AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
361bb1a047
v8/src/compiler/effect-control-linearizer.h

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

191 lines
7.8 KiB
C
Raw Normal View History

[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
#define V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
#include "src/compiler/common-operator.h"
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
#include "src/compiler/graph-assembler.h"
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
#include "src/compiler/node.h"
#include "src/compiler/simplified-operator.h"
Make unittests work in component build R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org BUG= CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe Review-Url: https://codereview.chromium.org/2416243002 Cr-Commit-Position: refs/heads/master@{#40350}
2016-10-17 10:01:42 +00:00
#include "src/globals.h"
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
namespace v8 {
namespace internal {
[turbofan] Lower StringEqual and friends in EffectControlLinearizer. Turn the StringEqualStub and friends into proper TurboFan builtins, which means that we don't need to do on-demand compilation for those stubs, and use those to defer lowering of the StringEqual, etc. simplified operators to effect/control linearization (i.e. move it to the concurrent recompilation part). BUG=v8:5428 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2363333003 Cr-Commit-Position: refs/heads/master@{#39762}
2016-09-27 11:24:07 +00:00
// Forward declarations.
class Callable;
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
class Zone;
namespace compiler {
class CommonOperatorBuilder;
class SimplifiedOperatorBuilder;
class MachineOperatorBuilder;
class JSGraph;
class Graph;
class Schedule;
[turbofan] track source positions in EffectControlLinearizer R=jarin@chromium.org BUG= Review-Url: https://codereview.chromium.org/2504913003 Cr-Commit-Position: refs/heads/master@{#41040}
2016-11-16 15:06:05 +00:00
class SourcePositionTable;
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
Make unittests work in component build R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org BUG= CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe Review-Url: https://codereview.chromium.org/2416243002 Cr-Commit-Position: refs/heads/master@{#40350}
2016-10-17 10:01:42 +00:00
class V8_EXPORT_PRIVATE EffectControlLinearizer {
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
public:
[turbofan] track source positions in EffectControlLinearizer R=jarin@chromium.org BUG= Review-Url: https://codereview.chromium.org/2504913003 Cr-Commit-Position: refs/heads/master@{#41040}
2016-11-16 15:06:05 +00:00
EffectControlLinearizer(JSGraph* graph, Schedule* schedule, Zone* temp_zone,
SourcePositionTable* source_positions);
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
void Run();
private:
[turbofan] Add frame state propagation to linearizer. This implements propagation of frame states from checkpoints to all deoptimization points inserted by the EffectControlLinearizer. It also allows us to remove the eager frame state input from all the checked conversion operations. R=jarin@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2033143002 Cr-Commit-Position: refs/heads/master@{#36710}
2016-06-03 11:37:18 +00:00
void ProcessNode(Node* node, Node** frame_state, Node** effect,
Node** control);
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
[turbofan] Add frame state propagation to linearizer. This implements propagation of frame states from checkpoints to all deoptimization points inserted by the EffectControlLinearizer. It also allows us to remove the eager frame state input from all the checked conversion operations. R=jarin@chromium.org BUG=v8:5021 Review-Url: https://codereview.chromium.org/2033143002 Cr-Commit-Position: refs/heads/master@{#36710}
2016-06-03 11:37:18 +00:00
bool TryWireInStateEffect(Node* node, Node* frame_state, Node** effect,
Node** control);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerChangeBitToTagged(Node* node);
Node* LowerChangeInt31ToTaggedSigned(Node* node);
Node* LowerChangeInt32ToTagged(Node* node);
Node* LowerChangeUint32ToTagged(Node* node);
Node* LowerChangeFloat64ToTagged(Node* node);
Node* LowerChangeFloat64ToTaggedPointer(Node* node);
Node* LowerChangeTaggedSignedToInt32(Node* node);
Node* LowerChangeTaggedToBit(Node* node);
Node* LowerChangeTaggedToInt32(Node* node);
Node* LowerChangeTaggedToUint32(Node* node);
