Commit Graph

121 Commits

Author SHA1 Message Date
Georg Neis
bc72a83192 [csa] Make use of CallBuiltin (rather than CallStub) in more places.
This is a cosmetic change only.

Change-Id: I9a0ea9a23b4fc1490759433153c7d47e492b853d
Reviewed-on: https://chromium-review.googlesource.com/936624
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51733}
2018-03-05 14:34:21 +00:00
Vaclav Brozek
44bed6a85e TF stubs out of ArrayIndexOf and ArrayInclude builtins
ArrayIndexOf is a monolithic builtin which does some checking and then handles
three groups of fast arrays: those with holey doubles, compacted doubles and
SMIs+objects. TF cannot reuse this efficiently, because calling the TFJ
ArrayIndexOf duplicates some checks and also does not allow passing arguments
through registers. Similarly for ArrayInclude.

This CL splits the three different types of fast array handling into a separate
TF stubs, and makes the parent TFJ as well as TurboFan itself use them where
appropriate.

The TODOs not tackled in this CL inculde:
* passing an empty context to spare a register when possible
* inlining the search loop if there is any performance gain to it

(This is the contiunation of http://crrev.com/2757853002, moved due to Rietveld
deprecation.)

BUG=v8:5985

Change-Id: I00c97b71be4892f8bc7e1ed6d72e02087618a9a6
Reviewed-on: https://chromium-review.googlesource.com/573020
Commit-Queue: Vaclav Brozek <vabr@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51729}
2018-03-05 13:37:21 +00:00
Benedikt Meurer
06ee127b75 [es2015] Refactor the JSArrayIterator.
This changes the JSArrayIterator to always have only a single instance
type, instead of the zoo of instance types that we had before, and
which became less useful with the specification update to when "next"
is loaded from the iterator now. This greatly simplifies the baseline
implementation of the array iterator, which now only looks at the
iterated object during %ArrayIteratorPrototype%.next invocations.

In TurboFan we introduce a new JSCreateArrayIterator operator, that
holds the IterationKind and get's the iterated object as input. When
optimizing %ArrayIteratorPrototype%.next in the JSCallReducer, we
check whether the receiver is a JSCreateArrayIterator, and if so,
we try to infer maps for the iterated object from there. If we find
any, we speculatively assume that these won't have changed during
iteration (as we did before with the previous approach), and generate
fast code for both JSArray and JSTypedArray iteration.

Drive-by-fix: Drop the fast_array_iteration protector, it's not
necessary anymore since we have the deoptimization guard bit in
the JSCallReducer now.

This addresses the performance cliff noticed in webpack 4. The minimal
repro on the tracking bug goes from

  console.timeEnd: mono, 124.773000
  console.timeEnd: poly, 670.353000

to

  console.timeEnd: mono, 118.709000
  console.timeEnd: poly, 141.393000

so that's a 4.7x improvement.

Also make presubmit happy by adding the missing #undef's.

Bug: v8:7510, v7:7514
Change-Id: I79a46bfa2cd0f0710e09365ef72519b1bbb667b5
Reviewed-on: https://chromium-review.googlesource.com/946098
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51725}
2018-03-05 11:57:28 +00:00
Sigurd Schneider
d1df563059 [turbofan] Fix bug in Array.p.reduceRight
Bug: v8:7495
Change-Id: Id929804e0d0f78c17d81d07cd6a5c5e571449d35
Reviewed-on: https://chromium-review.googlesource.com/947974
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51720}
2018-03-05 10:52:32 +00:00
Camillo Bruni
923ba7dabf [CSA] Type HasInstanceType and helpers
Bug: v8:7310
Change-Id: I328fd1b9ebff405f827f7ef810ab1e8459582fca
Reviewed-on: https://chromium-review.googlesource.com/941203
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51643}
2018-03-01 07:33:00 +00:00
Peter Marshall
7cbf9f8457 [CSA] Add a static assert to find unnecessary CAST calls.
This will fire if the CAST is never useful. This is helpful if you add
a TNode return type to a function - its callers no longer need to cast
the result if the types are the same.

