- 19 Nov, 2020 1 commit
-
-
Marja Hölttä authored
When accessing a super property which is a getter, the receiver is not restricted the same way as when doing normal property access. In particular, the receiver can be null / undefined. Bug: v8:9237, chromium:1148758, v8:11161 Change-Id: Ic6bc2053e5d046d4b19e868312aa9b50025256a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549941 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71281}
-
- 10 Nov, 2020 1 commit
-
-
Marja Hölttä authored
This is the second reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122 , this time without RuntimeCallStats in the tests. Generalize the existing property lookup machinery (JSNCS::ReduceNamedAccess) to handle the case where the lookup_start_object and the receiver are different objects. Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l Bug: v8:9237 Change-Id: I782df6e032ff8191082b425e68d68b69cef0a560 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527092 Auto-Submit: Marja Hölttä <marja@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71077}
-
- 09 Nov, 2020 2 commits
-
-
Shu-yu Guo authored
This reverts commit 30ca51ec. Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104 Original change's description: > [super] Optimize super property access in JSNativeContextSpecialization > > This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122 > > Generalize the existing property lookup machinery > (JSNCS::ReduceNamedAccess) to handle the case where the > lookup_start_object and the receiver are different objects. > > Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l > > Bug: v8:9237 > Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#71052} TBR=marja@chromium.org,neis@chromium.org Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9237 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#71058}
-
Marja Hölttä authored
This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122 Generalize the existing property lookup machinery (JSNCS::ReduceNamedAccess) to handle the case where the lookup_start_object and the receiver are different objects. Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l Bug: v8:9237 Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71052}
-
- 06 Nov, 2020 1 commit
-
-
Nico Hartmann authored
Bug: v8:11074 Change-Id: I6d58d523254915a6b0d6542d8f80ddc6cee71dee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520907Reviewed-by: Zhi An Ng <zhin@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#71003}
-
- 05 Nov, 2020 2 commits
-
-
Clemens Backes authored
This reverts commit 0147db5a. Reason for revert: Data races: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34056 Original change's description: > [super] Optimize super property access in JSNativeContextSpecialization > > Generalize the existing property lookup machinery > (JSNCS::ReduceNamedAccess) to handle the case where the > lookup_start_object and the receiver are different objects. > > Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l > > Bug: v8:9237 > Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Michael Stanton <mvstanton@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70988} TBR=marja@chromium.org,mvstanton@chromium.org,neis@chromium.org Change-Id: Ib5ddb919ae569fe5ddf266d986f1c8bc0fe9621a No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9237 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520908Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#70992}
-
Marja Hölttä authored
Generalize the existing property lookup machinery (JSNCS::ReduceNamedAccess) to handle the case where the lookup_start_object and the receiver are different objects. Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l Bug: v8:9237 Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#70988}
-
- 27 Oct, 2020 1 commit
-
-
Mike Stanton authored
This CL provides synchronized get/set to feedback vector slots. The FeedbackNexus is set up to use order preserving reads when used on the background thread, and a lock to ensure coherent read of information for ICKinds with two slots. The main thread takes the lock on sets. This test provides patterns to be followed by concurrent TurboFan. We don't yet access the FeedbackVector on the background thread. This CL only makes it safe to do so. The next step will come when the optimizing compiler begins to query the the vector from the background thread. Currently, with --concurrent-inlining turned on this is done in bytecode serialization on the main thread. Without concurrent inlining, it's also done on the main thread, in both cases using the FeedbackNexus. Bug: v8:7790 Change-Id: I49d8b8031190f91a0da1c24f375b6b6d8a9fe038 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2276210 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#70797}
