2016-04-18 08:28:33 +00:00
|
|
|
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
|
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
|
|
|
// found in the LICENSE file.
|
|
|
|
|
|
|
|
|
|
#ifndef V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
|
|
|
|
|
#define V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
|
|
|
|
|
|
|
|
|
|
#include "src/compiler/common-operator.h"
|
2017-01-02 15:50:55 +00:00
|
|
|
#include "src/compiler/graph-assembler.h"
|
2016-04-18 08:28:33 +00:00
|
|
|
#include "src/compiler/node.h"
|
|
|
|
|
#include "src/compiler/simplified-operator.h"
|
2016-10-17 10:01:42 +00:00
|
|
|
#include "src/globals.h"
|
2016-04-18 08:28:33 +00:00
|
|
|
|
|
|
|
|
namespace v8 {
|
|
|
|
|
namespace internal {
|
|
|
|
|
|
2016-09-27 11:24:07 +00:00
|
|
|
// Forward declarations.
|
|
|
|
|
class Callable;
|
2016-04-18 08:28:33 +00:00
|
|
|
class Zone;
|
|
|
|
|
|
|
|
|
|
namespace compiler {
|
|
|
|
|
|
|
|
|
|
class CommonOperatorBuilder;
|
|
|
|
|
class SimplifiedOperatorBuilder;
|
|
|
|
|
class MachineOperatorBuilder;
|
|
|
|
|
class JSGraph;
|
|
|
|
|
class Graph;
|
|
|
|
|
class Schedule;
|
2016-11-16 15:06:05 +00:00
|
|
|
class SourcePositionTable;
|
2018-05-18 14:04:36 +00:00
|
|
|
class NodeOriginTable;
|
2016-04-18 08:28:33 +00:00
|
|
|
|
2016-10-17 10:01:42 +00:00
|
|
|
class V8_EXPORT_PRIVATE EffectControlLinearizer {
|
2016-04-18 08:28:33 +00:00
|
|
|
public:
|
2017-12-19 16:22:15 +00:00
|
|
|
enum MaskArrayIndexEnable { kDoNotMaskArrayIndex, kMaskArrayIndex };
|
|
|
|
|
|
2016-11-16 15:06:05 +00:00
|
|
|
EffectControlLinearizer(JSGraph* graph, Schedule* schedule, Zone* temp_zone,
|
2017-12-19 16:22:15 +00:00
|
|
|
SourcePositionTable* source_positions,
|
2018-05-18 14:04:36 +00:00
|
|
|
NodeOriginTable* node_origins,
|
2017-12-19 16:22:15 +00:00
|
|
|
MaskArrayIndexEnable mask_array_index);
|
2016-04-18 08:28:33 +00:00
|
|
|
|
|
|
|
|
void Run();
|
|
|
|
|
|
|
|
|
|
private:
|
2016-06-03 11:37:18 +00:00
|
|
|
void ProcessNode(Node* node, Node** frame_state, Node** effect,
|
|
|
|
|
Node** control);
|
2016-04-18 08:28:33 +00:00
|
|
|
|
2016-06-03 11:37:18 +00:00
|
|
|
bool TryWireInStateEffect(Node* node, Node* frame_state, Node** effect,
|
|
|
|
|
Node** control);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerChangeBitToTagged(Node* node);
|
|
|
|
|
Node* LowerChangeInt31ToTaggedSigned(Node* node);
|
|
|
|
|
Node* LowerChangeInt32ToTagged(Node* node);
|
2018-09-14 15:28:42 +00:00
|
|
|
Node* LowerChangeInt64ToTagged(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerChangeUint32ToTagged(Node* node);
|
2018-09-14 15:28:42 +00:00
|
|
|
Node* LowerChangeUint64ToTagged(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerChangeFloat64ToTagged(Node* node);
|
|
|
|
|
Node* LowerChangeFloat64ToTaggedPointer(Node* node);
|
|
|
|
|
Node* LowerChangeTaggedSignedToInt32(Node* node);
|
[turbofan] Initial Word64 support in representation selection.
This adds support to TurboFan's representation selection for the Word64
representation, and makes use of that to handle indices for memory access
and allocation instructions (i.e. LoadElement, StoreElement, Allocate,
etc.). These instructions had previously used Word32 as representation
for the indices / sizes, and then internally converted it to the correct
representation (aka Word64 on 64-bit architectures) later on, but that
was kind of brittle, and sometimes led to weird generated code.
The change thus only adds support to convert integer values in the safe
integer range from all kinds of representations to Word64 (on 64-bit
architectures). We don't yet handle the opposite direction and none of
the representation selection heuristics for the numeric operations were
changed so far. This will be done in follow-up CLs.
This CL itself is supposed to be neutral wrt. functionality, and only
serves as a starting point, and a cleanup for the (weird) implicit
Word64 index/size handling.
Bug: v8:7881, v8:8015, v8:8171
Design-Document: http://bit.ly/turbofan-word64
Change-Id: I3c6961a0e96cbc3fb8ac9d3e1be8f2e5c89bfd25
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel
Reviewed-on: https://chromium-review.googlesource.com/1224932
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55886}
2018-09-14 07:32:02 +00:00
|
|
|
Node* LowerChangeTaggedSignedToInt64(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerChangeTaggedToBit(Node* node);
|
|
|
|
|
Node* LowerChangeTaggedToInt32(Node* node);
|
|
|
|
|
Node* LowerChangeTaggedToUint32(Node* node);
|
[turbofan] Initial Word64 support in representation selection.
