- 03 Apr, 2020 1 commit
-
-
Ross McIlroy authored
Effect-control-linearizer will update a basic block to connect it directly to the end node if it has an Unreachable node. Usually the block would already have been connected directly to end (via a Throw node) already, however in some cases it can be connected indirectly (via a branch, where both end in a throw node). If this happens, and the Effect-control-linearizer is maintaining the schedule (e.g., for TurboProp), it will cause the end block to have unreachable predecessor blocks, which can cause issues with the register allocator. To fix this, have the BasicBlockUpdater remove all successor blocks from the schedule, when they become Unreachable. Also add some tests to cover this in effect-control-linearizer-unittests. BUG=v8:10332,v8:9684 Change-Id: Ibce140e6d1f61751a86247e6f8c36075723a1e55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2120537 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#66994}
-
- 10 Dec, 2019 1 commit
-
-
Georg Neis authored
Change-Id: Ie0b6e7876abe229915afa4aaf3b1692750254cbc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1950977Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#65402}
-
- 01 Jul, 2019 1 commit
-
-
Georg Neis authored
Change its name to InferReceiverMapsUnsafe and add a comment that MapInference should be used instead in new code. There are two remaining uses (outside of MapInference) and I'm not planning to remove them. TBR: jarin@chromium.org Bug: v8:9197 Change-Id: I3c89f11bbf9b4eb3a1c6f1648c2046fe409fa830 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1680540 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#62477}
-
- 24 May, 2019 1 commit
-
-
Yang Guo authored
TBR=mvstanton@chromium.org,neis@chromium.org,ahaas@chromium.org Bug: v8:9247 Change-Id: I5433c863a54f3412d73df0d38aba3fdbcfac7ebe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627973 Commit-Queue: Yang Guo <yangguo@chromium.org> Auto-Submit: Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#61830}
-
- 03 May, 2019 1 commit
-
-
Jaroslav Sevcik authored
Bug: chromium:958725 Change-Id: I02d2f3ad19fa60482f8fdd8a539205091f428b68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594434Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61196}
-
- 02 May, 2019 2 commits
-
-
Georg Neis authored
Replace the unsafe function NodeProperties::HasInstanceTypeWitness with a new safe method on MapInference. Bug: v8:9197 Change-Id: I937433c7721946139dc761750ea34032e58e275c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1591612Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#61156}
-
Georg Neis authored
R=jarin Change-Id: I36d4952f351cfa428532cfd56ecbb10c9fe3d39a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588469 Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61154}
-
- 18 Mar, 2019 1 commit
-
-
Georg Neis authored
There were four places where we did essentially the same steps in order to extract the initial map for inlining a JSCreate operation. This CL creates a function on NodeProperties for this task. As a side effect, this fixes a bug in ReduceJSCreateArray, where has_initial_map could get called when it wasn't permissible to do so. Notes: For simplicity, in one or two places where we used to get the target/newtarget constants from the types we now get them from HeapConstant nodes. Cosmetic change: rename "receiver_map" to the more accurate "root_map" in JSNativeContextSpecialization::ExtractReceiverMaps. Bug: chromium:939316 Change-Id: I8fd9eb50993be3d839ab9b18eeea28184c53eabf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1528435 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#60301}
-
- 08 Feb, 2019 1 commit
-
-
Matt Gardner authored
This commit allows inlining of Array#indexOf and Array#includes when the array type is polymorphic for types that are compatable for array iteration. Bug: v8:8388 Change-Id: Ib826bad857c7dfe0ee7af99bb456b50b7a8b6ef9 Reviewed-on: https://chromium-review.googlesource.com/c/1450137 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#59473}
-
- 12 Oct, 2018 1 commit
-
-
Georg Neis authored
As part of the standard objects serialization, collect the identities of the Array prototype and the Object prototype from all native contexts. This information is then be consulted at compile time instead of having to call Isolate::IsInAnyContext (which accesses the heap). Bug: v8:7790 Change-Id: I26a8271afadfce243a8032e4a012f249ce3c2a60 Reviewed-on: https://chromium-review.googlesource.com/c/1275815 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#56599}
