Commit Graph

603 Commits

Author SHA1 Message Date
Adam Klein
3916401e4b Revert "[builtins] Mega-revert to address the Dev blocker in crbug.com/808911."
This reverts commit 14108f4c2e.

Reason for revert: Not the culprit for Canary microtask crashes

Original change's description:
> [builtins] Mega-revert to address the Dev blocker in crbug.com/808911.
> 
> - Revert "[builtins] Save one word in contexts for Promise.all."
>   This reverts commit 7632da067b.
> - Revert "[builtins] Also use the Promise#then protector for Promise#finally()."
>   This reverts commit d4f072ced3.
> - Revert "[builtins] Don't mess with entered context for MicrotaskCallbacks."
>   This reverts commit 6703dacdd6.
> - Revert "[debugger] Properly deal with settled promises in catch prediction."
>   This reverts commit 40dd065823.
> - Revert "[builtins] Widen the fast-path for Promise builtins."
>   This reverts commit db0556b7e8.
> - Revert "[builtins] Unify PerformPromiseThen and optimize it with TurboFan."
>   This reverts commit a582199c5e.
> - Revert "[builtins] Remove obsolete PromiseBuiltinsAssembler::AppendPromiseCallback."
>   This reverts commit 6bf8885290.
> - Revert "[builtins] Turn NewPromiseCapability into a proper builtin."
>   This reverts commit 313b490ddd.
> - Revert "[builtins] Inline InternalPromiseThen into it's only caller"
>   This reverts commit f7bd6a2fd6.
> - Revert "[builtins] Implement Promise#catch by really calling into Promise#then."
>   This reverts commit b23b098fa0.
> - Revert "[promise] Remove incorrect fast path"
>   This reverts commit 0f6eafe855.
> - Revert "[builtins] Squeeze JSPromise::result and JSPromise::reactions into a single field."
>   This reverts commit 8a677a2831.
> - Revert "[builtins] Refactor promises to reduce GC overhead."
>   This reverts commit 8e7737cb58.
> 
> Tbr: hpayer@chromium.org
> Bug: chromium:800651, chromium:808911, v8:5691, v8:7253
> Change-Id: I8c8ea5ed32ed62f6cd8b0d027a3707ddd891e5f1
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/906991
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51158}

Change-Id: I09d958cbebd635a325809072a290f2f53df8c5d4
Tbr: adamk@chromium.org,yangguo@chromium.org,bmeurer@chromium.org
Bug: chromium:800651, chromium:808911, v8:5691, v8:7253
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/908988
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51181}
2018-02-08 17:25:13 +00:00
Benedikt Meurer
14108f4c2e [builtins] Mega-revert to address the Dev blocker in crbug.com/808911.
- Revert "[builtins] Save one word in contexts for Promise.all."
  This reverts commit 7632da067b.
- Revert "[builtins] Also use the Promise#then protector for Promise#finally()."
  This reverts commit d4f072ced3.
- Revert "[builtins] Don't mess with entered context for MicrotaskCallbacks."
  This reverts commit 6703dacdd6.
- Revert "[debugger] Properly deal with settled promises in catch prediction."
  This reverts commit 40dd065823.
- Revert "[builtins] Widen the fast-path for Promise builtins."
  This reverts commit db0556b7e8.
- Revert "[builtins] Unify PerformPromiseThen and optimize it with TurboFan."
  This reverts commit a582199c5e.
- Revert "[builtins] Remove obsolete PromiseBuiltinsAssembler::AppendPromiseCallback."
  This reverts commit 6bf8885290.
- Revert "[builtins] Turn NewPromiseCapability into a proper builtin."
  This reverts commit 313b490ddd.
- Revert "[builtins] Inline InternalPromiseThen into it's only caller"
  This reverts commit f7bd6a2fd6.
- Revert "[builtins] Implement Promise#catch by really calling into Promise#then."
  This reverts commit b23b098fa0.
- Revert "[promise] Remove incorrect fast path"
  This reverts commit 0f6eafe855.
- Revert "[builtins] Squeeze JSPromise::result and JSPromise::reactions into a single field."
  This reverts commit 8a677a2831.
- Revert "[builtins] Refactor promises to reduce GC overhead."
  This reverts commit 8e7737cb58.

Tbr: hpayer@chromium.org
Bug: chromium:800651, chromium:808911, v8:5691, v8:7253
Change-Id: I8c8ea5ed32ed62f6cd8b0d027a3707ddd891e5f1
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/906991
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51158}
2018-02-07 19:46:59 +00:00
Benedikt Meurer
db0556b7e8 [builtins] Widen the fast-path for Promise builtins.
This adds a new isolate wide Promise#then protector, which guards the
"then" lookup for all JSPromise instances whose [[Prototype]] is the
initial %PromisePrototype%. Thus arbitrary mutations to the
Promise.prototype (i.e. monkey-patching other methods or installing
new functions) no longer sent you down the slow-path. Use this protector
in Promise.prototype.catch and in Promise.resolve.

Drive-by-fix: Restructure the resolve logic a bit and avoid the
expensive and large SameValue check, which can be turned into a simple
reference equal, as the promise in there is known to be a JSPromise
anyways.

Bug: v8:7253
Change-Id: If68b12c6bc6ca9c4d10552ae84854ebc3b5774f9
Reviewed-on: https://chromium-review.googlesource.com/899302
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51085}
2018-02-04 08:58:02 +00:00
Benedikt Meurer
8e7737cb58 [builtins] Refactor promises to reduce GC overhead.
This implements the ideas outlined in the section "Microtask queue"
of the exploration document "Promise and async/await performance" (at
https://goo.gl/WHRar2), except that the microtask queue stays a linear
FixedArray for now, to avoid running into trouble with the parallel
scavenger. This way we can already save a significant amount of
allocations, thereby reducing the GC frequency quite a bit.

All items on the microtask queue are now proper structs that subclass
Microtask, i.e. we also wrap JSFunction and MicrotaskCallback jobs
into structs. We also consistently remember the context for every
microtask (except for MicrotaskCallback where we don't have a
context), and execute it later in exactly that context (as required
by the spec anyways for the Promise related jobs). Particularly
interesting is the PromiseReactionJobTask and its subclasses, since
they are designed to have the same size as the PromiseReaction. When
we resolve a JSPromise we just take the existing PromiseReaction
instances and morph them into PromiseFulfillReactionJobTask or
PromiseRejectReactionJobTask (depending whether you "Fulfill" or
"Reject"). That way the JSPromise class is now only 6 words instead
of 10 words.

Also the PromiseReaction and the reaction tasks can either carry a
JSPromise (for the fast native case) or a PromiseCapability (for the
generic case), which means we don't always pay the overhead of having
to also remember the "deferred resolve" and "deferred reject" handlers
that are only relevant for the generic case anyways.

It also fixes a spec violation where we called "then" before we actually
enqueued the PromiseResolveThenableJob, which is observably wrong.
Calling it later has the advantage that it should be fairly
straight-forward now to completely avoid it for native Promise
instances.

This seems to save around 10-20% on the various Promise benchmarks and
micro-benchmarks. We expect to gain even more as we're now able to
inline various operations into TurboFan optimized code easily.

