Highlights of this CL:
* Introduced a new opcode in the deoptimizer for a setter stub frame.
* Added a global setter stub for returning after deoptimizing a setter.
* We do not need special deopt support for getters, although the getter stub creates an internal frame. The normal machinery works just right for this case, although we generate a stack that can never occur during normal fullcode execution. If this hurts us one day, we can parameterize and reuse the setter deopt machinery.
Review URL: https://chromiumcodereview.appspot.com/10855098
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
in anticipation of the upcoming lexical global scope.
Mostly automatised as:
for FILE in `egrep -ril "global[ _]?context" src test/cctest`
do
echo $FILE
sed "s/Global context/Native context/g" <$FILE >$FILE.0
sed "s/global context/native context/g" <$FILE.0 >$FILE.1
sed "s/global_context/native_context/g" <$FILE.1 >$FILE.2
sed "s/GLOBAL_CONTEXT/NATIVE_CONTEXT/g" <$FILE.2 >$FILE.3
sed "s/GlobalContext/NativeContext/g" <$FILE.3 >$FILE
rm $FILE.[0-9]
done
R=mstarzinger@chromium.org
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10832342
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r12298 (7b39ef67)
Original commit message:
Now a map points to a transition array which contains the descriptor array. The descriptor array is now immutable. The next step is to share the descriptor array with all back-pointed maps as long as there is a single line of extension. Maps that require a descriptor array but don't need transitions will still need a pseudo-empty transition array to contain the descriptor array.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10827335
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12319 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r12311 (f698ddd7)
Original commit message:
This fixes the positive lookup performed by these LoadICs, to use the
holder instead of the receiver to perfrom the lookup on. It also extends
this improvement to KeyedLoadICs. And it fixes a bug introduced for the
JavaScript getter case of a LoadIC.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10823326
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12314 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Currently only simple setter calls are handled (i.e. no calls in count
operations or compound assignments), and deoptimization in the setter is not
handled at all. Because of the latter, we temporarily hide this feature behind
the --inline-accessors flag, just like inlining getters.
We now use an enum everywhere we depend on the handling of a return value,
passing around several boolean would be more confusing.
Made VisitReturnStatement and the final parts of TryInline more similar, so
matching them visually is a bit easier now.
Simplified the signature of AddLeaveInlined, the target of the HGoto can simply
be retrieved from the function state.
Review URL: https://chromiumcodereview.appspot.com/10836133
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
mksnapshot or a VM that is booted from a snapshot. --debug-code
can still have an effect on stub and optimized code and it still
works on the full code generator when running without snapshots.
The deoptimizer generates full-code-generator code and relies on it having
the same layout as last time. This means that the code the full code
generator makes for the snapshot should be the same as the code it makes
later. This change makes the full code generator create more consistent
code between mksnapshot time and run time.
This is a bug fix and a step towards making the snapshot code more robust.
Review URL: https://chromiumcodereview.appspot.com/10834085
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The deoptimizer generates full-code-generator code and relies on it having
the same layout as last time. This means that the code the full code
generator makes for the snapshot should be the same as the code it makes
later. This change makes the full code generator create more consistent
code between mksnapshot time and run time.
This is a bug fix and a step towards making the snapshot code more robust.
Review URL: https://chromiumcodereview.appspot.com/10824084
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12233 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Currently only simple getter calls are handled (i.e. no calls in count
operations or compound assignments), and deoptimization in the getter is not
handled at all. Because of the latter, we temporarily hide this feature behind a
new flag --inline-accessors, which is false by default.
Review URL: https://chromiumcodereview.appspot.com/10828066
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r12042 (ce65764e)
Original commit message:
The LastAdded points to the descriptor that was last added to the array. From the descriptor we can deduce the NextEnumerationIndex. This allows us to quickly find the property that we are transitioning to, which is necessary for transition-intensive code, eg JSON parsing.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10690178
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
In this design maps contain descriptor arrays, which in turn can contain transition arrays. If transitions are needed when no descriptor array is present, a descriptor array without real descriptors is inserted just so it can point at the transition array.
