Reason for revert:
[Sheriff] Leads to some different rounding as it seems in some audio layout tests. Please rebase upstream first if intended:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7508
Original issue's description:
> [builtins] Introduce proper Float64Exp operator.
>
> Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
> TurboFan operator based on that, similar to what we do for Float64Log.
> Rewrite Math.exp() as TurboFan builtin and use that operator to also
> inline Math.exp() into optimized TurboFan functions.
>
> BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/93e26314afc9da9b5b8bd998688262444ed73260
> Cr-Commit-Position: refs/heads/master@{#37037}
TBR=mvstanton@chromium.org,ahaas@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
Review-Url: https://codereview.chromium.org/2070813002
Cr-Commit-Position: refs/heads/master@{#37039}
Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.exp() as TurboFan builtin and use that operator to also
inline Math.exp() into optimized TurboFan functions.
BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
R=mvstanton@chromium.org
Review-Url: https://codereview.chromium.org/2077533002
Cr-Commit-Position: refs/heads/master@{#37037}
Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
similar to what we already did for Float64Log and Float64Log1p. Rewrite
Math.atan() and Math.atan2() as TurboFan builtin and use the operators
to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.
R=yangguo@chromium.org
BUG=v8:5086,v8:5095
Review-Url: https://codereview.chromium.org/2065503002
Cr-Commit-Position: refs/heads/master@{#36916}
This patch adds a test for async/await analogous to a previous Promise test.
It also fixes a typo in promise.js and makes a previous Promise test more
correct by ensuring that all assertions run before completion, fixing the
test expectations for the real result (which seems correct).
BUG=v8:4483
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
Review-Url: https://codereview.chromium.org/2037653002
Cr-Commit-Position: refs/heads/master@{#36903}
This reverts commit d3a43e47dd.
This patch also adds typed_array_fun and typed_array_protoype to the
native context. These are used in InstallTypedArray to set up the
prototype chain correctly for each typed array sub class. This removes
the need to later monkey patch them prototype chain in typedarray.js.
This mechanism is also used to get hold of the TypedArray in
typedarray.js, removing the need for a global TypedArray.
This patch updates CallRuntime.golden to account for the two extra
native runtime calls. This patch also fixes some formatting issues (by
running git cl format).
BUG=chromium:579905, chromium:593634, v8:4085, v8:5073
Review-Url: https://codereview.chromium.org/2046333002
Cr-Commit-Position: refs/heads/master@{#36811}
Reason for revert:
Blink:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7296
Original issue's description:
> [builtins] Properly optimize TypedArray/DataView accessors.
>
> The following getters were moved to the TypedArray/DataView prototype
> chain with ES2015, and hence need different treatment now:
>
> - DataView.prototype.buffer
> - DataView.prototype.byteLength
> - DataView.prototype.byteOffset
> - TypedArray.prototype.buffer
> - TypedArray.prototype.byteLength
> - TypedArray.prototype.byteOffset
> - TypedArray.prototype.length
>
> Instead of having special magic on the LoadIC in the IC system and the
> optimizing compilers, as we used to do before (and which we got rid of
> already), we just treat those as normal accessors and make them
> recognizable via the BuiltinFunctionId mechanism. This allows us to
> remove some of the additional magic from the IC subsystem, and just
> extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
> these cases too (TurboFan doesn't yet support accessors, but that will
> be fixed soonish anyways).
>
> This addresses most of the 15-20% regression we saw on the Octane
> GameBoy emulator benchmark.
