Commits · deb5f524d7e7dd011bc245cb24e83358e22826f8 · Linshizhi / V8

10 Sep, 2015 18 commits

Enable loads and stores to global vars through property cell shortcuts... · deb5f524

ishell authored Sep 10, 2015

Enable loads and stores to global vars through property cell shortcuts installed into parent script context.

Review URL: https://codereview.chromium.org/1330213003

Cr-Commit-Position: refs/heads/master@{#30684}

deb5f524

Add instrumentation to track down a crasher · 071d03a4

jkummerow authored Sep 10, 2015

LoadICs must always return a JS-accessible value (nothing internal).
Dictionary property keys are guaranteed to be unique names.

BUG=chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1334673003

Cr-Commit-Position: refs/heads/master@{#30683}

071d03a4

[es6] fixup for rest parameters perf test · 0cc8eaa4

caitpotter88 authored Sep 10, 2015

BUG=v8:2160
LOG=N
NOTRY=true
R=adamk, machenbach@chromium.org, rossberg

Review URL: https://codereview.chromium.org/1331803003

Cr-Commit-Position: refs/heads/master@{#30682}

0cc8eaa4

Continuing removing deprecated functions from cctests · edb30522

mythria authored Sep 10, 2015

Removes deprecated functions from:
- test-unique.cc
- test-unscopables-hidden-prototype.cc
- test-utils-arm64.cc
- test-utils.cc
- test-version.cc
- test-weakmaps.cc
- test-weaksets.cc
- trace-extension.cc
- trace-extension.h

BUG=v8:4134
LOG=n

Review URL: https://codereview.chromium.org/1331013003

Cr-Commit-Position: refs/heads/master@{#30681}

edb30522

[runtime] Move binary operator fallbacks into the runtime. · a1b2ec60

bmeurer authored Sep 10, 2015

Replace the ADD, SUB, etc. builtins with proper runtime implementations,
and expose them as runtime calls that can be used by the code stubs and
the interpreter (for now).

Also remove all the support runtime functions for ADD, SUB and friends,
namely %NumberAdd, %NumberSub, and so on.

R=mstarzinger@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg

Review URL: https://codereview.chromium.org/1333843002

Cr-Commit-Position: refs/heads/master@{#30680}

a1b2ec60

Do not look for the slot in the ScopeInfo's global range when it's not necessary. · a1c1e2bd

ishell authored Sep 10, 2015

This fixes the Runtime_DeclareGlobals performance regression caused by a huge number of global var declarations mentioned in chromium:517778.

BUG=chromium:517778
LOG=N

Review URL: https://codereview.chromium.org/1335633002

Cr-Commit-Position: refs/heads/master@{#30679}

a1c1e2bd

TypedArray accessor detection: consider entire prototype chain · 6da51b4b

fedor authored Sep 10, 2015

When looking up a special accessor for known TypedArray fields
("length", "byteLength", "byteOffset"), consider the entire prototype
chain, not only the direct prototype.
This allows subclasses of TypedArrays to benefit from fast specialized
accesses.

Review URL: https://codereview.chromium.org/1313493005

Cr-Commit-Position: refs/heads/master@{#30678}

6da51b4b

Fix for v8:4380 introduced a regression in Octane crypto. · ebd16fd8

mvstanton authored Sep 10, 2015

Narrowed the scope of the fix, to make a best effort to avoid DEOPT in
case the hole is loaded, but not to permute the choice of a consolidated
load in case that effort fails.

BUG=chromium:530005
LOG=N

Review URL: https://codereview.chromium.org/1330233004

Cr-Commit-Position: refs/heads/master@{#30677}

ebd16fd8

Adding template parameter to PrototypeIterator GetCurrent · aacaafd0

cbruni authored Sep 10, 2015

BUG=

Review URL: https://codereview.chromium.org/1330153003

Cr-Commit-Position: refs/heads/master@{#30676}

aacaafd0

[runtime] Remove Runtime::KeyedGetObjectProperty function. · 763c68e4

mstarzinger authored Sep 10, 2015

R=conradw@chromium.org

Review URL: https://codereview.chromium.org/1317033009

Cr-Commit-Position: refs/heads/master@{#30675}

763c68e4

[turbofan] Disable test that started to timeout. · 5e156798

mstarzinger authored Sep 10, 2015

The two tests in question got a lot slower and started to timeout now
that the C++ fallback implementation of the %Arguments intrinsics is
composable with respect to inlining.