The transition array does not contain details about the field it transitions to. In order to weed out transitions to FIELDs from CONSTANT_FUNCTION (what used to be MAP_TRANSITION vs CONSTANT_TRANSITION), the transition needs to be followed and the details need to be looked up in the target map. CALLBACKS transitions are still easy to recognize since the transition targets are stored as an AccessorPair containing the maps, rather than the maps directly.
Currently AccessorPairs containing a transition and an accessor are shared between the descriptor array and the transition array. This simplifies lookup since we only have to look in one of both arrays. This will change in subsequent revisions, when descriptor arrays will become shared between multiple maps, since transitions cannot be shared.
Review URL: https://chromiumcodereview.appspot.com/10697015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11994 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- Ensure that IsFound() is only used when not in combination with other
checks. To do so, the default type is NONEXISTENT rather than NORMAL;
and NotFound() also resets the type to NONEXISTENT.
- Use test methods rather than .type() == A_PROPERTY_TYPE.
Review URL: https://chromiumcodereview.appspot.com/10626004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The CompilationInfo record now saves a Zone, and the compiler pipeline
allocates memory from the Zone in the CompilationInfo. Before
compiling a function, we create a Zone on the stack and save a pointer
to that Zone to the CompilationInfo; which then gets picked up and
allocated from.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10534139
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11877 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11817 (616dfcf0)
Original commit message:
Each SharedFunctionInfo gets an optimized code map to store
one optimized code object per context. When allocating a new
closure we consult this map and check if there is optimized code
that can be shared.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10557002
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11694 (29aa05e9)
Original commit message:
Implement correct checking for inherited readonliness on assignment.
Removes 6 out of 8 of our remaining unintentional failures on test262.
Also fixes treatment of inherited setters added after the fact.
Specifically:
- In the runtime, when looking for setter callbacks in the prototype chain,
also look for read-only properties. If one is found, reject (exception in
strict mode). If a proxy is found, invoke proper trap.
Note: this folds in the CanPut function from the spec and avoids an extra
lookup over the prototype chain.
- In generated code for stores, insert a test for the maps from the prototype
chain, but only up to the object where the property already exists (which
may be the object itself).
In Hydrogen, if the found property is read-only or not cacheable (e.g. a
proxy), bail out; in a stub, generate an unconditional miss (to get an
exception in strict mode).
- Add test cases and adapt existing test expectations.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10539004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11596 (0cee9fca)
Original commit message:
Array index computation dehoisting.
When an array index (in an array access) is a simple "expression + constant", just embed the constant in the array access operation so that the full index expression is (potentially) no longer used and its live range can be much shorter.
This is effective in conjunction with array bounds check removal (otherwise the index is anyway used in the check).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10442003
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11644 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11492 (d14ada19)
Original commit message:
Fix register clobbering in LoadIC for interceptors.
This fixes a corner-case where the receiver register was clobbered by
LoadICs for interceptors and inlined followup code still relied on the
receiver to be intact in case of prototype changes.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10315016
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11491 (705d40cc)
Original commit message:
Implement clearing of CompareICs.
This allows CompareICs to be cleared during garbage collection to avoid
cross-context garbage retention through maps stored in CompareIC stubs
for the KNOWN_OBJECTS state.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10342024
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11505 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11454 (72c662fc)
Original commit message:
Reduce size of LIR instruction by one word and remove dead code.
Until now we always recorded two deoptimization environments for instructions
that are marked as calls. We actually don't need two for all LIR
instructions except one (LInstanceOfKnownGlobal) where there is a lazy
deoptimization point in deferred code.
This change remove on of them and uses one virtual function instead
to make LInstanceOfKnownGlobal work as before.
Additionally, this change removes an unused predicate save_doubles_ from LIR
instructions and removes some helper functions that are used only in one place.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10233019
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11470 (621f96c0)
Original commit message:
Fix LFastLiteral to check boilerplate elements kind.
