Commit Graph

468 Commits

Author SHA1 Message Date
sigurds
3161c17126 [turbofan] Stabilize escape analysis (without deopt)
Bugfixes and improvements in escape analysis include:

* Handling of ObjectIsSmi (non-escaping)
* Handling of nested phi replacements
* Handling of phis with arity > 2
* Resilience against effectful nodes dangling from start
* Allocations escape now, if non-const load/store is performed
* Fixed a bug where non-allocated objects where tracked
* Allow fixed double arrays to be tracked

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1510973006

Cr-Commit-Position: refs/heads/master@{#32833}
2015-12-14 13:14:17 +00:00
sigurds
5b5821142b [turbofan] Improve escape analysis
This patch improves escape analysis and fixes bugs
triggered by clusterfuzz. Impovements include:
* Handling of LoadElement/StoreElement if index is a
  constant
* Handling of JSStoreProperty: invalidate all information,
  as the store could have altered any field.
* Treat phis that use an allocation as escaping
* Improve resolution of replacements

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1499143002

Cr-Commit-Position: refs/heads/master@{#32656}
2015-12-07 13:29:06 +00:00
machenbach
154a493cb7 Revert of [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors. (patchset #2 id:20001 of https://codereview.chromium.org/1500543002/ )
Reason for revert:
Blocks the roll:
https://codereview.chromium.org/1497763004/

Original issue's description:
> [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
>
> The ArrayBuffer and SharedArrayBuffer constructors should raise an
> exception when called with no arguments or undefined length.  Also
> unified the ArrayBuffer and SharedArrayBuffer implementations as C++
> builtins, and removed some (now) obsolete runtime entries.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/3235ccbb7826ceec2188f6ebab98fc851b54f60e
> Cr-Commit-Position: refs/heads/master@{#32590}

TBR=yangguo@chromium.org,cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1501673002

Cr-Commit-Position: refs/heads/master@{#32606}
2015-12-04 10:38:48 +00:00
bmeurer
3235ccbb78 [es6] Correctify and unify ArrayBuffer and SharedArrayBuffer constructors.
The ArrayBuffer and SharedArrayBuffer constructors should raise an
exception when called with no arguments or undefined length.  Also
unified the ArrayBuffer and SharedArrayBuffer implementations as C++
builtins, and removed some (now) obsolete runtime entries.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1500543002

Cr-Commit-Position: refs/heads/master@{#32590}
2015-12-03 21:16:31 +00:00
danno
3e7e3ed726 [stubs] A new approach to TF stubs
* Add a sibling interface to InterpreterAssembler called
  CodeStubAssembler which provides a wrapper around the
  RawMachineAssembler and is intented to make it easy to build
  efficient cross-platform code stubs. Much of the implementation
  of CodeStubAssembler is shamelessly stolen from the
  InterpreterAssembler, and the idea is to eventually merge the
  two interfaces somehow, probably moving the
  InterpreterAssembler interface over to use the
  CodeStubAssembler. Short-term, however, the two interfaces
  shall remain decoupled to increase our velocity developing the
  two systems in parallel.
* Implement the StringLength stub in TurboFan with the new
  CodeStubAssembler. Replace and remove the old Hydrogen-stub
  version.
* Remove a whole slew of machinery to support JavaScript-style
  code stub generation, since it ultimately proved unwieldy,
  brittle and baroque. This cleanup includes removing the shared
  code stub context, several example stubs and a tangle of build
  file changes.

BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1475953002

Cr-Commit-Position: refs/heads/master@{#32508}
2015-12-02 12:35:20 +00:00
sigurds
aa0ddf7db4 [turbofan] Initial support for escape analysis.
This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).

The CL includes 4 unittests.

There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1457683003

Cr-Commit-Position: refs/heads/master@{#32498}
2015-12-02 10:53:50 +00:00
bmeurer
8003db95cc [test] Reland test for 52bit multiplication and division.
Contributed by Fedor Indutny <fedor@indutny.com>.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1478933002

Cr-Commit-Position: refs/heads/master@{#32314}
2015-11-26 06:46:59 +00:00
jarin
a9fa0498e1 [turbofan] Only infer signedness for Float64->Word32 representation change from the input type.
If the input type does not help us, we are conservative and truncate (rather than guessing signed).

Review URL: https://codereview.chromium.org/1455103002

Cr-Commit-Position: refs/heads/master@{#32075}
2015-11-18 10:02:33 +00:00
bmeurer
a210c3757e [runtime] Remove the very dangerous %_CallFunction intrinsic.
The %_CallFunction doesn't implement the call sequence properly, it
doesn't do the receiver wrapping, nor does it check for
classConstructor. Also the eager deoptimization for %_CallFunction was
seriously b0rked (we must have been lucky with TurboFan so far).

R=yangguo@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1419813010

Cr-Commit-Position: refs/heads/master@{#31821}
2015-11-05 11:48:21 +00:00
bmeurer
eee597209b [turbofan] We can inline property access for all primitives.
TurboFan is actually able to generate property access to all prototypes
of all primitives, except the special Oddball primitives that have no
wrapper counterparts (namely null and undefined from the ES6 point of
view).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1409163007

Cr-Commit-Position: refs/heads/master@{#31739}
2015-11-03 10:44:57 +00:00
mstarzinger
37f5e23b5c [turbofan] Fix receiver binding for inlined callees.
This introduces a JSConvertReceiver operator to model the implicit
conversion of receiver values for sloppy callees. It is used by the
JSInliner for now, but can also be used to model direction function
calls that bypass call stubs.

Also note that a hint is passed to said operator whenever the source
structure constrains the receiver value type. This hint allows for
optimizations in the lowering of the operator.

The underlying specification in ES6, section 9.2.1.2 is the basis for
this implementation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/receiver-conversion
BUG=v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1412223015

Cr-Commit-Position: refs/heads/master@{#31598}
2015-10-27 12:13:49 +00:00
verwaest
b694266bb1 Fix Object.preventExtensions, .seal, .freeze on typed arrays
BUG=v8:4460
LOG=n

Review URL: https://codereview.chromium.org/1419823008

Cr-Commit-Position: refs/heads/master@{#31556}
2015-10-26 11:08:02 +00:00
bmeurer
2ab54f109e [turbofan] Add test case for stores to properties that are also present on prototype.
R=verwaest@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1407233006

Cr-Commit-Position: refs/heads/master@{#31517}
2015-10-23 12:09:54 +00:00
mstarzinger
d9a5add017 [turbofan] Fix liveness analysis for let variable in TDZ.
This makes sure that initializing assignments of let-declared variables
perform an environment lookup and hence keep the variable alive. This is
needed because full-codegen contains debug code verifying the variable
is still inside the TDZ at the initializing assignment.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-variable-liveness-let
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1420573002

Cr-Commit-Position: refs/heads/master@{#31437}
2015-10-21 12:23:06 +00:00
bmeurer
a916059aa7 [turbofan] Don't try to inline non-inlineable functions.
R=mstarzinger@chromium.org
BUG=chromium:540593
LOG=n

Review URL: https://codereview.chromium.org/1395453002

Cr-Commit-Position: refs/heads/master@{#31145}
2015-10-07 11:43:39 +00:00
bmeurer
9c8262f11e [builtins] Make sure argument count is always valid for C++ builtins.
When calling into C++ builtins, we need to make sure that the argument
count register contains the correct number of arguments, otherwise the
CEntryStub will not be able to leave the stack in the correct state.

R=ishell@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1391543002

Cr-Commit-Position: refs/heads/master@{#31120}
2015-10-06 08:23:51 +00:00
bmeurer
2a0759d3ff [es6] Fix missing bits for full @@toPrimitive support.
Introduce %_ToNumber intrinsic, which just calls to the existing
ToNumberStub, and remove all uses of our custom JavaScript plus
intrinsics based ToNumber and friends.

Also replace the TO_NUMBER_INLINE macro with TO_NUMBER,
which is currently a wrapper for %_ToNumber. Newly written JS
code should use TO_NUMBER (similar to TO_STRING, TO_INT32,
and friends).

Also finally remove the DefaultString/DefaultNumber builtins, which
are basically the ES5 version of ToPrimitive. Now all code uses the
ES6 version, which is implemented in Object::ToPrimitive and
JSReceiver::ToPrimitive in C++.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1384443002

Cr-Commit-Position: refs/heads/master@{#31054}
2015-10-01 16:08:49 +00:00
bmeurer
7a7b692b30 [runtime] Replace %to_string_fun with %_ToString.
Introduce a new macro TO_STRING that maps to %_ToString and use that
instead of calling into any of the ToString/NonStringToString JavaScript
builtins. Also remove the TO_STRING_INLINE macro, which is basically
obsolete with %_ToString. We still have a few uses of ToString left (via
the utils export mechanism), where we need to investigate whether we
will tank badly if we replace them with TO_STRING as well.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=yangguo@chromium.org
BUG=v8:4307
LOG=n

Review URL: https://codereview.chromium.org/1323543002

Cr-Commit-Position: refs/heads/master@{#30895}
2015-09-23 21:46:49 +00:00
conradw
33ec0b79b8 Parsing especially large nested functions takes up more memory than necessary.
Inner functions must be eagerly parsed for scope analysis, but the full AST is
also kept around even though it's not needed.

