1. 17 Jan, 2022 2 commits
  2. 16 Dec, 2021 1 commit
  3. 17 Nov, 2021 1 commit
    • Tobias Tebbi's avatar
      [builtins] add Torque fast-path for String.prototype.localeCompare · 6181ce59
      Tobias Tebbi authored
      This fast path works for ASCII-only strings and is similar to the
      existing fast-path in C++. Important differences:
      - The locale check is done at Turbofan optimization time instead of
        at runtime
      - Use tables of size 256 instead of 128 to save a bounds-check when
        handling one-byte strings.
      - It first performs an equality check that's optimized for detecting
        inequality quickly by comparing the strings from both ends. If the
        equality check succeeds, we are done. Otherwise chances are high
        that the strings differ according to collation level L1 already.
        Therefore, we first do an L1 check and perform the L3 check
        only when L1 didn't find a difference. This is based on the assumption
        that few strings are identical except for different capitalization.
      - Use the Torque version of string flattening instead of the runtime
        version.
      
      Bug: v8:12196
      Change-Id: I2d043c1138846783f6d567b736d34063ba9301e5
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268465Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#77946}
      6181ce59
  4. 13 Oct, 2021 1 commit
    • Joyee Cheung's avatar
      [class] Add IC support for defining class fields to replace runtime call · 713ebae3
      Joyee Cheung authored
      Introduces several new runtime mechanics for defining private fields,
      including:
        - Bytecode StaKeyedPropertyAsDefine
        - Builtins StoreOwnIC{Trampoline|Baseline|_NoFeedback}
        - Builtins KeyedDefineOwnIC{Trampoline|Baseline|_Megamorphic}
        - TurboFan IR opcode JSDefineProperty
      
      These new operations can reduce a runtime call per class field into a
      more traditional Store equivalent. In the microbenchmarks, this
      results in a substantial win over the status quo (~8x benchmark score
      for single fields with the changes, ~20x with multiple fields).
      
      The TurboFan JSDefineProperty op is lowered in
      JSNativeContextSpecialization, however this required some hacks.
      Because private fields are defined as DONT_ENUM when added to the
      object, we can't find a suitable transition using the typical data
      property (NONE) flags. I've added a mechanism to specify the required
      PropertyAttributes for the transition we want to look up.
      
      Details:
      
      New bytecodes:
        - StaKeyedPropertyAsDefine, which is essentially StaKeyedProperty
          but with a different IC builtin (KeyedDefineOwnIC). This is a
          bytecode rather than a flag for the existing StaKeyedProperty in
          order to avoid impacting typical keyed stores in any way due to
          additional branching and testing.
      
      New builtins:
        - StoreOwnIC{TTrampoline|Baseline|_NoFeedback} is now used for
          StaNamedOwnProperty. Unlike the regular StoreIC, this variant will
          no longer look up the property name in the prototype.
          In adddition, this CL changes an assumption that
          StoreNamedOwnProperty can't result in a map transition, as we
          can't rely on the property already being present in the Map due
          to an object literal boilerplate.
      
          In the context of class features, this replaces the runtime
          function %CreateDataProperty().
      
        - KeyedDefineOwnIC{Trampoline|Baseline|_Megamorphic} is used by the
          new StaKeyedPropertyAsDefine bytecode. This is similar to an
          ordinary KeyedStoreIC, but will not check the prototype for
          setters, and for private fields, will take the slow path if the
          field already exists.
      
          In the context of class features, this replaces the runtime
          function %AddPrivateField().
      
      TurboFan IR:
        - JSDefineProperty is introduced to represent a situation where we
          need to use "Define" semantics, in particular, it codifies that we
          do not consult the prototype chain, and the semantics relating to
          private fields are implied as well.
      
      R=leszeks@chromium.org, syg@chromium.org, rmcilroy@chromium.org
      
      Bug: v8:9888
      Change-Id: Idcc947585c0e612f9e8533aa4e2e0f8f0df8875d
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2795831Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
      Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Reviewed-by: 's avatarShu-yu Guo <syg@chromium.org>
      Commit-Queue: Joyee Cheung <joyee@igalia.com>
      Cr-Commit-Position: refs/heads/main@{#77377}
      713ebae3
  5. 12 Oct, 2021 1 commit
  6. 04 Oct, 2021 1 commit
  7. 29 Sep, 2021 1 commit
  8. 15 Sep, 2021 1 commit
  9. 09 Sep, 2021 1 commit
  10. 02 Sep, 2021 1 commit
  11. 01 Sep, 2021 1 commit
    • Jakob Gruber's avatar
      [compiler] Fine-grained JSFunctionData validation · 28d2b323
      Jakob Gruber authored
      JSFunctionData has a fairly heavy serialized payload, and likewise
      consistency validation validates many fields and thus has many
      opportunities to fail. We therefore want to avoid or reduce validation
      whenever possible.
      
      This CL adds tracking s.t. we know which fields were actually used,
      and we limit validation to used fields.
      
      Drive-by: Make serialized_ debug-only.
      Drive-by: Don't create deps for context/native_context/shared.
      