R=bmeurer@chromium.org,machenbach@chromium.org

Review URL: https://codereview.chromium.org/1330203003

Cr-Commit-Position: refs/heads/master@{#30674}

5e156798

[turbofan] Remove obsolete --turbo-try-catch flag. · a676da3a

mstarzinger authored Sep 10, 2015

This removes the aforementioned flag which has been on by default for a
while now. Note that this does not control optimization decisions, only
the last-resort bailout in the graph builder.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1335543002

Cr-Commit-Position: refs/heads/master@{#30673}

a676da3a

X87: On a call to Array(), we patched a call ic. · cfbe3f64

chunyang.dai authored Sep 10, 2015

port ba7b6413 (r30649)

original commit message:

   This CL makes do with a single dispatcher which inlines the special handling for the Array() call case, loading the allocation site found in the vector and c

BUG=

Review URL: https://codereview.chromium.org/1330993004

Cr-Commit-Position: refs/heads/master@{#30672}

cfbe3f64

[runtime] Sanitize %NewClosure runtime entries. · 6b3c070d

bmeurer authored Sep 10, 2015

There are now two runtime entries %NewClosure and %NewClosure_Tenured,
with the same signature (one parameter, the SharedFunctionInfo, and the
context of the caller).

Also remove the HFunctionLiteral special case instruction from Crankshaft,
as HCallWithDescriptor with FastNewClosureStub or HCallRuntime with
either %NewClosure or %NewClosure_Tenured can easily do that for you.

Also remove the redundant context parameter from the JSCreateClosure
operator, because every JS operator already takes a context input.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg

Review URL: https://codereview.chromium.org/1329293003

Cr-Commit-Position: refs/heads/master@{#30671}

6b3c070d

MIPS: Fix illegal use of at register · 9e05ee74

Djordje.Pesic authored Sep 10, 2015

Fix illegal use of at register when ldc1 and sdc1 are called. Added dchecks to prevent such a usage.

TEST=mjsunit/asm/float64array-negative-offset(r6), mjsunit/asm/float64array-outofbounds(r6)

Review URL: https://codereview.chromium.org/1323763002

Cr-Commit-Position: refs/heads/master@{#30670}

9e05ee74

X87: [calls] Consistent call protocol for calls. · 99f01307

chunyang.dai authored Sep 10, 2015

port b37907ff (r30648).

original commit message:

    The number of actual arguments should always be available, there's no
    point in trying to optimize away a simple assignment of an immediate to
    a register before some calls.

    The main motivation is to have a consistent state at the beginning of every
    function. Currently the arguments register (i.e. rax or eax) either contains
    the number of arguments or some random garbage depending on whether
    the callsite decided that the callee might need the information or not.
    This causes trouble with runtime implementations of functions that
    do not set internal_formal_parameter_count to the DontAdaptArguments
    sentinel (we don't have any of those yet), but also makes it impossible
    to sanity check the arguments in the callee, because the callee doesn't
    know whether the caller decided to pass the number of arguments or
    random garbage.

BUG=

Review URL: https://codereview.chromium.org/1335453002

Cr-Commit-Position: refs/heads/master@{#30669}

99f01307

X87: [builtins] Unify the various versions of [[Call]] with a Call builtin. · 20c9749b

chunyang.dai authored Sep 10, 2015

port ccbb4ff0 (r30629)

original commit message:

    The new Call and CallFunction builtins supersede the current
    CallFunctionStub (and CallIC magic) and will be the single bottleneck
    for all calling, including the currently special Function.prototype.call
    and Function.prototype.apply builtins, which had handwritten (and
    not fully compliant) versions of CallFunctionStub, and also the
    CallIC(s), which where also slightly different.