This CL mitigates this problem by allocating some AstNodes of the inner function
to a temporary Zone which is deallocated once the scope information has been
built. The remaining nodes (such as VariableProxy) must persist until scope
analysis actually happens, and have to be allocated to a parser-persistent Zone.

BUG=417697
LOG=N

Review URL: https://codereview.chromium.org/1304923004

Cr-Commit-Position: refs/heads/master@{#30685}
2015-09-10 14:41:14 +00:00
yangguo
299f775cf4 Call JS functions via native context instead of js builtins object.
We look up %-functions in the context if not found in the runtime.

R=bmeurer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1306993003

Cr-Commit-Position: refs/heads/master@{#30379}
2015-08-26 11:16:57 +00:00
bmeurer
fef38c21e8 [crankshaft] DCE must not eliminate (observable) math operations.
The HUnaryMathOperation cannot be eliminated in general, because the
spec requires a ToNumber conversion on the input, which is observable
of course.

BUG=v8:4389
LOG=y

Review URL: https://codereview.chromium.org/1307413003

Cr-Commit-Position: refs/heads/master@{#30343}
2015-08-25 06:24:55 +00:00
danno
a1475dae5d Create a internal native context used only for TF-generated code stubs
Until now, TF-generated code stubs piggy-backed off of the builtin
context. Since generation of code stubs is lazy, stubs generated at
different times in different native contexts would contain embedded
pointers different builtin contexts, leading to cross-context references
and memory leaks.

After this CL, all TF-generated code stubs are generated inside a
internal thinned-out, native context that lives solely for the
purpose of hosting generated code stubs.

Review URL: https://codereview.chromium.org/1213203007

Cr-Commit-Position: refs/heads/master@{#29593}
2015-07-13 09:45:51 +00:00
bmeurer
b19f118c16 [turbofan] Optimize string "length" property access based on types.
Optimize string "length" property access based on static type
information if possible, but also optimistically optimize the access
based on type feedback from the LoadIC.

R=jarin@chromium.org

Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40
Cr-Commit-Position: refs/heads/master@{#29543}

Review URL: https://codereview.chromium.org/1216593003

Cr-Commit-Position: refs/heads/master@{#29588}
2015-07-13 06:02:22 +00:00
adamk
54572281e9 Revert of [turbofan] Optimize string "length" property access based on types. (patchset #2 id:20001 of https://codereview.chromium.org/1216593003/)
Reason for revert:
Causes crash when running benchmarks/octane/regexp.js on ARM:
http://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/2492/steps/Benchmarks/logs/regexp

Original issue's description:
> [turbofan] Optimize string "length" property access based on types.
>
> Optimize string "length" property access based on static type
> information if possible, but also optimistically optimize the access
> based on type feedback from the LoadIC.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40
> Cr-Commit-Position: refs/heads/master@{#29543}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1224083002

Cr-Commit-Position: refs/heads/master@{#29544}
2015-07-08 21:30:14 +00:00
bmeurer
17add22ff4 [turbofan] Optimize string "length" property access based on types.
Optimize string "length" property access based on static type
information if possible, but also optimistically optimize the access
based on type feedback from the LoadIC.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1216593003

Cr-Commit-Position: refs/heads/master@{#29543}
2015-07-08 19:12:58 +00:00
danno
737b8573f8 Reland: Add unoptimized/optimized variants of MathFloor TF code stub
- Add a TurboFanIC class, derived from TurboFanCodeStub, that
  automatically distinguishes between versions of the IC called from
  optimized and unoptimized code.
- Add appropriate InterfaceDescriptors for both the versions of the
  stub called from unoptimized and optimized code
- Change the MathFloor TF stub generator to output either the
  for-optimized or for-unoptimized version based on the minor_key
  parameter.

Committed: https://crrev.com/8f13b655b8a10dae2116dd18b32f09337bb2d410
Cr-Commit-Position: refs/heads/master@{#29534}

Review URL: https://codereview.chromium.org/1225943002

Cr-Commit-Position: refs/heads/master@{#29539}
2015-07-08 16:53:50 +00:00
danno
7fc183af06 Revert of Add unoptimized/optimized variants of MathFloor TF code stub (patchset #4 id:60001 of https://codereview.chromium.org/1225943002/)
Reason for revert:
Failure on compiling runtime.js on windows

Original issue's description:
> Add unoptimized/optimized variants of MathFloor TF code stub
>
> - Add a TurboFanIC class, derived from TurboFanCodeStub, that
>   automatically distinguishes between versions of the IC called from
>   optimized and unoptimized code.
> - Add appropriate InterfaceDescriptors for both the versions of the
>   stub called from unoptimized and optimized code
> - Change the MathFloor TF stub generator to output either the
>   for-optimized or for-unoptimized version based on the minor_key
>   parameter.
>
> Committed: https://crrev.com/8f13b655b8a10dae2116dd18b32f09337bb2d410
> Cr-Commit-Position: refs/heads/master@{#29534}

TBR=mvstanton@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1220783006

Cr-Commit-Position: refs/heads/master@{#29535}
2015-07-08 15:00:40 +00:00
danno
8f13b655b8 Add unoptimized/optimized variants of MathFloor TF code stub
- Add a TurboFanIC class, derived from TurboFanCodeStub, that
  automatically distinguishes between versions of the IC called from
  optimized and unoptimized code.
- Add appropriate InterfaceDescriptors for both the versions of the
  stub called from unoptimized and optimized code
- Change the MathFloor TF stub generator to output either the
  for-optimized or for-unoptimized version based on the minor_key
  parameter.

Review URL: https://codereview.chromium.org/1225943002

Cr-Commit-Position: refs/heads/master@{#29534}
2015-07-08 14:43:25 +00:00
bmeurer
5f288c201c [turbofan] Right hand side of shifts needs ToUint32.
Currently we lower shifts directly to machine operators, and add an
appropriate Word32And to implement the & 0x1F operation on the right
hand side required by the specification. However for Word32And we assume
Int32 in simplified lowering, which is basically changes the right hand
side bit interpretation for the shifts from Uint32 to Int32, which is
obviously wrong. So now we represent that explicitly by proper
simplified operators for the shifts, which are lowered to machine in
simplified lowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1213803008

Cr-Commit-Position: refs/heads/master@{#29465}
2015-07-03 11:42:00 +00:00
titzer
2c979b96f1 Add mjsunit tests for optimization of float min/max.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1199053011

Cr-Commit-Position: refs/heads/master@{#29239}
2015-06-23 17:26:25 +00:00
bmeurer
78e9a2dff2 [turbofan] NaN is never truish.
BUG=v8:4207
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1198993009

Cr-Commit-Position: refs/heads/master@{#29230}
2015-06-23 12:24:54 +00:00
jacob.bramley
d783b76362 [arm64][turbofan] Fix implementation of Float64Min.
ARM64's `fmin` and `fmax` instructions don't have the same behaviour as
TurboFan's Float(32|64)(Min|Max) functions.

BUG=4206
LOG=N

Review URL: https://codereview.chromium.org/1200123004

Cr-Commit-Position: refs/heads/master@{#29229}
2015-06-23 11:58:58 +00:00
bmeurer
d19410f8e7 [mjsunit] Remove unsupported flag --turbo-deoptimization from tests.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}
2015-06-15 09:43:11 +00:00
mstarzinger
063079976c [turbofan] Fix throwing conversion inserted by JSTypedLowering.
This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}
2015-06-12 04:42:14 +00:00
mstarzinger
74c730a08d [turbofan] Add mjsunit tests for try-catch-finally and OSR.
This adds some basic tests of the interaction between try-catch and
try-finally statements and OSR in TurboFan. The try-osr test suite
follows the structure of try-deopt closely.