>
> BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/1ef737026565ea2becc84f30cfd432e581d50c6b
> Cr-Commit-Position: refs/heads/master@{#36782}
TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
Review-Url: https://codereview.chromium.org/2039093005
Cr-Commit-Position: refs/heads/master@{#36783}
The following getters were moved to the TypedArray/DataView prototype
chain with ES2015, and hence need different treatment now:
- DataView.prototype.buffer
- DataView.prototype.byteLength
- DataView.prototype.byteOffset
- TypedArray.prototype.buffer
- TypedArray.prototype.byteLength
- TypedArray.prototype.byteOffset
- TypedArray.prototype.length
Instead of having special magic on the LoadIC in the IC system and the
optimizing compilers, as we used to do before (and which we got rid of
already), we just treat those as normal accessors and make them
recognizable via the BuiltinFunctionId mechanism. This allows us to
remove some of the additional magic from the IC subsystem, and just
extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
these cases too (TurboFan doesn't yet support accessors, but that will
be fixed soonish anyways).
This addresses most of the 15-20% regression we saw on the Octane
GameBoy emulator benchmark.
BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
R=yangguo@chromium.org
Review-Url: https://codereview.chromium.org/2042013003
Cr-Commit-Position: refs/heads/master@{#36782}
Reason for revert:
As a side effect of calling PromiseSet from
FulfillPromise, clears the deferred symbol and the
resolve/reject callback symbols. Although this
isn't strictly necessary, not doing this seems to
result in a leak as seen in --
https://bugs.chromium.org/p/chromium/issues/detail?id=617137#c10
Original issue's description:
> Promises: Make PromiseSet operation monomorphic
>
> The PromiseSet operation is called with two types of promises
> 1) A newly created promise object with no properties
> 2) Promise object with callbacks and other properties
>
> PromiseSet is called with the first type of promise (with no
> properties) from multiple call sites. PromiseSet is called with the
> second type of promise object only from FulfillPromise. Furthermore,
> this call only sets the value and status of the promise, the rest of
> the values are reset to UNDEFINED (which isn't necessary).
>
> This patch inlines the calls to set the value and status of the
> promise in FulfillPromise, instead of calling out to PromiseSet.
>
> This patch also reduces the number of symbol lookups, as we only set
> the value and status of the promise, and don't change the callback or
> deferred symbols.
>
> This patch results in a performance improvement of 2.8% over 5 runs in
> the bluebird benchmark.
>
> BUG=v8:5046
>
> Committed: https://crrev.com/df4f8a2b9ee9e474e674301718d19b63650a0ba5
> Cr-Commit-Position: refs/heads/master@{#36688}
TBR=littledan@chromium.org,adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5046
Review-Url: https://codereview.chromium.org/2047553002
Cr-Commit-Position: refs/heads/master@{#36766}
When |ResolvePromise| is resolved with a promise that is
already fulfilled or resolved, we can short circuit the
promise resolution procedure by directly looking up the
result from the promise. We save creating two closures, enqueuing in
the promise queue, and running through PromiseThen.
This patch uses IsPromise to check if the |resolution| object is a native
promise and also checks if |resolution.then| hasn't been monkey
patched.
This patch adds some redundant code from PromiseThen like setting
the promiseHasHandlerSymbol and calling PromiseRevokeReject call,
which would've been taken care of by PromiseThen in the old code path.
This patch results in a 13.8% improvement(over 5 runs) in the bluebird
benchmarks.
BUG=v8:5046
Review-Url: https://codereview.chromium.org/2028253004
Cr-Commit-Position: refs/heads/master@{#36765}
Introduce a dedicated Float64Log machine operator, that is either
implemented by a direct C call or by platform specific code, i.e.
using the FPU on x64 and ia32.
This operator is used to implement Math.log as a proper TurboFan
builtin on top of the CodeStubAssembler.
Also introduce a NumberLog simplified operator on top of Float64Log
and use that for the fast inline path of Math.log inside TurboFan
optimized code.
BUG=v8:5065
Review-Url: https://codereview.chromium.org/2029413005
Cr-Commit-Position: refs/heads/master@{#36703}
The PromiseSet operation is called with two types of promises
1) A newly created promise object with no properties
2) Promise object with callbacks and other properties
PromiseSet is called with the first type of promise (with no
properties) from multiple call sites. PromiseSet is called with the
second type of promise object only from FulfillPromise. Furthermore,
this call only sets the value and status of the promise, the rest of
the values are reset to UNDEFINED (which isn't necessary).