[turbofan] Introduce ChangeTaggedToTaggedSigned operator. We were missing a case for Tagged->TaggedSigned conversions when the input type is known to be Type::SignedSmall. BUG=chromium:687029 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2666863002 Cr-Commit-Position: refs/heads/master@{#42809}
2017-01-31 08:55:56 +00:00
Node* LowerChangeTaggedToTaggedSigned(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerCheckBounds(Node* node, Node* frame_state);
Node* LowerCheckInternalizedString(Node* node, Node* frame_state);
Node* LowerCheckMaps(Node* node, Node* frame_state);
[turbofan] Introduce a dedicated CompareMaps operator. Instead of introducing a lot of explicit branching in the JSNativeContextSpecialization for polymorphic property accesses that cannot be folded into a single LoadField/StoreField, and which are mostly invisible and not optimizable for later passes, we now have a single CompareMaps operator that takes a set of maps (like the CheckMaps operator) and produces a boolean indicating the result of the comparison. R=jarin@chromium.org Bug: v8:6761 Change-Id: Iee8788e915b762d542acb54feb9931346e442dc0 Reviewed-on: https://chromium-review.googlesource.com/636365 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47635}
2017-08-28 07:27:27 +00:00
Node* LowerCompareMaps(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerCheckNumber(Node* node, Node* frame_state);
[turbofan] Add Receiver feedback for abstract/strict equality. Collect Receiver feedback for abstract/strict equality in Ignition and use it in TurboFan to optimize JSEqual and JSStrictEqual operations to pointer equality instead of having to call Equal/StrictEqual builtins. R=jarin@chromium.org BUG=v8:5267,v8:5400 Review-Url: https://codereview.chromium.org/2639883002 Cr-Commit-Position: refs/heads/master@{#42435}
2017-01-18 07:10:51 +00:00
Node* LowerCheckReceiver(Node* node, Node* frame_state);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerCheckString(Node* node, Node* frame_state);
[turbofan] Add CheckSeqString so that we have type info for CharCodeAt. Bug: v8:6391 Change-Id: If63078c756d9cfb00e515fae005755c4ed8b12f7 Reviewed-on: https://chromium-review.googlesource.com/512803 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#45549}
2017-05-24 14:05:05 +00:00
Node* LowerCheckSeqString(Node* node, Node* frame_state);
[turbofan] Add Symbol feedback to Equal/StrictEqual. Introduce a new Symbol comparison feedback bit in the lattice and collect that feedback on Equal/StrictEqual in Ignition. Utilize this feedback in TurboFan by adding a dedicated CheckSymbol operator to check for symbol inputs. This way we can optimize Symbol comparison where TurboFan doesn't know anything statically about either side, or abstract equality comparisons where TurboFan doesn't statically know anything about one side. BUG=v8:6278,v8:6344,v8:6423 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2893263002 Cr-Commit-Position: refs/heads/master@{#45455}
2017-05-22 12:07:40 +00:00
Node* LowerCheckSymbol(Node* node, Node* frame_state);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerCheckIf(Node* node, Node* frame_state);
Node* LowerCheckedInt32Add(Node* node, Node* frame_state);
Node* LowerCheckedInt32Sub(Node* node, Node* frame_state);
Node* LowerCheckedInt32Div(Node* node, Node* frame_state);
Node* LowerCheckedInt32Mod(Node* node, Node* frame_state);
Node* LowerCheckedUint32Div(Node* node, Node* frame_state);
Node* LowerCheckedUint32Mod(Node* node, Node* frame_state);
Node* LowerCheckedInt32Mul(Node* node, Node* frame_state);
Node* LowerCheckedInt32ToTaggedSigned(Node* node, Node* frame_state);
Node* LowerCheckedUint32ToInt32(Node* node, Node* frame_state);
Node* LowerCheckedUint32ToTaggedSigned(Node* node, Node* frame_state);
Node* LowerCheckedFloat64ToInt32(Node* node, Node* frame_state);
Node* LowerCheckedTaggedSignedToInt32(Node* node, Node* frame_state);
Node* LowerCheckedTaggedToInt32(Node* node, Node* frame_state);
Node* LowerCheckedTaggedToFloat64(Node* node, Node* frame_state);
Node* LowerCheckedTaggedToTaggedSigned(Node* node, Node* frame_state);
Node* LowerCheckedTaggedToTaggedPointer(Node* node, Node* frame_state);
Node* LowerChangeTaggedToFloat64(Node* node);
Node* LowerTruncateTaggedToBit(Node* node);
[turbofan] Introduce TruncateTaggedPointerToBit operator. Oftentimes we can avoid the Smi check for ToBoolean truncations, since we already know that the input is always going to be a HeapObject. So introduce a dedicated TruncateTaggedPointerToBit operator, which uses the fact that the input is known to be a HeapObject. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2738483002 Cr-Commit-Position: refs/heads/master@{#43629}