-
- 28 Jul, 2020 1 commit
-
-
Mythri A authored
1. Adds a flag to specify if minimorphic accesses should be optimized using dynamic map checks operators. This flag is disabled by default. 2. Builds the PropertyAccessInfo from handlers instead of reading it from maps for minimorphic accesses 3. Uses DynamicMapChecks operator to lower the minimorphic accesses. Bug: v8:10582, v8:9684 Change-Id: I0b7b26b876f9ad12d6fc38788137b66ee6455aeb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241524Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#69112}
-
- 22 Jan, 2020 1 commit
-
-
Georg Neis authored
... and consult it there from the various reducers. The flag makes no sense without the broker and the reducers already have access to the broker, so we can avoid an additional flag per reducer. Bug: v8:7790 Change-Id: I448050a55951b94d5313c1a79a502be906b98b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2013108 Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#65918}
-
- 09 Jan, 2020 1 commit
-
-
Maya Lekova authored
Bug: v8:7790 Change-Id: Idf066adcd5c3dca3004e2eaa0d8fa389755720af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1991490Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#65671}
-
- 20 Dec, 2019 1 commit
-
-
Tobias Tebbi authored
This reverts commit 91e3243d. Reason for revert: This deopts to the wrong point. Original change's description: > Extend GetIterator bytecode to perform JSReceiver check on object[Symbol.iterator]() > > Current GetIterator bytecode loads and calls @@iterator property on a > given object. This change extends the bytecode functionality to check > whether the value returned after calling @@iterator property is a valid > JSReceiver. The bytecode throws SymbolIteratorInvalid exception if the > returned value is not a valid JSReceiver. This change absorbs the > functionality of additional two bytecodes - JumpIfJSReceiver and > CallRuntime, that are part of the iterator protocol in the GetIterator > bytecode. > > Bug: v8:9489 > Change-Id: I9e84cfe85eeb9a1b8a97ca0595375ac26ba1bbfd > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1792905 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Swapnil Gaikwad <swapnilgaikwad@google.com> > Cr-Commit-Position: refs/heads/master@{#63704} TBR=rmcilroy@chromium.org,leszeks@chromium.org,tebbi@chromium.org,swapnilgaikwad@google.com # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:9489 Change-Id: I9324b5b01ead29912ad793a1e7b4d009643d7901 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1960288Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#65541}
-
- 26 Nov, 2019 1 commit
-
-
Georg Neis authored
This flag has had no effect since mid 2017 when its use-site was accidentally removed (in https://codereview.chromium.org/2902533003). Change-Id: I81436b064c2664deff781ad6d75ad47937e3fdc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1934333 Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#65172}
-
- 17 Oct, 2019 1 commit
-
-
Toon Verwaest authored
This is a reland of c7c47c68. This makes TSAN happy in addition to: Previously I presumed that the context read from a frame in the profiler was a valid context. Turns out that on non-intel we're not guaranteed that the frame is properly set up. In the case we looked at, the profiler took a sample right before writing the frame marker indicating a builtin frame, causing the "context" pointer from that frame to be a bytecode array. Since we'll read random garbage on the stack as a possible context pointer, I made the code reading the native context from it a little more defensive. Bug: v8:9860 Tbr: ulan@chromium.org, neis@chromium.org, ishell@chromium.org Original change's description: > [runtime] Move Context::native_context to the map > > Remove the native context slot from contexts by making context maps > native-context-specific. Now we require 2 loads to go from a context to the > native context, but we have 1 field fewer to store when creating contexts. > > Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629 > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64296} Change-Id: I4d0ab4cbbb23a9ae616407f17ef8f35a0b68ddb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864654 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#64360}
-
- 16 Oct, 2019 2 commits
-
-
Sathya Gunasekaran authored