-
- 15 Jun, 2018 1 commit
-
-
Leszek Swirski authored
Bug: v8:7786 Change-Id: I1e568ff6da02dfd92b24b8badd665096cf49a13a Reviewed-on: https://chromium-review.googlesource.com/1101321Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#53747}
-
- 28 Apr, 2018 1 commit
-
-
Jaroslav Sevcik authored
This is part of the effort to decrease the amount of undefined behavior. that v8 relies on. The main change here is to represent types with class Type rather than with pointer Type*. To make the CL smaller, I used an operator overload hack to separate the change from `->` to `.`. I am working on a CL that will remove the operator and change all those arrows to dots. Bug: v8:3770 Change-Id: I71a197cb739a1467937bc95c2a757fab0469aa22 Reviewed-on: https://chromium-review.googlesource.com/1032551 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#52872}
-
- 23 Feb, 2018 3 commits
-
-
Sigurd Schneider authored
This is a reland of 3ff4b447. Original version did not handle V8_INTL_SUPPORT. Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} Bug: v8:7250, v8:7340 Change-Id: Id908cbcfaa9e9cf5459d6d3289e6ec00e387d287 Reviewed-on: https://chromium-review.googlesource.com/934268Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51514}
-
Sigurd Schneider authored
This reverts commit 3ff4b447. Reason for revert: Does not handle V8_INTL_SUPPORT correctly Original change's description: > [turbofan] Move String.* functions to JSCallReducer > > Bug: v8:7250, v8:7340 > Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c > Reviewed-on: https://chromium-review.googlesource.com/913208 > Commit-Queue: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#51505} TBR=sigurds@chromium.org,bmeurer@chromium.org Change-Id: I6efb3b758b0fcadc012a90c4175de3c1ebccee95 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7250, v8:7340 Reviewed-on: https://chromium-review.googlesource.com/934267Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51507}
-
Sigurd Schneider authored
Bug: v8:7250, v8:7340 Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c Reviewed-on: https://chromium-review.googlesource.com/913208 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51505}
-
- 04 Jan, 2018 1 commit
-
-
Mostyn Bramley-Moore authored
Bug: v8:7127, v8:7204, v8:7205 Change-Id: Iedea388590991e4d0edcf59e02c767b6c04460e7 Reviewed-on: https://chromium-review.googlesource.com/849216Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com> Cr-Commit-Position: refs/heads/master@{#50351}
-
- 29 Nov, 2017 1 commit
-
-
Benedikt Meurer authored
The two helper functions CanBePrimitive and NeedsConvertReceiver did essentially the same, just in a slightly different way, and both weren't really robust wrt. to the list of JSConstruct* and JSCreate* operators that they were handling. There's now a single helper in the NodeProperties and a couple of extra macro lists to keep this list up to date more easily. Drive-by-fix: Also moved the CanBeNullOrUndefined helper to the NodeProperties class. Bug: v8:5267, v8:7109 Change-Id: Ibbf387040e3f424ee224c53fac15c2b3207b1926 Reviewed-on: https://chromium-review.googlesource.com/793734Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49695}
-
- 27 Oct, 2017 1 commit
-
-
Andreas Rossberg authored
R=titzer@chromium.org Change-Id: Ie8c361efb48b56dc65719f09dfc79d505e0f3459 Reviewed-on: https://chromium-review.googlesource.com/735610 Commit-Queue: Andreas Rossberg <rossberg@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49000}
-
- 07 Sep, 2017 1 commit
-
-
Benedikt Meurer authored
Introduce NodeProperties::NoObservableSideEffectBetween to check if there's any observable side effect between two nodes in the effect chain. Use this to guard the insertion of potentially redundant map checks in the lowering of Object.prototype.hasOwnProperty and keyed accesses within a for..in loop. This gives another boost on the for..in performance front. Bug: v8:6702 Change-Id: I68133f14ad388a1a7422714319c9b323d5cf8bc4 Reviewed-on: https://chromium-review.googlesource.com/654640Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#47869}
-
- 31 Jul, 2017 1 commit
-
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/591667/, removing thread-local variable Bug: Change-Id: Ia9bc73be4a46a6bf052220726193c8b6634eb73e Reviewed-on: https://chromium-review.googlesource.com/593559Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#47001}
-
- 28 Jul, 2017 4 commits
-
-
Tobias Tebbi authored