2017-03-07 10:11:16 +00:00
Node* LowerTruncateTaggedPointerToBit(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerTruncateTaggedToFloat64(Node* node);
Node* LowerTruncateTaggedToWord32(Node* node);
Node* LowerCheckedTruncateTaggedToWord32(Node* node, Node* frame_state);
[turbofan] Inline ArrayBuffer.isView into optimized code. This improves performance of ArrayBuffer.isView by roughly 2.5x itself, and enables optimizations across ArrayBuffer.isView calls, i.e. map checks can be eliminated across. This was discovered in a related Node pull request (https://github.com/nodejs/node/pull/15663). Bug: v8:6868 Change-Id: I1d56ec385f8daa0e1d44d3bc4d6c9a5558ba4522 Reviewed-on: https://chromium-review.googlesource.com/691660 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48247}
2017-09-29 09:10:16 +00:00
Node* LowerObjectIsArrayBufferView(Node* node);
[turbofan] Fix missing callability check on Array callbacks This fixes the second-order Array.prototype function {forEach} and {map} to now perform a callability check of the given callback function. For empty arrays it is observable whether such a check outside the loop has been elided or not. R=mvstanton@chromium.org TEST=mjsunit/regress/regress-crbug-747062 BUG=chromium:747062 Change-Id: I1bbe7f44b3b3d18e9b41ad0436975434adf84321 Reviewed-on: https://chromium-review.googlesource.com/588893 Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#46942}
2017-07-27 13:09:49 +00:00
Node* LowerObjectIsCallable(Node* node);
[turbofan] Fix new.target check in Reflect.construct. This adds and explicit check for the constructability of the new.target value in the lowering of {JSCall} nodes known to call Reflect.construct. The {JSConstruct} operator does not perform this check and relies on the implicit validity of new.target in all other use cases. R=jarin@chromium.org TEST=mjsunit/regress/regress-crbug-768080 BUG=chromium:768080 Change-Id: I7c1921e787bae64ba83de3eb08aa00fc5523e251 Reviewed-on: https://chromium-review.googlesource.com/718100 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#48543}
2017-10-13 08:49:00 +00:00
Node* LowerObjectIsConstructor(Node* node);
Fix typeof optimization for undetectable Currently, typeof o, where o is an undetectable callable object (such as document.all), returns 'function' if optimised. It should, however, return 'undefined'. This CL excludes undetectable objects from the optimization resulting in type 'function' and renames the related code to reflect that. BUG=v8:5972 R=bmeurer@chromium.org Review-Url: https://codereview.chromium.org/2697063002 Cr-Commit-Position: refs/heads/master@{#43298}
2017-02-18 12:43:37 +00:00
Node* LowerObjectIsDetectableCallable(Node* node);
[es2015] Optimize Object.is baseline and interesting cases. The Object.is builtin provides an entry point to the abstract operation SameValue, which properly distinguishes -0 and 0, and also identifies NaNs. Most of the time you don't need these, but rather just regular strict equality, but when you do, Object.is(o, -0) is the most readable way to check for minus zero. This is for example used in Node.js by formatNumber to properly print -0 for negative zero. However since the builtin thus far implemented as C++ builtin and TurboFan didn't know anything about it, Node.js considering to go with a more performant, less readable version (which also makes assumptions about the input value) in https://github.com/nodejs/node/pull/15726 until the performance of Object.is will be on par (so hopefully we can go back to Object.is in Node 9). This CL ports the baseline implementation of Object.is to CSA, which is pretty straight-forward since SameValue is already available in CodeStubAssembler, and inlines a few interesting cases into TurboFan, i.e. comparing same SSA node, and checking for -0 and NaN explicitly. On the micro-benchmarks we go from testNumberIsMinusZero: 1000 ms. testObjectIsMinusZero: 929 ms. testObjectIsNaN: 954 ms. testObjectIsSame: 793 ms. testStrictEqualSame: 104 ms. to testNumberIsMinusZero: 89 ms. testObjectIsMinusZero: 88 ms. testObjectIsNaN: 88 ms. testObjectIsSame: 86 ms. testStrictEqualSame: 105 ms. which is a nice 10x to 11x improvement and brings Object.is on par with strict equality for most cases. Drive-by-fix: Also refactor and optimize the SameValue check in the CodeStubAssembler to avoid code bloat (by not inlining StrictEqual into every user of SameValue, and also avoiding useless checks). Bug: v8:6882 Change-Id: Ibffd8c36511f219fcce0d89ed4e1073f5d6c6344 Reviewed-on: https://chromium-review.googlesource.com/700254 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48275}
