-barriers in MemoryOptimizer · a19c3ffb
      Tobias Tebbi authored
      With very few exceptions, this verifies all skipped write-barriers in
      CSA and Torque, showing that the MemoryOptimizer together with some
      type information on the stored value are enough to avoid unsafe skipped
      write-barriers.
      
      Changes to CSA:
      SKIP_WRITE_BARRIER and Store*NoWriteBarrier are verified by the
      MemoryOptimizer by default.
      Type information about the stored values (TNode<Smi>) is exploited to
      safely skip write barriers for stored Smi values.
      In some cases, the code is re-structured to make it easier to consume
      for the MemoryOptimizer (manual branch and load elimination).
      
      Changes to the MemoryOptimizer:
      Improve the MemoryOptimizer to remove write barriers:
      - When the store happens to a CSA-generated InnerAllocate, by ignoring
        Bitcasts and additions.
      - When the stored value is the HeapConstant of an immortal immovable root.
      - When the stored value is a SmiConstant (recognized by BitcastToTaggedSigned).
      - Fast C-calls are treated as non-allocating.
      - Runtime calls can be white-listed as non-allocating.
      
      Remaining missing cases:
      - C++-style iterator loops with inner pointers.
      - Inner allocates that are reloaded from a field where they were just stored
        (for example an elements backing store). Load elimination would fix that.
      - Safe stored value types that cannot be expressed in CSA (e.g., Smi|Hole).
        We could handle that in Torque.
      - Double-aligned allocations, which are not lowered in the MemoryOptimizer
        but in CSA.
      
      Drive-by change: Avoid Smi suffix for StoreFixedArrayElement since this
      can be handled by overload resolution (in Torque and C++).
      
      Reland Change: Support pointer compression operands.
      
      R=jarin@chromium.org
      TBR=mvstanton@chromium.org
      
      Bug: v8:7793
      Change-Id: I84e1831eb6bf9be14f36db3f8b485ee4fab6b22e
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612904
      Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61522}
      a19c3ffb
  5. 13 May, 2019 1 commit
  6. 10 May, 2019 1 commit
    • Seth Brenith's avatar
      [torque] Automatically generate verifier functions · e483fb27
      Seth Brenith authored
      This change generates functions that verify the things that Torque knows
      about objects and their fields. We still must implement each verifier
      function in objects-debug.cc, but we can call into the generated code to
      verify that field types match their Torque definitions. If no additional
      verification is required, we can use the macro USE_TORQUE_VERIFIER as a
      shorthand for a verifier that calls the corresponding generated
      function.
      
      A new annotation @noVerifier can be applied to both class and field
      definitions, to prevent generating verification code. This allows fully
      customized verification for complicated cases like
      JSFunction::prototype_or_initial_map, which might not exist at all, and
      JSObject::elements, which might be a one pointer filler map.
      
      Because Factory::InitializeJSObjectFromMap fills new objects with
      undefined values, and many verifiers need to deal with partially-
      initialized objects, the generated verifiers allow undefined values on
      every class deriving from JSObject. In cases where stricter checks were
      previously performed, they are kept in objects-debug.cc.
      
      Bug: v8:7793
      Change-Id: I84034efadca89ba0aceddf92e886ffbfaa4c23fa
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594042
      Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
      Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61422}
      e483fb27
  7. 09 May, 2019 1 commit
  8. 29 Apr, 2019 3 commits
  9. 26 Apr, 2019 1 commit
    • Ross McIlroy's avatar
      Revert "[csa] verify skipped write-barriers in MemoryOptimizer" · dd6c9536
      Ross McIlroy authored
      This reverts commit da7322c0.
      