This reverts commit ccd8bb69. Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Mac%20Release%20%28Intel%29/builds/2643 Original change's description: > Reland: [turbofan] staging new implementation of escape analysis > > Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. > > Bug: > Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe > Reviewed-on: https://chromium-review.googlesource.com/591667 > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46975} TBR=jarin@chromium.org,tebbi@chromium.org Change-Id: I30016fd8d71535c02bab8678b02147195c3e97a6 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591672Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46980}
-
Tobias Tebbi authored
Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall. Bug: Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe Reviewed-on: https://chromium-review.googlesource.com/591667Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46975}
-
Tobias Tebbi authored
This reverts commit d230b44f. Reason for revert: compile errors on the waterfall Original change's description: > [turbofan] staging new implementation of escape analysis > > Bug: > Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 > Reviewed-on: https://chromium-review.googlesource.com/565720 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#46966} TBR=mstarzinger@chromium.org,jarin@chromium.org,tebbi@chromium.org Change-Id: I73c3cb270d498aeb181e31bad04f1c73d5ca6741 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/591370Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#46968}
-
Tobias Tebbi authored
Bug: Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9 Reviewed-on: https://chromium-review.googlesource.com/565720 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46966}
-
- 10 Jul, 2017 1 commit
-
-
Jaroslav Sevcik authored
This introduces a new builtin (MapLookupHashIndex) and uses it in Turbofan to compute Map.p.get and Map.p.has. I have also refactored the existing CSA builtins for Map.p.get and Map.p.has to use the new builtin under the hood. The code for the lookup has been also improved. - Specialized lookups for smis, strings, heap numbers and everything else. - the advantage is that we can use fast equalities for the lookup. - strings can likely be optimized further if we care about the internalized string fast case. - Instead of a call to runtime to get the hash code, we now call C directly. In the Turbofan implementation itself, there are no special optimizations yet. The next step is to teach load elimination to reuse the indexes from previous calls of MapLookupHashIndex. BUG=v8:6410 Change-Id: I0b1a70493eb031d444e51002f6b2cc1f30ea2b68 Reviewed-on: https://chromium-review.googlesource.com/560169Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#46510}
-
- 10 May, 2017 1 commit
-
-
Tobias Tebbi authored
[turbofan] [builtins] Unify construct builtins for JS functions and classes and add inlining and deoptimizer support BUG=v8:6180 R=mstarzinger@chromium.org Change-Id: Iac5782a0f6b0ff92293421656d907073cfc3f5dd Reviewed-on: https://chromium-review.googlesource.com/489525 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#45232}
-
- 04 May, 2017 1 commit
-
-
neis authored
1. Generalize context specialization such that the provided context can be any outer context of the function, not necessarily the immediate outer context. 2. Based on this: if function specialization is disabled, then specialize for the module context if there is one. 3. Extend typed lowering of module loads and stores such that if the operand is a Module constant, we constant-fold the cell load. That is, a JSLoadModule with a Module HeapConstant input becomes a LoadField with a Cell HeapConstant input, and similarly for JSStoreModule. BUG=v8:1569 Review-Url: https://codereview.chromium.org/2841613002 Cr-Commit-Position: refs/heads/master@{#45083}
-
- 12 Apr, 2017 1 commit
-
-
bmeurer authored
Add the notion of reliable vs. unreliable receiver map information to the NodeProperties::InferReceiverMaps machinery. The information is considered reliable here if the maps are known to be valid based on the effect chain, and unreliable if there was a side-effect in between that might have changed the receiver map. Use this unreliable information for Array.prototype.push, guarded by either stability dependencies or map checks, which might present a potential deoptimization loop, which is very unlikely, but still needs fixing in the future. This is important to optimize calls to push even in cases like this array.push(something.func()); where we have a side-effect (the call to something.func) between the load of array.push and the actual call. R=jarin@chromium.org BUG=v8:5267,v8:6241 Review-Url: https://codereview.chromium.org/2812233002 Cr-Commit-Position: refs/heads/master@{#44595}