2017-10-04 06:25:26 +00:00
Node* LowerObjectIsMinusZero(Node* node);
[turbofan] Introduce dedicated ObjectIsNaN operator. We can compile a !== a and Number.isNaN(a) to ObjectIsNaN. The former is commonly used to check for NaN, i.e. in case of equals in AngularJS. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2722483003 Cr-Commit-Position: refs/heads/master@{#43572}
2017-03-03 09:08:14 +00:00
Node* LowerObjectIsNaN(Node* node);
[turbofan] Optimize typeof o === "object" checks. Properly recognize and optimize typeof in a strict/abstract equality comparison with the string literal "object" to a check for Null or a check of the map for Receiver instance type and non-callable. Drive-by-fix: Also optimize typeof o === "function" somewhat, now that we have the new types for Callable and NonCallable. R=jarin@chromium.org BUG=v8:5267 Review-Url: https://codereview.chromium.org/2646763003 Cr-Commit-Position: refs/heads/master@{#42501}
2017-01-19 13:16:27 +00:00
Node* LowerObjectIsNonCallable(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerObjectIsNumber(Node* node);
Node* LowerObjectIsReceiver(Node* node);
Node* LowerObjectIsSmi(Node* node);
Node* LowerObjectIsString(Node* node);
[TurboFan] Add ObjectIsSymbol simplified operator. Used by ReduceJSEqualTypeOf, and will also be used to lower a new TestTypeof bytecode in a followup CL. BUG=v8:5267 Change-Id: I990aa6ac8ac0b9bd01080dda1764c5bfe3a4d7cf Reviewed-on: https://chromium-review.googlesource.com/454797 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#43802}
2017-03-14 16:14:58 +00:00
Node* LowerObjectIsSymbol(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerObjectIsUndetectable(Node* node);
[turbofan] escape analysis supports arguments object and rest elements The new NewUnmappedArgumentsElements node now takes two inputs: - the frame holding the arguments (current frame or arguments adaptor frame) - the length of the suffix of passed arguments to be copied into the backing store These inputs are computed with two new node types: ArgumentsFrame() ArgumentsLength[formal_parameter_count,is_rest_length](Node* arguments_frame) The node type NewRestParameterElements can now be expressed with NewUnmappedArgumentsElements and an appropriate length and is thus not needed anymore. In escape analysis, we lower loads from the length field of NewUnmappedArgumentsElements with its length input and if we find out that no write access to the arguments elements exists, we replace element loads with direct stack access and replace the NewUnmappedArgumentsElements node with a node of the new node type ArgumentsElementsState. This corresponds to an ObjectState node and gets translated into a deoptimizer instruction to allocate the backing store. Together with the already existing deoptimizer support for the actual arguments object/rest parameters, this allows to remove all allocations for arguments objects/rest parameters in this case. In the deoptimizer, we read the actual parameters from the stack while transforming the static deopt info into TranslatedValue objects. If escape analysis cannot remove the backing store allocation, NewUnmappedArgumentsElements gets lo BUG=v8:5726 Review-Url: https://codereview.chromium.org/2692753004 Cr-Commit-Position: refs/heads/master@{#43475}
2017-02-28 11:16:27 +00:00
Node* LowerArgumentsFrame(Node* node);
Node* LowerArgumentsLength(Node* node);
[turbofan] Make New*Elements operator naming consistent. We no longer use the terminology "fast elements", so drop the "Fast" from both NewFastSmiOrObjectElements and NewFastDoubleElements operator names. Bug: v8:6399, v8:6901 Tbr: jarin@chromium.org Change-Id: Icc204623f2b459b0d0e172e26ddd73e29fe6c884 Reviewed-on: https://chromium-review.googlesource.com/707246 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48399}
2017-10-09 16:49:07 +00:00
Node* LowerNewDoubleElements(Node* node);
Node* LowerNewSmiOrObjectElements(Node* node);
[turbofan] Add escape analysis support for mapped arguments. This adds support for the backing store of mapped arguments objects to escape analysis. It also unifies two simplified operators representing allocations of these backing stores into a single {NewArgumentsElements} operator and threads through the "mapped count" to the deoptimizer. R=tebbi@chromium.org Change-Id: I1864e29a5703348597b7b2e41deaf5fab73e2c93 Reviewed-on: https://chromium-review.googlesource.com/643208 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#47800}