    This also reduces the overhead for API function calls, which is still
    unnecessary high, but let's do that step-by-step.

    This also fixes a bunch of cases where the implicit ToObject for
    sloppy receivers was done in the wrong context (in the caller
    context instead of the callee context), which basically meant
    that we allowed cross context access to %ObjectPrototype%.

BUG=

Review URL: https://codereview.chromium.org/1332703002

Cr-Commit-Position: refs/heads/master@{#30668}

20c9749b

X87: [runtime] Replace many buggy uses of %_CallFunction with %_Call. · 0cfa52d0

chunyang.dai authored Sep 10, 2015

port db2ba190 (r30634).

original commit message:

    The semantics of the %_CallFunction intrinsic seem to be very unclear,
    which resulted in a lot of bugs. Especially the combination with
    %IsSloppyModeFunction is always a bug, because the receiver would be
    wrapped in the wrong context. So the %IsSloppyModeFunction helper is
    gone now, and many of the buggy uses of %_CallFunction are also
    eliminated.

    If you ever need to call something with a different receiver, then
    %_Call is your friend now. It does what you want and implements the
    call sequence fully (and correct).

Review URL: https://codereview.chromium.org/1336443002

Cr-Commit-Position: refs/heads/master@{#30667}

0cfa52d0

09 Sep, 2015 19 commits

PPC: Fix "Desugar %DefaultConstructorCallSuper partially in parser." · f852f56c

mbrandy authored Sep 09, 2015

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1303333009

Cr-Commit-Position: refs/heads/master@{#30666}

f852f56c

[turbofan] relative_id of splinters and their children. · 96c0e6f9

mtrofin authored Sep 09, 2015

A LiveRange is identified by 2 integers: the vreg() of its TopLevel,
which is the virtual register (operand) ID; and a relative_id(), which has
no meaning in the program, but is valuable in debugging or tracing
scenarios.

This change ensures that relative_id is unique even in cases of splinter
ranges and their children.

Review URL: https://codereview.chromium.org/1318493005

Cr-Commit-Position: refs/heads/master@{#30665}

96c0e6f9

Desugar %DefaultConstructorCallSuper partially in parser. · 5b938f52

mstarzinger authored Sep 09, 2015

This desugars the loading of the super constructor function using the
%GetPrototype runtime function in the parser. The produced code remains
the same while fewer parts need to be glued together.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1321343004

Cr-Commit-Position: refs/heads/master@{#30664}

5b938f52

[runtime] Move AtomicIsLockFree out of Runtime class. · a14d2dfa

mstarzinger authored Sep 09, 2015

R=binji@chromium.org

Review URL: https://codereview.chromium.org/1327743004

Cr-Commit-Position: refs/heads/master@{#30663}

a14d2dfa

PPC: [calls] Consistent call protocol for calls. · 422b0fa7

mbrandy authored Sep 09, 2015

Port b37907ff

Original commit message:
    The number of actual arguments should always be available, there's no
    point in trying to optimize away a simple assignment of an immediate to
    a register before some calls.

    The main motivation is to have a consistent state at the beginning of every
    function. Currently the arguments register (i.e. rax or eax) either contains
    the number of arguments or some random garbage depending on whether
    the callsite decided that the callee might need the information or not.
    This causes trouble with runtime implementations of functions that
    do not set internal_formal_parameter_count to the DontAdaptArguments
    sentinel (we don't have any of those yet), but also makes it impossible
    to sanity check the arguments in the callee, because the callee doesn't
    know whether the caller decided to pass the number of arguments or
    random garbage.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1314353007

Cr-Commit-Position: refs/heads/master@{#30662}

422b0fa7

PPC: On a call to Array(), we patched a call ic. This CL makes do with a... · 50fa1e50

mbrandy authored Sep 09, 2015

PPC: On a call to Array(), we patched a call ic. This CL makes do with a single dispatcher which inlines the special handling for the Array() call case, loading the allocation site found in the vector and calling the array constructor stub appropriately.