      Reason for revert: Breaking the pointer compression bots, e.g.:
      https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20pointer%20compression/3047
      
      Original change's description:
      > [csa] verify skipped write-barriers in MemoryOptimizer
      > 
      > With very few exceptions, this verifies all skipped write-barriers in
      > CSA and Torque, showing that the MemoryOptimizer together with some
      > type information on the stored value are enough to avoid unsafe skipped
      > write-barriers.
      > 
      > Changes to CSA:
      > SKIP_WRITE_BARRIER and Store*NoWriteBarrier are verified by the
      > MemoryOptimizer by default.
      > Type information about the stored values (TNode<Smi>) is exploited to
      > safely skip write barriers for stored Smi values.
      > In some cases, the code is re-structured to make it easier to consume
      > for the MemoryOptimizer (manual branch and load elimination).
      > 
      > Changes to the MemoryOptimizer:
      > Improve the MemoryOptimizer to remove write barriers:
      > - When the store happens to a CSA-generated InnerAllocate, by ignoring
      >   Bitcasts and additions.
      > - When the stored value is the HeapConstant of an immortal immovable root.
      > - When the stored value is a SmiConstant (recognized by BitcastToTaggedSigned).
      > - Fast C-calls are treated as non-allocating.
      > - Runtime calls can be white-listed as non-allocating.
      > 
      > Remaining missing cases:
      > - C++-style iterator loops with inner pointers.
      > - Inner allocates that are reloaded from a field where they were just stored
      >   (for example an elements backing store). Load elimination would fix that.
      > - Safe stored value types that cannot be expressed in CSA (e.g., Smi|Hole).
      >   We could handle that in Torque.
      > - Double-aligned allocations, which are not lowered in the MemoryOptimizer
      >   but in CSA.
      > 
      > Drive-by change: Avoid Smi suffix for StoreFixedArrayElement since this
      > can be handled by overload resolution (in Torque and C++).
      > 
      > R=​jarin@chromium.org
      > TBR=mvstanton@chromium.org
      > 
      > Change-Id: I0af9b710673f350e0fe81c2e59f37da93c024b7c
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1571414
      > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#61016}
      
      TBR=mvstanton@chromium.org,jarin@chromium.org,tebbi@chromium.org
      
      Change-Id: I36877cd6d08761726ef8dce8a3e3f2ce3eebe6cf
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585732Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61038}
      dd6c9536
  10. 25 Apr, 2019 2 commits
    • Irina Yatsenko's avatar
      Derive SourcePositionTableWithFrameCache directly from Struct · ca88d049
      Irina Yatsenko authored
      Bug: v8:9158
      Change-Id: I40a419a65485a5f407710cbe0cc44275c3fc9739
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1575037Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
      Cr-Commit-Position: refs/heads/master@{#61022}
      ca88d049
    • Tobias Tebbi's avatar
      [csa] verify skipped write-barriers in MemoryOptimizer · da7322c0
      Tobias Tebbi authored
      With very few exceptions, this verifies all skipped write-barriers in
      CSA and Torque, showing that the MemoryOptimizer together with some
      type information on the stored value are enough to avoid unsafe skipped
      write-barriers.
      
      Changes to CSA:
      SKIP_WRITE_BARRIER and Store*NoWriteBarrier are verified by the
      MemoryOptimizer by default.
      Type information about the stored values (TNode<Smi>) is exploited to
      safely skip write barriers for stored Smi values.
      In some cases, the code is re-structured to make it easier to consume
      for the MemoryOptimizer (manual branch and load elimination).
      
      Changes to the MemoryOptimizer:
      Improve the MemoryOptimizer to remove write barriers:
      - When the store happens to a CSA-generated InnerAllocate, by ignoring
        Bitcasts and additions.
      - When the stored value is the HeapConstant of an immortal immovable root.
      - When the stored value is a SmiConstant (recognized by BitcastToTaggedSigned).
      - Fast C-calls are treated as non-allocating.
      - Runtime calls can be white-listed as non-allocating.
      
      Remaining missing cases:
      - C++-style iterator loops with inner pointers.
      - Inner allocates that are reloaded from a field where they were just stored
        (for example an elements backing store). Load elimination would fix that.
      - Safe stored value types that cannot be expressed in CSA (e.g., Smi|Hole).
        We could handle that in Torque.
      - Double-aligned allocations, which are not lowered in the MemoryOptimizer
        but in CSA.
      