2017-09-04 11:49:25 +00:00
Node* LowerNewArgumentsElements(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerArrayBufferWasNeutered(Node* node);
Node* LowerStringCharAt(Node* node);
Node* LowerStringCharCodeAt(Node* node);
[turbofan] Add SeqStringCharCodeAt operation. Add a sequential string type to the compiler, and transform charCodeAt on SeqString into SeqStringCharCodeAt. SeqStringCharCodeAt can handle one and two byte strings. Bug: v8:6391 Change-Id: I2785257522c28f3b268c9833f5313e9630cb982a Reviewed-on: https://chromium-review.googlesource.com/509573 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#45508}
2017-05-24 11:50:14 +00:00
Node* LowerSeqStringCharCodeAt(Node* node);
[turbofan] Redundancy elimination of String.to(Lower|Upper)Case(). This is mainly to enable optimization of case-insensitive maps, where we see the pattern if (m.has(key.toLowerCase())) { return m.get(key.toLowerCase()) } ... Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I8c78a185401c51e8a53ae2932a158eaafa169495 Reviewed-on: https://chromium-review.googlesource.com/547057 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#46206}
2017-06-26 08:19:08 +00:00
Node* LowerStringToLowerCaseIntl(Node* node);
Node* LowerStringToUpperCaseIntl(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerStringFromCharCode(Node* node);
Node* LowerStringFromCodePoint(Node* node);
[turbofan] Introduce dedicated StringIndexOf operator. The StringIndexOf operation is pure on the JS level, but the actual stub call must be in the effect chain later so that the Scheduler doesn't place it inside some allocation region (The %StringIndexOf runtime function may trigger a GC for string flattening). BUG=chromium:685580 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2657243002 Cr-Commit-Position: refs/heads/master@{#42736}
2017-01-27 12:02:42 +00:00
Node* LowerStringIndexOf(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerStringEqual(Node* node);
Node* LowerStringLessThan(Node* node);
Node* LowerStringLessThanOrEqual(Node* node);
Node* LowerCheckFloat64Hole(Node* node, Node* frame_state);
[Interpreter] Introduce bytecodes that check for hole and throw. Introduces ThrowReferenceErrorIfHole / ThrowSuperNotCalledIfHole / ThrowSuperAlreadyCalledIfNotHole bytecodes to handle hole checks. In the bytecode-graph builder they are handled by introducing a deopt point instead of adding explicit control flow. JumpIfNotHole / JumpIfNotHoleConstant bytecodes are removed since they are no longer required. Bug: v8:4280, v8:6383 Change-Id: I58b70c556b0ffa30e41a0cd44016874c3e9c5fe1 Reviewed-on: https://chromium-review.googlesource.com/509613 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#45720}
2017-06-06 09:00:22 +00:00
Node* LowerCheckNotTaggedHole(Node* node, Node* frame_state);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerConvertTaggedHoleToUndefined(Node* node);
Node* LowerPlainPrimitiveToNumber(Node* node);
Node* LowerPlainPrimitiveToWord32(Node* node);
Node* LowerPlainPrimitiveToFloat64(Node* node);
Node* LowerEnsureWritableFastElements(Node* node);
Node* LowerMaybeGrowFastElements(Node* node, Node* frame_state);
void LowerTransitionElementsKind(Node* node);
[turbofan] Optimize fast enum cache driven for..in. This CL adds support to optimize for..in in fast enum-cache mode to the same degree that it was optimized in Crankshaft, without adding the same deoptimization loop that Crankshaft had with missing enum cache indices. That means code like for (var k in o) { var v = o[k]; // ... } and code like for (var k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) { var v = o[k]; // ... } } which follows the https://eslint.org/docs/rules/guard-for-in linter rule, can now utilize the enum cache indices if o has only fast properties on the receiver, which speeds up the access o[k] significantly and reduces the pollution of the global megamorphic stub cache. For example the micro-benchmark in the tracking bug v8:6702 now runs faster than ever before: forIn: 1516 ms. forInHasOwnProperty: 1674 ms. forInHasOwnPropertySafe: 1595 ms. forInSum: 2051 ms. forInSumSafe: 2215 ms. Compared to numbers from V8 5.8 which is the last version running with Crankshaft forIn: 1641 ms. forInHasOwnProperty: 1719 ms. forInHasOwnPropertySafe: 1802 ms. forInSum: 2226 ms. forInSumSafe: 2409 ms. and V8 6.0 which is the current stable version with TurboFan: forIn: 1713 ms. forInHasOwnProperty: 5417 ms. forInHasOwnPropertySafe: 5324 ms. forInSum: 7556 