Change-Id: If0b04c615cb2dbfa91ba43d5d0d35ace5a31d4e7
Reviewed-on: https://chromium-review.googlesource.com/934449
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51599}
2018-02-27 13:37:34 +00:00
Sigurd Schneider
0165432e20 [cleanup] Rename Word to Int32/IntPtr depending on context
Bug: v8:7310
Change-Id: I3b9832c7090d5c4b2f425f85095b0d7bae29fbfd
Reviewed-on: https://chromium-review.googlesource.com/934321
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51519}
2018-02-23 14:34:07 +00:00
Dan Elphick
efd5f6d82a [builtins] Add typing to builtins-array-gen
Convert all context, receiver and argc Node*s to their appropriate TNode
type.

Bug: v8:7310
Change-Id: Ic6bf22ffb22199d390731d424b7395c47a8f19cf
Reviewed-on: https://chromium-review.googlesource.com/934442
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51511}
2018-02-23 13:12:15 +00:00
Peter Marshall
6040cbb876 [cleanup] Add CSA types to Number{Inc,Dec,Add,Sub}
Bug: v8:7310
Change-Id: I8d3ac3127d5ca3ea88fbb954727a7222de5d75a0
Reviewed-on: https://chromium-review.googlesource.com/934261
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51509}
2018-02-23 12:48:23 +00:00
Peter Marshall
6a2926e559 [cleanup] Add CSA types to CallBuiltin and GetMethod.
Bug: v8:7310
Change-Id: Iaebe8fa8e5a622b0963754548aa7e29fd6028e22
Reviewed-on: https://chromium-review.googlesource.com/934203
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51501}
2018-02-23 10:23:44 +00:00
Jakob Kummerow
ec19cd24f2 [cleanup] Clean up CSA::LoadFixedTypedArrayElementAsTagged
and use it more often.

Bug: v8:7310
Change-Id: I7773f35415a0bb529cdaac380c9068f4ed5010ae
Reviewed-on: https://chromium-review.googlesource.com/930236
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51493}
2018-02-23 03:46:53 +00:00
Jakob Kummerow
bd0b32f545 Reland "[bigint] Add BigInt64Array, BigUint64Array"
This is a reland of dda0419ecd.

Originally reviewed-on: https://chromium-review.googlesource.com/914513
and landed as refs/heads/master@{#51342}.

Bug: v8:6791
Change-Id: I3b3a069da7a0e64c38a81b3110dc5ece4887cb19
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/924665
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51352}
2018-02-19 10:23:18 +00:00
Michael Achenbach
cb7a15fede Revert "[bigint] Add BigInt64Array, BigUint64Array"
This reverts commit dda0419ecd.

Reason for revert: msvc unhappy:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/1434

Original change's description:
> [bigint] Add BigInt64Array, BigUint64Array
> 
> Bug: v8:6791
> Tbr: hpayer@chromium.org
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I637e9084d2fe4869ad0be2fb996149ab9940f346
> Reviewed-on: https://chromium-review.googlesource.com/914513
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51342}

TBR=jkummerow@chromium.org,neis@chromium.org,hpayer@chromium.org

Change-Id: I49237fa323f0d3ea70e744d92d5cbdd4d5c4b39f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6791
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/924663
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51344}
2018-02-17 06:01:31 +00:00
Jakob Kummerow
dda0419ecd [bigint] Add BigInt64Array, BigUint64Array
Bug: v8:6791
Tbr: hpayer@chromium.org
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I637e9084d2fe4869ad0be2fb996149ab9940f346
Reviewed-on: https://chromium-review.googlesource.com/914513
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51342}
2018-02-17 04:52:29 +00:00
Dan Elphick
7e8cd73983 [CSA] Create ToObject convenience function
Adds a function to call Builtins::kToObject returning a JSReceiver.
Also changes all previous uses of CallBuiltin(Builtins:kToObject to use
it.

Also fixed a case in builtins-object-gen.cc, where the result of
ToObject is cast (unchecked so it doesn't crash) to a JSObject before
actually checking it is a JSObject.

Change-Id: I3b1ff50babc3b3cbf44d56970099d105f7a66d34
Reviewed-on: https://chromium-review.googlesource.com/906778
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51232}
2018-02-12 10:14:27 +00:00
Tobias Tebbi
68c2750e01 [csa] remove implicit conversions from TVariable to TNode
This avoids the ambiguous implicit conversion C++ compile
errors we had to fix with static_cast before.