      Drive-by change: Avoid Smi suffix for StoreFixedArrayElement since this
      can be handled by overload resolution (in Torque and C++).
      
      R=jarin@chromium.org
      TBR=mvstanton@chromium.org
      
      Change-Id: I0af9b710673f350e0fe81c2e59f37da93c024b7c
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1571414
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61016}
      da7322c0
  11. 17 Apr, 2019 1 commit
  12. 11 Apr, 2019 1 commit
  13. 04 Apr, 2019 1 commit
  14. 01 Apr, 2019 1 commit
  15. 25 Mar, 2019 3 commits
  16. 06 Mar, 2019 1 commit
  17. 27 Feb, 2019 1 commit
  18. 25 Feb, 2019 1 commit
    • Ross McIlroy's avatar
      [Runtime] Ensure template objects are retained if bytecode is flushed. · ec9aef3d
      Ross McIlroy authored
      Template objects should be cached after they are first created and reused on
      subsiquent calls to tag functions. Currently these cached objects are stored
      on the feedback vector, which has appropriate lifetime, however with bytecode
      flushing the feedback vector could be cleared when the bytecode is flushed,
      causing the template object to be dropped.
      
      In order to retain the cached template objects in the face of bytecode flushing,
      this CL adds a weakmap for each native context that is (weakly) keyed by
      shared function info, and holds a linked list of cached template objects
      associated with that shared function info, indexed by feedback vector slot id.
      Misses will check this weakmap, and if no entry is found, a new template object
      is created and added into this weakmap alongside the feedback vector.
      
      BUG=v8:8799,v8:8799,v8:8395
      
      Change-Id: Ia95d5cfc394ce58dc9fe6a1e49780f05299acc17
      Reviewed-on: https://chromium-review.googlesource.com/c/1477746
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#59818}
      ec9aef3d
  19. 15 Feb, 2019 1 commit
  20. 13 Feb, 2019 1 commit
  21. 09 Feb, 2019 1 commit
  22. 08 Feb, 2019 2 commits
  23. 30 Jan, 2019 1 commit
  24. 25 Jan, 2019 1 commit
    • Mythri's avatar
      Defer inferring language mode as far as possible · 592aeefa
      Mythri authored
      Inferring the language mode involves iterating the stack to find the
      closure. This is an expensive operation and should be done only when
      required. This cl changes the implementation to infer the language
      mode only when we can't defer it any further. Currently, we infer the
      language mode when throwing an exception or when passing this
      information to PropertyCallbackArguments.
      
      This cl also changes the language mode parameter to SetProperty
      related methods to Maybe<ShouldThrow>. We only use the language mode to
      decide if we need to throw and using ShouldThrow instead of language
      mode simplifies the code by avoiding conversions from Maybe<ShouldThrow>
      to Maybe<LanguageMode> and vice-versa.
      
      Bug: v8:8580, chromium:923820, chromium:925289
      Change-Id: I72497497f62fe0d86fcecd57b06b3183b7531f7b
      Reviewed-on: https://chromium-review.googlesource.com/c/1425912
      Commit-Queue: Mythri Alle <mythria@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#59094}
      592aeefa
  25. 24 Jan, 2019 1 commit
    • Mythri's avatar
      Reland "Change SetProperty/SetSuperProperty to infer language mode when possible" · e2846ea6
      Mythri authored
      This is a reland of 0896599f with a fix for
      failing layout test.
      