ms. forInSumSafe: 11067 ms. It also improves the throughput on the string-fasta benchmark by around 7-10%, and there seems to be a ~5% improvement on the Speedometer/React benchmark locally. For this to work, the ForInPrepare bytecode was split into ForInEnumerate and ForInPrepare, which is very similar to how it was handled in Fullcodegen initially. In TurboFan we introduce a new operator LoadFieldByIndex that does the dynamic property load. This also removes the CheckMapValue operator again in favor of just using LoadField, ReferenceEqual and CheckIf, which work automatically with the EscapeAnalysis and the BranchConditionElimination. Bug: v8:6702 Change-Id: I91235413eea478ba77ace7bd14bb2f62e155dd9a Reviewed-on: https://chromium-review.googlesource.com/645949 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#47768}
2017-09-01 10:49:06 +00:00
Node* LowerLoadFieldByIndex(Node* node);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerLoadTypedElement(Node* node);
void LowerStoreTypedElement(Node* node);
[Turbofan] Specialize TransitionAndStoreElement We can improve performance of inlined Array.prototype.map if we statically know the type of the callback return result is a SignedSmall. Indeed, we no longer need bother with transitioning the output array, because we can store a SignedSmall (aka "Smi") anywhere. Bug: v8:6896 Change-Id: I140ce9a7c15ff77d05afeda6cda58f0560d922c8 Reviewed-on: https://chromium-review.googlesource.com/707139 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#48387}
2017-10-09 14:03:51 +00:00
void LowerStoreSignedSmallElement(Node* node);
[collections] Refactor map entry lookup and make naming more consistent. Rename the MapLookupHashIndex builtin to FindOrderedHashMapEntry and also rename the TurboFan operators LookupHashStorageIndex and LookupSigned32HashStorageIndex to FindOrderedHashMapEntry and FindOrderedHashMapEntryForInt32Key respectively. This way the naming is more consistent and it's immediately obvious from the operator name that this operator deals with OrderedHashMaps, which wasn't clear before. Also fix the result of the operation to be either -1 or the index of the entry relative to the hash table start (that is, no longer eagerly add hash table start plus value offset to the entry index). This removes this non-foldable integer additon from TurboFan code for both Map#get and Map#has. Drive-by-fix: Also provide more concrete types for the FindOrderedHashMapEntry operators. Bug: v8:5049 Change-Id: I418d107b806f3031a52a525cffc20456dc2342db Reviewed-on: https://chromium-review.googlesource.com/707414 Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48404}
2017-10-09 18:41:12 +00:00
Node* LowerFindOrderedHashMapEntry(Node* node);
Node* LowerFindOrderedHashMapEntryForInt32Key(Node* node);
[Turbofan] Inline Array.prototype.map Bug: v8:1956 Change-Id: I41af0cf5eb2fbb9f1d9d4172f3f546bcc2a715dc Reviewed-on: https://chromium-review.googlesource.com/548639 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#46618}
2017-07-13 08:16:17 +00:00
void LowerTransitionAndStoreElement(Node* node);
Introduce an Abort bytecode and turbofan operator. The advantage of an explicit Abort that the interpreter and the compiler know that aborting cannot continue or throw or deopt. As a result we generate less code and we do not confuse the compiler if the environment is not set up for throwing (as in the generator dispatch that fails validation in crbug.com/762057). Bug: chromium:762057 Change-Id: I3e88f78be32f31ac49b1845595255f802c405ed7 Reviewed-on: https://chromium-review.googlesource.com/657025 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#47922}
2017-09-08 11:46:07 +00:00
void LowerRuntimeAbort(Node* node);
[turbofan] Introduce PlainPrimitiveToNumber. This should solve the problem with missing checkpoints after JSToNumber (PlainPrimitiveToNumber is marked no-write, so the frame-state propagation should see through it.) Unfortunately, this also duplicates the word32- and float64-truncation magic that we have for JSToNumber in "simplified lowering". Review-Url: https://codereview.chromium.org/2059653002 Cr-Commit-Position: refs/heads/master@{#36881}
2016-06-10 07:41:45 +00:00
[turbofan] Move lowering of Float64 optional operators to EffectControlLinearizer. It's just a refactoring to avoid introducing new floating controls in the SimplifiedLowering phase. R=bmeurer@chromium.org Review-Url: https://codereview.chromium.org/2215183003 Cr-Commit-Position: refs/heads/master@{#38365}
2016-08-05 10:05:49 +00:00
// Lowering of optional operators.