Change-Id: I4247f617740f2b6d14d9588a902e0e25029a6726
Reviewed-on: https://chromium-review.googlesource.com/911629
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51217}
2018-02-09 16:42:33 +00:00
Choongwoo Han
f118d952d2 [typedarray] Reduce generated code size of TA.map
We don't need to generate TypedArraySpeciesCreate code for each type
case because TypedArraySpeciesCreate also handles each case, so it
generates duplicated codes.  Thus, create a result object once before
switching to each type case.  Also, replace ToNumber with
ToNumber_Inline.

This CL saves about 8000 bytes of generated code size.

Change-Id: I014535b0ef4b3d2a50a37cdc2b6cb4e83f6c2f17
Reviewed-on: https://chromium-review.googlesource.com/910755
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51213}
2018-02-09 15:01:59 +00:00
Dan Elphick
630b2a5f19 [builtins] Implement Array.from in CodeStubAssembler
This removes the Javascript version of Array.from in js/array.js and
adds a CodeStubAssembler version in src/builtins/builtins-array-gen.cc.

Also modify IteratorBuiltinsAssembler to allow querying the existence
of the iterator method without calling it so we can fall back to the
array-like behavior.

BUG=v8:1956

Change-Id: Ibfb3cef002d72d70bd30b4de676fd22becde006c
Reviewed-on: https://chromium-review.googlesource.com/887066
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51208}
2018-02-09 14:01:06 +00:00
Peter Marshall
3b8a5879a4 [cleanup] Remove builtin wrappers and use ThrowError helpers in CSA.
Cleanup CL that removes unnecessary builtins that were just wrapping
the throwing of errors. Use the ThrowTypeError and ThrowRangeError
helpers more consistently from CSA.

Change-Id: I2d0c3647340c88c457b27e16c0a81567869b7ec7
Reviewed-on: https://chromium-review.googlesource.com/906769
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51150}
2018-02-07 16:26:27 +00:00
Mike Stanton
03efbd4cd4 [TurboFan] Array.prototype.reduce[Right] was missing a deopt point
We need a deopt point for the case when we fail to find an initial
element from which to begin the reduction step.

Bug: v8:7384
Change-Id: I5e476ddc433be690577677b018639c4c0c70809b
Reviewed-on: https://chromium-review.googlesource.com/906508
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51146}
2018-02-07 14:20:37 +00:00
Peter Marshall
a2aac98ddf [typedarray] Share SpeciesCreateByLength between CSA code.
Move the class declaration for SpeciesCreateByLength to a header file
so that we can share more TypedArray CSA code.

Delete the C++ implementation of species create for typed arrays
because it is no longer used.

Change-Id: I7c43b8ef144ba9a8ce12516f7cb8fb570491cb26
Reviewed-on: https://chromium-review.googlesource.com/904987
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51139}
2018-02-07 11:26:56 +00:00
Daniel Clifford
ca1508fc3b Refactor ArrayBuiltinsAssembler to split into a header and source file
This makes the ArrayBuiltinsAssembler consistent with the StringBuiltinsAssembler
and paves the way for tools that expect the assemblers to have a common structure.

Change-Id: I7470fc2cf144f9cc2fdbcee99b31daed267550be
Reviewed-on: https://chromium-review.googlesource.com/889933
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50920}
2018-01-29 09:15:27 +00:00
Dan Elphick
d5dca89b60 [builtins] Fix Array.of crashes by setting length correctly
Before we can set the length of the created array in CSA, first check
that it's possible and will do what we want. I.e. check
a) that the length is writable
b) the backing store is not copy-on-write and
c) the old length is not greater than the new length (as otherwise later
insertion past the end could restore values from the original
constructor).

If not then fall back on Runtime::kSetProperty.

Bug: chromium:804177
Change-Id: Id0e452f9d160704bbd71e87a075ba4e3983729a7
Reviewed-on: https://chromium-review.googlesource.com/880922
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50818}
2018-01-23 21:59:16 +00:00
Dan Elphick
08b0ff26c5 Fix Array.of crashing when called with lots of parameters
When the array created would exceed the maximum size for a regular heap
object, instead create it using Runtime::kNewArray directly rather than
via AllocateJSArray.