R=titzer@chromium.org
TEST=mjsunit/compiler/try-osr

Review URL: https://codereview.chromium.org/1165103003

Cr-Commit-Position: refs/heads/master@{#28855}
2015-06-09 08:16:41 +00:00
mstarzinger
b715329a15 [turbofan] Split --turbo-exceptions into two flags.
This allows try-catch and try-finally constructs to be separately
enabled and disabled. We plan to stage try-catch support soon.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1157863015

Cr-Commit-Position: refs/heads/master@{#28848}
2015-06-08 18:22:00 +00:00
bmeurer
b53c35a797 [turbofan] Properly kill Terminate nodes when removing loops.
BUG=chromium:491578
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1161583002

Cr-Commit-Position: refs/heads/master@{#28621}
2015-05-26 10:48:07 +00:00
yangguo
5cb925e448 Revert of Revert of Hook up more import/exports in natives. (patchset #1 id:1 of https://codereview.chromium.org/1154743003/)
Reason for revert:
Unrelated failure that was uncovered by this CL has been fixed (https://codereview.chromium.org/1152243002/)

Original issue's description:
> Revert of Hook up more import/exports in natives. (patchset #3 id:40001 of https://codereview.chromium.org/1154483002/)
>
> Reason for revert:
> [Sheriff] Speculative revert for gc stress failures:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/481
>
> Original issue's description:
> > Hook up more import/exports in natives.
> >
> > R=jkummerow@chromium.org
> >
> > Committed: https://crrev.com/7a918ac9658d11778f39593bfcc19d7c506defd9
> > Cr-Commit-Position: refs/heads/master@{#28573}
> >
> > Committed: https://crrev.com/e13a39dd7f4062898709d7c68900677df0513995
> > Cr-Commit-Position: refs/heads/master@{#28578}
>
> TBR=jkummerow@chromium.org,erik.corry@gmail.com,yangguo@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/eb0024d1dbdda5f51b006dd54887404ee6c5cbfc
> Cr-Commit-Position: refs/heads/master@{#28584}

TBR=jkummerow@chromium.org,erik.corry@gmail.com,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1149773003

Cr-Commit-Position: refs/heads/master@{#28608}
2015-05-26 07:24:21 +00:00
machenbach
eb0024d1db Revert of Hook up more import/exports in natives. (patchset #3 id:40001 of https://codereview.chromium.org/1154483002/)
Reason for revert:
[Sheriff] Speculative revert for gc stress failures:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/481

Original issue's description:
> Hook up more import/exports in natives.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/7a918ac9658d11778f39593bfcc19d7c506defd9
> Cr-Commit-Position: refs/heads/master@{#28573}
>
> Committed: https://crrev.com/e13a39dd7f4062898709d7c68900677df0513995
> Cr-Commit-Position: refs/heads/master@{#28578}

TBR=jkummerow@chromium.org,erik.corry@gmail.com,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1154743003

Cr-Commit-Position: refs/heads/master@{#28584}
2015-05-22 11:21:17 +00:00
svenpanne
a326691c75 JavaScript stubs have access to their calling convention and minor key now.
First steps only, the TurboFan compilation is still triggered from C++ land.

Includes some simplifications/cleanups, too.

Review URL: https://codereview.chromium.org/1150263002

Cr-Commit-Position: refs/heads/master@{#28581}
2015-05-22 11:01:31 +00:00
yangguo
e13a39dd7f Hook up more import/exports in natives.
R=jkummerow@chromium.org

Committed: https://crrev.com/7a918ac9658d11778f39593bfcc19d7c506defd9
Cr-Commit-Position: refs/heads/master@{#28573}

Review URL: https://codereview.chromium.org/1154483002

Cr-Commit-Position: refs/heads/master@{#28578}
2015-05-22 10:32:37 +00:00
machenbach
4c2690a475 Revert of Hook up more import/exports in natives. (patchset #2 id:20001 of https://codereview.chromium.org/1154483002/)
Reason for revert:
[Sheriff] Breaks nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6943

Original issue's description:
> Hook up more import/exports in natives.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/7a918ac9658d11778f39593bfcc19d7c506defd9
> Cr-Commit-Position: refs/heads/master@{#28573}

TBR=jkummerow@chromium.org,erik.corry@gmail.com,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1154793003

Cr-Commit-Position: refs/heads/master@{#28574}
2015-05-22 08:53:05 +00:00
yangguo
7a918ac965 Hook up more import/exports in natives.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1154483002

Cr-Commit-Position: refs/heads/master@{#28573}
2015-05-22 08:32:28 +00:00
jarin
d2ca18d849 [turbofan] Fix variable liveness control structure creation.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1148133002

Cr-Commit-Position: refs/heads/master@{#28536}
2015-05-21 09:57:11 +00:00
titzer
f659ae4c89 [turbofan] Support vector IC feedback in the JSTypeFeedbackTable.
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1133113004

Cr-Commit-Position: refs/heads/master@{#28465}
2015-05-19 08:58:29 +00:00
bmeurer
5494920a18 [turbofan] Use frame state before for shift operations as well.
This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}
2015-05-13 11:17:28 +00:00
bmeurer
2111d18dba [turbofan] Add frame state before JavaScript comparisons.
Use these check points to optimize comparisons where we already know
that one side cannot be a String (or turn into a string via
ToPrimitive).

Also remove bunch of useless DoNotCrash tests for the scheduler that are
painful to maintain and add almost no value.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140583004

Cr-Commit-Position: refs/heads/master@{#28383}
2015-05-13 07:38:35 +00:00
danno
abc35080b3 Add a MathFloor stub generated with TurboFan
This stub will be used as the basis of a Math.floor-specific CallIC to
detect and track calls to floor that return -0.

Along the way:
- Create a TurboFanCodeStub super class from which the StringLength and
MathRound TF stubs derive.
- Fix the ugly hack that passes the first stub parameter as the "this"
pointer in the the TF-compiled JS function.
- Fix bugs in the ia32/x64 disassembler.

Review URL: https://codereview.chromium.org/1137703002

Cr-Commit-Position: refs/heads/master@{#28339}
2015-05-11 11:45:02 +00:00
yangguo
b0eb920fe2 Reland #2 "Wrap v8natives.js into a function."
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1127693006

Cr-Commit-Position: refs/heads/master@{#28217}
2015-05-05 09:16:01 +00:00
machenbach
6afc0dcbfc Revert of Reland "Wrap v8natives.js into a function." (patchset #2 id:20001 of https://codereview.chromium.org/1123703002/)
Reason for revert:
[Sheriff] Speculative revert for braking arm64 nosnap:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug%20-%202/builds/2314

(reverted already titzer's CL which didn't help)

Original issue's description:
> Reland "Wrap v8natives.js into a function."
>
> Committed: https://crrev.com/72ab42172979b60a1b784ea0c6a495d7ee2bba67
> Cr-Commit-Position: refs/heads/master@{#28193}

TBR=jkummerow@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1127543003

Cr-Commit-Position: refs/heads/master@{#28208}
2015-05-04 16:49:58 +00:00
yangguo
72ab421729 Reland "Wrap v8natives.js into a function."
Review URL: https://codereview.chromium.org/1123703002

Cr-Commit-Position: refs/heads/master@{#28193}
2015-05-04 11:17:01 +00:00
machenbach
b0b82fa89d Revert of Wrap v8natives.js into a function. (patchset #2 id:20001 of https://codereview.chromium.org/1109343004/)
Reason for revert:
[Sheriff] Speculative revert for breaking layout tests, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2682

See. e.g.:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/3130/layout-test-results/http/tests/websocket/workers/worker-reload-diff.txt

Original issue's description:
> Wrap v8natives.js into a function.
>
> R=jkummerow@chromium.org
>
> Committed: https://crrev.com/ee1b39b4303829e6c6805fe8b2f2602b13f6463a
> Cr-Commit-Position: refs/heads/master@{#28174}

TBR=jkummerow@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1121453003

Cr-Commit-Position: refs/heads/master@{#28182}
2015-04-30 17:33:19 +00:00
yangguo
ee1b39b430 Wrap v8natives.js into a function.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1109343004

Cr-Commit-Position: refs/heads/master@{#28174}
2015-04-30 14:59:09 +00:00
yangguo
4d12e94801 Port CallSite methods to C++.
The goal is to port all of error stack trace formatting to C++.
We will do this bottom up, by first porting helper functions.