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Maybe<Node*> LowerFloat64RoundUp(Node* node);
Maybe<Node*> LowerFloat64RoundDown(Node* node);
Maybe<Node*> LowerFloat64RoundTiesEven(Node* node);
Maybe<Node*> LowerFloat64RoundTruncate(Node* node);
Node* AllocateHeapNumberWithValue(Node* node);
Node* BuildCheckedFloat64ToInt32(CheckForMinusZeroMode mode, Node* value,
Node* frame_state);
Node* BuildCheckedHeapNumberOrOddballToFloat64(CheckTaggedInputMode mode,
Node* value,
Node* frame_state);
Node* BuildFloat64RoundDown(Node* value);
[turbofan] Introduce LookupSigned32HashStorageIndex specialization of Map#get. This adds a new operator LookupSigned32HashStorageIndex, which is a specialization of the general LookupHashStorageIndex for Map#get that is used when TurboFan knows that the key is in Signed32 range. This improves the execution time of the ARES6 Basic test locally by around 5% and seems to make sense in general. Bug: v8:6410, v8:6354, v8:6278, v8:6344 Change-Id: I78dcbc9cc855a4109e1690d8cd14fbc88fd89861 Reviewed-on: https://chromium-review.googlesource.com/706787 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48361}
2017-10-09 05:29:15 +00:00
Node* ComputeIntegerHash(Node* value);
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
Node* LowerStringComparison(Callable const& callable, Node* node);
[Turbofan] Inline Array.prototype.map Bug: v8:1956 Change-Id: I41af0cf5eb2fbb9f1d9d4172f3f546bcc2a715dc Reviewed-on: https://chromium-review.googlesource.com/548639 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#46618}
2017-07-13 08:16:17 +00:00
Node* IsElementsKindGreaterThan(Node* kind, ElementsKind reference_kind);
[turbofan] Introduce PlainPrimitiveToNumber. This should solve the problem with missing checkpoints after JSToNumber (PlainPrimitiveToNumber is marked no-write, so the frame-state propagation should see through it.) Unfortunately, this also duplicates the word32- and float64-truncation magic that we have for JSToNumber in "simplified lowering". Review-Url: https://codereview.chromium.org/2059653002 Cr-Commit-Position: refs/heads/master@{#36881}
2016-06-10 07:41:45 +00:00
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
Node* ChangeInt32ToSmi(Node* value);
[turbofan] Introduce LookupSigned32HashStorageIndex specialization of Map#get. This adds a new operator LookupSigned32HashStorageIndex, which is a specialization of the general LookupHashStorageIndex for Map#get that is used when TurboFan knows that the key is in Signed32 range. This improves the execution time of the ARES6 Basic test locally by around 5% and seems to make sense in general. Bug: v8:6410, v8:6354, v8:6278, v8:6344 Change-Id: I78dcbc9cc855a4109e1690d8cd14fbc88fd89861 Reviewed-on: https://chromium-review.googlesource.com/706787 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48361}
2017-10-09 05:29:15 +00:00
Node* ChangeIntPtrToInt32(Node* value);
Node* ChangeUint32ToUintPtr(Node* value);
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
Node* ChangeUint32ToSmi(Node* value);
[turbofan] Introduce LookupSigned32HashStorageIndex specialization of Map#get. This adds a new operator LookupSigned32HashStorageIndex, which is a specialization of the general LookupHashStorageIndex for Map#get that is used when TurboFan knows that the key is in Signed32 range. This improves the execution time of the ARES6 Basic test locally by around 5% and seems to make sense in general. Bug: v8:6410, v8:6354, v8:6278, v8:6344 Change-Id: I78dcbc9cc855a4109e1690d8cd14fbc88fd89861 Reviewed-on: https://chromium-review.googlesource.com/706787 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48361}
2017-10-09 05:29:15 +00:00
Node* ChangeSmiToIntPtr(Node* value);
[turbofan] Remove left-over change bits from ChangeLowering. Now ChangeLowering is only concerned with lowering memory access and allocation operations, and all changes are consistently lowered during the effect/control linearization pass. The next step is to move the left over lowerings to a pass dedicated to eliminate redundant loads and stores, eliminate write barriers, fold and inline allocations. Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged, ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to ChangeInt31ToTaggedSigned for consistency. CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0 Cr-Commit-Position: refs/heads/master@{#35924} Review-Url: https://codereview.chromium.org/1941673002 Cr-Commit-Position: refs/heads/master@{#35929}