This reverts commit c7c47c68. Reason for revert: breaks TSAN https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/28738 Original change's description: > Reland "[runtime] Move Context::native_context to the map" > > This is a reland of f05bae1e > > Previously I presumed that the context read from a frame in the profiler was > a valid context. Turns out that on non-intel we're not guaranteed that the > frame is properly set up. In the case we looked at, the profiler took a > sample right before writing the frame marker indicating a builtin frame, > causing the "context" pointer from that frame to be a bytecode array. Since > we'll read random garbage on the stack as a possible context pointer, I made > the code reading the native context from it a little more defensive. > > Bug: v8:9860 > > Original change's description: > > [runtime] Move Context::native_context to the map > > > > Remove the native context slot from contexts by making context maps > > native-context-specific. Now we require 2 loads to go from a context to the > > native context, but we have 1 field fewer to store when creating contexts. > > > > Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629 > > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > > Reviewed-by: Igor Sheludko <ishell@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Reviewed-by: Maya Lekova <mslekova@chromium.org> > > Reviewed-by: Georg Neis <neis@chromium.org> > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#64296} > > Change-Id: If9461e9b21d35a260d71c79d7f95e518cc429e09 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864930 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Auto-Submit: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64314} TBR=ulan@chromium.org,neis@chromium.org,petermarshall@chromium.org,ishell@chromium.org,verwaest@chromium.org,mslekova@chromium.org,victorgomes@google.com Change-Id: I4f9edc62ea6f9f5857619ff0ad1a63cab4b33cc3 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9860 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864937Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#64316}
-
Toon Verwaest authored
This is a reland of f05bae1e Previously I presumed that the context read from a frame in the profiler was a valid context. Turns out that on non-intel we're not guaranteed that the frame is properly set up. In the case we looked at, the profiler took a sample right before writing the frame marker indicating a builtin frame, causing the "context" pointer from that frame to be a bytecode array. Since we'll read random garbage on the stack as a possible context pointer, I made the code reading the native context from it a little more defensive. Bug: v8:9860 Original change's description: > [runtime] Move Context::native_context to the map > > Remove the native context slot from contexts by making context maps > native-context-specific. Now we require 2 loads to go from a context to the > native context, but we have 1 field fewer to store when creating contexts. > > Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629 > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64296} Change-Id: If9461e9b21d35a260d71c79d7f95e518cc429e09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864930Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#64314}
-
- 15 Oct, 2019 2 commits
-
-
Sathya Gunasekaran authored
This reverts commit f05bae1e. Reason for revert: broke arm sim debug https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17714 https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8899519852984476944/+/steps/Check_-_trusted/0/logs/FunctionDetailsInlining/0 Original change's description: > [runtime] Move Context::native_context to the map > > Remove the native context slot from contexts by making context maps > native-context-specific. Now we require 2 loads to go from a context to the > native context, but we have 1 field fewer to store when creating contexts. > > Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629 > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64296} TBR=ulan@chromium.org,neis@chromium.org,petermarshall@chromium.org,ishell@chromium.org,verwaest@chromium.org,mslekova@chromium.org,victorgomes@google.com Change-Id: Ie7b4086c3a9ab2627ecac599da36b20cf8d1f948 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863200Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#64299}
-
Toon Verwaest authored
Remove the native context slot from contexts by making context maps native-context-specific. Now we require 2 loads to go from a context to the native context, but we have 1 field fewer to store when creating contexts. Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#64296}
-
- 16 Sep, 2019 1 commit
-
-
Georg Neis authored