      Original change's description:
      > Change SetProperty/SetSuperProperty to infer language mode when possible
      >
      > In most cases, the language mode can be inferred from the closure and
      > the context. Computing the language mode instead of passing it around
      > simplifies the ICs and will make it possible to go towards lazily
      > allocating feedback vectors. Currently ICs obtain the language mode from
      > the feedback vectors and with lazy feedback allocation we may not always
      > have feedback vectors. Since computing language mode is a bit expensive
      > we want to defer it as far as possible.
      >
      > In Array builtins and other builtins like Reflect.Set we need to force a
      > language mode when setting the properties. To support these cases the
      > SetProperty methods allow the language mode to be overridden when needed.
      >
      > This is a first cl in a series of cls, that will defer the language mode
      > computation further and remove language mode where it is not needed.
      >
      > BUG: v8:8580
      > Change-Id: I9c2396e3bcfe77c3c9d6760c46d86954d54744b9
      > Reviewed-on: https://chromium-review.googlesource.com/c/1409426
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
      > Commit-Queue: Mythri Alle <mythria@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#58893}
      
      TBR: ahaas@chromium.org
      Change-Id: Id5d81eae91b55638dbc72168f0e5203e684869fb
      Reviewed-on: https://chromium-review.googlesource.com/c/1421077
      Commit-Queue: Mythri Alle <mythria@chromium.org>
      Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#59075}
      e2846ea6
  26. 18 Jan, 2019 1 commit
    • Maya Lekova's avatar
      Revert "Change SetProperty/SetSuperProperty to infer language mode when possible" · 697885b9
      Maya Lekova authored
      This reverts commit 0896599f.
      
      Reason for revert: Speculative revert, seems to cause a layout test failure blocking the LKGR - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/29320
      
      Original change's description:
      > Change SetProperty/SetSuperProperty to infer language mode when possible
      > 
      > In most cases, the language mode can be inferred from the closure and
      > the context. Computing the language mode instead of passing it around
      > simplifies the ICs and will make it possible to go towards lazily
      > allocating feedback vectors. Currently ICs obtain the language mode from
      > the feedback vectors and with lazy feedback allocation we may not always
      > have feedback vectors. Since computing language mode is a bit expensive
      > we want to defer it as far as possible.
      > 
      > In Array builtins and other builtins like Reflect.Set we need to force a
      > language mode when setting the properties. To support these cases the
      > SetProperty methods allow the language mode to be overridden when needed.
      > 
      > This is a first cl in a series of cls, that will defer the language mode
      > computation further and remove language mode where it is not needed.
      > 
      > BUG: v8:8580
      > Change-Id: I9c2396e3bcfe77c3c9d6760c46d86954d54744b9
      > Reviewed-on: https://chromium-review.googlesource.com/c/1409426
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
      > Commit-Queue: Mythri Alle <mythria@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#58893}
      
      TBR=mlippautz@chromium.org,mythria@chromium.org,jgruber@chromium.org,verwaest@chromium.org
      
      Change-Id: I2e0f80a4577a8ca86c05a62205f9dfa488418a52
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/1420758Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
      Commit-Queue: Maya Lekova <mslekova@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#58911}
      697885b9
  27. 17 Jan, 2019 1 commit
    • Mythri's avatar
      Change SetProperty/SetSuperProperty to infer language mode when possible · 0896599f
      Mythri authored
      In most cases, the language mode can be inferred from the closure and
      the context. Computing the language mode instead of passing it around
      simplifies the ICs and will make it possible to go towards lazily
      allocating feedback vectors. Currently ICs obtain the language mode from
      the feedback vectors and with lazy feedback allocation we may not always
      have feedback vectors. Since computing language mode is a bit expensive
      we want to defer it as far as possible.
      
      In Array builtins and other builtins like Reflect.Set we need to force a
      language mode when setting the properties. To support these cases the
      SetProperty methods allow the language mode to be overridden when needed.
      
      This is a first cl in a series of cls, that will defer the language mode
      computation further and remove language mode where it is not needed.
      
      BUG: v8:8580
      Change-Id: I9c2396e3bcfe77c3c9d6760c46d86954d54744b9
      Reviewed-on: https://chromium-review.googlesource.com/c/1409426Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Commit-Queue: Mythri Alle <mythria@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#58893}
      0896599f
  28. 09 Jan, 2019 1 commit
  29. 08 Jan, 2019 3 commits
  30. 07 Jan, 2019 1 commit