Adds a missing check that the elements kind of the boilerplate object
still has the expected elements kind, unoptimized code can transition
the boilerplate. Corner cases might cause the optimized code to be
reentered again.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10271018
Patch from Akos Palfi <palfia@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Until now we always recorded two deoptimization environments for instructions
that are marked as calls. We actually don't need two for all LIR
instructions except one (LInstanceOfKnownGlobal) where there is a lazy
deoptimization point in deferred code.
This change remove on of them and uses one virtual function instead
to make LInstanceOfKnownGlobal work as before.
Additionally, this change removes an unused predicate save_doubles_ from LIR
instructions and removes some helper functions that are used only in one place.
Review URL: https://chromiumcodereview.appspot.com/10035021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11336 (6dd4e844)
Original commit message:
Implement rudimentary module linking.
Constructs the (generally cyclic) graph of module instance objects
and populates their exports. Any exports other than nested modules
are currently set to 'undefined' (but already present as properties).
Details:
- Added new type JSModule for instance objects: a JSObject carrying a context.
- Statically allocate instance objects for all module literals (in parser 8-}).
- Extend interfaces to record and unify concrete instance objects,
and to support iteration over members.
- Introduce new runtime function for pushing module contexts.
- Generate code for allocating, initializing, and setting module contexts,
and for populating instance objects from module literals.
Currently, all non-module exports are still initialized with 'undefined'.
- Module aliases are resolved statically, so no special code is required.
- Make sure that code containing module constructs is never optimized
(macrofy AST node construction flag setting while we're at it).
- Add test case checking linkage.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10035028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11374 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11331 (bd7843a0)
Original commit message:
Refactoring of code generation for declarations, in preparation for modules.
Do proper dispatch on declaration type instead of mingling together
different code generation paths. Once we add more declaration forms,
this is more scalable.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10119017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11372 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11278 (e5dc7ebd).
Original commit message:
Skip canonicalization check in LStoreKeyedFastDoubleElement when it is not needed:
- if value is a result of integer32 to double conversion (can't be NaN);
- if value was loaded from fast double backing store (already canonicalized).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10071004
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11306 (36b58f7).
Original commit message:
This passes the isolate through to API callback functions so that it is
available through AccessorInfo and Arguments. This allows bindings to
avoid unnecessary TLS lookups to retrieve the current isolate.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10083001
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11319 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11282 (bd2ab07).
Patch by Daniel Kalmar.
Original commit message:
Some GWT compiled code results in array access that has a heap number (e.g. -0)
as an index. Until now this would result in a generic IC.
For example:
a[-0] === a[0] or
a[0.25 * 4] === a[1]
This change detects heap numbers that are representable as a smi
and converts them. As a result we can still use the fast keyed monomorphic
ICs. Optimized code already handles keyed access with a double-key efficiently.
As a result the frame rate on the reported benchmark improves by roughly 2x.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/10068012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11010 (1daa81bc).
MIPS-specific changes:
-register codes and registers are defined using a macro to avoid redundancy
-renamed s8_fp to fp, removed the "fp" alias
-removed kSavedValueRegister (found by check-static-initializers.sh)
Original commit message:
Landing for pliard@chromium.org: Remove static initializers in v8.
This change includes two CLs by pliard@chromium.org:
1. http://codereview.chromium.org/9447052/ (Add CallOnce() and simple LazyInstance implementation):
Note that this implementation of LazyInstance does not handle global destructors (i.e. the lazy instances a
This CL was initially reviewed on codereview.appspot.com:
http://codereview.appspot.com/5687064/
2. http://codereview.chromium.org/9455088/ (Remove static initializers in v8):
This CL depends on CL 9447052 (adding CallOnce and LazyInstance).
It is based on a patch sent by Digit.
With this patch applied, we have only one static initializer left (in atomicops_internals_x86_gcc.cc). This
This CL also modifies the presubmit script to check the number of static initializers.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9689069
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Lithium translation rebuilds hydrogen environments from scratch so we have to ensure that arguments object is correctly bound on function entry otherwise deoptimization will not materialize it.
This fix was implemented as part of r11109 and then reverted.