Bug: chromium:803750
Change-Id: I78cd82edf5a813a2ed69272361e0ca07f864c5ba
Reviewed-on: https://chromium-review.googlesource.com/876011
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50726}
2018-01-19 16:11:18 +00:00
Dan Elphick
0d4ed06cac Replace JS version of Array.of with a CSA version
This removes the Javascript version of Array.of in js/array.js and adds
a CodeStubAssembler version in src/builtins/builtins-array-gen.cc.

Mostly this change is for code-health reasons but it also gives
performance improvements for nearly all cases with the exception of
"transplanted" arrays. E.g.
function ArrayLike {}
ArrayLike.of = Array.of
ArrayLike.of(...) is now slower in the perf tests. Most of this change
can be attributed to using CallRuntime(kSetProperty,...) to set the
length. The JS version can do better due to inline caches trained on
the same datatype for 1000s of iterations, but this kind of workload is
unlikely.

Change-Id: I18e5b19b185257e9e0d553e1183b40ba4a5d3289
Reviewed-on: https://chromium-review.googlesource.com/863625
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50680}
2018-01-18 13:36:35 +00:00
Mike Stanton
c38cb367e7 [Turbofan] Inline Array.prototype.some
Bug: v8:1956
Change-Id: Ie941811110b3c106e252a2621544864673074da5
Reviewed-on: https://chromium-review.googlesource.com/846759
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50357}
2018-01-04 11:39:41 +00:00
Sigurd Schneider
1ac263b185 [cleanup] Rename FastArray* to ArrayPrototype*
Rename FastArray{Push,Pop,Shift,Slice} to
ArrayPrototype{Push,Pop,Shift,Slice}.

Bug: v8:7127, v8:7204, v8:7205
Change-Id: I409fcb4b088f1acece7c6520690f419cad36e78c
Reviewed-on: https://chromium-review.googlesource.com/846982
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50334}
2018-01-03 09:27:57 +00:00
Sigurd Schneider
d313d77fbf [cleanup] Fix typo
Change-Id: I56dfa2a0ee6d953002ba9a86f25c142bc2262106
Reviewed-on: https://chromium-review.googlesource.com/846740
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50321}
2017-12-29 13:13:01 +00:00
Mike Stanton
530e655adf [TurboFan] Array.prototype.every inlined
Bug: v8:1956
Change-Id: Iee1c6245832b786993ebd71b615cf4257c6bd0bb
Reviewed-on: https://chromium-review.googlesource.com/758769
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50320}
2017-12-29 12:42:36 +00:00
Daniel Clifford
7bcd92650c Implement Array.prototype.reduceRight inlining in TF
Bug: v8:1956
Change-Id: I785986ed20e60e21966abe82a1567d239b22b416
Reviewed-on: https://chromium-review.googlesource.com/840026
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50283}
2017-12-21 20:05:13 +00:00
Daniel Clifford
14cd4b5455 Implement Array.prototype.reduce inlining in TF
Bug: v8:1956,v8:4869
Change-Id: Id5822319c14142be2dd984c922b2b65717b96dee
Reviewed-on: https://chromium-review.googlesource.com/803974
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50261}
2017-12-21 12:31:54 +00:00
jgruber
c293bc010b [csa] Add and use ToInteger_Inline
This reduces reduces code size by 16 KB while keeping the fast path (in
which the given argument is already a smi) inlined and extracting
remaining logic to a stub call.

Change-Id: I531999c990519eef1247cc3785ad4b16164f7a5e
Reviewed-on: https://chromium-review.googlesource.com/833912
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50224}
2017-12-20 07:35:58 +00:00
peterwmwong
33c5e80276 [CSA] Add types to CSA HasProperty
Bug: 
Change-Id: If86c51b428f254ffce68d295f9e8001cee27b9ce
Reviewed-on: https://chromium-review.googlesource.com/833236
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50219}
2017-12-19 20:10:29 +00:00
peterwmwong
61e2f270d8 [turbofan] Array.prototype.findIndex inlining.
Support inlining Array.prototype.findIndex in Turbofan.
Depending on array size, quick benchmarks show a >2x
improvement: https://github.com/peterwmwong/v8-perf/blob/master/array-find-findIndex-tf/README.md