This patch inlines the calls to set the value and status of the
promise in FulfillPromise, instead of calling out to PromiseSet.
This patch also reduces the number of symbol lookups, as we only set
the value and status of the promise, and don't change the callback or
deferred symbols.
This patch results in a performance improvement of 2.8% over 5 runs in
the bluebird benchmark.
BUG=v8:5046
Review-Url: https://codereview.chromium.org/2025073002
Cr-Commit-Position: refs/heads/master@{#36688}
There are 2 possible states for the deferred symbol --
1) UNDEFINED -- This is the zero state, no deferred object is attached
to this symbol. When we want to add a new deferred we directly
attach it to this symbol.
2) symbol with attached deferred object -- New deferred objects are
not attached to this symbol, but instead they are directly attached
to the resolve, reject callback arrays. At this point, the deferred
symbol's state is stale, and the deferreds should be read from the
reject, resolve callbacks.
BUG=v8:5046
Review-Url: https://codereview.chromium.org/2018913004
Cr-Commit-Position: refs/heads/master@{#36623}
The in-operator has recently been optimized making our smart macros obsolete.
This should give up to 10% speedup on forEach and friends.
BUG=v8:5041
Review-Url: https://codereview.chromium.org/2013873002
Cr-Commit-Position: refs/heads/master@{#36576}
These builtins always call into C++ anyways and so there's no point in
having the JavaScript wrapper around them, but instead they can be
implemented as C++ builtins directly.
R=franzih@chromium.org
BUG=v8:5049
Review-Url: https://codereview.chromium.org/2018983002
Cr-Commit-Position: refs/heads/master@{#36569}
This was initially used to special case some weird date.js behavior, but
has since been abused in other areas. In case of the string character
access, everything that is outside the Smi range cannot be a valid
string index anyways, so %NumberToSmi is perfect here in either case,
and for ToPositiveInteger it's better to just use ToInteger adding +0 to
turn -0 into +0.
R=ishell@chromium.org
BUG=v8:5049
Review-Url: https://codereview.chromium.org/2010183003
Cr-Commit-Position: refs/heads/master@{#36545}
Rewrite decodeURI and decodeURIComponent as builtin functions
and install them in the bootstrapper.
Delete unused runtime functions:
- TruncateString
- NewString
- OneByteSeqStringGetChar
- OneByteSeqStringSetChar
- TwoByteSeqStringGetChar
- TwoByteSeqStringSetChar
Add regression test for decoding large strings. Clusterfuzz detected
a problem with %TruncateString, see
https://bugs.chromium.org/p/chromium/issues/detail?id=612109#c6
This is automatically fixed by this rewrite because %TruncateString
is deleted anyways.
Crude benchmark on 585 decodeURI and decodeURIComponent tests
averaged over five runs:
* builtin functions
real 0m9.69s
user 2m39.8816s
sys 0m12.6398s
* JS functions calling into the runtime e.g., for %TruncateString
real 0m11.0598s
user 3m6.7026s
sys 0m13.5756s
By running:
$ time tools/run-tests.py --arch=x64 --mode=Release --buildbot
test262/built-ins/decodeURI* mjsunit/uri
>>> Running tests for x64.Release
BUG=v8:4912, chromium:612109
R=yangguo@chromium.org, bmeurer@chromium.org
Review-Url: https://codereview.chromium.org/1994733003
Cr-Commit-Position: refs/heads/master@{#36543}
For the common use case of having a single resolve or reject callback,
the callbacks are stored directly. Only when an additional callback is
registered, we create an array to store these callbacks.
There are 3 possible states for the resolve, reject symbols when we add
a new callback --
1) UNDEFINED -- This is the zero state where there is no callback
registered. When we see this state, we directly attach the callbacks to
the symbol.
2) !IS_ARRAY -- There is a single callback directly attached to the
symbols. We need to create a new array to store additional callbacks.