This adds support to TurboFan's representation selection for the Word64
representation, and makes use of that to handle indices for memory access
and allocation instructions (i.e. LoadElement, StoreElement, Allocate,
etc.). These instructions had previously used Word32 as representation
for the indices / sizes, and then internally converted it to the correct
representation (aka Word64 on 64-bit architectures) later on, but that
was kind of brittle, and sometimes led to weird generated code.
The change thus only adds support to convert integer values in the safe
integer range from all kinds of representations to Word64 (on 64-bit
architectures). We don't yet handle the opposite direction and none of
the representation selection heuristics for the numeric operations were
changed so far. This will be done in follow-up CLs.
This CL itself is supposed to be neutral wrt. functionality, and only
serves as a starting point, and a cleanup for the (weird) implicit
Word64 index/size handling.
Bug: v8:7881, v8:8015, v8:8171
Design-Document: http://bit.ly/turbofan-word64
Change-Id: I3c6961a0e96cbc3fb8ac9d3e1be8f2e5c89bfd25
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel
Reviewed-on: https://chromium-review.googlesource.com/1224932
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55886}
2018-09-14 07:32:02 +00:00
|
|
|
Node* LowerChangeTaggedToInt64(Node* node);
|
2017-01-31 08:55:56 +00:00
|
|
|
Node* LowerChangeTaggedToTaggedSigned(Node* node);
|
2018-04-30 12:13:54 +00:00
|
|
|
Node* LowerPoisonIndex(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckInternalizedString(Node* node, Node* frame_state);
|
2017-10-19 13:02:06 +00:00
|
|
|
void LowerCheckMaps(Node* node, Node* frame_state);
|
2017-08-28 07:27:27 +00:00
|
|
|
Node* LowerCompareMaps(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckNumber(Node* node, Node* frame_state);
|
2017-01-18 07:10:51 +00:00
|
|
|
Node* LowerCheckReceiver(Node* node, Node* frame_state);
|
[turbofan] ReceiverOrNullOrUndefined feedback for JSEqual.
This changes the ReceiverOrOddball feedback on JSStrictEqual to
ReceiverOrNullOrUndefined feedback, which can also safely be
consumed by JSEqual (we cannot generally accept any oddball here
since booleans trigger implicit conversions, unfortunately).
Thus we replace the previously introduced CheckReceiverOrOddball
with CheckReceiverOrNullOrUndefined, and drop CheckOddball, since
we will no longer collect Oddball feedback separately.
TurboFan will then turn a JSEqual[ReceiverOrNullOrUndefined] into
a sequence like this:
```
left = CheckReceiverOrNullOrUndefined(left);
right = CheckReceiverOrNullOrUndefined(right);
result = if ObjectIsUndetectable(left) then
ObjectIsUndetectable(right)
else
ReferenceEqual(left, right);
```
This significantly improves the peak performance of abstract equality
with Receiver, Null or Undefined inputs. On the test case outlined in
http://crbug.com/v8/8356 we go from
naive: 2946 ms.
tenary: 2134 ms.
to
naive: 2230 ms.
tenary: 2250 ms.
which corresponds to a 25% improvement on the abstract equality case.
For regular code this will probably yield more performance, since we
get rid of the JSEqual operator, which might have arbitrary side
effects and thus blocks all kinds of TurboFan optimizations. The
JSStrictEqual case is slightly slower now, since it has to rule out
booleans as well (even though that's not strictly necessary, but
consistency is key here).
This way developers can safely use `a == b` instead of doing a dance
like `a == null ? b == null : a === b` (which is what dart2js does
right now) when both `a` and `b` are known to be Receiver, Null or
Undefined. The abstract equality is not only faster to parse than
the tenary, but also generates a shorter bytecode sequence. In the
test case referenced in http://crbug.com/v8/8356 the bytecode for
`naive` is
```
StackCheck
Ldar a1
TestEqual a0, [0]
JumpIfFalse [5]
LdaSmi [1]
Return
LdaSmi [2]
Return
```
which is 14 bytes, whereas the `tenary` function generates
```
StackCheck
Ldar a0
TestUndetectable
JumpIfFalse [7]
Ldar a1
TestUndetectable
Jump [7]
Ldar a1
TestEqualStrict a0, [0]
JumpIfToBooleanFalse [5]
LdaSmi [1]
Return
LdaSmi [2]
Return
```
which is 24 bytes. So the `naive` version is 40% smaller and requires
fewer bytecode dispatches.
Bug: chromium:898455, v8:8356
Change-Id: If3961b2518b4438700706b3bd6071d546305e233
Reviewed-on: https://chromium-review.googlesource.com/c/1297315
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56948}
2018-10-24 12:09:34 +00:00
|
|
|
Node* LowerCheckReceiverOrNullOrUndefined(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckString(Node* node, Node* frame_state);
|
2017-05-22 12:07:40 +00:00
|
|
|
Node* LowerCheckSymbol(Node* node, Node* frame_state);
|
2017-10-19 13:02:06 +00:00
|
|
|
void LowerCheckIf(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckedInt32Add(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt32Sub(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt32Div(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt32Mod(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedUint32Div(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedUint32Mod(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt32Mul(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt32ToTaggedSigned(Node* node, Node* frame_state);
|
2018-09-14 15:28:42 +00:00
|
|
|
Node* LowerCheckedInt64ToInt32(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedInt64ToTaggedSigned(Node* node, Node* frame_state);
|
[turbofan] Add support for huge DataViews.