We used to have two special cases for named accesses on the global proxy, one based on seeing the global proxy constant in the graph and on based on seeing the global proxy map either in the feedback or in the graph. A change I made a while ago accidentally disabled the second one. This CL restores that. Moreover, given how things are set up now (this might have been different before), the first optimization is subsumed by the second one, so this CL also removes the first one. Finally, this CL records an accumulator hint in the case of a load, which improves precision of the serializer for concurrent inlining. Tbr: tebbi@chromium.org Bug: v8:7790 Change-Id: I255afc6c79e5c5c900b3ccfcd8459d836d21e42b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801954 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#63806}
-
- 12 Sep, 2019 1 commit
-
-
Swapnil Gaikwad authored
Current GetIterator bytecode loads and calls @@iterator property on a given object. This change extends the bytecode functionality to check whether the value returned after calling @@iterator property is a valid JSReceiver. The bytecode throws SymbolIteratorInvalid exception if the returned value is not a valid JSReceiver. This change absorbs the functionality of additional two bytecodes - JumpIfJSReceiver and CallRuntime, that are part of the iterator protocol in the GetIterator bytecode. Bug: v8:9489 Change-Id: I9e84cfe85eeb9a1b8a97ca0595375ac26ba1bbfd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1792905Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Swapnil Gaikwad <swapnilgaikwad@google.com> Cr-Commit-Position: refs/heads/master@{#63704}
-
- 30 Aug, 2019 1 commit
-
-
Maya Lekova authored
Introduce JSGlobalObjectRef to the heap broker. Bug: v8:7790 Change-Id: I055a0545b582d6ff4c4e0dd639ce532311a76fec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773267Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63472}
-
- 20 Aug, 2019 1 commit
-
-
Maya Lekova authored
Bug: v8:7790 Change-Id: I6f493d994f49d84020966322d60061567b54c854 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760808 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63265}
-
- 19 Aug, 2019 3 commits
-
-
Georg Neis authored
This is a reland of 29585a06 after removing an incorrect DCHECK. Original change's description: > [turbofan] Various serializer/broker improvements > > They are all somewhat entangled, sorry for the big CL. > > - Brokerize remaining feedback vector slots. > - Introduce Hints::SingleConstant helper. > - Introduce SerializationPolicy enum. > - Eliminate use of nullptr for megamorphic load/store ic feedback. > Instead use the corresponding ProcessedFeedback with an empty list > of maps or the like. new class MegamorphicFeedback. > - Separate processing of feedback from serialization. This eliminates > code duplication. > - Be very careful when clearing hints not to overwrite hints that are > being processed. > - Move AccessInfos out of NamedAccessFeedback. Always store them in > property_access_infos_ map on broker. (This was actually unused > before, somewhat by mistake.) > - Support map inference in concurrent inlining. Rewrite > ElementAccessFeedback such that we can refine it with the set of > inferred maps. > > TBR: mvstanton@chromium.org > Change-Id: I05e9eb250bdffc6dff29db01742550a86a41cb31 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752853 > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63232} TBR: mvstanton@chromium.org Bug: v8:7790 Change-Id: Ia4acd31b339a941ee065e1ae4835bb7b85d5685e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758319Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63241}
-
Maya Lekova authored
This reverts commit 29585a06. Reason for revert: Breaks GC stress bots - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/24009 https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/27281 Original change's description: > [turbofan] Various serializer/broker improvements > > They are all somewhat entangled, sorry for the big CL. > > - Brokerize remaining feedback vector slots. > - Introduce Hints::SingleConstant helper. > - Introduce SerializationPolicy enum. > - Eliminate use of nullptr for megamorphic load/store ic feedback. > Instead use the corresponding ProcessedFeedback with an empty list > of maps or the like. new class MegamorphicFeedback. > - Separate processing of feedback from serialization. This eliminates > code duplication. > - Be very careful when clearing hints not to overwrite hints that are > being processed. > - Move AccessInfos out of NamedAccessFeedback. Always store them in > property_access_infos_ map on broker. (This was actually unused > before, somewhat by mistake.) > - Support map inference in concurrent inlining. Rewrite > ElementAccessFeedback such that we can refine it with the set of > inferred maps. > > TBR: mvstanton@chromium.org > Change-Id: I05e9eb250bdffc6dff29db01742550a86a41cb31 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752853 > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63232} TBR=mvstanton@chromium.org,neis@chromium.org Change-Id: I88625d92fddf993db63661666c59af05a47b2b58 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758314Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63237}