Eventually, CallSite methods will only be used when a custom
error stack trace formatter is defined via Error.prepareStackTrace.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1060583008

Cr-Commit-Position: refs/heads/master@{#28095}
2015-04-28 08:52:47 +00:00
titzer
6e82fbfbaf [turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1110503002

Cr-Commit-Position: refs/heads/master@{#28073}
2015-04-27 12:15:06 +00:00
machenbach
fbf300802f Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer. (patchset #10 id:180001 of https://codereview.chromium.org/1063513003/)
Reason for revert:
[sheriff] Breaks nosnap debug:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/156

Original issue's description:
> [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
>
> Uses lazy deoptimization and code dependencies to introduce loads
> from property cells and also to promote globals to constants.
>
> R=mstarzinger@chromium.org
> BUG=
>
> Committed: https://crrev.com/aae4a62d07e839455b1d0ad4fa512cc5d48a1a68
> Cr-Commit-Position: refs/heads/master@{#28057}

TBR=mstarzinger@chromium.org,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1084533003

Cr-Commit-Position: refs/heads/master@{#28063}
2015-04-27 10:07:08 +00:00
titzer
aae4a62d07 [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.
Uses lazy deoptimization and code dependencies to introduce loads
from property cells and also to promote globals to constants.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1063513003

Cr-Commit-Position: refs/heads/master@{#28057}
2015-04-27 09:06:41 +00:00
jarin
ae0bc41635 Fix stack layout of full code arm64 for object literal.
BUG=

Review URL: https://codereview.chromium.org/1095203005

Cr-Commit-Position: refs/heads/master@{#28055}
2015-04-27 08:31:33 +00:00
titzer
5b6111edff Add test for deoptimization bug.
R=jarin@chromium.org,mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1100113002

Cr-Commit-Position: refs/heads/master@{#28013}
2015-04-22 14:32:49 +00:00
titzer
1850803d56 [turbofan] Fix reduction of LoadProperty/StoreProperty to LoadNamed/StoreNamed.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1095313002

Cr-Commit-Position: refs/heads/master@{#27972}
2015-04-21 15:12:58 +00:00
jkummerow
3eb277f270 %GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present
Review URL: https://codereview.chromium.org/1086923002

Cr-Commit-Position: refs/heads/master@{#27822}
2015-04-14 14:57:48 +00:00
vegorov
021f738127 Treat HArgumentsObject as a safe use during Uint32 analysis phase.
Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}
2015-04-13 10:47:15 +00:00
titzer
a511c78999 Fix maybe_string_add for adds that have no type feedback where --always-opt is on.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1071473003

Cr-Commit-Position: refs/heads/master@{#27667}
2015-04-08 13:14:30 +00:00
titzer
ebc5167476 [turbofan] Fix loading of JSFunction from activation in case of adapter frame.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1026023004

Cr-Commit-Position: refs/heads/master@{#27454}
2015-03-25 17:46:16 +00:00
bmeurer
ff89876bb9 [turbofan] Fix lowering of Math.max for integral inputs.
R=jarin@chromium.org
BUG=chromium:468162
LOG=y

Review URL: https://codereview.chromium.org/1027753002

Cr-Commit-Position: refs/heads/master@{#27341}
2015-03-20 12:05:19 +00:00
bmeurer
d5893cad6b [turbofan] Work-around untagged result of CompareIC in pointer maps.
BUG=chromium:469089
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1026683002

Cr-Commit-Position: refs/heads/master@{#27333}
2015-03-20 09:45:12 +00:00
jarin
b7dc9c580a [turbofan] Remember types for deoptimization during simplified lowering.
With this change, we remember the types of frame state inputs (in a new
operator, called TypedStateValues). Instead of inferring the value types
when building translations, we used the recorded types.

The original approach was not reliable because the passes after
simplified lowering can change node types, and this in turn confuses
the translation builder.

BUG=chromium:468727
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1015423002

Cr-Commit-Position: refs/heads/master@{#27310}
2015-03-19 14:00:33 +00:00
jarin
0cde253c9e [turbofan] Support lazy deopt for truncating store to a typed array.
The change introduces a second frame state (for the state before
the operation) for the StoreProperty nodes. If the store writes
into a typed array, the frame state is used for lazy deopt from
the to-number conversion that is performed by the store.

BUG=v8:3963
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/997983004

Cr-Commit-Position: refs/heads/master@{#27285}
2015-03-19 05:46:30 +00:00
titzer
434d1ad014 [turbofan] Fix bug in OSR deconstruction.
In constructing the transfer between loop copies, we need to merge the backedges from all the previous copies of the given loop. The control reduction will work out which ones are really reachable.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1004993004

Cr-Commit-Position: refs/heads/master@{#27246}
2015-03-17 17:55:29 +00:00
titzer
0b3f4af12c [turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in.
R=mstarzinger@chromium.org
BUG=chromium:462775
LOG=Y

Review URL: https://codereview.chromium.org/988423003

Cr-Commit-Position: refs/heads/master@{#27088}
2015-03-10 09:27:40 +00:00
jarin
6f559b7ec3 [turbofan] Fix lazy deopt for JSToNumber conversions in binary operations.
This slightly hacky change provides lazy deopt points for to-number conversions in binops: When we deopt from a to-number conversion, we create a frame state with the already-converted value(s) so that we do not repeat the side effect of the conversion.

Embenchen numbers are below. It is not quite clear what happened to fasta - the hot code looks nearly identical.

Current: EmbenchenBox2d(RunTime): 12746 ms.
d8-master: EmbenchenBox2d(RunTime): 13861 ms.
----------- bullet.js
Current: EmbenchenBullet(RunTime): 17680 ms.
d8-master: EmbenchenBullet(RunTime): 19170 ms.
----------- copy.js
Current: EmbenchenCopy(RunTime): 4939 ms.
d8-master: EmbenchenCopy(RunTime): 4943 ms.
----------- corrections.js
Current: EmbenchenCorrections(RunTime): 6639 ms.
d8-master: EmbenchenCorrections(RunTime): 6728 ms.
----------- fannkuch.js
Current: EmbenchenFannkuch(RunTime): 4630 ms.
d8-master: EmbenchenFannkuch(RunTime): 4872 ms.
----------- fasta.js
Current: EmbenchenFasta(RunTime): 10209 ms.
d8-master: EmbenchenFasta(RunTime): 9673 ms.
----------- lua_binarytrees.js
Current: EmbenchenLuaBinaryTrees(RunTime): 12936 ms.
d8-master: EmbenchenLuaBinaryTrees(RunTime): 15529 ms.
----------- memops.js
Current: EmbenchenMemOps(RunTime): 7357 ms.
d8-master: EmbenchenMemOps(RunTime): 7340 ms.
----------- primes.js
Current: EmbenchenPrimes(RunTime): 7530 ms.
d8-master: EmbenchenPrimes(RunTime): 7457 ms.
----------- skinning.js
Current: EmbenchenSkinning(RunTime): 15832 ms.
d8-master: EmbenchenSkinning(RunTime): 15630 ms.
----------- zlib.js
Current: EmbenchenZLib(RunTime): 11176 ms.
d8-master: EmbenchenZLib(RunTime): 11324 ms.

BUG=

Review URL: https://codereview.chromium.org/985713003

Cr-Commit-Position: refs/heads/master@{#27071}
2015-03-09 13:24:42 +00:00
mstarzinger
dcb502a4ee [turbofan] Only reduce inline %DeoptimizeNow.
This makes sure only the %_DeoptimizeNow intrinsic is inlined, and
not the %DeoptimizeNow one. It hence re-establishes the invariant
that JSIntrinsicLowering only deals with inline intrinsics.

R=jarin@chromium.org
TEST=mjsunit/compiler/eager-deopt-simple

Review URL: https://codereview.chromium.org/988333003

Cr-Commit-Position: refs/heads/master@{#27070}
2015-03-09 13:20:26 +00:00
jarin
8d2e45669f [turbofan] First shot at eager deoptimization in Turbofan.
BUG=

Review URL: https://codereview.chromium.org/961973002

Cr-Commit-Position: refs/heads/master@{#26993}
2015-03-04 15:21:21 +00:00
mstarzinger
d016387e81 [turbofan] Add test coverage for deopt within try-catch.
This just contains test, no fixes. Note that some of the tests are
still disabled because they either fail or we don't want ClusterFuzz
to pick up the flag yet.

R=jarin@chromium.org
TEST=cctest/test-run-jsexceptions/Deopt,mjsunit/compiler/try-deopt

Review URL: https://codereview.chromium.org/972943004

Cr-Commit-Position: refs/heads/master@{#26968}
2015-03-03 17:23:42 +00:00
Jaroslav Sevcik
f0b11873a3 [turbofan] Fix deferred replacement in simplified lowering.
Deferred replacement must also replace in the pending node vector.