Bug: v8:7253
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I893d24ca5bb046974b4f5826a8f6dd22f1210b6a
Reviewed-on: https://chromium-review.googlesource.com/892819
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50980}
2018-01-31 10:05:39 +00:00
Yang Guo
3857b44e69 Introduce SimpleNumberDictionary.
This is somewhat of a revival of what used to be
UnseededNumberDictionary. The difference to NumberDictionary is that
each entry only has two fields (no field for property details) and there
is no header field for a bitfield.

The reason for this change is memory regression introduced when we
removed UnseededNumberDictionary (6e1c57eaa9). We now use
SimpleNumberDictionary for
- slow template instantiation cache
- code stubs table
- value serializer map
- stack frame cache
- type profile source positions

R=ishell@chromium.org, ulan@chromium.org

Bug: chromium:783695
Change-Id: I3cd32e485060bb379fb2279eeefbbbded7455f0e
Reviewed-on: https://chromium-review.googlesource.com/885811
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50869}
2018-01-25 13:49:23 +00:00
Benedikt Meurer
18d02b4fa9 [turbofan] Reduce promise creation overhead in async functions
This adds a new operator JSCreatePromise, which currently allocates
a native JSPromise instance and initializes it to pending state.

In addition to that we introduce a new PromiseHookProtector, which
get's invalidated the first time someone enables the debugger or
installs a PromiseHook (via async_hooks for example). As long as
the protector is intact we lower AsyncFunctionPromiseCreate to
JSCreatePromise and AsyncFunctionPromiseRelease to a no-op in
optimized code.

This yields a speedup of roughly 33% on the benchmark mentioned
in the bug.

Bug: v8:7271, v8:7253
Change-Id: Ib5d219f2b6e052a7cc5e6ed5aa66dd3c8885a859
Reviewed-on: https://chromium-review.googlesource.com/883124
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50849}
2018-01-24 19:03:43 +00:00
Yang Guo
11e80a3509 [snapshot] support attaching arbitrary v8::Data.
In collaboration with Qingyan Li <qingyan.liqy@alibaba-inc.com>.

R=jgruber@chromium.org, mlippautz@chromium.org

Bug: v8:7249
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I87f62103ec5b31de274fa22ad275f1c1bcb3ed86
Reviewed-on: https://chromium-review.googlesource.com/846750
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50433}
2018-01-09 12:06:40 +00:00
Yang Guo
c8736f6899 Reduce max instance type enum value.
We collect instance type statistics in FatalProcessOutOfMemory into an
array, which is allocated to the max instance type value. While we want
to leave space to ensure new instance types do not affect constants in
the API, we can be more frugal.

We currently serialize 350 maps into the startup/context snapshot.  Even
if we assign a distinct instance type to each of these maps, we would
still have more than enough to spare with this change.

R=ulan@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3e583c2c8da3342e9132d96046b5d80cd41afd72
Reviewed-on: https://chromium-review.googlesource.com/842542
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50302}
2017-12-22 19:08:18 +00:00
Yang Guo
9c6bc7afc0 Leave spaces between instance types.
We used to frequently break the ABI when we introduced new instance
types because some instance types are hard-coded in v8.h.

Now that we have more instance types available, we can leave some
room to anticipate future new instance types.

Also take this opportunity to reorder some instance types.

Also see: https://github.com/nodejs/node/issues/17754

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9b59eeab9dfcdf11d779f0b700fc5dce30d3eebe
Reviewed-on: https://chromium-review.googlesource.com/833874
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50223}
2017-12-20 07:34:39 +00:00
Alexei Filippov
f514cc967d [cpu-profiler] Introduce NativeFrame type.
The new frame type is inteneded to represent native C++ stack frames.
JS code may sometimes make calls to helper native functions that do not
provide any special stack layout besides the return address and frame pointer.

Currently the stack iterator bails out when it sees an unknown frame.
The patch allows the iterator to unwind stacks having such frames.

BUG=chromium:768540

Change-Id: I9c273c7015695a6733c0a0c52b522fca7b25de0d
Reviewed-on: https://chromium-review.googlesource.com/794991
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50058}
2017-12-13 00:05:45 +00:00
Igor Sheludko
42a7c0be4c [runtime] Introduce Load/StoreHandler heap objects.
They will eventually be used instead of Tuple3/FixedArray by the IC system.

Bug: v8:5561, v8:7159
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I39faad1b2dc10ce7d42cb7477ea87b64d1e0b44c
Reviewed-on: https://chromium-review.googlesource.com/806178
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49908}
2017-12-06 18:19:07 +00:00
Igor Sheludko
932aafb91f [runtime] Introduce instance type for descriptor arrays.
This simplifies handling of DescriptorArray objects in deserializer.

Bug: v8:5799
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie4f9c6903afd8273d6320e6b0e0b05231db6cc00
Reviewed-on: https://chromium-review.googlesource.com/785676
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49605}
2017-11-23 11:42:29 +00:00
Mircea Trofin
85ce824003 [wasm] Distinguish WASM_TO_WASM_FUNCTION
Identify wasm-to-wasm wrappers separately from wasm-to-js ones.

Bug: 
Change-Id: I853ed8fb999297f8a951ebb0e5be1c99bfacc18c
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/782680
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49580}
2017-11-22 15:36:08 +00:00
Benedikt Meurer
a9a1671345 [cleanup] Rename "array protector" to "no elements protector".
The "array protector" now guards the Object.prototype, the
Array.prototype and the String.prototype, so the name was a
bit misleading nowadays. So the new name "no elements protector"
was chosen.

Bug: v8:6936, v8:7014, v8:7027
Change-Id: I9a9d7caa2caf0ac9e78cc6658de2f0506970dfa2
Reviewed-on: https://chromium-review.googlesource.com/778162
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49471}
2017-11-20 09:43:35 +00:00
Yang Guo
aae52f6b0f [snapshot] introduce more maps for rehashing.
R=mstarzinger@chromium.org

Bug: v8:6593
Change-Id: Ica794c7b0d779f04647d2b2c5ce7762a537620ae
Reviewed-on: https://chromium-review.googlesource.com/759793
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49469}
2017-11-19 10:39:16 +00:00
Yang Guo
678f910375 [snapshot] no longer iterate strong roots twice.
Previously, in order to get immortal immovable objects onto
the first page, the serializer would iterate the root list
twice. The first time it would prioritize immortal immovables.
The second time it would serialize the rest.

This does not guarantee that immortal immovable objects
actually end up on the first page, and by now this is not
necessary anymore, since we mark all pages created during
heap init as immortal immovable pages.

R=mlippautz@chromium.org

Change-Id: Ie95fcd779377a75337621ba862bc1a745ed5cbaa
Reviewed-on: https://chromium-review.googlesource.com/768731
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49468}
2017-11-19 08:39:16 +00:00
Igor Sheludko
cc9e77abe8 Reland^2 "[runtime] Slightly optimize creation of class literals."
This CL also includes fixes for CF issues found while the previous
reland was active.

Bug: v8:5799, chromium:783902, chromium:783926, chromium:783822
Change-Id: I1f7d9b037d90838469c45f5d72771a77444c662e
Reviewed-on: https://chromium-review.googlesource.com/764067
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49457}
2017-11-17 18:15:34 +00:00
Jakob Gruber
e4b394a1f4 Revert "Reland "[runtime] Slightly optimize creation of class literals.""
This reverts commit 22932d6b43.