R=danno@chromium.org
BUG=v8:2045
TEST=test/mjsunit/regress/regress-2045.js
Review URL: https://chromiumcodereview.appspot.com/9963008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11194 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r11132 (91bdad6108).
Original commit message:
If all property lookups for a polymorphic load actually result in the
same field index under all maps, we can actually emit a monomorphic load
that is guarded by a map check that verifies that the actual map is in
the set of handled maps. This also allows GVN to get rid of redundant
such map checks.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9852007
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
List of changes:
-added a minor optimization to the Simulator that quickly skips nops in the delay slot
-slightly re-worked CEntryStub to save a few instructions
CEntryStub now expects the following values:
-s0: number of arguments including receiver
-s1: size of arguments excluding receiver
-s2: pointer to builtin function
Two new MacroAssembler functions were added to make usage more convenient:
-PrepareCEntryArgs(int num_args) to set up s0 and s1
-PrepareCEntryFunction(const ExternalReference&) to set up s2
-removed branch delay slot nops from the most frequently used code areas
-reorganized some code to execute fewer instructions
-utilized the delay slot of most Ret instructions
This does not cover all Rets, only the most obvious cases.
Also added a special version of DropAndRet that utilizes the delay slot.
-added some comments to code areas where explanation of the register/delay slot usage may be needed
-added an optimization to Jump so it doesn't always pre-load the target register
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9699071
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11099 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
To do this, we collect all accessor properties in a first pass and emit code for
defining those properties afterwards in a second pass.
As a finger exercise, the table used for collecting accessors has a (subset of
an) STL-like iterator interface, including STL-like names and operators.
Although C++ is quite verbose here (as usual, but partly this is caused by our
current slightly clumsy classes/templates), things work out quite nicely and it
cleans up some confusion, e.g. a table entry is not an iterator etc.
Everything compiles into very efficient code, e.g. the loop condition 'it !=
accessor_table.end()' compiles into a single 'testl' instruction on ia32.
+1 for using standard APIs!
Review URL: https://chromiumcodereview.appspot.com/9691040
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Previously, there were 1 or 2 calls to the runtime when accessors were changed
or set. This doesn't really work well with property attributes, leading to some
hacks and complicates things even further when trying to share maps in presence
of accessors. Therefore, the runtime entry now takes the full triple (getter,
setter, attributes), where the getter and/or the setter can be null in case they
shouldn't be changed.
For now, we do basically the same on the native side as we did before on the
JavaScript side, but this will change in future CLs, the current CL is already
large enough.
Note that object literals with a getter and a setter for the same property still
do 2 calls, but this is a little bit more tricky to fix and will be handled in a
separate CL.
Review URL: https://chromiumcodereview.appspot.com/9616016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10905 (2a997cf).
Original commit message:
Allow Crankshaft to inline ordered relational comparisons (<, >, <=, >=) that have undefined arguments in addition to double value arguments (rather than calling the generic Compare stub).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9583038
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10925 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The old code used a separate HToInt32 instruction which had a wrong register
constraint for the input register which caused wrong result when the stored value
is used after a typed array store. (UseRegister instead of UseTempRegister) when no
SSE3 is available.
This change fixes it by replacing HToInt32 with the corresponding HChange
instruction which has correct register contraints.
TEST=mjsunit/compiler/regress-toint32.js
Review URL: https://chromiumcodereview.appspot.com/9565007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10881 (0d25c61e).
Original commit message:
Generates inlined code for object allocation specific to the initial map
of the given constructor function. Also forces completion of inobject
slack tracking while crankshafting to finalize instance size of these
objects.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9569008
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10890 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10794 (654fe910).
Original commit message:
Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.
HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).
New hydrogen instructions:
- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;
Changed hydrogen instructions:
- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9453009
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10849 (b0fe79c).
Also included: Fixed a bug in GenerateRecordCallTarget.
This bug prevented certain functions from being registered as Monomorphic
and thus prevented them from being inlined using the new system (b0fe79c).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9511002
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10700 (c976fbd5).