BUG=chromium:463056
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/966423002

Cr-Commit-Position: refs/heads/master@{#26938}
2015-03-02 12:49:49 +00:00
titzer
d050c331eb [turbofan] Simplify context specialization and fix for OSR.
AstGraphBuilder puts a constant context in from the beginning.
Also fix bug in merging contexts in environment.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/934293002

Cr-Commit-Position: refs/heads/master@{#26745}
2015-02-19 11:36:50 +00:00
titzer
71765afff9 [turbofan] Rename context stack as part of the environment for OSR.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/921083004

Cr-Commit-Position: refs/heads/master@{#26705}
2015-02-17 18:10:11 +00:00
jarin
0b8063cec8 [turbofan] Avoid ToNumber conversions if they could deoptimize.
BUG=chromium:454158
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/922623002

Cr-Commit-Position: refs/heads/master@{#26661}
2015-02-16 12:59:20 +00:00
titzer
31637fb396 [turbofan] Use heavy-handed graph duplication to do loop peeling for OSR.
BUG=

Review URL: https://codereview.chromium.org/898353002

Cr-Commit-Position: refs/heads/master@{#26576}
2015-02-11 13:26:45 +00:00
titzer
1db760de7d Reduce the number of iterations in some OSR tests by using an explicit %OptimizeOsr().
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/913463002

Cr-Commit-Position: refs/heads/master@{#26540}
2015-02-10 09:53:22 +00:00
titzer
4c302ca290 Make it easier to test OSR with %OptimizeOsr() runtime call.
This call triggers OSR for the current function. And also allows explicitly testing OSR on the top-level code.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/906243002

Cr-Commit-Position: refs/heads/master@{#26523}
2015-02-09 12:47:43 +00:00
titzer
79cad15cb0 Speed up tests for OSR of for-in and for-of loops.
R=marja@chromium.org
BUG=

Review URL: https://codereview.chromium.org/889293003

Cr-Commit-Position: refs/heads/master@{#26378}
2015-02-02 11:52:07 +00:00
titzer
e25a0f7e4e [turbofan] Fix usage of ThisFunction parameter in OSR.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/892593002

Cr-Commit-Position: refs/heads/master@{#26355}
2015-01-30 13:09:44 +00:00
titzer
11311c083a [turbofan] Fix OSR compilations of for-in.
R=mstarzinger@chromium.org
LOG=Y
BUG=

Review URL: https://codereview.chromium.org/890543002

Cr-Commit-Position: refs/heads/master@{#26333}
2015-01-29 17:40:23 +00:00
jarin
a4b163a940 [turbofan] Make sure there is space for lazy deopt patching before the constant pool.
BUG=chromium:446647
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/874863003

Cr-Commit-Position: refs/heads/master@{#26327}
2015-01-29 15:30:32 +00:00
titzer
f5479ca675 [turbofan] Gracefully bail out if OSR encounters a loop too deeply nested.
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/877553007

Cr-Commit-Position: refs/heads/master@{#26318}
2015-01-29 09:46:36 +00:00
jarin
489b6f7c60 [turbofan] Add missing deopt for the assignment in the for-in statement.
BUG=chromium:416359
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/881303002

Cr-Commit-Position: refs/heads/master@{#26309}
2015-01-28 16:16:24 +00:00
jarin
b4a4c4c591 [turbofan] Only replace nodes eagerly during simplified lowering if the types stay the same.
BUG=chromium:452427
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/871373010

Cr-Commit-Position: refs/heads/master@{#26286}
2015-01-27 09:27:37 +00:00
jarin
4c79f55c32 [turbofan] Handle cyclic dependencies in context typing.
BUG=chromium:451012
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/874983002

Cr-Commit-Position: refs/heads/master@{#26281}
2015-01-27 06:57:41 +00:00
mstarzinger
209b771431 Enable test coverage for test coverage.
R=titzer@chromium.org
TEST=mjsunit/compiler/opt-next-call-turbo

Review URL: https://codereview.chromium.org/822673003

Cr-Commit-Position: refs/heads/master@{#26192}
2015-01-21 14:07:19 +00:00
Michael Starzinger
cecd89c2c6 Disable new test failing since 79748e3f7c.
TBR=titzer@chromium.org
TEST=mjsunit/compiler/opt-next-call-turbo

Review URL: https://codereview.chromium.org/862533002

Cr-Commit-Position: refs/heads/master@{#26143}
2015-01-19 16:17:07 +00:00
mstarzinger
79748e3f7c Remove overzealous check from %OptimizeFunctionOnNextCall.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/863443003

Cr-Commit-Position: refs/heads/master@{#26142}
2015-01-19 15:52:00 +00:00
jarin
ac04d777d6 [turbofan] Allow deoptimization for JSToNumber operator.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/841443004

Cr-Commit-Position: refs/heads/master@{#26053}
2015-01-14 13:09:32 +00:00
bmeurer
70b32e4b8a [turbofan] Fix truncation/representation sloppiness wrt. bool/bit.
TEST=cctest,mjsunit,unittests
BUG=v8:3812
LOG=y

Review URL: https://codereview.chromium.org/850013003

Cr-Commit-Position: refs/heads/master@{#26051}
2015-01-14 12:06:56 +00:00
jarin
527e19afd5 [turbofan] Add missing deopt.
BUG=chromium:447567
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/809463005

Cr-Commit-Position: refs/heads/master@{#26033}
2015-01-13 08:40:54 +00:00
titzer
159b14172f [turbofan] Implement OSR for outer loops.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/809333002

Cr-Commit-Position: refs/heads/master@{#26020}
2015-01-12 11:39:58 +00:00
bmeurer
fec1bba852 [turbofan] Correctify representation changes to bit.
TEST=cctest/test-representation-change,unittests,mjsunit/compiler/regress-bit-number-constant
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/840953003

Cr-Commit-Position: refs/heads/master@{#25987}
2015-01-08 09:48:41 +00:00
bmeurer
d1c1a3c48f [turbofan] Fix bit representation of NumberConstant.
TEST=mjsunit/compiler/regress-bit-number-constant

Review URL: https://codereview.chromium.org/839813002

Cr-Commit-Position: refs/heads/master@{#25979}
2015-01-07 15:44:22 +00:00
jarin
80a7be5cd9 Restrict representation inference to avoid truncation of phi inputs.
BUG=chromium:446778
LOG=N

Review URL: https://codereview.chromium.org/837153002

Cr-Commit-Position: refs/heads/master@{#25967}
2015-01-07 11:38:54 +00:00
jarin
a9716d9840 Make control reducer revisit newly introduced merges.
TEST=mjsunit/compiler/regress-445876
BUG=chromium:445876
LOG=N

Review URL: https://codereview.chromium.org/830293003

Cr-Commit-Position: refs/heads/master@{#25959}
2015-01-05 16:35:34 +00:00
Benedikt Meurer
17a180842e [turbofan] Don't crash when typing load from a Uint8ClampedArray.
TEST=mjsunit/compiler/regress-446156
BUG=chromium:446156
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/835883003

Cr-Commit-Position: refs/heads/master@{#25957}
2015-01-05 13:43:47 +00:00
jarin
bdf446f590 Do not reduce effect phis for loops.
This prevents eliminating effectful statements before the loop.

BUG=

Review URL: https://codereview.chromium.org/830923002

Cr-Commit-Position: refs/heads/master@{#25953}
2015-01-03 12:46:00 +00:00
bmeurer
fb2643c858 [turbofan] Truncation of Bit/Word8/16 to Word32 is a no-op.
TEST=mjsunit/compiler/regress-445859
BUG=chromium:445859
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/828313002

Cr-Commit-Position: refs/heads/master@{#25951}
2015-01-02 10:39:10 +00:00
bmeurer
cf866b7c61 [x64] Rearrange code for OOB integer loads.
We cannot just clear the result register optimistically, because the
register allocator might assign the same register to result and buffer.

TEST=mjsunit/compiler/regress-445858
BUG=chromium:445858
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/828303002

Cr-Commit-Position: refs/heads/master@{#25950}
2015-01-02 10:15:40 +00:00
bmeurer
a64ac4575a Fix %NeverOptimizeFunction() intrinsic.
Set a valid reason for disabling optimization when using
%NeverOptimizeFunction.

TEST=mjsunit/compiler/regress-445732
BUG=chromium:445732
LOG=y
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/832003002

Cr-Commit-Position: refs/heads/master@{#25949}
2015-01-02 08:18:01 +00:00
bmeurer
ef41f70684 [turbofan] Fix invalid bounds check with overflowing offset.
TEST=mjsunit/compiler/regress-445267
BUG=chromium:445267
LOG=y

Review URL: https://codereview.chromium.org/825403002

Cr-Commit-Position: refs/heads/master@{#25945}
2014-12-29 10:01:15 +00:00
bmeurer
b5e8dd0e12 [turbofan] Raise max virtual registers and call parameter limit.
Change InstructionOperand to use a 64-bit field for encoding the operand
information instead of the 32-bit field that was used before. Ideally we
wouldn't use the Zone-allocated bit field at all, and use an integer
instead of the pointer; but that requires fixing the register allocator
first, which will take some time.