Reason for revert: TSAN https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/18232

Original change's description:
> Reland "[runtime] Slightly optimize creation of class literals."
> 
> Bug: v8:5799
> Change-Id: I782ec131c7194aef20942a19750168a974913c3f
> Reviewed-on: https://chromium-review.googlesource.com/757337
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49291}

TBR=ulan@chromium.org,rmcilroy@chromium.org,jarin@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: I0742d25b0e2364efc696d19492ba20614a3821fa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5799
Reviewed-on: https://chromium-review.googlesource.com/763458
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49303}
2017-11-10 16:00:31 +00:00
Igor Sheludko
22932d6b43 Reland "[runtime] Slightly optimize creation of class literals."
Bug: v8:5799
Change-Id: I782ec131c7194aef20942a19750168a974913c3f
Reviewed-on: https://chromium-review.googlesource.com/757337
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49291}
2017-11-10 11:57:18 +00:00
Igor Sheludko
03f4c091a9 Snapshot: support rehashing of standalone descriptors.
This is necessary in order to support class literals boilerplates which will
contain descriptor arrays not attached to maps.

This CL introduces Heap::descriptor_array_map() which will be used only for
descriptor arrays templates created as a part of class literal boilerplate.

We don't use the new map for all descriptors for now because in order to handle
chicken-egg problem in deserializer which can be solved in a clean and readable
way only if introduce a DESCRIPTOR_ARRAY_TYPE instance type which we can't
currently do because the InstanceType enum is already "full".

Bug: v8:5799
Change-Id: I732d236b0dda2c436ab3ce3ac5967f6c66162df3
Reviewed-on: https://chromium-review.googlesource.com/758360
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49271}
2017-11-09 13:33:42 +00:00
Yang Guo
6e1c57eaa9 Remove UnseededNumberDictionary.
Use (Seeded)NumberDictionary instead.

Change-Id: I426cd0a33df7d47fe4fec0c108be5632ef7c0f19
Reviewed-on: https://chromium-review.googlesource.com/756697
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49179}
2017-11-07 11:45:30 +00:00
Yang Guo
656c640ca9 Reland: Snapshot: support rehashing property and element dictionaries.
This change
- adds new maps for elements, global, and named dictionaries.
- adds support to embed these dictionaries in the startup snapshot.
- adds support to embed these dictionaries in the code cache.
- refactors the rehashing logic.

TBR=mstarzinger@chromium.org, ishell@chromium.org, jgruber@chromium.org

Bug: v8:6593
Change-Id: I2455fe2a9cc6e93247940de99de5f124c2ada137
Reviewed-on: https://chromium-review.googlesource.com/756693
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49167}
2017-11-07 07:22:19 +00:00
Adam Klein
03260ce48a Revert "Snapshot: support rehashing property and element dictionaries."
This reverts commit 3877bf6f4b.

Reason for revert: failed compilation on Win64/clang:

https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20clang/builds/9015

Original change's description:
> Snapshot: support rehashing property and element dictionaries.
> 
> This change
> - adds new maps for elements, global, and named dictionaries.
> - adds support to embed these dictionaries in the startup snapshot.
> - adds support to embed these dictionaries in the code cache.
> - refactors the rehashing logic.
> 
> R=​ishell@chromium.org, jgruber@chromium.org, mstarzinger@chromium.org
> 
> Bug: v8:6593
> Change-Id: I8d9a7ba7145f1af4e6e15301a4d5611f07c77f33
> Reviewed-on: https://chromium-review.googlesource.com/753323
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49155}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,ishell@chromium.org

Change-Id: I0b45d2d07da97b9a7953abf4ad24eec4ea944306
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6593
Reviewed-on: https://chromium-review.googlesource.com/755493
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49156}
2017-11-06 19:09:30 +00:00
Yang Guo
3877bf6f4b Snapshot: support rehashing property and element dictionaries.
This change
- adds new maps for elements, global, and named dictionaries.
- adds support to embed these dictionaries in the startup snapshot.
- adds support to embed these dictionaries in the code cache.
- refactors the rehashing logic.

R=ishell@chromium.org, jgruber@chromium.org, mstarzinger@chromium.org

Bug: v8:6593
Change-Id: I8d9a7ba7145f1af4e6e15301a4d5611f07c77f33
Reviewed-on: https://chromium-review.googlesource.com/753323
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49155}
2017-11-06 18:56:48 +00:00
Michael Starzinger
3b67d7a0f4 Reland "[objects] Introduce {CodeDataContainer} object type."
This is a reland of eeaffa9f33
Original change's description:
> [objects] Introduce {CodeDataContainer} object type.
> 
> This introduces the {CodeDataContainer} as a container for all mutable
> fields associated with a {Code} object. For now only the kind-specific
> flags are moved, but more fields can/will be moved gradually. The goal
> is to make all fields in the {Code} header be immutable eventually.
> 
> R=jarin@chromium.org
> BUG=v8:6792
> 
> Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
> Reviewed-on: https://chromium-review.googlesource.com/732987
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48902}

Bug: v8:6792
Change-Id: I31a127df4bb8ee5fedb4d73755df4deae6e1d352
Reviewed-on: https://chromium-review.googlesource.com/738109
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48928}
2017-10-25 12:43:56 +00:00
Michael Achenbach
9249df1d73 Revert "[objects] Introduce {CodeDataContainer} object type."
This reverts commit eeaffa9f33.

Reason for revert: Breaks msan compile (uninitialized value in snapshot):
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/17824

Original change's description:
> [objects] Introduce {CodeDataContainer} object type.
> 
> This introduces the {CodeDataContainer} as a container for all mutable
> fields associated with a {Code} object. For now only the kind-specific
> flags are moved, but more fields can/will be moved gradually. The goal
> is to make all fields in the {Code} header be immutable eventually.
> 
> R=​jarin@chromium.org
> BUG=v8:6792
> 
> Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
> Reviewed-on: https://chromium-review.googlesource.com/732987
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48902}

TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I74fe833b074752d640cff4aa4680f250e1bd8780
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6792
Reviewed-on: https://chromium-review.googlesource.com/738029
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48904}
2017-10-25 09:24:59 +00:00
Michael Starzinger
eeaffa9f33 [objects] Introduce {CodeDataContainer} object type.
This introduces the {CodeDataContainer} as a container for all mutable
fields associated with a {Code} object. For now only the kind-specific
flags are moved, but more fields can/will be moved gradually. The goal
is to make all fields in the {Code} header be immutable eventually.

R=jarin@chromium.org
BUG=v8:6792

Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
Reviewed-on: https://chromium-review.googlesource.com/732987
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48902}
2017-10-25 08:46:29 +00:00
Michael Starzinger
8dfebbc381 [objects] Turn {PromiseCapability} into a {Tuple3}.
R=gsathya@chromium.org
BUG=v8:6792

Change-Id: I68a5f9e7e52dbc9512e6919fce2064d748a3e7c4
Reviewed-on: https://chromium-review.googlesource.com/730726
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48824}
2017-10-23 11:15:07 +00:00
Toon Verwaest
b8b25e1c27 [ic] Remove extra-ic-state and Map::code_cache
There are only very few custom compiled IC handlers left that go in there, and for each compiled handler we only have 1 cache hit on top25; maximally saving 60ms over 33s. Additionally we'll migrate the remaining handlers to data-driven handlers anyway. Let's try to remove this code.