This introduces Word64 support for the CheckBounds operator, which now
lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
representation selection. The right hand side of CheckBounds can now
be any positive safe integer on 64-bit architectures, whereas it remains
Unsigned31 for 32-bit architectures. We only use the extended Word64
support when the right hand side is outside the Unsigned31 range, so
for everything except DataViews this means that the performance should
remain the same. The typing rule for the CheckBounds operator was
updated to reflect this new behavior.
The CheckBounds with a right hand side outside the Unsigned31 range will
pass a new Signed64 feedback kind, which is handled with newly introduced
CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
selection.
The JSCallReducer lowering for DataView getType()/setType() methods was
updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
but instead just use the raw uintptr_t values and operate on any value
(for 64-bit architectures these fields can hold any positive safe
integer, for 32-bit architectures it's limited to Unsigned31 range as
before). This means that V8 can now handle huge DataViews fully, without
falling off a performance cliff.
This refactoring even gave us some performance improvements, on a simple
micro-benchmark just exercising different DataView accesses we go from
testDataViewGetUint8: 796 ms.
testDataViewGetUint16: 997 ms.
testDataViewGetInt32: 994 ms.
testDataViewGetFloat64: 997 ms.
to
testDataViewGetUint8: 895 ms.
testDataViewGetUint16: 889 ms.
testDataViewGetInt32: 888 ms.
testDataViewGetFloat64: 890 ms.
meaning we lost around 10% on the single byte case, but gained 10% across
the board for all the other element sizes.
Design-Document: http://bit.ly/turbofan-word64
Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83
Reviewed-on: https://chromium-review.googlesource.com/c/1303732
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57095}
2018-10-29 14:16:51 +00:00
|
|
|
Node* LowerCheckedUint32Bounds(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckedUint32ToInt32(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedUint32ToTaggedSigned(Node* node, Node* frame_state);
|
[turbofan] Add support for huge DataViews.
This introduces Word64 support for the CheckBounds operator, which now
lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
representation selection. The right hand side of CheckBounds can now
be any positive safe integer on 64-bit architectures, whereas it remains
Unsigned31 for 32-bit architectures. We only use the extended Word64
support when the right hand side is outside the Unsigned31 range, so
for everything except DataViews this means that the performance should
remain the same. The typing rule for the CheckBounds operator was
updated to reflect this new behavior.
The CheckBounds with a right hand side outside the Unsigned31 range will
pass a new Signed64 feedback kind, which is handled with newly introduced
CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
selection.
The JSCallReducer lowering for DataView getType()/setType() methods was
updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
but instead just use the raw uintptr_t values and operate on any value
(for 64-bit architectures these fields can hold any positive safe
integer, for 32-bit architectures it's limited to Unsigned31 range as
before). This means that V8 can now handle huge DataViews fully, without
falling off a performance cliff.
This refactoring even gave us some performance improvements, on a simple
micro-benchmark just exercising different DataView accesses we go from
testDataViewGetUint8: 796 ms.
testDataViewGetUint16: 997 ms.
testDataViewGetInt32: 994 ms.
testDataViewGetFloat64: 997 ms.
to
testDataViewGetUint8: 895 ms.
testDataViewGetUint16: 889 ms.
testDataViewGetInt32: 888 ms.
testDataViewGetFloat64: 890 ms.
meaning we lost around 10% on the single byte case, but gained 10% across
the board for all the other element sizes.
Design-Document: http://bit.ly/turbofan-word64
Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83
Reviewed-on: https://chromium-review.googlesource.com/c/1303732
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57095}
2018-10-29 14:16:51 +00:00
|
|
|
Node* LowerCheckedUint64Bounds(Node* node, Node* frame_state);
|
2018-09-14 15:28:42 +00:00
|
|
|
Node* LowerCheckedUint64ToInt32(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedUint64ToTaggedSigned(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckedFloat64ToInt32(Node* node, Node* frame_state);
|
[turbofan] Add support for huge DataViews.
This introduces Word64 support for the CheckBounds operator, which now
lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
representation selection. The right hand side of CheckBounds can now
be any positive safe integer on 64-bit architectures, whereas it remains
Unsigned31 for 32-bit architectures. We only use the extended Word64
support when the right hand side is outside the Unsigned31 range, so
for everything except DataViews this means that the performance should
remain the same. The typing rule for the CheckBounds operator was
updated to reflect this new behavior.
The CheckBounds with a right hand side outside the Unsigned31 range will
pass a new Signed64 feedback kind, which is handled with newly introduced
CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
selection.
The JSCallReducer lowering for DataView getType()/setType() methods was
updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
but instead just use the raw uintptr_t values and operate on any value
(for 64-bit architectures these fields can hold any positive safe
integer, for 32-bit architectures it's limited to Unsigned31 range as
before). This means that V8 can now handle huge DataViews fully, without
falling off a performance cliff.