TEST=mjsunit/compiler/regress-3786
BUG=v8:3786
LOG=y

Review URL: https://codereview.chromium.org/826673002

Cr-Commit-Position: refs/heads/master@{#25941}
2014-12-25 18:18:04 +00:00
Benedikt Meurer
3f00ce2d59 [turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer.
TEST=mjsunit/compiler/regress-444695
BUG=chromium:444695
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/824843002

Cr-Commit-Position: refs/heads/master@{#25932}
2014-12-23 06:54:00 +00:00
Benedikt Meurer
65e69497ab [turbofan] Correctify lowering of Uint8ClampedArray buffer access.
TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}
2014-12-22 08:27:59 +00:00
Benedikt Meurer
f7e4689061 [turbofan] Fix unsafe out-of-bounds check for checked loads/stores.
BUG=chromium:443744
LOG=y
TEST=mjsunit/compiler/regress-443744
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/804993004

Cr-Commit-Position: refs/heads/master@{#25901}
2014-12-19 12:53:29 +00:00
Benedikt Meurer
14409abc22 [turbofan] Quickfix for invalid number truncation of typed array loads.
TEST=mjsunit/compiler/regress-int32array-outofbounds-nan
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/803483002

Cr-Commit-Position: refs/heads/master@{#25793}
2014-12-12 10:45:38 +00:00
Benedikt Meurer
19418d76df [x64] Fix optimization for certain checked load/stores.
BUG=chromium:439743
LOG=y
TEST=mjsunit
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/733893008

Cr-Commit-Position: refs/heads/master@{#25731}
2014-12-10 07:49:12 +00:00
Benedikt Meurer
48a6766e78 [x86] Disable invalid checked load/store optimization.
TEST=mjsunit/compiler/regress-lena
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/784153006

Cr-Commit-Position: refs/heads/master@{#25722}
2014-12-09 14:16:34 +00:00
jarin
322bb23e82 [turbofan] Insert appropriate conversions for typed array stores.
BUG=

Review URL: https://codereview.chromium.org/758643003

Cr-Commit-Position: refs/heads/master@{#25496}
2014-11-25 08:40:29 +00:00
svenpanne
be0fcaa2bc Added test cases for truncating stores.
Review URL: https://codereview.chromium.org/741643003

Cr-Commit-Position: refs/heads/master@{#25474}
2014-11-24 10:42:26 +00:00
yangguo
61bee5c898 Correctly escape RegExp source.
R=ulan@chromium.org
BUG=v8:3229
LOG=N

Review URL: https://codereview.chromium.org/736003002

Cr-Commit-Position: refs/heads/master@{#25457}
2014-11-21 10:50:24 +00:00
danno@chromium.org
9a58807030 [turbofan] Optimize add operations to use 'leal' instruction on x64
Add MemoryOperandMatcher that recognizes node clusters in the form
[%r1 + %r2*SCALE + OFFSET] and explicit support in the x64 Int32Add
selector to use it to translate complex adds to 'leal' instructions.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/704713003

Cr-Commit-Position: refs/heads/master@{#25223}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25223 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-07 16:47:45 +00:00
jarin@chromium.org
364cec0034 [turbofan] Fix deoptimization of uint8, uint16 inputs.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/707443003

Cr-Commit-Position: refs/heads/master@{#25214}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-07 14:07:45 +00:00
dcarney@chromium.org
a350f0d608 [turbofan] phis cannot take registers as inputs
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/704153002

Cr-Commit-Position: refs/heads/master@{#25191}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25191 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-06 12:56:44 +00:00
bmeurer@chromium.org
017c518321 [x86] Fix register constraints for multiply high and modulus.
R=jarin@chromium.org
TEST=mjsunit/compiler/regress-register-allocator2

Review URL: https://codereview.chromium.org/697053002

Cr-Commit-Position: refs/heads/master@{#25054}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-11-03 06:28:12 +00:00
bmeurer@chromium.org
548fb46331 [x86] Fix register constraints for multiply-high.
TEST=mjsunit/compiler,unittests
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/671393002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-24 09:36:40 +00:00
verwaest@chromium.org
23868b419c Optimize Function.prototype.call
BUG=
R=verwaest@chromium.org, jarin@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/588573002

Patch from Petka Antonov <p.antonov@partner.samsung.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-15 12:22:15 +00:00
jkummerow@chromium.org
b6f82c734c Remove FLAG_opt_safe_uint32_operations.
It has been turned on by default for a long time, and hydrogenized BinaryOpStubs actually depend on it being turned on.

BUG=v8:3487
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/630023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24415 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-10-06 13:15:23 +00:00
titzer@chromium.org
cbf66711af Minor compiler pipeline refactoring. Inline UpdateSharedFunctionInfo and make Parser::Parse responsible for setting the strict mode of the CompilationInfo.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/555553003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-17 12:34:46 +00:00
titzer@chromium.org
4c53bb086e Fix more fallout from making OptimizeFunctionOnNextCall work as advertised.
R=jarin@chromium.org
BUG=411262

Review URL: https://codereview.chromium.org/544213002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23745 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-05 15:31:33 +00:00
titzer@chromium.org
67b89f9db6 Fix %OptimizeFunctionOnNextCall to actually work when the function has not yet been compiled.
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/543643002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-04 11:27:20 +00:00
Jacob.Bramley@arm.com
da48f1246c ARM64: Fix SHR logic error.
The `right == 0` checks only worked for `0 <= right < 32`. This patch
replaces the checks with simple tests for negative results.

The attached test can detect this error, but the test relies on a broken
flag (--noopt-safe-uint32-operations), so it is skipped for now. See
issue 3487 for details.

BUG=
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/487913005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-08-20 14:58:18 +00:00
mstarzinger@chromium.org
7a4054b7d7 Allow inlining of functions containing %_Arguments.
R=svenpanne@chromium.org
TEST=mjsunit/compiler/inline-arguments

Review URL: https://codereview.chromium.org/356773002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-27 11:04:35 +00:00
dcarney@chromium.org
bd3f8a524e Revert "Optimize Function.prototype.call"
This reverts commit r21840.

R=danno@chromium.org
LOG=y
BUG=chromium:385565

Review URL: https://codereview.chromium.org/347573002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-18 14:04:41 +00:00
verwaest@chromium.org
7005abf03b Optimize Function.prototype.call
- May inline the function, or call it directly, instead of going through call
- Supports arguments object escaping when it escapes to builtins (preparation for slice.call(arguments, ...) optimization)
- Both .call and .apply now support inlining when calling builtins indirectly

BUG=
R=verwaest@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/335683002

Patch from Petka Antonov <p.antonov@partner.samsung.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21840 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-06-13 12:52:23 +00:00
hpayer@chromium.org
de21c8a245 Simplify ConfigureHeap and change --max_new_space_size to --max_semi_space_size.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/271843005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21204 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-09 08:38:27 +00:00
hpayer@chromium.org
dde49c9dc3 Set max new space size in tests to proper MB value.
Revert "Limit old space size in test which require a large new space."

This reverts commit r21103.

Revert "Remove max space limits in tests."

This reverts commit r21104.

BUG=
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/263103006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-05-05 16:48:33 +00:00
hpayer@chromium.org
56d0b9757e Remove max space limits in tests.
BUG=

Review URL: https://codereview.chromium.org/263703003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21104 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 19:32:47 +00:00
hpayer@chromium.org
3dd05f8fc7 Limit old space size in test which require a large new space.
BUG=

Review URL: https://codereview.chromium.org/265673003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21103 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-30 18:57:25 +00:00
dslomov@chromium.org
f66af4feb4 Refactor optimized in hydrogen only runtime functions.
This splits all runtime function into 3 categories:
1) RUNTIME: implemented in runtime and called from both full and optimized code.
2) RUNTIME_HIDDEN: implemented in runtime, never called directly from JS builtins.
3) INLINE: inlined in both full and optimized code
4) INLINE_OPTIMIZED: inlined in optimized code, implemented in runtime for full code.

R=yangguo@chromium.org, yannguo@chromium.org

Review URL: https://codereview.chromium.org/209353006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-25 14:26:55 +00:00
titzer@chromium.org
3c31102025 First implementation of store elimination.
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/100253004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-25 09:06:16 +00:00
ulan@chromium.org
2cb4e78e74 Fix mjsunit/compiler/concurrent-invalidate-transition-map.js test.
BUG=v8:3156
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/180053003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20009 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-17 17:00:48 +00:00
svenpanne@chromium.org
be328fd4ce Disable special handling of flooring division by constant until it is fixed for real.
Added a test to check the various division-like operations more exhaustively.

R=bmeurer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/194863002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19852 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-12 14:28:59 +00:00
ishell@chromium.org
6bb57517c0 Restore of compare-objeq-elim test accidentally removed in r19229.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/162903005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-13 12:22:24 +00:00
ulan@chromium.org
e95bc7eec8 Merge experimental/a64 to bleeding_edge.
BUG=v8:3113
LOG=Y
R=jochen@chromium.org, rmcilroy@chromium.org, rodolph.perfetta@arm.com

Review URL: https://codereview.chromium.org/148293020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 09:19:30 +00:00
ishell@chromium.org
994f0f6dda Fix for a smi stores optimization on x64 with a test case.
BUG=338425
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/152923006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19288 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-11 16:02:18 +00:00
ishell@chromium.org
f46da9d43b Reland of r19102: Check elimination improvement: propagation of state through phis is supported, CheckMap narrowing implemented with tests.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/146623006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19229 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-10 15:32:54 +00:00
ishell@chromium.org
2aa17c6e62 Load elimination fix: load should not be replaced with another load if the former is not dominated by the latter.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/151333003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18985 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-31 12:03:32 +00:00
jarin@chromium.org
99ce5a2484 The current
version is passing all the existing test + a bunch of new tests
(packaged in the change list, too).