Original commit message:
This change enables optimization of top-level and eval-code. For this to work, it adds
support for declaring global variables in optimized code.
At the same time it disables the eager generation of deoptimization support data
in the full code generator (originally introduced in
r10040). This speeds up initial compilation and saves
memory for functions that won't be optimized. It requires
recompiling the function with deoptimization
support when we decide to optimize it.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9418006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10773 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This extends the current support for nested object literals we already
have in Crankshaft, to also support nested array literals and mixed
nested literals containing arrays and objects. All three types are
generated by the unified HFastLiteral instruction.
All previous upper bounds on nested literal graphs remain unchanged,
keeping the size of generated code in check.
The main intention is to boost performance of two-dimensional array
literals containing constant elements (aka. matrices).
R=danno@chromium.org
TEST=mjsunit/compiler/literals-optimized
Review URL: https://chromiumcodereview.appspot.com/9403018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This method works around the Branch offset and relocinfo issues by emulating a pc-relative jump.
This allows us to generate larger entry tables. The theoretical limit is 2^16 (number of entries)
but even that can be extended by allowing a larger instruction count.
Also reverted the mips-specific constant (kNumberOfEntries) in deoptimizer.h
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9347016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10717 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10673 (18d3af5).
Original commit message:
Supports growing non-COW JSArray by a single element if the backing store has room, and initial allocation of a backing store for the store to index zero of an empty array to kPreallocatedArrayElements elements (e.g. the [] array literal).
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9378005
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Some instructions can use >16 bit immediates if they represent a <=16 bit signed value.
However some logical instructions (andi, xori, ori, lui) should always treat the immediate value as unsigned.
This patch adds an ASSERT to these places and a minor change to MacroAssembler::li to satisfy this.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9309077
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10644 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
1. Instead of checking upfront and estimating a limit for the number, we
now are able to stop register allocation and bailout when we don't
have enough virtual registers.
2. GCed some out-dated flags from flag-definition.h
3. Simplified the interface from the Lithium builder to the
register allocator in lithium-*.cc: For uses and definitions, we
just record the virtual register number given by the Hydrogen value id.
For temporaries, we request a new virtual register from the allocator.
For fixed temps, we don't need to do anything.
4. Increased number of deoptimization entries to 16K. Eventually we
probably want to make this array grow dynamically.
Review URL: https://chromiumcodereview.appspot.com/9325019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10538 (21c5dc1).
MIPS-specific changes:
-moved MacroAssembler::SmiTagCheckOverflow definition to macro-assembler-mips.cc from the header
-added optimized 3-argument version of said function
-removed the related, completely unused TrySmiTag function
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9296045
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10567 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10531 (d61db240).
Original commit message:
This caches call targets of constructor calls by associating one element
caches with call sites. The type feedback oracle can use the recorded
valued to gather type information for monomorphic constructor call sites.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9298014
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10546 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Yak shaving for map sharing with accessor properties contd.: When CALLBACKS can
have map transitions, simply looking at the property type is not sufficient
anymore to decide if a property is there or not. One has to look at the actual
contents of the descriptor entry then, but this breaks down sometimes when the
lookup is being done with a NULL holder. Luckily enough, we can oftren replace
IsProperty by the simpler IsFound, because we inspect the type immediately
afterwards, anyway.
Review URL: https://chromiumcodereview.appspot.com/9280007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10356 (69da81).
Original commit message:
Loosen the requirement for Map equivalency on several map checks, including checks up the prototype chain, that are not sensitive to ElementsKinds. These selected map checks should also match against FAST_DOUBLE_ELEMENT and FAST_ELEMENT transitions of the original map. This specifically helps all variants of transitioned JSArrays to still efficiently call builtins like push, pop and sort.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9265007
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
for call-sites with mismatched number of arguments.
Port r10424 (92a05c9c).
Original commit message:
Adjust InvokeFunction to avoid generating dead code when number when arity mismatch is detected in compile time.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9150026
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10374 (03bbe39).
Note: the MIPS version was not affected by the bug. This is merely a style cleanup.