-
- 02 Mar, 2017 1 commit
-
-
Michael Starzinger authored
This unifies the search for a potential {IfException} projection with the existing predicate on {NodeProperties} used by the rest of the system. Also contains a related drive-by change to graph builders. This is in preparation of eliding {IfSuccess} projections when possible. R=jarin@chromium.org Change-Id: I8ba0ae9e9fdb69a77bce01578200ceea434535f7 Reviewed-on: https://chromium-review.googlesource.com/448039Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43540}
-
- 20 Feb, 2017 1 commit
-
-
bmeurer authored
Unify the three different implementations of InferReceiverMaps, which were basically copy&paste with slightly different optimizations applied later into a single NodeProperties::InferReceiverMaps helper, which also returns a ZoneHandleSet of maps, rather than only a single map. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2703133003 Cr-Commit-Position: refs/heads/master@{#43318}
-
- 18 Jan, 2017 1 commit
-
-
epertoso authored
BUG= Review-Url: https://codereview.chromium.org/2635243002 Cr-Commit-Position: refs/heads/master@{#42439}
-
- 13 Jan, 2017 1 commit
-
-
neis authored
With this CL, context loads and stores are "strengthened" by reducing the incoming context chain and decreasing the depth accordingly, whenever possible. This enables more opportunities for specialization and will let us easily add module context specialization later. BUG= Review-Url: https://codereview.chromium.org/2559173003 Cr-Commit-Position: refs/heads/master@{#42334}
-
- 17 Oct, 2016 1 commit
-
-
jochen authored
R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org BUG= CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe Review-Url: https://codereview.chromium.org/2416243002 Cr-Commit-Position: refs/heads/master@{#40350}
-
- 10 Oct, 2016 1 commit
-
-
bmeurer authored
There were once plans to generate cross-context code with TurboFan, however that doesn't fit into the model anymore, and so all of this is essentially dead untested code (and thus most likely already broken in subtle ways). With this mode still in place it would also be a lot harder to make inlining based on SharedFunctionInfo work. BUG=v8:2206,v8:5499 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2406803002 Cr-Commit-Position: refs/heads/master@{#40109}
-
- 05 Sep, 2016 1 commit
-
-
mvstanton authored
BUG= Review-Url: https://codereview.chromium.org/2309823002 Cr-Commit-Position: refs/heads/master@{#39181}
-
- 03 Aug, 2016 1 commit
-
-
mstarzinger authored
This completely removes the ability from nodes to point directly to the frame state representing their eager bailout point. All nodes now either have zero or one frame state inputs. These frame states can by now be found via checkpoints in the graph. R=bmeurer@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2020323004 Cr-Commit-Position: refs/heads/master@{#38282}
-
- 02 Jun, 2016 1 commit
-
-
mstarzinger authored
This removes the frame state input representing the before-state from nodes having the {JSCallFunction} or {JSCallConstruct} operator. These frame states can by now be found via checkpoints in the graph. R=bmeurer@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2025573003 Cr-Commit-Position: refs/heads/master@{#36669}
-
- 25 Apr, 2016 1 commit
-
-
jarin authored
Review URL: https://codereview.chromium.org/1921483002 Cr-Commit-Position: refs/heads/master@{#35747}
-
- 11 Jan, 2016 1 commit
-
-
titzer authored
R=bmeurer@chromium.org BUG= Review URL: https://codereview.chromium.org/1578723002 Cr-Commit-Position: refs/heads/master@{#33202}
-
- 20 Nov, 2015 1 commit
-
-
bmeurer authored
Introduce a JSCreateArray operator that represents the Array constructor, and lower call and construct calls to the Array constructor to JSCreateArray. Currently we don't yet replace that with an inline allocation, but always use the specialized stubs for the Array constructor. This saves a lot of unnecessary deopts and elements transitions because now we can actually consume the allocation site feedback for the transitions. R=mstarzinger@chromium.org BUG=v8:4470 LOG=n Review URL: https://codereview.chromium.org/1466643002 Cr-Commit-Position: refs/heads/master@{#32145}
-