-
Georg Neis authored
They are all somewhat entangled, sorry for the big CL. - Brokerize remaining feedback vector slots. - Introduce Hints::SingleConstant helper. - Introduce SerializationPolicy enum. - Eliminate use of nullptr for megamorphic load/store ic feedback. Instead use the corresponding ProcessedFeedback with an empty list of maps or the like. new class MegamorphicFeedback. - Separate processing of feedback from serialization. This eliminates code duplication. - Be very careful when clearing hints not to overwrite hints that are being processed. - Move AccessInfos out of NamedAccessFeedback. Always store them in property_access_infos_ map on broker. (This was actually unused before, somewhat by mistake.) - Support map inference in concurrent inlining. Rewrite ElementAccessFeedback such that we can refine it with the set of inferred maps. TBR: mvstanton@chromium.org Change-Id: I05e9eb250bdffc6dff29db01742550a86a41cb31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752853 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63232}
-
- 09 Aug, 2019 1 commit
-
-
Swapnil Gaikwad authored
This is the first in a series of changes to reduce the number of bytecodes generated for the iteration protocol based operations. The GetIterator bytecode introduced in this change currently loads the @@iterator symbol from an object that was previously done using the LdaNamedProperty bytecode. This change uses builtin-based mechanism that would be extended to perform additional operations in the future on absorbing the bytecodes associated with the GetIterator operation from the iteration protocol. Bug: v8:9489 Change-Id: I83b8b55c27bae8260bf227f355eeca1ba80cd8f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1701852 Commit-Queue: Swapnil Gaikwad <swapnilgaikwad@google.com> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#63139}
-
- 01 Aug, 2019 1 commit
-
-
Georg Neis authored
From JSNativeContextSpecialization::ReduceKeyedLoadFromHeapConstant to JSNativeContextSpecialization::ReduceElementLoadFromHeapConstant. Change-Id: Ib07a6a4bd599dc71a9a100b2f1f6baef68acbe0b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728618Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63027}
-
- 25 Jul, 2019 1 commit
-
-
Georg Neis authored
- Move SerializePrototype out of DependOnStablePrototypes into ComputePropertyAccessInfo. - Brokerize JSNativeContextSpecialization::InferHasInPrototypeChain. - Brokerize JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance (modulo the call to ReduceJSInstanceOf). - Brokerize JSNativeContextSpecialization::ReduceJSHasInPrototypeChain. - Serialize for JSCallReducer::ReduceObjectPrototypeIsPrototypeOf. - Serialize for JSNativeContextSpecialization::ReduceJSInstanceOf. This is still incomplete. Bug: v8:7790 Change-Id: Ic56eab5ddd8d725a13d2980e5b55db53ae82e822 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709408 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#62920}
-
- 05 Jul, 2019 1 commit
-
-
Maya Lekova authored
Got rid of the following circular header dependency chains: compilation-dependencies <-> js-heap-broker <-> access-info types <-> js-heap-broker <-> access-info Extracted former CompilationDependencies::Dependency class into its own header. Extracted *Ref classes into their own header. This should enable building on older GCC versions, e.g. 5.4.0. Bug: v8:9440 Change-Id: Ia345bc227d8f7806d0b8622b706346a7ce6d01ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687415 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#62541}
-
- 24 Jun, 2019 1 commit
-
-
Georg Neis authored
We tried to pass the load mode even for stores. Bug: chromium:977670 Change-Id: I2527a5ca755dba343b75f54383d17e22be0a20a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1672940 Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#62333}
-
- 21 Jun, 2019 1 commit
-
-
Georg Neis authored
A few are still left and made explicit with Allow* scopes. Bug: v8:7790 Change-Id: I85e78949730d046d3449e0cee70997e60a043825 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622108 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#62310}
-
- 20 May, 2019 3 commits
-
-
Yang Guo authored