This refactoring even gave us some performance improvements, on a simple
micro-benchmark just exercising different DataView accesses we go from
testDataViewGetUint8: 796 ms.
testDataViewGetUint16: 997 ms.
testDataViewGetInt32: 994 ms.
testDataViewGetFloat64: 997 ms.
to
testDataViewGetUint8: 895 ms.
testDataViewGetUint16: 889 ms.
testDataViewGetInt32: 888 ms.
testDataViewGetFloat64: 890 ms.
meaning we lost around 10% on the single byte case, but gained 10% across
the board for all the other element sizes.
Design-Document: http://bit.ly/turbofan-word64
Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83
Reviewed-on: https://chromium-review.googlesource.com/c/1303732
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57095}
2018-10-29 14:16:51 +00:00
|
|
|
Node* LowerCheckedFloat64ToInt64(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckedTaggedSignedToInt32(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedTaggedToInt32(Node* node, Node* frame_state);
|
[turbofan] Add support for huge DataViews.
This introduces Word64 support for the CheckBounds operator, which now
lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
representation selection. The right hand side of CheckBounds can now
be any positive safe integer on 64-bit architectures, whereas it remains
Unsigned31 for 32-bit architectures. We only use the extended Word64
support when the right hand side is outside the Unsigned31 range, so
for everything except DataViews this means that the performance should
remain the same. The typing rule for the CheckBounds operator was
updated to reflect this new behavior.
The CheckBounds with a right hand side outside the Unsigned31 range will
pass a new Signed64 feedback kind, which is handled with newly introduced
CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
selection.
The JSCallReducer lowering for DataView getType()/setType() methods was
updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
but instead just use the raw uintptr_t values and operate on any value
(for 64-bit architectures these fields can hold any positive safe
integer, for 32-bit architectures it's limited to Unsigned31 range as
before). This means that V8 can now handle huge DataViews fully, without
falling off a performance cliff.
This refactoring even gave us some performance improvements, on a simple
micro-benchmark just exercising different DataView accesses we go from
testDataViewGetUint8: 796 ms.
testDataViewGetUint16: 997 ms.
testDataViewGetInt32: 994 ms.
testDataViewGetFloat64: 997 ms.
to
testDataViewGetUint8: 895 ms.
testDataViewGetUint16: 889 ms.
testDataViewGetInt32: 888 ms.
testDataViewGetFloat64: 890 ms.
meaning we lost around 10% on the single byte case, but gained 10% across
the board for all the other element sizes.
Design-Document: http://bit.ly/turbofan-word64
Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83
Reviewed-on: https://chromium-review.googlesource.com/c/1303732
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57095}
2018-10-29 14:16:51 +00:00
|
|
|
Node* LowerCheckedTaggedToInt64(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerCheckedTaggedToFloat64(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedTaggedToTaggedSigned(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerCheckedTaggedToTaggedPointer(Node* node, Node* frame_state);
|
|
|
|
|
Node* LowerChangeTaggedToFloat64(Node* node);
|
2017-11-16 08:52:43 +00:00
|
|
|
void TruncateTaggedPointerToBit(Node* node, GraphAssemblerLabel<1>* done);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerTruncateTaggedToBit(Node* node);
|
2017-03-07 10:11:16 +00:00
|
|
|
Node* LowerTruncateTaggedPointerToBit(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerTruncateTaggedToFloat64(Node* node);
|
|
|
|
|
Node* LowerTruncateTaggedToWord32(Node* node);
|
|
|
|
|
Node* LowerCheckedTruncateTaggedToWord32(Node* node, Node* frame_state);
|
2017-11-10 14:12:54 +00:00
|
|
|
Node* LowerAllocate(Node* node);
|
2017-11-28 06:07:57 +00:00
|
|
|
Node* LowerNumberToString(Node* node);
|
2017-09-29 09:10:16 +00:00
|
|
|
Node* LowerObjectIsArrayBufferView(Node* node);
|
2017-11-13 12:00:05 +00:00
|
|
|
Node* LowerObjectIsBigInt(Node* node);
|
2017-07-27 13:09:49 +00:00
|
|
|
Node* LowerObjectIsCallable(Node* node);
|
2017-10-13 08:49:00 +00:00
|
|
|
Node* LowerObjectIsConstructor(Node* node);
|
2017-02-18 12:43:37 +00:00
|
|
|
Node* LowerObjectIsDetectableCallable(Node* node);
|
[es2015] Optimize Object.is baseline and interesting cases.
The Object.is builtin provides an entry point to the abstract operation
SameValue, which properly distinguishes -0 and 0, and also identifies
NaNs. Most of the time you don't need these, but rather just regular
strict equality, but when you do, Object.is(o, -0) is the most readable
way to check for minus zero.
This is for example used in Node.js by formatNumber to properly print -0
for negative zero. However since the builtin thus far implemented as C++
builtin and TurboFan didn't know anything about it, Node.js considering
to go with a more performant, less readable version (which also makes
assumptions about the input value) in
https://github.com/nodejs/node/pull/15726
until the performance of Object.is will be on par (so hopefully we can
go back to Object.is in Node 9).
