1. 21 Jan, 2021 1 commit
  2. 26 Nov, 2020 1 commit
  3. 06 Nov, 2020 1 commit
  4. 28 Oct, 2020 1 commit
  5. 28 Jul, 2020 1 commit
  6. 10 Jul, 2020 1 commit
  7. 30 Aug, 2019 1 commit
  8. 17 Jul, 2019 1 commit
  9. 18 Jun, 2019 1 commit
  10. 23 May, 2019 1 commit
  11. 16 May, 2019 1 commit
  12. 15 May, 2019 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Fix missing `break` in EscapeAnalysis. · 444f83d9
      Benedikt Meurer authored
      In the case of LoadElement in EscapeAnalysis we accidentally always set
      the object as escaping, even in the case where the index was a constant
      (or had a constant type).
      
      This forced us to always allocate array backing stores even in the
      trivial cases like swapping, i.e.
      
      ```js
      function foo(a, b) {
        [a, b] = [b, a];
        return a - b;
      }
      ```
      
      Now with this change we do proper scalar replacement again, even for the
      array backing stores.
      
      Bug: v8:9183
      Change-Id: I3b2dcade23e47df032087778aca1292c8b0d69d4
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612907Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#61521}
      444f83d9
  13. 29 Mar, 2019 1 commit
  14. 25 Feb, 2019 1 commit
  15. 19 Dec, 2018 1 commit
  16. 19 Nov, 2018 1 commit
  17. 29 Oct, 2018 1 commit
  18. 08 Oct, 2018 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Escape analysis support for LoadElement with variable index. · 3e43ded9
      Benedikt Meurer authored
      This adds support to the escape analysis to allow scalar replacement
      of (small) FixedArrays with element accesses where the index is not a
      compile time constant. This happens quite often when inlining functions
      that operate on variable number of arguments. For example consider this
      little piece of code:
      
      ```js
      function sum(...args) {
        let s = 0;
        for (let i = 0; i < args.length; ++i) s += args[i];
        return s;
      }
      
      function sum2(x, y) {
        return sum(x, y);
      }
      ```
      
      This example is made up, of course, but it shows the problem. Let's
      assume that TurboFan inlines the function `sum` into it's call site
      at `sum2`. Now it has to materialize the `args` array with the two
      values `x` and `y`, and iterate through these `args` to sum them up.
      The escape analysis pass figures out that `args` doesn't escape (aka
      doesn't outlive) the optimized code for `sum2` now, but TurboFan still
      needs to materialize the elements backing store for `args` since there's
      a `LoadElement(args.elements,i)` in the graph now, and `i` is not a
      compile time constant.
      
      However the escape analysis has more information than just that. In
      particular the escape analysis knows exactly how many elements a non
      escaping object has, based on the fact that the allocation must be
      local to the function and that we only track objects with known size.
      So in the case above when we get to `args[i]` in the escape analysis
      the relevant part of the graph looks something like this:
      
      ```
      elements = LoadField[elements](args)
      length = LoadField[length](args)
      index = CheckBounds(i, length)
      value = LoadElement(elements, index)
      ```
      
      In particular the contract here is that `LoadElement(elements,index)`
      is guaranteed to have an `index` that is within the valid bounds for
      the `elements` (there must be a preceeding `CheckBounds` or some other
      guard in optimized code before it). And since `elements` is allocated
      inside of the optimized code object, the escape analysis also knows
      that `elements` has exactly two elements inside (namely the values of
      `x` and `y`). So we can use that information and replace the access
      with a `Select(index===0,x,y)` operation instead, which allows us to
      scalar replace the `elements`, since there's no escaping use anymore
      in the graph.
      
      We do this for the case that the number of elements is 2, as described
      above, but also for the case where elements length is one. In case
      of 0, we know that the `LoadElement` must be in dead code, but we can't
      just mark it for deletion from the graph (to make sure it doesn't block
      scalar replacement of non-dead code), so we don't handle this for now.
      And for one element it's even easier, since the `LoadElement` has to
      yield exactly said element.
      
      We could generalize this to handle arbitrary lengths, but since there's
      a cost to arbitrary decision trees here, it's unclear when this is still
      beneficial. Another possible solution for length > 2 would be to have
      special stack allocation for these backing stores and do variable index
      accesses to these stack areas. But that's way beyond the scope of this
      isolated change.
      
      This change shows a ~2% improvement on the EarleyBoyer benchmark in
      JetStream, since it benefits a lot from not having to materialize these
      small arguments backing stores.
      
      Drive-by-fix: Fix JSCreateLowering to properly initialize "elements"
      with StoreElement instead of StoreField (which violates the invariant
      in TurboFan that fields and elements never alias).
      
      Bug: v8:5267, v8:6200
      Change-Id: Idd464a15a81e7c9653c48c814b406eb859841428
      Reviewed-on: https://chromium-review.googlesource.com/c/1267935
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#56442}
      3e43ded9
  19. 21 Sep, 2018 1 commit
    • Jakob Kummerow's avatar
      Fix building with GCC 7.x and 8.x · 9ed4b965
      Jakob Kummerow authored
      GCC 7.x doesn't like it (-Werror=subobject-linkage) when a class
      either derives from a class or has a member field of a type that
      was declared in an anonymous namespace.
      It is also opposed (-Werror=attributes) to visibility attributes
      being defined at explicit template instantiations.
      GCC 8.x further has reservations (-Werror=class-memaccess) about
      letting memset/memcpy modify areas within non-POD objects.
      