Port ba7b6413

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1322103005

Cr-Commit-Position: refs/heads/master@{#30661}

50fa1e50

[Interpreter] Add support for property store operations. · 23f7d34d

rmcilroy authored Sep 09, 2015

Adds support for property store operations via Store/KeyedStore ICs. Adds the
following bytecodes:
 - StoreIC
 - KeyedStoreIC

The --vector_store flag is now required for --ignition.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1319833004

Cr-Commit-Position: refs/heads/master@{#30660}

23f7d34d

Crankshaft: consolidated element loads always deopted on seeing the hole · 164f92d2

mvstanton authored Sep 09, 2015

Update the consolidated load case to carefully chose the load mode
based on the consolidated elements kind.

BUG=v8:4380
LOG=N

Review URL: https://codereview.chromium.org/1329793003

Cr-Commit-Position: refs/heads/master@{#30659}

164f92d2

AIX: Fix 'may be used uninitialized' compiler errors · 44b9f1e7

mbrandy authored Sep 09, 2015

Fix additional cases where the AIX compiler reports that a variable
may be used uninitialized.

R=danno@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1323313003

Cr-Commit-Position: refs/heads/master@{#30658}

44b9f1e7

PPC: Reland Vector ICs: platform support for vector-based stores. · 1b191a5d

mbrandy authored Sep 09, 2015

Port 40fbed06

Original commit message:
    The last changes for vector store functionality, they are in 3 areas:

    1) The new vector [keyed] store code stubs - implementation.
    2) IC and handler compiler adjustments
    3) Odds and ends. A change in ast.cc, a test update, a small Oracle fix.

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1330883002

Cr-Commit-Position: refs/heads/master@{#30657}

1b191a5d

PPC: [builtins] Unify the various versions of [[Call]] with a Call builtin. · 31a9396e

mbrandy authored Sep 09, 2015

Port ccbb4ff0

Original commit message:
    The new Call and CallFunction builtins supersede the current
    CallFunctionStub (and CallIC magic) and will be the single bottleneck
    for all calling, including the currently special Function.prototype.call
    and Function.prototype.apply builtins, which had handwritten (and
    not fully compliant) versions of CallFunctionStub, and also the
    CallIC(s), which where also slightly different.

    This also reduces the overhead for API function calls, which is still
    unnecessary high, but let's do that step-by-step.

    This also fixes a bunch of cases where the implicit ToObject for
    sloppy receivers was done in the wrong context (in the caller
    context instead of the callee context), which basically meant
    that we allowed cross context access to %ObjectPrototype%.

    MIPS and MIPS64 ports contributed by akos.palfi@imgtec.com.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1327093002

Cr-Commit-Position: refs/heads/master@{#30656}

31a9396e

PPC: [runtime] Replace many buggy uses of %_CallFunction with %_Call. · 50c6b031

mbrandy authored Sep 09, 2015

Port db2ba190

Original commit message:
    The semantics of the %_CallFunction intrinsic seem to be very unclear,
    which resulted in a lot of bugs. Especially the combination with
    %IsSloppyModeFunction is always a bug, because the receiver would be
    wrapped in the wrong context. So the %IsSloppyModeFunction helper is
    gone now, and many of the buggy uses of %_CallFunction are also
    eliminated.

    If you ever need to call something with a different receiver, then
    %_Call is your friend now. It does what you want and implements the
    call sequence fully (and correct).

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1310303008

Cr-Commit-Position: refs/heads/master@{#30655}

50c6b031

[turbofan] Make %Arguments composable with inlining. · a504a184

mstarzinger authored Sep 09, 2015

This makes the C++ fallback implementations for the two intrinsics,
%Arguments and %ArgumentsLength composable with respect to inlining.
Using deoptimization information gives us accurate data here.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4374
BUG=v8:4374
LOG=n

Review URL: https://codereview.chromium.org/1328363002

Cr-Commit-Position: refs/heads/master@{#30654}

a504a184

MIPS64: Fix 'On a call to Array(), we patched a call ic.' · da830b0e

balazs.kilvady authored Sep 09, 2015

Port ba7b6413

Original commit message:
This CL makes do with a single dispatcher which inlines the special handling for the Array() call case, loading the allocation site found in the vector and calling the array constructor stub appropriately.