The patch extends the SlotRef object to describe captured and duplicated
objects. Since the SlotRefs are not independent of each other anymore,
there is a new SlotRefValueBuilder class that stores the SlotRefs and
later materializes the objects from the SlotRefs.

Note that unlike the previous implementation of SlotRefs, we now build
the SlotRef entries for the entire frame, not just the particular
function.  This is because duplicate objects might refer to previous
captured objects (that might live inside other inlined function's part
of the frame).

We also need to store the materialized objects between other potential
invocations of the same arguments object so that we materialize each
captured object at most once.  The materialized objects of frames live
in the new MaterielizedObjectStore object (contained in Isolate),
indexed by the frame's FP address.  Each argument materialization (and
deoptimization) tries to lookup its captured objects in the store before
building new ones.  Deoptimization also removes the materialized objects
from the store. We also schedule a lazy deopt to be sure that we always
get rid of the materialized objects and that the optmized function
adopts the materialized objects (instead of happily computing with its
captured representations).

Concerns:

- Is the FP address the right key for a frame? (Note that deoptimizer's
representation of frame is different from the argument object
materializer's one - it is not easy to find common ground.)

- Performance is suboptimal in several places, but a quick local run of
benchmarks does not seem to show a perf hit. Examples of possible
improvements: smarter generation of SlotRefs (build other functions'
SlotRefs only for captured objects and only if necessary), smarter
lookup of stored materialized objects.

- Ideally, we would like to share the code for argument materialization
with deoptimizer's materializer.  However, the supporting data structures
(mainly the frame descriptor) are quite different in each case, so it
looks more like a separate project.

Thanks for any feedback.

R=danno@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=18918

Review URL: https://codereview.chromium.org/103243005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-30 10:33:53 +00:00
jarin@chromium.org
ec51f26b9e Revert "Captured arguments object materialization"
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/130803009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18923 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-29 15:49:48 +00:00
jarin@chromium.org
868ad01ecb This is a preview of the captured arguments object materialization,
mostly to make sure that it is going in the right direction. The current
version is passing all the existing test + a bunch of new tests
(packaged in the change list, too).

The patch extends the SlotRef object to describe captured and duplicated
objects. Since the SlotRefs are not independent of each other anymore,
there is a new SlotRefValueBuilder class that stores the SlotRefs and
later materializes the objects from the SlotRefs.

Note that unlike the previous implementation of SlotRefs, we now build
the SlotRef entries for the entire frame, not just the particular
function.  This is because duplicate objects might refer to previous
captured objects (that might live inside other inlined function's part
of the frame).

We also need to store the materialized objects between other potential
invocations of the same arguments object so that we materialize each
captured object at most once.  The materialized objects of frames live
in the new MaterielizedObjectStore object (contained in Isolate),
indexed by the frame's FP address.  Each argument materialization (and
deoptimization) tries to lookup its captured objects in the store before
building new ones.  Deoptimization also removes the materialized objects
from the store. We also schedule a lazy deopt to be sure that we always
get rid of the materialized objects and that the optmized function
adopts the materialized objects (instead of happily computing with its
captured representations).

Concerns:

- Is there a simpler/more correct way to store the already-materialized
objects? (At the moment there is a custom root reference to JSArray
containing frames' FixedArrays with their captured objects.)

- Is the FP address the right key for a frame? (Note that deoptimizer's
representation of frame is different from the argument object
materializer's one - it is not easy to find common ground.)

- Performance is suboptimal in several places, but a quick local run of
benchmarks does not seem to show a perf hit. Examples of possible
improvements: smarter generation of SlotRefs (build other functions'
SlotRefs only for captured objects and only if necessary), smarter
lookup of stored materialized objects.

- Ideally, we would like to share the code for argument materialization
with deoptimizer's materializer.  However, the supporting data structures
(mainly the frame descriptor) are quite different in each case, so it
looks more like a separate project.

Thanks for any feedback.

R=mstarzinger@chromium.org, danno@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/103243005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-29 15:14:15 +00:00
ishell@chromium.org
d330d4801d Load elimination fix with a test case.
R=titzer@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/143413019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-28 16:45:04 +00:00
machenbach@chromium.org
cde3ed1fe3 Speed up some mjsunit test cases and clean up test expectations for arm and mips.
Many skipped test cases already run very fast. Removing the corresponding expectations.

BUG=
R=jkummerow@chromium.org, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/138503008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-24 11:36:45 +00:00
jarin@chromium.org
acf24331e3 Fixed Lithium environment generation bug for captured objects (created
by escape analysis). Added several tests that expose the bug.

Summary:
LCodegen::AddToTranslation assumes that Lithium environments are
generated by depth-first traversal, but LChunkBuilder::CreateEnvironment
was generating them in breadth-first fashion. This fixes the
CreateEnvironment to traverse the captured objects depth-first.

Note:
It might be worth considering representing LEnvironment by a list
with the same order as the serialized translation representation
rather than having two lists with a subtle relationship between
them (and then serialize in a slightly different order again).

R=titzer@chromium.org, mstarzinger@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/93803003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18470 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-07 14:36:26 +00:00
yangguo@chromium.org
2a4be7067c Refactor the compiling pipeline.
Goals:
 - easier to read, more suitable identifiers.
 - better distinction between compiling optimized/unoptimized code
 - compiler does not install code on the function.
 - easier to add features (e.g. caching optimized code for osr).
 - remove unnecessary code.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/110203002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-23 14:30:35 +00:00
titzer@chromium.org
be32761a67 Improve load elimination handling of transitioning stores.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/106973005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18388 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 12:12:41 +00:00
titzer@chromium.org
1f679a58f7 Improve check elimination with branch sensitivity on HCompareObjectEqAndBranch.
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/106733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-19 17:42:21 +00:00
titzer@chromium.org
1d6710c933 Add some test cases with dead loops.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/98323004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 18:04:45 +00:00
titzer@chromium.org
16c4c14fac Check elimination: Learn from if(CompareMap(x)) on true branch.
BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/99043002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18210 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 18:34:33 +00:00
titzer@chromium.org
bbdd21ebb0 Fix load elimination: can only .Equals() GVN-able instructions.
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/95193002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:27:42 +00:00
yangguo@chromium.org
afd8e5a305 Speed up long-running test cases.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/85163003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 11:32:39 +00:00
yangguo@chromium.org
4716b292db Make some ARM test cases faster.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/85473004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 10:43:44 +00:00
yangguo@chromium.org
aa3518a0f3 Make sure files end with exactly one new line and police this in presubmit.
The changes are (excluding presubmit.py) mechanical. I added the following
lines after the check and iterated the presubmit script until all errors
went away:

f = open(name, "w");
if contents.endswith('\n\n'):
  f.write(contents[0:-1])
else:
  f.write(contents + '\n')

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/82803005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 13:50:39 +00:00
yangguo@chromium.org
df9665032e Introduce %_IsMinusZero.
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/63423004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-12 11:53:13 +00:00
svenpanne@chromium.org
acb06df0e9 Tune mjsunit/compiler/expression-trees.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/43703002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-28 07:24:19 +00:00
mstarzinger@chromium.org
be3ed75ff3 Fix materialization of captured objects with field tracking.
R=titzer@chromium.org
BUG=chromium:298990
TEST=mjsunit/compiler/escape-analysis-representation

Review URL: https://codereview.chromium.org/35133003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 13:48:54 +00:00
titzer@chromium.org
4d0f2cdd3b Implement global load elimination based on flow engine.
BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/27148004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-18 14:28:24 +00:00
yangguo@chromium.org
71ba8c5fb4 Retire concurrent recompilation delay for non-stress testing.
Instead, we block concurrent recompilation until unblocked. This makes
affected tests more predictable and run shorter.