Bug: 
Change-Id: Ib874cc498015046a3ff67c83ea8b10b3c4eb7d0f
Reviewed-on: https://chromium-review.googlesource.com/668409
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48201}
2017-09-28 11:24:12 +00:00
Mike Stanton
c5295b0d71 Make JavaScriptFrame pure virtual.
Bug: v8:6409
Change-Id: I23b5c20022dcda5f46489596b3de4fb69be7e568
Reviewed-on: https://chromium-review.googlesource.com/660539
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48037}
2017-09-15 11:40:06 +00:00
Georg Neis
0c246c33a3 [bigint] Introduce BigInt type.
BigInt is a new primitive type of arbitrary precision integers,
proposed in https://tc39.github.io/proposal-bigint.

This CL introduces a corresponding instance type, map, and C++
class to V8 and adds BigInt support to a few operations (see the
test file). Much more is to come. Also, the concrete representation
of BigInts is not yet fixed, currently a BigInt is simply a wrapped
Smi.

Bug: v8:6791
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ia2901948efd7808f17cfc945f0d56e23e8ae0b45
Reviewed-on: https://chromium-review.googlesource.com/657022
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47956}
2017-09-11 18:55:48 +00:00
Sathya Gunasekaran
d138f8d7ef [promise] Reduce size of PromiseCapability by making it a struct
Bug: v8:5046
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I586dad351c950c119ec4d16693ce2a82395a8272
Reviewed-on: https://chromium-review.googlesource.com/640011
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47726}
2017-08-31 04:20:16 +00:00
Sathya Gunasekaran
dbfe4a49d8 [Modules] Introduce ScriptOrModule and HostDefinedOptions
This patch introduces a new container type ScriptOrModule which
provides the name and the host defined options of the script/module.

This patch also introduces a new PrimitivesArray that can hold
Primitive values, which the embedder can use to store metadata.

The HostDefinedOptions is passed to V8 through the ScriptOrigin, and
passed back to the embedder through HostImportModuleDynamically for
module loading.

Bug: v8:5785, v8:6658, v8:6683
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I56c26fc9a680b273ac0a6691e5ad75f15b8dc80a
Reviewed-on: https://chromium-review.googlesource.com/622158
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47724}
2017-08-31 00:28:56 +00:00
Benedikt Meurer
562663d545 [cleanup] Unify enum cache handling.
Introduce a proper empty_descriptor_array, which has the proper layout
(length is 2 and the two fields are set properly). Also add a special
EnumCache class and a matching empty_enum_cache. The contract now is
that we only need to check the EnumLength on the map to know whether we
are allowed to use the enum cache. This greatly simplifies the handling
of the enum cache (and also the descriptor arrays), especially for the
future work on optimizing keyed access via the enum cache indices.

Bug: v8:6702
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I5ef517a3041163cd65ef003f691139ea52233e83
Reviewed-on: https://chromium-review.googlesource.com/641030
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47697}
2017-08-30 05:29:16 +00:00
Benedikt Meurer
9be4b61007 [cleanup] Make StringLengthProtector into a Cell.
There's no need to have the StringLengthProtector as a PropertyCell,
since it's only used to guard against deoptimization loops. This also
allows us to remove the use of the CompilationDependencies from the
JSTypedLowering.

R=jarin@chromium.org

Bug: v8:6759
Change-Id: I54a37be6b8064ca3475e3b321f928b6a9903f209
Tbr: mstarzinger@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/637303
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47633}
2017-08-28 06:26:17 +00:00
Marja Hölttä
3710fd4a3d Revert "[parser] Tentative: turn on FLAG_preparser_scope_analysis."
This reverts commit fe50e8178f.

Reason for revert: Too close to branch point

Original change's description:
> [parser] Tentative: turn on FLAG_preparser_scope_analysis.
> 
> The main motivation is to get bug reports / crashes from Canary.
> 
> This commit is expected to break all kinds of things! The most typical failure
> modes are crashes, CHECK failures and JavaScript executing incorrectly.
> 
> BUG=v8:5516
> 
> Change-Id: Ifa02b420ad4e8eda46002b334bed2665c8ceeeb2
> Reviewed-on: https://chromium-review.googlesource.com/623751
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47502}

TBR=adamk@chromium.org,marja@chromium.org,cbruni@chromium.org

Change-Id: I98d2d186cbde6e185b05ef0d3460115a654b6b45
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5516
Reviewed-on: https://chromium-review.googlesource.com/626796
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47519}
2017-08-22 17:30:50 +00:00
Marja Hölttä
fe50e8178f [parser] Tentative: turn on FLAG_preparser_scope_analysis.
The main motivation is to get bug reports / crashes from Canary.

This commit is expected to break all kinds of things! The most typical failure
modes are crashes, CHECK failures and JavaScript executing incorrectly.

BUG=v8:5516

Change-Id: Ifa02b420ad4e8eda46002b334bed2665c8ceeeb2
Reviewed-on: https://chromium-review.googlesource.com/623751
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47502}
2017-08-22 11:37:20 +00:00
Michael Achenbach
b27bf3201d Revert "[parser] Turn FLAG_experimental_preparser_scope_analysis on."
This reverts commit 2e9f725338.

Reason for revert: Done experimenting...

Original change's description:
> [parser] Turn FLAG_experimental_preparser_scope_analysis on.
> 
> Experimental run, just for getting data from RuntimeCallstats bots.
> 
> To be reverted soon - expected to break various things.
> 
> BUG=v8:5516
> NOTREECHECKS=true
> 
> Change-Id: I6d235fddee36b0f0efe70065166d25ed40d6e163
> Reviewed-on: https://chromium-review.googlesource.com/557863
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47248}

TBR=adamk@chromium.org,machenbach@chromium.org,marja@chromium.org

Change-Id: I871d8a68442597b777e8f9e3d04ba3298ae87549
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5516
Reviewed-on: https://chromium-review.googlesource.com/608190
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47249}
2017-08-09 13:55:47 +00:00
Marja Hölttä
2e9f725338 [parser] Turn FLAG_experimental_preparser_scope_analysis on.
Experimental run, just for getting data from RuntimeCallstats bots.

To be reverted soon - expected to break various things.

BUG=v8:5516
NOTREECHECKS=true

Change-Id: I6d235fddee36b0f0efe70065166d25ed40d6e163
Reviewed-on: https://chromium-review.googlesource.com/557863
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47248}
2017-08-09 13:40:25 +00:00
Clemens Hammacher
c39c6eba00 [wasm] [debug] Implement calling imported wasm functions
The interpreter was not able to call imported wasm functions (hitting
UNIMPLEMENTED). This CL fixes this by creating a "CWasmEntry", which is
signature-specific. It has JS linkage and receives the wasm code object
to call and a buffer containing all arguments (similar to the
interpreter entry). It loads all arguments from the buffer and calls the
given code object.
The c-wasm-entry code objects are cached per instance, such that we
only create them once per signature.

These wasm entry stubs will also allow us to call back to compiled code
from the interpreter, which we might want to do to reduce the slowdown
of executing wasm for debugging.