2016-05-02 10:23:02 +00:00
Node* ChangeSmiToInt32(Node* value);
Node* ObjectIsSmi(Node* value);
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
Node* SmiMaxValueConstant();
Node* SmiShiftBitsConstant();
[Turbofan] Inline Array.prototype.map Bug: v8:1956 Change-Id: I41af0cf5eb2fbb9f1d9d4172f3f546bcc2a715dc Reviewed-on: https://chromium-review.googlesource.com/548639 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#46618}
2017-07-13 08:16:17 +00:00
void TransitionElementsTo(Node* node, Node* array, ElementsKind from,
ElementsKind to);
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
[turbofan] Add new StringFromCharCode simplified operator. We use StringFromCharCode to optimize calls to String.fromCharCode with a single Number argument for now. We will use it to also implement the charAt method on the String prototype. R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2037453003 Cr-Commit-Position: refs/heads/master@{#36668}
2016-06-02 07:59:29 +00:00
Factory* factory() const;
Isolate* isolate() const;
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
JSGraph* jsgraph() const { return js_graph_; }
Graph* graph() const;
Schedule* schedule() const { return schedule_; }
Zone* temp_zone() const { return temp_zone_; }
CommonOperatorBuilder* common() const;
SimplifiedOperatorBuilder* simplified() const;
MachineOperatorBuilder* machine() const;
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
GraphAssembler* gasm() { return &graph_assembler_; }
[turbofan] Introduce PlainPrimitiveToNumber. This should solve the problem with missing checkpoints after JSToNumber (PlainPrimitiveToNumber is marked no-write, so the frame-state propagation should see through it.) Unfortunately, this also duplicates the word32- and float64-truncation magic that we have for JSToNumber in "simplified lowering". Review-Url: https://codereview.chromium.org/2059653002 Cr-Commit-Position: refs/heads/master@{#36881}
2016-06-10 07:41:45 +00:00
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
JSGraph* js_graph_;
Schedule* schedule_;
Zone* temp_zone_;
[turbofan] Introduce CheckTaggedSigned and CheckTaggedPointer operators. These are used to check for Smi or HeapObject, and we use them appropriately in JSNativeContextSpecialization, so we don't need to introduce dependencies on concrete control flow and/or concrete frame states. They will be optimized by a proper check elimination reducer, which will be added in a separate CL. R=jarin@chromium.org BUG=v8:4470 Review-Url: https://codereview.chromium.org/2082523002 Cr-Commit-Position: refs/heads/master@{#37096}
2016-06-20 10:46:12 +00:00
RegionObservability region_observability_ = RegionObservability::kObservable;
[turbofan] track source positions in EffectControlLinearizer R=jarin@chromium.org BUG= Review-Url: https://codereview.chromium.org/2504913003 Cr-Commit-Position: refs/heads/master@{#41040}
2016-11-16 15:06:05 +00:00
SourcePositionTable* source_positions_;
[turbofan] Introduce graph assembler to build effect-control-linearizer sub-graphs. Review-Url: https://codereview.chromium.org/2571903004 Cr-Commit-Position: refs/heads/master@{#42013}
2017-01-02 15:50:55 +00:00
GraphAssembler graph_assembler_;
[compiler] Add instrumentation for tracking down Node::New crashes. R=jarin@chromium.org BUG=chromium:713584 Review-Url: https://codereview.chromium.org/2833783002 Cr-Commit-Position: refs/heads/master@{#44748}
2017-04-20 14:27:57 +00:00
Node* frame_state_zapper_; // For tracking down compiler::Node::New crashes.
[turbofan] Effect linearization after representation inference. This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in. This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes. Review URL: https://codereview.chromium.org/1849603002 Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:28:33 +00:00
};
} // namespace compiler
} // namespace internal
} // namespace v8
#endif // V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
Reference in New Issue Copy Permalink