Bug: chromium:791045, v8:1956, v8:7165
Change-Id: I250554885f924c97b0072e09ee289713df5cbe63
Reviewed-on: https://chromium-review.googlesource.com/824382
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50133}
2017-12-15 16:32:26 +00:00
Jakob Kummerow
741213d6ed [cleanup] Clean up CSA::RelationalComparison for readability
Bug: v8:7109
Change-Id: I6384546566a760bd2956685a09d2327616eabd6d
Reviewed-on: https://chromium-review.googlesource.com/810266
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50093}
2017-12-13 23:41:10 +00:00
peterwmwong
a837ef8a9a [turbofan] Array.prototype.find inlining.
Support inlining Array.prototype.find in Turbofan.
Quick benchmarks show >2x improvement for Smi and
Double packed arrays: https://github.com/peterwmwong/v8-perf/blob/master/array-find-tf/README.md

Bug: chromium:791045, v8:1956
Change-Id: I9a6882be9bc3e1e84df372a24bd0f85897cf92a0
Reviewed-on: https://chromium-review.googlesource.com/818193
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49987}
2017-12-11 11:16:09 +00:00
Daniel Clifford
6f6ca7301a Fix OOB access in Array.prototype.slice
Bug: chromium:791345
Change-Id: I81e5e23e2ddfc5e78a4ca922ceffda28516277c3
Reviewed-on: https://chromium-review.googlesource.com/806097
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49871}
2017-12-05 14:34:17 +00:00
peterwmwong
99b5f699ab [builtins] Port Array.p.{find,findIndex} to CSA
- Removes JS implementation and InnerArrayFind/InnerArrayFindIndex
- Adds TFJ, with TFS for slow continuation path

Some quick benchmarks show ~2x improvement for unoptimized code
and up to 16% improvement against optimized code (diminishes with
larger arrays as iterating dominates).

https://github.com/peterwmwong/v8-perf/blob/master/array-find-findIndex/README.md

Bug: chromium:791045, v8:1956, v8:5049, v8:7165
Change-Id: Ie16252ed495bbd91fe548b16d5ef6764de791a50
Reviewed-on: https://chromium-review.googlesource.com/804704
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49851}
2017-12-05 07:23:13 +00:00
peterwmwong
3669036509 [typedarray] Port TA.p.findIndex() to CSA TFJ
This reduces the overhead of calling the builtin.
Quick measurements show >5x improvement. As the
typed array's size grows, iterating dominates
and the performance gap closes.
https://github.com/peterwmwong/v8-perf/blob/master/typedarray-findIndex/README.md

Bug: v8:5929
Change-Id: I27d67776c83cbe28f4f9f5ef479a7eeabf594654
Reviewed-on: https://chromium-review.googlesource.com/792394
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49720}
2017-11-29 14:47:48 +00:00
peterwmwong
04746c8109 [typedarray] Port TA.p.find() to CSA TFJ
This reduces the overhead of calling the builtin.
Quick measurements show >5x improvement. As the
typed array's size grows, iterating dominates
and the performance gap closes.
https://github.com/peterwmwong/v8-perf/blob/master/typedarray-find/README.md

Bug: v8:5929
Change-Id: Ia74546bb46d446c6161c8956e350d4b5cdc1b328
Reviewed-on: https://chromium-review.googlesource.com/792454
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49706}
2017-11-29 11:31:16 +00:00
Daniel Clifford
4d70aa02fd Fix hole handling in fast arguments slice
Bug: chromium:784080
Change-Id: I38c539435d867f6abb80218457e5b5a982e34817
Reviewed-on: https://chromium-review.googlesource.com/785210
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49571}
2017-11-22 12:32:37 +00:00
Daniel Clifford
f0ceb9f277 Fix bug in length handling of Array.prototype.slice fast-path
Bug: chromium:785804
Change-Id: I1a65e2007438ac009d961e0e2c0425212216fcf1
Reviewed-on: https://chromium-review.googlesource.com/776696
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49481}
2017-11-20 11:53:13 +00:00
Benedikt Meurer
a9a1671345 [cleanup] Rename "array protector" to "no elements protector".
The "array protector" now guards the Object.prototype, the
Array.prototype and the String.prototype, so the name was a
bit misleading nowadays. So the new name "no elements protector"
was chosen.