R=titzer@chromium.org

Bug: chromium:735792
Change-Id: I7fecec3a7bec62a9de40fff115b684759b12a28b
Reviewed-on: https://chromium-review.googlesource.com/600308
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47195}
2017-08-07 12:31:18 +00:00
Ben L. Titzer
f8b7267477 Naming consistency and further small cleanups to frames.h
R=mstarzinger@chromium.org

Bug: 
Change-Id: Ia416acd8c12a3c8e3fdfabc56a4cd31cb946c88c
Reviewed-on: https://chromium-review.googlesource.com/599949
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47135}
2017-08-03 15:35:11 +00:00
Vyacheslav Chigrin
bde4dc8eda Fix serializing objects that may require non-world aligning.
We must ensure required root objects will be filled when such
objects will be deserialized.

Change-Id: I25136d31cb2e0c0a69a51c5635192f17bbe2a9ba
Reviewed-on: https://chromium-review.googlesource.com/579768
Commit-Queue: Vyacheslav Chigrin <vchigrin@yandex-team.ru>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46944}
2017-07-27 15:30:28 +00:00
Leszek Swirski
37680d6563 [objects] Make feedback vector a first-class object
Instead of having feedback vector as a subtype of FixedArray with
reserved slots, make it a first-class variable-sized object with a
fixed-size header. This allows us to compress counters to ints in the
header, rather than forcing them to be Smis.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icc5f088ffbc2e2651b845bc71ea42060639e3e48
Reviewed-on: https://chromium-review.googlesource.com/585129
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46935}
2017-07-27 13:31:55 +00:00
Ulan Degenbaev
2cc8fdfb47 [heap] Re-implement weak cell tracking in the marker.
This replaces the linked list of weak cells with a worklist.

TBR=yangguo@chromium.org

BUG=chromium:694255

Change-Id: Ia877e25010ebbec9c05fbbe48cff460a92d3a132
Reviewed-on: https://chromium-review.googlesource.com/587067
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46929}
2017-07-27 11:09:24 +00:00
Georg Neis
ddec1c4f57 [modules] Fix Object.prototype.hasOwnProperty on namespace objects.
This must throw for uninitialized properties.

R=adamk@chromium.org

Bug: v8:1569, v8:5487
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I8beb8bf6a197870eb5c038102ab474dd12f6b6eb
Reviewed-on: https://chromium-review.googlesource.com/582013
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46870}
2017-07-25 12:09:41 +00:00
Yang Guo
89ef9556d7 Reland: Introduce HASH_TABLE_TYPE instance type.
This is so that we can distinguish hash tables by instance type. We can
then introduce maps for each kind of hash tables to further distinguish.

R=mstarzinger@chromium.org

Bug: v8:6593
Change-Id: Ice9e6bb7b85d825207ac489b6930ac9020d60db8
Reviewed-on: https://chromium-review.googlesource.com/582814
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46861}
2017-07-25 09:19:46 +00:00
Yang Guo
f4867154c4 Revert "Introduce HASH_TABLE_TYPE instance type."
This reverts commit 990dd947bc.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Introduce HASH_TABLE_TYPE instance type.
> 
> This is so that we can distinguish hash tables by instance type. We can
> then introduce maps for each kind of hash tables to further distinguish.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: v8:6593
> Change-Id: I1a532884758e571abdfe2e2743fc5ea611d12f7e
> Reviewed-on: https://chromium-review.googlesource.com/581009
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46828}

TBR=yangguo@chromium.org,mstarzinger@chromium.org

Change-Id: Ia47d408e5cf47983940227b4cc445a704d7f8d19
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6593
Reviewed-on: https://chromium-review.googlesource.com/581493
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46833}
2017-07-24 07:33:52 +00:00
Yang Guo
990dd947bc Introduce HASH_TABLE_TYPE instance type.
This is so that we can distinguish hash tables by instance type. We can
then introduce maps for each kind of hash tables to further distinguish.

R=mstarzinger@chromium.org

Bug: v8:6593
Change-Id: I1a532884758e571abdfe2e2743fc5ea611d12f7e
Reviewed-on: https://chromium-review.googlesource.com/581009
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46828}
2017-07-24 06:04:29 +00:00
Yang Guo
0e4965e59e Remove PREPARED_SCOPE_DATA instance type.
And alpha-sort some lists.

R=jgruber@chromium.org

Change-Id: I01fcf01cf8e1eb1e6c99202156c1013e92bf4e7e
Reviewed-on: https://chromium-review.googlesource.com/579711
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46809}
2017-07-21 07:19:39 +00:00
Yang Guo
33ad95682c Remove padding instance types.
This also makes sure 6.0 and 6.1 have the same constants exposed
in v8.h.

Bug: v8:6592

R=bmeurer@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3afc0e5e4495594c76229555aab148ac78388f80
Reviewed-on: https://chromium-review.googlesource.com/569618
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46642}
2017-07-13 14:48:56 +00:00
Sathya Gunasekaran
892d49a695 [runtime] Introduce PropertyArray
This patch changes the backing store of slow properties to be a
new instance type called PropertyArray.

Currently the only difference between this and a FixedArray is
the map. A future patch will change the length property to store
the hash code.

Bug: v8:5717, v8:6404
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iaebc98f42e6d93c1392772e6f837787beb64afec
Reviewed-on: https://chromium-review.googlesource.com/539028
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46569}
2017-07-11 22:48:54 +00:00
Benedikt Meurer
3b84cbfeb0 [builtins] Port Map and Set iterators to CodeStubAssembler.
This is the next step towards faster Map and Set iteration. It
introduces the appropriate instance types for Map and Set
iterators (following the pattern for Array iterators) and migrates
the following builtins to the CodeStubAssembler:

  - Set.prototype.entries
  - Set.prototype.values
  - Map.prototype.entries
  - Map.prototype.keys
  - Map.prototype.values
  - %SetIteratorPrototype%.next
  - %MapIteratorPrototype%.next

This already provides a significant performance boost for regular
for-of iteration of Sets and Maps, by a factor of 5-10 depending
on the input. The final step will be to inline some fast-paths
into TurboFan.

Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
intrinsics and runtime functions.

TBR=jgruber@chromium.org

Bug: v8:6344, v8:6571, chromium:740122
Change-Id: I3ab0ee49e2afe8d4295707a5ecbd51adda621918
Reviewed-on: https://chromium-review.googlesource.com/563626
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46497}
2017-07-10 07:57:02 +00:00
Michael Achenbach
5a6e24e9e4 Revert "[builtins] Port Map and Set iterators to CodeStubAssembler."
This reverts commit 3f22832be7.