BUG=

Review URL: https://codereview.chromium.org/1324093005

Cr-Commit-Position: refs/heads/master@{#30653}

da830b0e

[runtime] Remove unused %NumberUnaryMinus runtime function. · 100da0a7

bmeurer authored Sep 09, 2015

This has been dead code for quite a while now.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1314353006

Cr-Commit-Position: refs/heads/master@{#30652}

100da0a7

[turbofan] Handle stack overflow exceptions in JSInliner. · c505907d

mstarzinger authored Sep 09, 2015

R=bmeurer@chromium.org
BUG=chromium:527364
LOG=n

Review URL: https://codereview.chromium.org/1322203005

Cr-Commit-Position: refs/heads/master@{#30651}

c505907d

Use v8-reviews@ for review mail, so v8-dev@ is free for dev discussions · 65ba650f

jochen authored Sep 09, 2015

BUG=none
R=danno@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1308953011

Cr-Commit-Position: refs/heads/master@{#30650}

65ba650f

On a call to Array(), we patched a call ic. This CL makes do with a single... · ba7b6413

mvstanton authored Sep 09, 2015

On a call to Array(), we patched a call ic. This CL makes do with a single dispatcher which inlines the special handling for the Array() call case, loading the allocation site found in the vector and calling the array constructor stub appropriately.

BUG=

Review URL: https://codereview.chromium.org/1332563003

Cr-Commit-Position: refs/heads/master@{#30649}

ba7b6413

[calls] Consistent call protocol for calls. · b37907ff

bmeurer authored Sep 09, 2015

The number of actual arguments should always be available, there's no
point in trying to optimize away a simple assignment of an immediate to
a register before some calls.

The main motivation is to have a consistent state at the beginning of every
function. Currently the arguments register (i.e. rax or eax) either contains
the number of arguments or some random garbage depending on whether
the callsite decided that the callee might need the information or not.
This causes trouble with runtime implementations of functions that
do not set internal_formal_parameter_count to the DontAdaptArguments
sentinel (we don't have any of those yet), but also makes it impossible
to sanity check the arguments in the callee, because the callee doesn't
know whether the caller decided to pass the number of arguments or
random garbage.

BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1330033002

Cr-Commit-Position: refs/heads/master@{#30648}

b37907ff

08 Sep, 2015 3 commits

[es6] add js-perf-test for rest parameters · ce95a4db

caitpotter88 authored Sep 08, 2015

BUG=v8:2160
LOG=N
R=adamk, rossberg, wingo

Review URL: https://codereview.chromium.org/1317113007

Cr-Commit-Position: refs/heads/master@{#30647}

ce95a4db

MIPS: minor cleanup in macro-assembler. · e4a8161a

paul.lind authored Sep 08, 2015

Fix some dodgy temp-register usage and remove some unnecessary
push/pop's.

BUG=

Review URL: https://codereview.chromium.org/1324553004

Cr-Commit-Position: refs/heads/master@{#30646}

e4a8161a

MIPS64: [turbofan] Improve changes from and to Smi. · 4329a7c2

dusan.m.milosavljevic authored Sep 08, 2015

The instruction selection for following sequences is
improved:

  113: Word64Sar(107, 91) : Internal/Any
  114: TruncateInt64ToInt32(113) : Signed32/UntaggedSigned32
  115: ChangeInt32ToFloat64(114) : Signed32/UntaggedFloat64

TEST=unittests/InstructionSelectorTest.ChangesFromToSmi
BUG=

Review URL: https://codereview.chromium.org/1318153006

Cr-Commit-Position: refs/heads/master@{#30645}

4329a7c2