Original commit message:
An off-by-one in the register allocator could lead to allocating (and
clobbering) the reserved 0.0 double register. This required a function with
14 or more live double values.
BUG=
TEST=
Review URL: https://chromiumcodereview.appspot.com/9150025
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
CPU-eating DOS attacks against node.js servers. Based on code from
Bert Belder. This version only solves the issue for those that compile
V8 themselves or those that do not use snapshots. A snapshot-based
precompiled V8 will still have predictable string hash codes.
Review URL: http://codereview.chromium.org/9086006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10280 (5f6aec5).
Original commit message:
Tell the register allocator the value is not overwritten. Never use
temporary registers on ia32, avoid them on x64 and ARM. Restore the
original copyright date on assembler.cc.
BUG=
TEST=
Review URL: http://codereview.chromium.org/9004017
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10281 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This introduces an additional check into the StoreIC_ArrayLength builtin
checking that the array still has fast properties. Redifinitions of the
length property that would cause it's type or attributes to change, will
switch to slow properties, thereby invalidating said optimization.
R=svenpanne@chromium.org
BUG=v8:1756
TEST=test262
Review URL: http://codereview.chromium.org/8895025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10220 (1dae466).
Original commit message:
This CL adds support for loading from and storing to context slots
belonging to harmony let or const bound variables. Checks for the
hole value are performed and the function is deoptimized if they fail.
The full-codegen generated code will take care of properly throwing
a reference error in these cases.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8897025
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10219 (56686b).
Original commit message:
Now with arm and x64 support. Additionally, added default unreachable case to switch statement in CompareIC::TargetState to make win and mac compilers happy.
Reviewer guide:
This is an exact copy of 10216 except:
src/arm/*
src/x64/*
src/ic.cc (added default case to swith in CompareIC::TargetState)
BUG=
TEST=
Review URL: http://codereview.chromium.org/8896022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10085 (1ef7d5eb2).
This patch also contains a fix for StoreArrayLiteralElementStub::Generate which is only used from this code.
Original commit message:
Includes general array boilerplate copier and re-introduction FAST_ELEMENT optimizations in full-codegen.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8743010
Patch from Daniel Kalmard <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10061 (c648e1d1)
Original commit message:
This generates optimized code for deep-copying of nested object literal
boilerplates which are statically known. Most of the boilerplates have
already been generated at crankshaft time, so this optimization should
kick in for virtually every object literal. Only nested object literal
graphs up to a certain depth and containing up to a certain total number
of properties are considered for this optimization. This will prevent
explosion of code size due to large object literals (e.g. eval on JSON).
Improves splay performance because object literals are created often.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8745012
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10064 (9c6789a3)
Original commit message:
There is no test case to trigger any crash. This is only to guard against the case that the native function is called with unsafe arguments.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8742012
Patch from Daniel Kalmar <kalmard@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10097 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This shaves 416+ KB, just under 1% off the size of the debug d8 executable
on Linux (mostly because the CheckHelper functions for assertions were
getting separate copies for each compilation unit). The difference in
release builds is negligible---a size reduction of 0.1%.
Also, change namespace-level 'static const' variables to remove the static
storage class as it's the default.
R=danno@chromium.org
BUG=
TEST=
Review URL: http://codereview.chromium.org/8680013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10083 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This CL introduces a third mode next to the non-strict
(henceforth called 'classic mode') and 'strict mode'
which is called 'extended mode' as in the current
ES.next specification drafts. The extended mode is based on
the 'strict mode' and adds new functionality to it. This
means that most of the semantics of these two modes
coincide.
The 'extended mode' is entered instead of the 'strict mode'
during parsing when using the 'strict mode' directive
"use strict" and when the the harmony-scoping flag is
active. This should be changed once it is fully specified how the 'extended mode' is entered.