Bug: v8:6936, v8:7014, v8:7027
Change-Id: I9a9d7caa2caf0ac9e78cc6658de2f0506970dfa2
Reviewed-on: https://chromium-review.googlesource.com/778162
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49471}
2017-11-20 09:43:35 +00:00
Toon Verwaest
8123f5c3c7 [csa] Type CSA code related to String length accesses
Bug: v8:7065
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I7882b719f72561cd22b874eae239000936fad35c
Reviewed-on: https://chromium-review.googlesource.com/768874
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49381}
2017-11-15 12:59:04 +00:00
Daniel Clifford
d5885ca2b9 Fix splice bug in handling of negative arguments length
Bug: chromium:778668
Change-Id: Ie75f2ecb9e6134b6eb57c7d7fb6ea33cbb2fc2bf
Reviewed-on: https://chromium-review.googlesource.com/753324
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49301}
2017-11-10 15:23:28 +00:00
Benedikt Meurer
f597eec152 [builtins] Support two byte strings in StringEqual builtin.
This CL adds support for two byte string comparisons to the StringEqual
builtin, which so far was bailing out to the generic %StringEqual
runtime function whenever any two-byte string was involved. This made
comparisons that involved two-byte strings, either comparing them to
one-byte strings or comparing two two-byte strings, up to 3x slower than
if only one-byte strings were involved.

With this change, all direct string (SeqString or ExternalString)
equality checks are roughly on par now, and the weird performance cliff
is gone. On the micro-benchmark from the bug we go from

  stringEqualBothOneByteSeqString: 162 ms.
  stringEqualTwoByteAndOneByteSeqString: 446 ms.
  stringEqualOneByteAndTwoByteSeqString: 438 ms.
  stringEqualBothTwoByteSeqString: 472 ms.

to

  stringEqualBothOneByteSeqString: 151 ms.
  stringEqualTwoByteAndOneByteSeqString: 158 ms.
  stringEqualOneByteAndTwoByteSeqString: 166 ms.
  stringEqualBothTwoByteSeqString: 160 ms.

which is the desired result. On the esprima test of the
web-tooling-benchmark we seem to improve by 1-2%, which corresponds to
the savings of going to the runtime for many StringEqual comparisons.

Drive-by-cleanup: Introduce LoadAndUntagStringLength helper into the CSA
with proper typing to avoid the unnecessary shifts on 64-bit platforms
when keeping the length tagged initially in StringEqual.

Bug: v8:4913, v8:6365, v8:6371, v8:6936, v8:7022
Change-Id: I566f4b80e217513775ffbd35e0480154abf59b27
Reviewed-on: https://chromium-review.googlesource.com/749223
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49067}
2017-11-02 06:39:34 +00:00
Jakob Kummerow
9daf3e2039 [cleanup] Limit Token usage to Parser, AST, BytecodeGenerator
and use a newly-introduced "enum class Operation" in all
other places that so far passed Token::Values around.
Also delete some related dead code along the way.

Bug: v8:6921
Change-Id: I062f396d304aa62298cfeff202e3132a4a5597c1
Reviewed-on: https://chromium-review.googlesource.com/736851
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48944}
2017-10-25 18:15:26 +00:00
Georg Neis
5867270651 [cleanup] Make better use of heap constant accessors.
E.g. use TrueConstant() instead of BooleanConstant(true) and
NullConstant() instead of HeapConstant(factory...null_value()).

R=jkummerow@chromium.org

Bug: 
Change-Id: I0588d71940d8baf289eb8f8e6c8d20aa717d57f6
Reviewed-on: https://chromium-review.googlesource.com/735681
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48911}
2017-10-25 09:55:53 +00:00
Georg Neis
d74199d52e [bigint] Resolve a few minor TODOs.
R=jkummerow@chromium.org

Bug: v8:6791
Change-Id: I55c11c1328c92983286a8173795ce38f0b1e9e8e
TBR: yangguo@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/735322
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48897}
2017-10-25 07:16:06 +00:00
Camillo Bruni
fbc419dfaa [cleanup] Use IsNull, IsUndefined and IsNullOrUndefined in CSA
Bug: v8:6921
Change-Id: Icbbb7c08b9ff9f20339988770d88d96653a9ddef
Reviewed-on: https://chromium-review.googlesource.com/718656
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48890}
2017-10-24 20:10:02 +00:00