This CL ports the baseline implementation of Object.is to CSA, which
is pretty straight-forward since SameValue is already available in
CodeStubAssembler, and inlines a few interesting cases into TurboFan,
i.e. comparing same SSA node, and checking for -0 and NaN explicitly.
On the micro-benchmarks we go from
testNumberIsMinusZero: 1000 ms.
testObjectIsMinusZero: 929 ms.
testObjectIsNaN: 954 ms.
testObjectIsSame: 793 ms.
testStrictEqualSame: 104 ms.
to
testNumberIsMinusZero: 89 ms.
testObjectIsMinusZero: 88 ms.
testObjectIsNaN: 88 ms.
testObjectIsSame: 86 ms.
testStrictEqualSame: 105 ms.
which is a nice 10x to 11x improvement and brings Object.is on par with
strict equality for most cases.
Drive-by-fix: Also refactor and optimize the SameValue check in the
CodeStubAssembler to avoid code bloat (by not inlining StrictEqual
into every user of SameValue, and also avoiding useless checks).
Bug: v8:6882
Change-Id: Ibffd8c36511f219fcce0d89ed4e1073f5d6c6344
Reviewed-on: https://chromium-review.googlesource.com/700254
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48275}
2017-10-04 06:25:26 +00:00
|
|
|
Node* LowerObjectIsMinusZero(Node* node);
|
2017-03-03 09:08:14 +00:00
|
|
|
Node* LowerObjectIsNaN(Node* node);
|
2018-04-23 08:49:19 +00:00
|
|
|
Node* LowerNumberIsNaN(Node* node);
|
2017-01-19 13:16:27 +00:00
|
|
|
Node* LowerObjectIsNonCallable(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerObjectIsNumber(Node* node);
|
|
|
|
|
Node* LowerObjectIsReceiver(Node* node);
|
|
|
|
|
Node* LowerObjectIsSmi(Node* node);
|
|
|
|
|
Node* LowerObjectIsString(Node* node);
|
2017-03-14 16:14:58 +00:00
|
|
|
Node* LowerObjectIsSymbol(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerObjectIsUndetectable(Node* node);
|
2018-01-02 12:24:11 +00:00
|
|
|
Node* LowerNumberIsFloat64Hole(Node* node);
|
2018-03-16 08:36:57 +00:00
|
|
|
Node* LowerNumberIsFinite(Node* node);
|
|
|
|
|
Node* LowerObjectIsFiniteNumber(Node* node);
|
2018-03-16 08:37:33 +00:00
|
|
|
Node* LowerNumberIsInteger(Node* node);
|
|
|
|
|
Node* LowerObjectIsInteger(Node* node);
|
2018-03-21 12:04:47 +00:00
|
|
|
Node* LowerNumberIsSafeInteger(Node* node);
|
|
|
|
|
Node* LowerObjectIsSafeInteger(Node* node);
|
2017-02-28 11:16:27 +00:00
|
|
|
Node* LowerArgumentsFrame(Node* node);
|
|
|
|
|
Node* LowerArgumentsLength(Node* node);
|
2017-10-09 16:49:07 +00:00
|
|
|
Node* LowerNewDoubleElements(Node* node);
|
|
|
|
|
Node* LowerNewSmiOrObjectElements(Node* node);
|
2017-09-04 11:49:25 +00:00
|
|
|
Node* LowerNewArgumentsElements(Node* node);
|
2017-11-30 03:56:35 +00:00
|
|
|
Node* LowerNewConsString(Node* node);
|
2017-10-27 07:34:03 +00:00
|
|
|
Node* LowerSameValue(Node* node);
|
2018-01-04 12:45:56 +00:00
|
|
|
Node* LowerDeadValue(Node* node);
|
2018-09-07 12:06:06 +00:00
|
|
|
Node* LowerStringConcat(Node* node);
|
2017-10-19 09:39:49 +00:00
|
|
|
Node* LowerStringToNumber(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerStringCharCodeAt(Node* node);
|
2018-01-26 12:03:39 +00:00
|
|
|
Node* LowerStringCodePointAt(Node* node, UnicodeEncoding encoding);
|
2017-06-26 08:19:08 +00:00
|
|
|
Node* LowerStringToLowerCaseIntl(Node* node);
|
|
|
|
|
Node* LowerStringToUpperCaseIntl(Node* node);
|
2018-03-23 13:03:34 +00:00
|
|
|
Node* LowerStringFromSingleCharCode(Node* node);
|
2018-03-23 13:43:08 +00:00
|
|
|
Node* LowerStringFromSingleCodePoint(Node* node);
|
2017-01-27 12:02:42 +00:00
|
|
|
Node* LowerStringIndexOf(Node* node);
|
2018-02-23 15:08:44 +00:00
|
|
|
Node* LowerStringSubstring(Node* node);
|
2017-11-30 06:10:35 +00:00
|
|
|
Node* LowerStringLength(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerStringEqual(Node* node);
|
|
|
|
|
Node* LowerStringLessThan(Node* node);
|
|
|
|
|
Node* LowerStringLessThanOrEqual(Node* node);
|
|
|
|
|
Node* LowerCheckFloat64Hole(Node* node, Node* frame_state);
|
2017-06-06 09:00:22 +00:00
|
|
|
Node* LowerCheckNotTaggedHole(Node* node, Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerConvertTaggedHoleToUndefined(Node* node);
|
[ic] Ensure that we make progress on KeyedLoadIC polymorphic name.