      Change-Id: Ic5107bb5ee3af6233e3741e3ef78d03a0a84005a
      Reviewed-on: https://chromium-review.googlesource.com/1208306
      Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarBen Titzer <titzer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#56106}
      9ed4b965
  20. 11 Sep, 2018 1 commit
  21. 04 Jul, 2018 1 commit
  22. 30 Apr, 2018 1 commit
  23. 28 Apr, 2018 1 commit
  24. 10 Mar, 2018 1 commit
    • Tobias Tebbi's avatar
      [turbofan] escape analysis: no longer remove TypeGuard nodes · 94bbb8bb
      Tobias Tebbi authored
      The analysis phase used to skip TypeGuard nodes, which are
      normally re-introduced by the reduction phase. However, phi nodes
      are created during the analysis phase already, and so it could happen
      that a phi input skips a TypeGuard.
      
      This CL solves the problem by not removing TypeGuard nodes in the first
      place, but only forwarding the VirtualObject. This is analogous to how
      we already treat FinishRegion nodes, which are similar in that they are
      a renaming too.
      
      Bug: chromium:741225
      Change-Id: Icf8aa2d40a30d89788d875b37b9986111f9c966f
      Reviewed-on: https://chromium-review.googlesource.com/958442
      Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#51863}
      94bbb8bb
  25. 11 Dec, 2017 1 commit
  26. 15 Nov, 2017 2 commits
  27. 14 Nov, 2017 1 commit
    • Michael Stanton's avatar
      Revert "[TurboFan] Diagnostic code to track down bug in representation selection" · ebe6d7a9
      Michael Stanton authored
      This reverts commit f010b28f.
      
      Reason for revert: Introduces a clusterfuzz issue and CAnary crash
      
      Original change's description:
      > [TurboFan] Diagnostic code to track down bug in representation selection
      > 
      > We need to characterize the types of dead (IrOpcode::kDead) nodes
      > introduced in compilation phases prior to representation selection.
      > Normally, a dead node isn't expected at the start of this phase. The
      > question is, which phase introduced the dead node and failed to
      > deal with it properly?
      > 
      > Bug: chromium:780658
      > Change-Id: Ief5b45480bb7d704a2d09dafd60b5d389e0fd42e
      > Reviewed-on: https://chromium-review.googlesource.com/765968
      > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
      > Commit-Queue: Michael Stanton <mvstanton@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#49328}
      
      TBR=mvstanton@chromium.org,mstarzinger@chromium.org
      
      Change-Id: I5d628eb1de630ce4a353b6ef0f80fd74ad740f17
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: chromium:780658
      Reviewed-on: https://chromium-review.googlesource.com/768747Reviewed-by: 's avatarMichael Stanton <mvstanton@chromium.org>
      Commit-Queue: Michael Stanton <mvstanton@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#49347}
      ebe6d7a9
  28. 13 Nov, 2017 1 commit
  29. 08 Nov, 2017 1 commit
  30. 20 Oct, 2017 1 commit
  31. 19 Oct, 2017 2 commits
    • Jaroslav Sevcik's avatar
      Revert "[turbofan] Load elimination prunes control flow based on instance type." · 8f09a751
      Jaroslav Sevcik authored
      This reverts commit 71bcc1d9.
      
      Reason for revert: Regresses Octane/Box2D, among other things.
      
      Original change's description:
      > [turbofan] Load elimination prunes control flow based on instance type.
      > 
      > Changes:
      > - introduce the notion of unreachable abstract states.
      > 
      > - reconnect unreachables states to runtime abort in effect phis (so that
      >   the merged states are not polluted by unreachable branches while
      >   preserving SSA).
      > 
      > - mark states with failed map checks, unreachable map guars as unreachable.
      > 
      > - add instance type to AbstractMaps, only invalidate instance type on
      >   mismatched effect merges.
      > 
      > 
      > This results in 2-3% improvement on ARES/ML steady state.
      > 
      > Bug: v8:6396
      > Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
      > Reviewed-on: https://chromium-review.googlesource.com/727761
      > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
      > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#48742}
      
      TBR=jarin@chromium.org,bmeurer@chromium.org
      
      Change-Id: I6302b37dbf5ea781c64815ef1900681531ad7d71
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:6396
      Reviewed-on: https://chromium-review.googlesource.com/728440Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48763}
      8f09a751
    • Jaroslav Sevcik's avatar
      [turbofan] Load elimination prunes control flow based on instance type. · 71bcc1d9
      Jaroslav Sevcik authored
      Changes:
      - introduce the notion of unreachable abstract states.
      
      - reconnect unreachables states to runtime abort in effect phis (so that
        the merged states are not polluted by unreachable branches while
        preserving SSA).
      
      - mark states with failed map checks, unreachable map guars as unreachable.
      
      - add instance type to AbstractMaps, only invalidate instance type on
        mismatched effect merges.
      
      
      This results in 2-3% improvement on ARES/ML steady state.
      
      Bug: v8:6396
      Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
      Reviewed-on: https://chromium-review.googlesource.com/727761Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48742}
      71bcc1d9
  32. 28 Sep, 2017 1 commit
    • Peter Marshall's avatar
      [cleanup] Remove List. · 690d52af
      Peter Marshall authored
      ZoneList still used List as a base class, so this CL merges the two
      classes together. We also remove unused functions in List and ZoneList.
      
      We keep the inline header but move it to src/zone/zone-list-inl.h. The
      includes that use this header are still quite tangled, but we can fix
      that later.
      
      Bug: v8:6333
      Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
      Change-Id: Ia809813834b2328ff616623f8a843812a1eb42a7
      Reviewed-on: https://chromium-review.googlesource.com/681658
      Commit-Queue: Peter Marshall <petermarshall@chromium.org>
      Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48200}
      690d52af
  33. 25 Sep, 2017 1 commit
  34. 13 Sep, 2017 1 commit
  35. 07 Sep, 2017 1 commit
  36. 30 Aug, 2017 2 commits
  37. 21 Aug, 2017 1 commit