Reason for revert: Layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16849

Original change's description:
> [builtins] Port Map and Set iterators to CodeStubAssembler.
> 
> This is the next step towards faster Map and Set iteration. It
> introduces the appropriate instance types for Map and Set
> iterators (following the pattern for Array iterators) and migrates
> the following builtins to the CodeStubAssembler:
> 
>   - Set.prototype.entries
>   - Set.prototype.values
>   - Map.prototype.entries
>   - Map.prototype.keys
>   - Map.prototype.values
>   - %SetIteratorPrototype%.next
>   - %MapIteratorPrototype%.next
> 
> This already provides a significant performance boost for regular
> for-of iteration of Sets and Maps, by a factor of 5-10 depending
> on the input. The final step will be to inline some fast-paths
> into TurboFan.
> 
> Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
> intrinsics and runtime functions.
> 
> Bug: v8:6571, chromium:740122
> Change-Id: Iad7a7dec643d8f8b5799327f89a351108ae856bf
> Reviewed-on: https://chromium-review.googlesource.com/563399
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46492}

TBR=jgruber@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6571, chromium:740122
Change-Id: Iadb48d72e3b85ec8ad880e50ab7912c5502caf07
Reviewed-on: https://chromium-review.googlesource.com/564419
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46495}
2017-07-10 04:44:13 +00:00
Benedikt Meurer
3f22832be7 [builtins] Port Map and Set iterators to CodeStubAssembler.
This is the next step towards faster Map and Set iteration. It
introduces the appropriate instance types for Map and Set
iterators (following the pattern for Array iterators) and migrates
the following builtins to the CodeStubAssembler:

  - Set.prototype.entries
  - Set.prototype.values
  - Map.prototype.entries
  - Map.prototype.keys
  - Map.prototype.values
  - %SetIteratorPrototype%.next
  - %MapIteratorPrototype%.next

This already provides a significant performance boost for regular
for-of iteration of Sets and Maps, by a factor of 5-10 depending
on the input. The final step will be to inline some fast-paths
into TurboFan.

Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
intrinsics and runtime functions.

Bug: v8:6571, chromium:740122
Change-Id: Iad7a7dec643d8f8b5799327f89a351108ae856bf
Reviewed-on: https://chromium-review.googlesource.com/563399
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46492}
2017-07-08 18:46:59 +00:00
titzer
17001a05c8 [wasm] Introduce instance types for WebAssembly.* objects.
This CL refactors the internal representation of JavaScript-exposed
WebAssembly objects to be more like other such objects in V8. By introducing
a new instance type for each of the JS-exposed types, we get more robust
typechecking without using embedder fields (which were previously used
when these objects where instance type JS_API_OBJECT).

In addition to the new instance types, the subclasses X of JSObject
(WasmInstanceObject, WasmMemoryObject, WasmModuleObject, WasmTableObject)
now have appropriate Is##X() methods on Object and are now robust.

BUG=v8:6547
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2964943002
Cr-Commit-Position: refs/heads/master@{#46475}
2017-07-07 12:27:56 +00:00
Marja Hölttä
937b5011b8 [parser] Skipping inner funcs: Associate data to SharedFunctionInfo, not Script.
This way, each lazy function needs to handle only the data relevant to
itself. This reduced data handling overheads.

Other changes:

1) Don't deserialize the data; once it's on the heap, it can stay there. Lazy
function compilation is only done in the main thread.

2) Separate ProducedPreParsedScopeData and ConsumedPreParsedScopeData. It's clearer, because:

- The data looks fundamentally different when we're producing it and when we're
  consuming it.

- Cleanly separates the operations we can do in the "producing phase" and in the
  "consuming phase".

Bug: v8:5516
Change-Id: I6985a6621f71b348a55155724765624b5d5f7c33
Reviewed-on: https://chromium-review.googlesource.com/528094
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46347}
2017-06-30 11:12:52 +00:00
Mike Stanton
f9e0322ae8 The Species protector should be a property cell.
To be able to use this in optimized code dependency relationships.

Bug: 
Change-Id: Ia099a68994b1252de3c72c8d688862ca17ca76d9
Reviewed-on: https://chromium-review.googlesource.com/548716
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46277}
2017-06-28 10:42:29 +00:00
Toon Verwaest
e91c6dc7a9 [dictionary] Move Name into PropertyCell to save space in overallocated hashtable
Bug: 
Change-Id: I56bfd921d63783ddaa74133dde5f3daf776e68ca
Reviewed-on: https://chromium-review.googlesource.com/548115
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46250}
2017-06-27 12:25:22 +00:00
Michael Starzinger
0d833cb94f [deoptimizer] Remove support for code-stub "deopt".
This removes support for code-stub to tail-call into the runtime via the
deoptimizer. The Hydrogen code-stubs would trigger a deopt in order to
materialize a trampoline frame, which would then continue execution in a
runtime function associated with each stub. This is no longer needed for
code-stubs built with the CSA.

R=jarin@chromium.org
BUG=v8:6408

Change-Id: I1ff8dc03ac716200b28e962259a3e233aeda1234
Reviewed-on: https://chromium-review.googlesource.com/548375
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46223}
2017-06-26 15:04:43 +00:00
Toon Verwaest
b186ca9c75 [runtime] Move MaxNumberKey and NextEnumerationIndex to the subclasses that use it
Bug: 
Change-Id: Ica3ebd998ad44d24c401cfb74cf5cbe3a6164c47
Reviewed-on: https://chromium-review.googlesource.com/541344
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46099}
2017-06-21 14:58:44 +00:00
Sathya Gunasekaran
4cf144dc2e [Collections] Implement SmallOrderedHashMap
Bug: v8:6443
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I20b1006a5c5ff24a730f15286cf0f340ba047b78
Reviewed-on: https://chromium-review.googlesource.com/526001
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46034}
2017-06-20 10:25:15 +00:00
Mythri
aed96e7b04 [Turbofan] Simplify handling of hole check bytecodes in bytecode-graph-builder.
ThrowIfHole bytecodes were handled by introducing deopt points to check
for a hole. To avoid deopt loops a hole check protector was used to
generate control flow if there was a deopt due to a hole. However, the
normal control flow version should be as fast as the deopt version
in general. The deopt version could potentially consume less compile time
but it may not be worth the complexity added. Hence simplifying it to
only construct the control flow.

Bug: v8:6383
Change-Id: Icace11f7a6e21e64e1cebd104496e3f559bc85f7
Reviewed-on: https://chromium-review.googlesource.com/525573
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45783}
2017-06-08 08:53:16 +00:00
danno
90c3a2d54b Inline Array.prototype.forEach in TurboFan
This CL contains a few pieces:

- A new mechanism to create "BuiltinContinuation" checkpoints in TurboFan
  graphs, which--when triggered--swizzle the values in the the FrameState to be
  parameters to a typically TF-generated builtin that resumes execution to finish
  the slow-case functionality.
- Continuation builtins that have special handling in the deoptimizer and their own
  new frame type to ensure that the values they need to begin executing can be stashed
  away and restored immediately before the builtin is called via a trampoline that runs
  when the continuation builtin's frame execution resumes.
- An implementation of Array.prototype.forEach in TurboFan that can be used to
  inline it. The inlined forEach implementation uses the checkpoints mechanism
  described above to deopt in the middle of the forEach in the cases that optimization
  invariants are violated. There is a slightly different continuation stub for each
  deopt point in the forEach implementation to ensure the correct side-effects, i.e.
  that the deopt of the builtin isn't programmatically observable.

Review-Url: https://codereview.chromium.org/2803853005
Cr-Commit-Position: refs/heads/master@{#45764}
2017-06-07 13:23:33 +00:00
Mythri
c360c6a1d0 [Interpreter] Introduce bytecodes that check for hole and throw.
Introduces ThrowReferenceErrorIfHole / ThrowSuperNotCalledIfHole 
/ ThrowSuperAlreadyCalledIfNotHole bytecodes to handle hole checks.
In the bytecode-graph builder they are handled by introducing a deopt point
instead of adding explicit control flow. JumpIfNotHole / JumpIfNotHoleConstant
bytecodes are removed since they are no longer required.