      Bug: v8:7790
      Change-Id: Ic32c9919f0c75a76d9c36e4396b6bce383151b62
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3132962
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#76614}
      28d2b323
  12. 30 Aug, 2021 9 commits
  13. 12 Aug, 2021 1 commit
  14. 11 Aug, 2021 1 commit
  15. 05 Aug, 2021 2 commits
  16. 04 Aug, 2021 1 commit
  17. 03 Aug, 2021 1 commit
  18. 02 Aug, 2021 1 commit
  19. 30 Jul, 2021 2 commits
  20. 27 Jul, 2021 1 commit
  21. 20 Jul, 2021 1 commit
    • Jakob Gruber's avatar
      [compiler] Audit all remaining SerializeFoo methods · d430856d
      Jakob Gruber authored
      .. and explicitly mark behavior through tags/naming conventions:
      
       // This method is never called when concurrent inlining is enabled.
       void SerializeFoo(NotConcurrentInliningTag);
      
       // This method is thread-safe and may be called at any time.
       void CacheBar();
      
      It turns out that all our remaining SerializeFoo methods are already
      either of the former or latter category and thus do not block removal
      of the serialization phase for concurrent inlining.
      
      Bug: v8:7790
      Change-Id: If8f3bc2e407bc2824f83bfcd1f520f3b14dc58ec
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3026709
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#75804}
      d430856d
  22. 19 Jul, 2021 2 commits
  23. 14 Jul, 2021 2 commits
    • Mike Stanton's avatar
      [compiler] Address two concurrency TODOs · 72c8f3fb
      Mike Stanton authored
      JSHeapBroker::ReadFeedbackForCall() - it may be that the JSFunction
      we read in the feedback vector hasn't been store-ordered and is
      therefore unsafe to read. Therefore, we need to call the gc
      predicate to ensure safety.
      
      JSFunctionRef::feedback_vector() & raw_feedback_cell() - I was able
      to remove the TODO warning about uninitialized data visible from
      a direct read of these fields from the background. This is because
      we either store-order into those fields, or rely on a prior
      store-ordering. Additionally, FeedbackVectorRef and FeedbackCellRef
      are never-serialized objects, so their first encounter on the
      background thread is fine (we don't need to have seen and
      serialized them on the main thread first).
      
      Bug: v8:7790
      Change-Id: I9cd19999e70fadcf62778dac2b0f679966a4a53f
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3026708Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Michael Stanton <mvstanton@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#75720}
      72c8f3fb
    • Jakob Gruber's avatar
      [compiler] Remove MapData::SerializeElementsKindGeneralizations · d5b27bd2
      Jakob Gruber authored
      .. and the corresponding map cache.
      
      This cache was only used for CreateArray reductions, thus we mostly
      expect to see unmodified JSArray initial maps. These are already
      accessible from the native context and don't need to be cached
      separately.
      
      We may also see initial maps for custom JSArray subclasses. New map
      allocation may be necessary in this case if the requested elements
      kind differs from that of the current given initial map. Since we
      can't (easily) allocate on the background thread, we skip the
      optimization starting with this CL.
      
      Bug: v8:7790
      Change-Id: Ib8d81094e1572f49eda18e9ec485d317cec62473
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3021175Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Auto-Submit: Jakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#75719}
      d5b27bd2
  24. 13 Jul, 2021 1 commit
  25. 09 Jul, 2021 1 commit
    • Georg Neis's avatar
      [compiler] Make AllocationSite never-serialized · 9a23caf0
      Georg Neis authored
      To get there, also:
      
      - Refactor AllocationSite serialization as necessary.
      
      - Make some accessors on AllocationSite atomic.
      
      - Add JSObjectRef::raw_properties_or_hash().
      
      - Eliminate use of IsFastLiteral in JSCallReducer. It isn't really
        needed there and we want to have only a single piece of code
        traversing boilerplates. (We still have a separate traversal in the
        serializer but that will be removed soon.)
      
      - Merge IsFastLiteral checks into JSCreateLowering's
        TryAllocateFastLiteral.
        Note: TryAllocateFastLiteral doesn't explicitly look at the
        boilerplate's elements kind beyond bailing out for
        DICTIONARY_ELEMENTS in the beginning. After that it looks only at
        the backing store instance type. There is no room for confusion
        because, while elements kind transitions can generally happen
        concurrently to TryAllocateFastLiteral, boilerplates can never
        transition to DICTIONARY_ELEMENTS (added a CHECK for that).
      
      - Slightly adapt CompilationDependencies and remove obsolete comments.
      
      - Fix JSHeapBroker::ClearReconstructibleData (clearing of Refs in
        stress mode) to exclude JSObjectRefs with extra data.
      
      Bug: v8:7790
      Change-Id: Iee1232d01e04bcd00db04d48f6e82064fce6ff62
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3008894
      Commit-Queue: Georg Neis <neis@chromium.org>
      Auto-Submit: Georg Neis <neis@chromium.org>
      Reviewed-by: 's avatarSantiago Aboy Solanes <solanes@chromium.org>
      Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#75656}
      9a23caf0
  26. 08 Jul, 2021 2 commits