In the special case of KeyedLoadIC, where the key that is passed in is a
Name that is always the same we only checked for identity in both the
stub and the TurboFan case, which works fine for symbols and internalized
strings, but doesn't really work with non-internalized strings, where
the identity check will fail, the runtime will internalize the string,
and the IC will then see the original internalized string again and not
progress in the feedback lattice. This leads to tricky deoptimization
loops in TurboFan and constantly missing ICs.
This adds fixes the stub to always try to internalize strings first
when the identity check fails and then doing the check again. If the
name is not found in the string table we miss, since in that case the
string cannot match the previously recorded feedback name (which is
always a unique name).
In TurboFan we represent this checks with new CheckEqualsSymbol and
CheckEqualsInternalizedString operators, which validate the previously
recorded feedback, and the CheckEqualsInternalizedString operator does
the attempt to internalize the input.
Bug: v8:6936, v8:6948, v8:6969
Change-Id: I3f3b4a587c67f00f7c4b60d239eb98a9626fe04a
Reviewed-on: https://chromium-review.googlesource.com/730224
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48784}
2017-10-20 11:36:26 +00:00
|
|
|
void LowerCheckEqualsInternalizedString(Node* node, Node* frame_state);
|
|
|
|
|
void LowerCheckEqualsSymbol(Node* node, Node* frame_state);
|
2017-10-16 09:23:53 +00:00
|
|
|
Node* LowerTypeOf(Node* node);
|
2017-10-19 08:11:17 +00:00
|
|
|
Node* LowerToBoolean(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerPlainPrimitiveToNumber(Node* node);
|
|
|
|
|
Node* LowerPlainPrimitiveToWord32(Node* node);
|
|
|
|
|
Node* LowerPlainPrimitiveToFloat64(Node* node);
|
|
|
|
|
Node* LowerEnsureWritableFastElements(Node* node);
|
|
|
|
|
Node* LowerMaybeGrowFastElements(Node* node, Node* frame_state);
|
|
|
|
|
void LowerTransitionElementsKind(Node* node);
|
2017-09-01 10:49:06 +00:00
|
|
|
Node* LowerLoadFieldByIndex(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerLoadTypedElement(Node* node);
|
2018-07-04 14:58:00 +00:00
|
|
|
Node* LowerLoadDataViewElement(Node* node);
|
2017-01-02 15:50:55 +00:00
|
|
|
void LowerStoreTypedElement(Node* node);
|
2018-07-09 12:47:15 +00:00
|
|
|
void LowerStoreDataViewElement(Node* node);
|
2017-10-09 14:03:51 +00:00
|
|
|
void LowerStoreSignedSmallElement(Node* node);
|
2017-10-09 18:41:12 +00:00
|
|
|
Node* LowerFindOrderedHashMapEntry(Node* node);
|
2017-10-25 17:35:15 +00:00
|
|
|
Node* LowerFindOrderedHashMapEntryForInt32Key(Node* node);
|
2017-07-13 08:16:17 +00:00
|
|
|
void LowerTransitionAndStoreElement(Node* node);
|
2017-10-16 08:21:45 +00:00
|
|
|
void LowerTransitionAndStoreNumberElement(Node* node);
|
|
|
|
|
void LowerTransitionAndStoreNonNumberElement(Node* node);
|
2017-09-08 11:46:07 +00:00
|
|
|
void LowerRuntimeAbort(Node* node);
|
2017-10-26 07:12:38 +00:00
|
|
|
Node* LowerConvertReceiver(Node* node);
|
2018-04-25 11:20:34 +00:00
|
|
|
Node* LowerDateNow(Node* node);
|
2016-06-10 07:41:45 +00:00
|
|
|
|
2016-08-05 10:05:49 +00:00
|
|
|
// Lowering of optional operators.
|
2017-01-02 15:50:55 +00:00
|
|
|
Maybe<Node*> LowerFloat64RoundUp(Node* node);
|
|
|
|
|
Maybe<Node*> LowerFloat64RoundDown(Node* node);
|
|
|
|
|
Maybe<Node*> LowerFloat64RoundTiesEven(Node* node);
|
|
|
|
|
Maybe<Node*> LowerFloat64RoundTruncate(Node* node);
|
|
|
|
|
|
|
|
|
|
Node* AllocateHeapNumberWithValue(Node* node);
|
2017-12-18 11:36:47 +00:00
|
|
|
Node* BuildCheckedFloat64ToInt32(CheckForMinusZeroMode mode,
|
|
|
|
|
const VectorSlotPair& feedback, Node* value,
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* frame_state);
|
[turbofan] Add support for huge DataViews.
This introduces Word64 support for the CheckBounds operator, which now
lowers to either CheckedUint32Bounds or CheckedUint64Bounds after the
representation selection. The right hand side of CheckBounds can now
be any positive safe integer on 64-bit architectures, whereas it remains
Unsigned31 for 32-bit architectures. We only use the extended Word64
support when the right hand side is outside the Unsigned31 range, so
for everything except DataViews this means that the performance should
remain the same. The typing rule for the CheckBounds operator was
updated to reflect this new behavior.