Bug: v8:4280, v8:6383
Change-Id: I58b70c556b0ffa30e41a0cd44016874c3e9c5fe1
Reviewed-on: https://chromium-review.googlesource.com/509613
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45720}
2017-06-06 09:41:31 +00:00
Sathya Gunasekaran
f4664d0257 [runtime] Implement SmallOrderedHashTable
Implements the Allocate, Add, and HasKey operations. Also, adds GC
support for this new instance type.

Bug: v8:6443
Change-Id: I1cc7ba2faead2a11f7b0381a57858629e123aee6
Reviewed-on: https://chromium-review.googlesource.com/500447
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45551}
2017-05-29 10:04:22 +00:00
georgia.kouveli
c15b3ffc77 [arm] Share constant pool entries in snapshot.
This patch also adds sharing of code target entries, which requires
sharing the RelocInfo for those entries as well. The disassembler
is also modified in order to print comments for the RelocInfo that
is now shared.

This improves the snapshot size for arm by about 4%.

BUG=

Review-Url: https://codereview.chromium.org/2869683004
Cr-Commit-Position: refs/heads/master@{#45497}
2017-05-23 18:30:32 +00:00
Georg Neis
f846e7df71 [compiler] Make root detection thread-safe.
... by only looking at the handle.

This is in preparation for running code generation off the main thread.

Bug: v8:6048
Change-Id: I19b105c13278a2821a0b2395033e54abf5552a43
Reviewed-on: https://chromium-review.googlesource.com/506190
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45333}
2017-05-16 11:14:05 +00:00
yangguo
9d71683e11 Introduce mkgrokdump to update tools/v8heapconst.py.
- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Original-Commit-Position: refs/heads/master@{#44687}
Committed: 0cc0c130fa
Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Commit-Position: refs/heads/master@{#44710}
Committed: 477f005574
Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44738}
2017-04-20 06:15:02 +00:00
machenbach
84b22eb29f Revert of Introduce mkgrokdump to update tools/v8heapconst.py. (patchset #21 id:390001 of https://codereview.chromium.org/2809653003/ )
Reason for revert:
Test driver runs into assert:
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/17082

Original issue's description:
> Introduce mkgrokdump to update tools/v8heapconst.py.
>
> - Migrate make grokdump to GYP and GN
> - Move code from d8 into stand-alone execution
> - Add test case to ensure it's up-to-date
>
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Original-Commit-Position: refs/heads/master@{#44687}
> Committed: 0cc0c130fa
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Commit-Position: refs/heads/master@{#44710}
> Committed: 477f005574

TBR=mstarzinger@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2826743003
Cr-Commit-Position: refs/heads/master@{#44711}
2017-04-19 07:03:00 +00:00
yangguo
477f005574 Introduce mkgrokdump to update tools/v8heapconst.py.
- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Original-Commit-Position: refs/heads/master@{#44687}
Committed: 0cc0c130fa
Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44710}
2017-04-19 06:10:15 +00:00
yangguo
0e12ac85c1 Revert of Introduce mkgrokdump to update tools/v8heapconst.py. (patchset #19 id:350001 of https://codereview.chromium.org/2809653003/ )
Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/17063/steps/Check/logs/mkgrokdump

Original issue's description:
> Introduce mkgrokdump to update tools/v8heapconst.py.
>
> - Migrate make grokdump to GYP and GN
> - Move code from d8 into stand-alone execution
> - Add test case to ensure it's up-to-date
>
> Review-Url: https://codereview.chromium.org/2809653003
> Cr-Commit-Position: refs/heads/master@{#44687}
> Committed: 0cc0c130fa

TBR=mstarzinger@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2824853003
Cr-Commit-Position: refs/heads/master@{#44691}
2017-04-18 14:41:13 +00:00
yangguo
0cc0c130fa Introduce mkgrokdump to update tools/v8heapconst.py.
- Migrate make grokdump to GYP and GN
- Move code from d8 into stand-alone execution
- Add test case to ensure it's up-to-date

Review-Url: https://codereview.chromium.org/2809653003
Cr-Commit-Position: refs/heads/master@{#44687}
2017-04-18 14:05:27 +00:00
Camillo Bruni
5ca9632e51 [tools] Improve grokdump.py
- Add new address markers:
   T: tagged pointer in the minidump
   C: address into a module in the minidump
   S: pointer into the exception stack in the minidump
   *: other address in the minidump
- Show ASCII decoding of address in dd
- Display potential frame markers on the exception stack:
   00000032212fdae8: 0000000300000000   ........ Smi(3) EXIT frame marker
- Display relative addresses, useful to detect stack frames:
   00000032212fdb68: 00000032212fdb98 S ........  [+6]=00000032212fdcb0 S
   00000032212fdb70: 0000010ff5ca0a84   ........
   00000032212fdb78: 000001064c1fa881   ........
   00000032212fdb80: 0000016a8e52fcb1   ........
   00000032212fdb88: 0000010ff5ca0981   ........
   00000032212fdb90: 0000000d00000000   ........ Smi(13) INTERNAL frame marker
   00000032212fdb98: 00000032212fdcb0 S ........  [+35]=00000032212fdd61 S

Change-Id: I56bd7e6723a34bcb668719246dd5ff2898224928
Reviewed-on: https://chromium-review.googlesource.com/461862
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44269}
2017-03-30 13:38:31 +00:00
Toon Verwaest
1826f09c58 [grokdump] Update grokdump to decode new map layouts, and dump-heap-constants to 512kb pages
BUG=

Change-Id: I5e60705764b8ea20b171981cdd44d57a928fa34d
Reviewed-on: https://chromium-review.googlesource.com/461178
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44188}
2017-03-28 12:07:01 +00:00
jochen
a1c917ca58 Update heap constants
R=ishell@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2590923002
Cr-Commit-Position: refs/heads/master@{#41865}
2016-12-20 15:26:08 +00:00
jochen
50d54ee2e3 Rename SloppyBlockWithEvalContextExtension to ContextExtension
The plan is to also use it for With and Catch scopes, so all kinds of
contexts have a pointer back to their ScopeInfo

R=neis@chromium.org,marja@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2301913002
Cr-Commit-Position: refs/heads/master@{#39092}
2016-09-01 15:04:01 +00:00
jochen
f4e142d1df Update heap constants from ToT
BUG=
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2171313002
Cr-Commit-Position: refs/heads/master@{#37979}
2016-07-22 11:49:17 +00:00
yangguo
a13e0af506 Update tools/v8heapconst.py.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1674023003

Cr-Commit-Position: refs/heads/master@{#33803}
2016-02-08 08:14:50 +00:00
mlippautz
55422bdd50 [heap] Use HashMap as scratchpad backing store
We use a scratchpad to remember visited allocation sites for post processing
(making tenure decisions). The previous implementation used a rooted FixedArray
with constant length (256) to remember all sites. Updating the scratchpad is a
bottleneck in any parallel/concurrent implementation of newspace evacuation.

The new implementation uses a HashMap with allocation sites as keys and
temporary counts as values. During evacuation we collect a local hashmap of
visited allocation sites. Upon merging the local hashmap back into a global one
we update potential forward pointers of compacted allocation sites.  The
scavenger can directly enter its entries into the global hashmap. Note that the
actual memento found count is still kept on the AllocationSite as it needs to
survive scavenges and full GCs.