3) IS_ARRAY -- There are multiple callbacks already registered,
therefore we can just push the new callback to the existing array.
Also, this change creates a new symbol for storing the deferred objects.
Previously the deferred objects were stored in the callback arrays, but
since we no longer create arrays for the initial case, we need this new
symbol. The cctest has been updated to account for this new symbol.
This patch results in a 19% improvement(over 5 runs) in the bluebird benchmark.
BUG=v8:5046
Review-Url: https://codereview.chromium.org/2007803002
Cr-Commit-Position: refs/heads/master@{#36536}
Removes the DONT_DELETE enum bit from the properties to make them
configurable.
Also, updates the regress-typedarray-length test to --
- Check for true boolean return value on deletion of these
properties.
- Check for undefined return value on trying to access these
properties after deletion.
BUG=v8:4902
LOG=Y
Review-Url: https://codereview.chromium.org/2001393004
Cr-Commit-Position: refs/heads/master@{#36528}
Moved functionality of Script.{lineCount, lineFromPosition, sourceLine,
locationFromLine, and sourceSlice} into runtime functions.
R=yangguo@chromium.org
BUG=
Review-Url: https://codereview.chromium.org/2003303002
Cr-Commit-Position: refs/heads/master@{#36469}
Script position calculation logic (i.e. line & column numbers for a
given code position) is now based on a single method
Script::GetPositionInfo(). Refactored related code in isolate.cc and
js/messages.js to use the new method. The line_ends accessor is still
in use by chromium and thus cannot be removed yet.
R=yangguo@chromium.org
BUG=
Review-Url: https://codereview.chromium.org/2002993002
Cr-Commit-Position: refs/heads/master@{#36458}
Previously, certain calls to DebugPushPromise and DebugPopPromise
happened always, without any check to see if we were in a debugging
environment. This patch adds a conditional check before making these
debug calls to make sure they aren't called when not needed.
Before the patch, running --prof over the bluebird benchmarks,
brings up these unprotected debug calls --
ticks cpp total name
16 6.7% 2.0% v8::internal::Runtime_DebugPushPromise(int, v8::internal::Object**, v8::internal::Isolate*)
7 2.9% 0.9% v8::internal::Runtime_DebugPopPromise(int, v8::internal::Object**, v8::internal::Isolate*)
This patch removes the above calls and provides a 4% improvement (with
a 2% variance over 10 runs) in the bluebird benchmark.
Review-Url: https://codereview.chromium.org/1985293002
Cr-Commit-Position: refs/heads/master@{#36451}
The previous JavaScript version created way too many ConsStrings for
longer strings, i.e. when using String.fromCharCode together with
Function.prototype.apply and arrays of char codes.
This version now always allocates sequential strings and therefore uses
way less memory when turning longer character sequences into strings,
and therefore fixes the memory regression on Google Maps.
BUG=chromium:609831
R=yangguo@chromium.org
Review-Url: https://codereview.chromium.org/2004733002
Cr-Commit-Position: refs/heads/master@{#36427}
In case of calling 'toLocaleString', 'toLocaleTimeString' and
'toLocaleDateString' functions of 'Date' with empty 'locales' and
'options', DateTimeFormat is cached inside 'defaultObjects'.
If we change the timezone the cache is not invalidated.
BUG=v8:5022
TEST=cctest:DateCacheVersion. See the bug
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_noi18n_rel_ng
Review-Url: https://codereview.chromium.org/1985423003
Cr-Commit-Position: refs/heads/master@{#36420}
Script position calculation logic (i.e. line & column numbers for a
given code position) is now based on a single method
Script::GetPositionInfo(). Refactored related code in isolate.cc and
js/messages.js to use the new method. The line_ends accessor is still
in use by chromium and thus cannot be removed yet.
R=yangguo@chromium.org
BUG=
Review-Url: https://codereview.chromium.org/2003483002
Cr-Commit-Position: refs/heads/master@{#36398}