The CheckBounds with a right hand side outside the Unsigned31 range will
pass a new Signed64 feedback kind, which is handled with newly introduced
CheckedFloat64ToInt64 and CheckedTaggedToInt64 operators in representation
selection.
The JSCallReducer lowering for DataView getType()/setType() methods was
updated to not smi-check the [[ByteLength]] and [[ByteOffset]] anymore,
but instead just use the raw uintptr_t values and operate on any value
(for 64-bit architectures these fields can hold any positive safe
integer, for 32-bit architectures it's limited to Unsigned31 range as
before). This means that V8 can now handle huge DataViews fully, without
falling off a performance cliff.
This refactoring even gave us some performance improvements, on a simple
micro-benchmark just exercising different DataView accesses we go from
testDataViewGetUint8: 796 ms.
testDataViewGetUint16: 997 ms.
testDataViewGetInt32: 994 ms.
testDataViewGetFloat64: 997 ms.
to
testDataViewGetUint8: 895 ms.
testDataViewGetUint16: 889 ms.
testDataViewGetInt32: 888 ms.
testDataViewGetFloat64: 890 ms.
meaning we lost around 10% on the single byte case, but gained 10% across
the board for all the other element sizes.
Design-Document: http://bit.ly/turbofan-word64
Bug: chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: Ic9d1bf152e47802c04dcfd679372e5c85e4abc83
Reviewed-on: https://chromium-review.googlesource.com/c/1303732
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57095}
2018-10-29 14:16:51 +00:00
|
|
|
Node* BuildCheckedFloat64ToInt64(CheckForMinusZeroMode mode,
|
|
|
|
|
const VectorSlotPair& feedback, Node* value,
|
|
|
|
|
Node* frame_state);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* BuildCheckedHeapNumberOrOddballToFloat64(CheckTaggedInputMode mode,
|
2017-12-18 11:36:47 +00:00
|
|
|
const VectorSlotPair& feedback,
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* value,
|
|
|
|
|
Node* frame_state);
|
2018-08-14 08:39:05 +00:00
|
|
|
Node* BuildReverseBytes(ExternalArrayType type, Node* value);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* BuildFloat64RoundDown(Node* value);
|
2018-03-16 08:37:33 +00:00
|
|
|
Node* BuildFloat64RoundTruncate(Node* input);
|
[turbofan] Improve CheckedInt32Mod lowering.
The CheckedInt32Mod lowering in the EffectControlLinearizer wasn't
playing well with subsequent optimizations in the MachineOperatorReducer
especially due to the use of Int32Mod, which introduces another (floating)
diamond in the MachineOperatorReducer. Switching to Uint32Mod and explicit
sign handling fixes the problem, plus we also do the mask trick in the
case where the left hand side is negative now.
With this change the performance on the benchmark mentioned in the bug
report goes from
console.timeEnd: binary, 1872.346000
console.timeEnd: modulo, 5967.464000
console.timeEnd: binary, 6006.789000
console.timeEnd: modulo, 6293.496000
console.timeEnd: binary, 5969.264000
console.timeEnd: modulo, 6291.874000
to
console.timeEnd: binary, 1876.464000
console.timeEnd: modulo, 5846.643000
console.timeEnd: binary, 5962.545000
console.timeEnd: modulo, 5972.639000
console.timeEnd: binary, 5958.221000
console.timeEnd: modulo, 5973.171000
so even the peak performance of the modulus is now mostly the same as
the binary bitwise and.
Bug: v8:8069
Change-Id: Iaf3828fc0f6c53352367e8bf6c42534f8b13bfb3
Reviewed-on: https://chromium-review.googlesource.com/1180971
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55211}
2018-08-20 11:03:53 +00:00
|
|
|
Node* BuildUint32Mod(Node* lhs, Node* rhs);
|
2018-09-20 10:54:52 +00:00
|
|
|
Node* ComputeUnseededHash(Node* value);
|
2017-01-02 15:50:55 +00:00
|
|
|
Node* LowerStringComparison(Callable const& callable, Node* node);
|
2017-07-13 08:16:17 +00:00
|
|
|
Node* IsElementsKindGreaterThan(Node* kind, ElementsKind reference_kind);
|
2016-06-10 07:41:45 +00:00
|
|
|
|
2016-04-18 08:28:33 +00:00
|
|
|
Node* ChangeInt32ToSmi(Node* value);
|
2018-01-19 12:50:16 +00:00
|
|
|
Node* ChangeInt32ToIntPtr(Node* value);
|
2018-09-14 15:28:42 +00:00
|
|
|
Node* ChangeInt64ToSmi(Node* value);
|
2017-10-09 05:29:15 +00:00
|
|
|
Node* ChangeIntPtrToInt32(Node* value);
|
[turbofan] Initial Word64 support in representation selection.
This adds support to TurboFan's representation selection for the Word64
representation, and makes use of that to handle indices for memory access
and allocation instructions (i.e. LoadElement, StoreElement, Allocate,
etc.). These instructions had previously used Word32 as representation
for the indices / sizes, and then internally converted it to the correct
representation (aka Word64 on 64-bit architectures) later on, but that
was kind of brittle, and sometimes led to weird generated code.
The change thus only adds support to convert integer values in the safe
integer range from all kinds of representations to Word64 (on 64-bit
architectures). We don't yet handle the opposite direction and none of
the representation selection heuristics for the numeric operations were
changed so far. This will be done in follow-up CLs.