R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/26758003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 14:15:22 +00:00
mstarzinger@chromium.org
9c3ffc4f58 Fix replaying of HCapturedObject for nested objects.
R=titzer@chromium.org
TEST=mjsunit/compiler/property-refs,mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/24561002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16969 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-26 15:28:46 +00:00
titzer@chromium.org
957a6da2a2 Dynamically align OSR frames on ia32.
BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23619076

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-18 16:05:39 +00:00
titzer@chromium.org
05797e77fd Implement local load/store elimination on basic blocks.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/24117004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-17 15:32:21 +00:00
svenpanne@chromium.org
8ed9b08e31 In the case of shift amounts with two constants and if their sum is equal 32, then shift can also be replaced with bit rotate.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/24095002

Patch from Bangfu Tao <bangfu.tao@samsung.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-16 13:51:14 +00:00
titzer@chromium.org
49d9555a97 Generate a custom OSR entrypoint for OSR compiles on all platforms, and transition to optimized code using the special entrypoint, instead of through the deoptimizer. Do not install the OSR compiled code as _the_ optimized code for a function.
Remove OSR-related stuff from deoptimizer.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/21340002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 16:34:40 +00:00
mstarzinger@chromium.org
ba48f3bd8c Consider out-of-bounds accesses as escaping uses.
R=titzer@chromium.org
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/23892007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16589 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 09:53:58 +00:00
yangguo@chromium.org
070e3b0af4 Introduce concurrent on-stack replacement.
Currently disabled behind --concurrent-osr.

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23710014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 12:55:59 +00:00
mstarzinger@chromium.org
fa8a182208 Fix OSR to ignore phis without merge index in loop entry.
This fixes a corner case introduced by escape analysis where phis are
introduced in OSR loop entry blocks that don't have a merge index and
hence cannot contain OSR values.

R=titzer@chromium.org
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/23503025

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 16:51:44 +00:00
jkummerow@chromium.org
9efb5cd23b Make VisitStatements() consistent among all AstVisitor implementations
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/23441018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-30 10:51:37 +00:00
mstarzinger@chromium.org
57ac971a78 Implement proper map checks of captured objects.
R=verwaest@chromium.org
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/23697002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16403 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 14:16:57 +00:00
jkummerow@chromium.org
da037f9872 H-BuildIncrement should make use of available type feedback
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/22611009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-27 11:44:45 +00:00
mstarzinger@chromium.org
e146b6e148 Fix replaying of captured objects during chunk building.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/22819011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16334 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 16:43:19 +00:00
yangguo@chromium.org
be48c5ae26 Rename "parallel recompilation" to "concurrent recompilation".
Also introduced macros for flag aliases for temporary backwards compatibility.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23014007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 16:14:37 +00:00
titzer@chromium.org
6f3169e571 Fix deoptimization bug, where recursive call can frighten and confuse the unwitting, simple, poor caveman that is Runtime_NotifyDeoptimized.
BUG=274164
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/23201016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 13:03:40 +00:00
mstarzinger@chromium.org
63defee477 First implementation of allocation elimination in Hydrogen.
This change implements a simple data-flow analysis pass over captured
objects to the existing escape analysis. It tracks the state of values
in the Hydrogen graph through CapturedObject marker instructions that
are used to construct an appropriate translation for the deoptimizer to
be able to materialize these objects again.

This can be considered a combination of scalar replacement of loads and
stores on captured objects and sinking of unused allocations.

R=titzer@chromium.org
TEST=mjsunit/compiler/escape-analysis

Review URL: https://codereview.chromium.org/21055011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16098 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 11:24:14 +00:00
titzer@chromium.org
37ee4a0369 Fix IsDeletable() for HStringAdd, HStringCharCodeAt, HStringCharFromCode.
BUG=
R=mstarzinger@chromium.org, svenpanne@chromium.org

Review URL: https://codereview.chromium.org/20241005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-29 12:35:43 +00:00
yangguo@chromium.org
cd41cb9b6d Turn on parallel recompilation for tests that assert optimization status.
R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/19807002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 09:16:33 +00:00
mstarzinger@chromium.org
3eded2c06c Fix %NeverOptimizeFunction runtime call.
The current usage of this runtime function is broken as it does not
prevent inlining of the affected function but rather bails out from the
whole unit of compilation after trying to inline affected functions.
This simplifies said runtime function to avoid accidental misuse.

R=titzer@chromium.org
TEST=mjsunit/never-optimize

Review URL: https://codereview.chromium.org/19776006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 08:25:44 +00:00
titzer@chromium.org
9e7819fac4 Added %NeverOptimize runtime call that can disable optimizations for a method for tests.
BUG=

Review URL: https://codereview.chromium.org/18214005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-11 14:17:56 +00:00
jkummerow@chromium.org
ed6d2d5c44 Add a test case for Phi representations
BUG=chromium:167394
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18838002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15553 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-08 13:43:43 +00:00
jkummerow@chromium.org
f0811f4e6f Fix and cleanup can_be_minus_zero computation
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/18434004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15546 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-08 11:15:24 +00:00
titzer@chromium.org
bfa9fe95dc Change PC for OSR entries to point to something more sensible (i.e. the first UnknownOsrValue), removing the need to record spilled OSR values and the need for duplicate deopt entries.
Review URL: https://codereview.chromium.org/16381006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-26 08:43:27 +00:00
yangguo@chromium.org
928cbcdc8d Skip parallel recompilation tests if parallel recompilation is disabled.
Parallel recompilation is usually disabled on single-core systems.

R=jkummerow@chromium.org
BUG=v8:2733

Review URL: https://codereview.chromium.org/17261021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15231 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-20 11:01:33 +00:00
mstarzinger@chromium.org
93ab1864ea Allow the deoptimizer translation to track de-materialized objects.
This allows the deoptimizer to materialize objects (e.g. the arguments
object) while deopting without having a consective stack area holding
the object values. The LEnvironment explicitly tracks locations for
these values and preserves them in the translation.

R=svenpanne@chromium.org
TEST=mjsunit/compiler/inline-arguments

Review URL: https://codereview.chromium.org/16779004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 14:22:49 +00:00
yangguo@chromium.org
74556569d1 Reland "Enable map dependency to in-flight compilation info."
BUG=248076
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16782004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 09:43:22 +00:00
yangguo@chromium.org
6da97b1d4a Revert "Enable map dependency to in-flight compilation info."
This includes r15032, r15030 and r15005.

R=ulan@chromium.org
BUG=248076

Review URL: https://chromiumcodereview.appspot.com/16482004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:55:56 +00:00
yangguo@chromium.org
17cfe68015 Enable map dependency to in-flight compilation info.
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/16542003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 13:27:03 +00:00
mstarzinger@chromium.org
d696f7b3c1 Use explicit type feedback clearing in some tests.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/15711004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14744 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 09:17:27 +00:00
titzer@chromium.org
68eb1e50ca Improve dead code elimination by transitively marking live code and removing all dead code. Replace unreachable phi removal algorithm with the new dead code elimination pass, which is more thorough.
Review URL: https://codereview.chromium.org/14676011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14661 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-14 13:10:52 +00:00
mstarzinger@chromium.org
9aa25ad1a0 Allow inlining of functions containing function literals.
R=yangguo@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://codereview.chromium.org/10702036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-14 14:29:10 +00:00
yangguo@chromium.org
479e39a058 Parallel recompilation: remove interrupt for code generation.
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12488006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-12 18:03:18 +00:00
svenpanne@chromium.org
e44d3b7a87 Fixed register allocation corner case.
The predicate CanBeSpilled had a bug, prohibiting the necessary spilling and
correct splitting of live ranges. Removed a redundant assertion immediately done
by the callee anyway.

Thanks to Slava for help with that issue and the entertaining historical
background of the whole story... ;-)

BUG=177883

Review URL: https://codereview.chromium.org/12631012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-11 09:49:00 +00:00
ulan@chromium.org
87265114c4 Emit VMLS for multiply-subtract on ARM.
BUG=none

Review URL: https://chromiumcodereview.appspot.com/12319113
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 10:24:40 +00:00
mstarzinger@chromium.org
300413b5a9 Fix f.apply() optimization when declared arguments are mutated.
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539

Review URL: https://codereview.chromium.org/12255033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 15:12:49 +00:00
mstarzinger@chromium.org
05e95eee0e Allow full inlining of f.apply(this, arguments) calls.
This allows Crankshaft to completely inline a f.apply() dispatch if the
exact number of arguments is known and the function is constant. The
deoptimizer doesn't generate the f.apply() frame during deoptimization,
so the materialized frames look like f.apply() did a tailcall.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-function-apply

Review URL: https://codereview.chromium.org/12263004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 09:55:50 +00:00
mstarzinger@chromium.org
fe8e97798e Allow inlining of multiple closures from shared function.
This allows Crankshaft to allow inlining of multiple different closures
that were all derived from the same shared function info. This pattern
appears when libraries provide generic closures that are used over and
over again at different call-sites.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-closures

Review URL: https://codereview.chromium.org/12071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 16:55:00 +00:00
mstarzinger@chromium.org
44ffa0dcd3 Allow monomorphic loads when static type is known.
This allows Crankshaft to generate monomorphic loads when the receiver
type is statically known even though the load site has polymorphic type
feedback. This applies to inlined constructor calls and literals.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/property-static

Review URL: https://codereview.chromium.org/12051058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 17:54:30 +00:00