This change introduces a new 3 valued enum LanguageMode
(see globals.h) corresponding to the modes which is mostly
used by the frontend code. This includes the following
components:
* (Pre)Parser
* Compiler
* SharedFunctionInfo, Scope and ScopeInfo
* runtime functions: StoreContextSlot,
ResolvePossiblyDirectEval, InitializeVarGlobal,
DeclareGlobals
The old enum StrictModeFlag is still used in the backend
when the distinction between the 'strict mode' and the 'extended mode' does not matter. This includes:
* SetProperty runtime function, Delete builtin
* StoreIC and KeyedStoreIC
* StubCache
Review URL: http://codereview.chromium.org/8417035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10062 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r9977 (9aded78be4).
Note: This is the port of the reapplied patch, not the original.
Original commit message:
To support deoptimization of exception handlers, the handler address in the
stack is converted to a pair of code object and an index into a separate
table of code offsets. The index part is invariant under deoptimization.
The index is packed into the handler state field so that handler size does
not change.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8557003
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r10006 (4b344a03).
Original commit message:
Changes the way we do lazy deoptimization:
1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.
CALL
GAP
LAZY-BAILOUT ==> lazy-deopt-call
2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.
STACK-CHECK
GAP ==> lazy-deopt-call
The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.
Additional changes:
* RegExpLiteral marked it as having side-effects so that it
gets an explicitlazy-bailout instruction (instead of
treating it specially like stack-checks)
* Enable target recording CallFunctionStub to achieve
more inlining on optimized code.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8587008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10020 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
EmitIsObject is only called from one function, DoIsObjectAndBranch.
DoIsObjectAndBranch now passes the temp2 register to EmitIsObject
instead of simply relying on the two functions using the same
lithium scratch register.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8588004
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Changes:
-separated the two code-paths (constant power of 2 divisor similar to ARM and everything else)
-replaced a bailout condition with faster handling (negative modulo result)
-removed a possibly useless mov instruction from one path
-replaced the IsConstantOperand condition with the more meaningful HasPowerOf2Divisor (although in this specific case they're equivalent)
BUG=
TEST=
Review URL: http://codereview.chromium.org/8591002
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10016 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
r9871 (5baeaf57) changed the fill value for deleted entries in hash tables from null_value to the_hole_value.
This commit changes an assertion in MIPS code that expects this value.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8479028
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9955 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r9909 (56c8728aa).
Original commit message:
Test at the bottom in the unwind loop. Eliminate the possibility of a
useless move to the eax/rax/r0 register (currently impossible because
this function has two call sites). Do not explicitly zero the context
because we've already saved 0 as the context in the handler.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8507007
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r9847 (fc7590).
Original commit message:
Also partition side effects into observable and not observable, with only observable requiring Simulates and non-observable changes able to participate in GVN and code hoisting.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8387044
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r9863 (0996dc77)
Original commit message:
This was pretty heavyweight. It was kept in just for a few corner cases
that assumed it was there. We can work around them by making sure that the
expression in a reified test context is always really the expression that
was visited in that context; and by inspecting the context manually and
consing up a pair of extra AST IDs for the unusual case of unary not in a
value AST context.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8372085
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This was pretty heavyweight. It was kept in just for a few corner cases
that assumed it was there. We can work around them by making sure that the
expression in a reified test context is always really the expression that
was visited in that context; and by inspecting the context manually and
consing up a pair of extra AST IDs for the unusual case of unary not in a
value AST context.
R=fschneider@chromium.org
BUG=
TEST=
Review URL: http://codereview.chromium.org/8386037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Port r9837 (38061af).
Port r9834 (95ac04).
Original commit message (r9834):
Also, handlify functions for loading with interceptors and callbacks.
Remove some unneeded code. Rename Foreign::address() because it
confusingly shadows HeapObject::address() which does something quite
different.
BUG=
TEST=
Review URL: http://codereview.chromium.org/8400087
Patch from Gergely Kis <gergely@homejinni.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Previously we omitted all cases where the global eval property was shadowed,
even if by a variable holding the same value. ES5 requires us to treat these
as direct calls.
We still throw if calling indirect eval with a detached global object.
BUG=v8:994
TEST=mjsunit/eval.js
Review URL: http://codereview.chromium.org/8343054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