This CL itself is supposed to be neutral wrt. functionality, and only
serves as a starting point, and a cleanup for the (weird) implicit
Word64 index/size handling.
Bug: v8:7881, v8:8015, v8:8171
Design-Document: http://bit.ly/turbofan-word64
Change-Id: I3c6961a0e96cbc3fb8ac9d3e1be8f2e5c89bfd25
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel
Reviewed-on: https://chromium-review.googlesource.com/1224932
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55886}
2018-09-14 07:32:02 +00:00
|
|
|
Node* ChangeIntPtrToSmi(Node* value);
|
2017-10-09 05:29:15 +00:00
|
|
|
Node* ChangeUint32ToUintPtr(Node* value);
|
2016-04-18 08:28:33 +00:00
|
|
|
Node* ChangeUint32ToSmi(Node* value);
|
2017-10-09 05:29:15 +00:00
|
|
|
Node* ChangeSmiToIntPtr(Node* value);
|
2016-05-02 10:23:02 +00:00
|
|
|
Node* ChangeSmiToInt32(Node* value);
|
[turbofan] Initial Word64 support in representation selection.
This adds support to TurboFan's representation selection for the Word64
representation, and makes use of that to handle indices for memory access
and allocation instructions (i.e. LoadElement, StoreElement, Allocate,
etc.). These instructions had previously used Word32 as representation
for the indices / sizes, and then internally converted it to the correct
representation (aka Word64 on 64-bit architectures) later on, but that
was kind of brittle, and sometimes led to weird generated code.
The change thus only adds support to convert integer values in the safe
integer range from all kinds of representations to Word64 (on 64-bit
architectures). We don't yet handle the opposite direction and none of
the representation selection heuristics for the numeric operations were
changed so far. This will be done in follow-up CLs.
This CL itself is supposed to be neutral wrt. functionality, and only
serves as a starting point, and a cleanup for the (weird) implicit
Word64 index/size handling.
Bug: v8:7881, v8:8015, v8:8171
Design-Document: http://bit.ly/turbofan-word64
Change-Id: I3c6961a0e96cbc3fb8ac9d3e1be8f2e5c89bfd25
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel
Reviewed-on: https://chromium-review.googlesource.com/1224932
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55886}
2018-09-14 07:32:02 +00:00
|
|
|
Node* ChangeSmiToInt64(Node* value);
|
2016-05-02 10:23:02 +00:00
|
|
|
Node* ObjectIsSmi(Node* value);
|
2018-01-19 12:50:16 +00:00
|
|
|
Node* LoadFromSeqString(Node* receiver, Node* position, Node* is_one_byte);
|
2016-04-18 08:28:33 +00:00
|
|
|
|
|
|
|
|
Node* SmiMaxValueConstant();
|
|
|
|
|
Node* SmiShiftBitsConstant();
|
2017-07-13 08:16:17 +00:00
|
|
|
void TransitionElementsTo(Node* node, Node* array, ElementsKind from,
|
|
|
|
|
ElementsKind to);
|
2016-04-18 08:28:33 +00:00
|
|
|
|
2016-06-02 07:59:29 +00:00
|
|
|
Factory* factory() const;
|
|
|
|
|
Isolate* isolate() const;
|
2016-04-18 08:28:33 +00:00
|
|
|
JSGraph* jsgraph() const { return js_graph_; }
|
|
|
|
|
Graph* graph() const;
|
|
|
|
|
Schedule* schedule() const { return schedule_; }
|
|
|
|
|
Zone* temp_zone() const { return temp_zone_; }
|
|
|
|
|
CommonOperatorBuilder* common() const;
|
|
|
|
|
SimplifiedOperatorBuilder* simplified() const;
|
|
|
|
|
MachineOperatorBuilder* machine() const;
|
|
|
|
|
|
2017-01-02 15:50:55 +00:00
|
|
|
GraphAssembler* gasm() { return &graph_assembler_; }
|
2016-06-10 07:41:45 +00:00
|
|
|
|
2016-04-18 08:28:33 +00:00
|
|
|
JSGraph* js_graph_;
|
|
|
|
|
Schedule* schedule_;
|
|
|
|
|
Zone* temp_zone_;
|
2017-12-19 16:22:15 +00:00
|
|
|
MaskArrayIndexEnable mask_array_index_;
|
2016-06-20 10:46:12 +00:00
|
|
|
RegionObservability region_observability_ = RegionObservability::kObservable;
|
2016-11-16 15:06:05 +00:00
|
|
|
SourcePositionTable* source_positions_;
|
2018-05-18 14:04:36 +00:00
|
|
|
NodeOriginTable* node_origins_;
|
2017-01-02 15:50:55 +00:00
|
|
|
GraphAssembler graph_assembler_;
|
2017-04-20 14:27:57 +00:00
|
|
|
Node* frame_state_zapper_; // For tracking down compiler::Node::New crashes.
|
2016-04-18 08:28:33 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
} // namespace compiler
|
|
|
|
|
} // namespace internal
|
|
|
|
|
} // namespace v8
|
|
|
|
|
|
|
|
|
|
#endif // V8_COMPILER_EFFECT_CONTROL_LINEARIZER_H_
|