BUG=chromium:524425
LOG=N
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1535723002

Cr-Commit-Position: refs/heads/master@{#33233}
2016-01-12 11:46:37 +00:00
jochen
7730edcc12 Remove easy to remove calls to Isolate::Current() from api.cc
R=vogelheim@chromium.org
LOG=n
BUG=v8:2487

Review URL: https://codereview.chromium.org/1474353002

Cr-Commit-Position: refs/heads/master@{#32389}
2015-11-30 08:16:59 +00:00
oth
cb6e705686 [Interpreter] Add BytecodeArray class and add to SharedFunctionInfo.
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1230753004

Cr-Commit-Position: refs/heads/master@{#29843}
2015-07-24 12:03:03 +00:00
mbrandy
1c56723d1b [grokdump] Update v8heapconst.py
R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1165453009

Cr-Commit-Position: refs/heads/master@{#28843}
2015-06-08 18:16:12 +00:00
jkummerow
0897244dd4 [grokdump] Update v8heapconst.py
Review URL: https://codereview.chromium.org/1125543004

Cr-Commit-Position: refs/heads/master@{#28231}
2015-05-05 14:26:35 +00:00
hpayer
59be4ba7f4 Reland "Merge old data and pointer space."
This reverts commit cbfcee5575.

BUG=

Review URL: https://codereview.chromium.org/1051233002

Cr-Commit-Position: refs/heads/master@{#27623}
2015-04-07 11:32:10 +00:00
hpayer
cbfcee5575 Revert "Merge old data and pointer space."
TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1027463002

Cr-Commit-Position: refs/heads/master@{#27323}
2015-03-19 22:03:32 +00:00
hpayer
257ff48931 Merge old data and pointer space.
BUG=

Review URL: https://codereview.chromium.org/1012023002

Cr-Commit-Position: refs/heads/master@{#27259}
2015-03-18 09:39:03 +00:00
dcarney
79417664b2 remove undetectable strings
BUG=

Review URL: https://codereview.chromium.org/916753002

Cr-Commit-Position: refs/heads/master@{#26571}
2015-02-11 09:28:12 +00:00
dcarney
74c00e93c5 update vector ics to handle megamorphic keyed loads
R=mvstanton@chromium.org

BUG=

Review URL: https://codereview.chromium.org/889863002

Cr-Commit-Position: refs/heads/master@{#26352}
2015-01-30 12:41:08 +00:00
dcarney
c15c737362 remove SignatureInfo class
BUG=

Review URL: https://codereview.chromium.org/855903002

Cr-Commit-Position: refs/heads/master@{#26129}
2015-01-19 12:17:23 +00:00
dcarney
a5aa01beec remove declarative accessors
R=jochen@chromium.org

BUG=

Review URL: https://codereview.chromium.org/834443004

Cr-Commit-Position: refs/heads/master@{#25981}
2015-01-07 16:37:43 +00:00
yangguo@chromium.org
c71976d55a Also rename ascii to one-byte in tool scripts.
TBR=marja@chromium.org

Review URL: https://codereview.chromium.org/561743002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23841 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-09-10 12:56:19 +00:00
svenpanne@chromium.org
bd96b9ffce Updated constants.
No idea when they got out-of-sync...

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/194953002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-03-11 11:56:04 +00:00
jkummerow@chromium.org
e0842a75b9 Update v8heapconst.py
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/170263002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19424 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-18 08:50:19 +00:00
rafaelw@chromium.org
6b5a4cdef2 V8 Microtask Queue & API
This patch generalizes Object.observe callbacks and promise resolution into a FIFO queue called a "microtask queue".

It also exposes new V8 API which exposes the microtask queue to the embedder. In particular, it allows the embedder to

-schedule a microtask (EnqueueExternalMicrotask)
-run the microtask queue (RunMicrotasks)
-control whether the microtask queue is run automatically within V8 when the last script exits (SetAutorunMicrotasks).

R=dcarney@chromium.org, rossberg@chromium.org, dcarney, rossberg, svenpanne
BUG=

Review URL: https://codereview.chromium.org/154283002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 22:04:19 +00:00
ulan@chromium.org
2638dca48f Make cells pointing to JSObjects weak in optimized code.
This is done similar to weak embedded objects in optimized code (r17102). The
reference from optimized code to a cell is treated weakly in marking visitors
if the cell points to a JSObject. After marking we iterate over all cells
embedded in optimized code. If a cell is not marked but its value is marked,
then we revive the cell by marking it. Otherwise, the cell value is dead, so
we mark the code for deoptimization.

BUG=v8:2073
TEST=cctest/test-heap/CellsInOptimizedCodeAreWeak
LOG=Y
R=hpayer@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/117483002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18616 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-15 11:42:19 +00:00
ulan@chromium.org
83c63cf555 Out-of-line constant pool on Arm: Stage 2 - Introduce ConstantPoolArray object.
Second stage of implementing an out-of-line constant pool on Arm.  This CL
Introduces the ConstantPoolArray object which will be used as the backing
store of out-of-line constant pools.  Nothing uses this object yet.

BUG=
R=ulan@chromium.org

Review URL: https://chromiumcodereview.appspot.com/22601003

Patch from Ross McIlroy <rmcilroy@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17197 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 13:35:06 +00:00
titzer@chromium.org
562d8ddcb9 Remove dead strings from heap.h
BUG=
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/23600023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-11 08:58:38 +00:00
dcarney@chromium.org
615c34869c Push SetAccessor to Template
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/23182003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16515 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 07:45:36 +00:00
dcarney@chromium.org
ad9cc8e716 js accessor creation on Template
R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/22903012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 11:59:14 +00:00
svenpanne@chromium.org
f0305bd83e Instance-type-related fixes and cleanup.
Things got quite a bit out of sync (don't we all love copy-n-paste?):

   * TypeToString didn't handle SLICED_STRING_TYPE,
     SLICED_ASCII_STRING_TYPE, FIXED_DOUBLE_ARRAY_TYPE,
     JS_FUNCTION_PROXY_TYPE and JS_DATE_TYPE.

   * INSTANCE_TYPE_LIST was missing entries for
     SLICED_ASCII_STRING_TYPE, JS_SET_TYPE, and JS_MAP_TYPE.

To improve this maintenance nightmare a little bit, the missing
instance types were added to the INSTANCE_TYPE_LIST macro and this
list is now used via our beloved 2nd order macro technique in
TypeToString. As a side-effect, the strings returned by TypeToString
have a "_TYPE" suffix now, but this doesn't really matter and is a
small price to pay for consistency.

Removed INVALID_TYPE on the way, it had no real use.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/22681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 08:22:46 +00:00
mstarzinger@chromium.org
e9f6a2d7b4 Use first hit when dumping heap constants.
This makes sure that the first hit is used when dumping heap constants
and hence "TheHoleValue" is not overwritten with other roots that are
initialized to the hole as well.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/21639004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16058 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 16:47:45 +00:00
dcarney@chromium.org
207396101f introduce eternal handles
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/21133006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 09:46:23 +00:00
mstarzinger@chromium.org
12c8d36331 Generate grokdump constants with 'make grokdump' now.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/21771002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16022 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-02 09:02:02 +00:00