This reverts commit a7695520. Reason for revert: Was not the culprit. Original change's description: > Revert "Move deoptimizer files" > > This reverts commit 61523c45. > > Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20debug/20396 > > Original change's description: > > Move deoptimizer files > > > > Bug: v8:9247 > > Change-Id: I6287907edb8a36225bfa9fe864305ea59c20dd8b > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617667 > > Commit-Queue: Yang Guo <yangguo@chromium.org> > > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#61648} > > TBR=yangguo@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org > > Change-Id: Icf258f7bc409ef0c360cfa82029bfc45a41dc75f > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Bug: v8:9247 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619749 > Reviewed-by: Yang Guo <yangguo@chromium.org> > Commit-Queue: Yang Guo <yangguo@chromium.org> > Cr-Commit-Position: refs/heads/master@{#61650} TBR=yangguo@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org Change-Id: Ic2aa07ccd08b6070222ec7a65b92b7afb9db484c No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9247 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619753Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61652}
-
Yang Guo authored
This reverts commit 61523c45. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20debug/20396 Original change's description: > Move deoptimizer files > > Bug: v8:9247 > Change-Id: I6287907edb8a36225bfa9fe864305ea59c20dd8b > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617667 > Commit-Queue: Yang Guo <yangguo@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#61648} TBR=yangguo@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org Change-Id: Icf258f7bc409ef0c360cfa82029bfc45a41dc75f No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9247 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619749Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61650}
-
Yang Guo authored
Bug: v8:9247 Change-Id: I6287907edb8a36225bfa9fe864305ea59c20dd8b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617667 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61648}
-
- 16 May, 2019 1 commit
-
-
Georg Neis authored
Bug: v8:7790 Change-Id: Ib3c67e4f038b3eac3f85cd2f3c38501a4b2073f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609792 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61577}
-
- 10 May, 2019 1 commit
-
-
Georg Neis authored
Brokerize parts of named property access. Bug: v8:7790 Change-Id: I465bced5f266969040d1e966946a162b0a850c5b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1596734Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#61414}
-
- 12 Apr, 2019 1 commit
-
-
Georg Neis authored
Bug: v8:7790 Change-Id: I65e050929a45c3391c5c9c9b0d814ae536664cf4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564067 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#60828}
-
- 09 Apr, 2019 1 commit
-
-
Georg Neis authored
Instead optimize based on the name feedback. This simplifies matters for concurrent optimization. Drive-by: Rename "index" to "key" for clarity where appropriate. Bug: v8:7790 Change-Id: Id6db1174c7840c24044bc655e0ffee6a5b0de21c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559742 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#60709}
-
- 29 Mar, 2019 1 commit
-
-
Clemens Hammacher authored
Even though both are allowed in the style guide, it recommends to use 'using', as its syntax is more consistent with the rest of C++. This CL turns all typedefs in compiler code to 'using' declarations. R=mstarzinger@chromium.org Bug: v8:8834 Change-Id: I3baf3ecbfe2c853cb17bb479ebbf140382193b5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545896 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#60527}
-
- 14 Mar, 2019 1 commit
-
-
Georg Neis authored
Main changes: - Rename ProcessedFeedback to ElementAccessFeedback and introduce a base class with the old name ProcessedFeedback. - Introduce another kind of ProcessedFeedback, namely GlobalAccessFeedback for the LoadGlobal/StoreGlobal IC. It's either a PropertyCell or a script context slot. - Produce such processed feedback in the serializer, when visiting LdaGlobal and similar bytecodes. - Consume it, and disallow heap access, in JSNativeContextSpecialization's ReduceJSLoadGlobal and ReduceJSStoreGlobal (for --concurrent-inlining). Minor changes: - Introduce a FeedbackSource class (pair of FeedbackVector and FeedbackSlot) that is used as the key of the processed feedback hash table. We already have two similar classes, FeedbackNexus and VectorSlotPair, but both are unsuitable for technical reasons (e.g. FeedbackNexus construction accesses the heap). Eventually we should remove VectorSlotPair. - Processed feedback is now returned as a pointer, which is nullptr if the original feedback wasn't interesting (e.g. megamorphic). The title says "partially" because the CL doesn't yet take into account named accesses where the receiver happens to be the global proxy. Bug: v8:7790 Change-Id: I4404d98636b91a8f2d5667115944bae4773a4770 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518184 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#60240}
-