Commit Graph

107 Commits

Author SHA1 Message Date
Jakob Kummerow
862266a2aa [ubsan] Port WeakFixedArray and subclasses
TransitionArray, NormalizedMapCache, DependentCode to the new design.

Bug: v8:3770
Change-Id: I8bd56f231fb62b146e0fb05989418aedb62a628b
Reviewed-on: https://chromium-review.googlesource.com/c/1350287
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57921}
2018-11-29 02:03:20 +00:00
Jakob Kummerow
0f581e4b99 [ubsan] Port Name/String/Symbol to the new design
Bug: v8:3770
Change-Id: I4da6404aa968adca1fbb49029fc304622101d6c3
Reviewed-on: https://chromium-review.googlesource.com/c/1349112
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57853}
2018-11-27 01:42:36 +00:00
Shiyu Zhang
69232ba6d5 Reland "Create a fast path to get migration target when updating map"
This is a reland of 6ec90ecee2

Original change's description:
> Reland "Create a fast path to get migration target when updating map"
>
> This is a reland of c285380ca8
>
> Original change's description:
> > Create a fast path to get migration target when updating map
> >
> > During map updating, store the pointer to new map in the
> > raw_transitions slot of the old map that is deprecated from map
> > transition tree. Thus, we can get the migration target directly
> > instead of TryReplayPropertyTransitions when updating map.
> >
> > This can improve Speedometer2.0 Elm-TodoMVC case by ~5% on ATOM
> > Chromebook and ~9% on big-core Ubuntu.
> >
> > Change-Id: I56f9ce5183bbdd567b964890f623ef0ceed9b7db
> > Reviewed-on: https://chromium-review.googlesource.com/1233433
> > Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#56303}
>
> Change-Id: Idf0b7716b92a6a15bfe58721c2c34dbd02b31137
> Reviewed-on: https://chromium-review.googlesource.com/c/1270261
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Cr-Commit-Position: refs/heads/master@{#56588}

Change-Id: Iad23455f66c83340430370be6670bac493c638a1
Reviewed-on: https://chromium-review.googlesource.com/c/1309305
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57705}
2018-11-22 01:59:36 +00:00
Jakob Kummerow
0dbda17de5 [ubsan] Port Map to the new design
Bug: v8:3770
Change-Id: I52660eeda1bd299953793af9af1395f47e89072e
Reviewed-on: https://chromium-review.googlesource.com/c/1331155
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57454}
2018-11-13 06:59:12 +00:00
Jakob Kummerow
e7b8699910 [ubsan] Port MaybeObject to new design
This CL applies the equivalent of the Object -> ObjectPtr
transformation to MaybeObject and HeapObjectReference. We
need no renaming in this case because we can just migrate
them both in one go.

Bug: v8:3770
Change-Id: Ie1259c3e8c556eff00f8bcf534d7270ca9fe00e1
Reviewed-on: https://chromium-review.googlesource.com/c/1298386
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57010}
2018-10-26 01:08:30 +00:00
Jakob Kummerow
266c0b967b [ubsan,heap] Replace Object** with ObjectSlot
as part of the continuing quest to get rid of Object*/Object**.
This is a fairly mechanical replacement of Object**/MaybeObject** with
wrapper objects carrying the same data. No change in behavior is intended.
Overloaded operators are provided to minimize code churn.

Bug: v8:3770
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I76cee82b8bf2dd80a1b66f09dd2bb2b65038eeb7
Reviewed-on: https://chromium-review.googlesource.com/c/1287889
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56920}
2018-10-24 00:14:20 +00:00
Igor Sheludko
1898944bd9 Revert "Reland "Create a fast path to get migration target when updating map""
This reverts commit 6ec90ecee2.

Reason for revert: causes a lot of Canary crashes (chromium:895208).
GC relies on an the fact that the transition array stays alive while it's owner map
is alive (this is needed in order to properly transfer descriptor array ownership
to the parent map when the map owning a shared descriptor array dies). We need to
rethink a way of caching the migration target shortcut.

Original change's description:
> Reland "Create a fast path to get migration target when updating map"
>
> This is a reland of c285380ca8
>
> Original change's description:
> > Create a fast path to get migration target when updating map
> >
> > During map updating, store the pointer to new map in the
> > raw_transitions slot of the old map that is deprecated from map
> > transition tree. Thus, we can get the migration target directly
> > instead of TryReplayPropertyTransitions when updating map.
> >
> > This can improve Speedometer2.0 Elm-TodoMVC case by ~5% on ATOM
> > Chromebook and ~9% on big-core Ubuntu.
> >
> > Change-Id: I56f9ce5183bbdd567b964890f623ef0ceed9b7db
> > Reviewed-on: https://chromium-review.googlesource.com/1233433
> > Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#56303}
>
> Change-Id: Idf0b7716b92a6a15bfe58721c2c34dbd02b31137
> Reviewed-on: https://chromium-review.googlesource.com/c/1270261
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Cr-Commit-Position: refs/heads/master@{#56588}

TBR=ishell@chromium.org,shiyu.zhang@intel.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Ie7e9b98395b041a1095da549d1cd71d7180a4888
Bug: chromium:895208
Reviewed-on: https://chromium-review.googlesource.com/c/1280223
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56641}
2018-10-15 14:35:37 +00:00
Shiyu Zhang
6ec90ecee2 Reland "Create a fast path to get migration target when updating map"
This is a reland of c285380ca8

Original change's description:
> Create a fast path to get migration target when updating map
>
> During map updating, store the pointer to new map in the
> raw_transitions slot of the old map that is deprecated from map
> transition tree. Thus, we can get the migration target directly
> instead of TryReplayPropertyTransitions when updating map.
>
> This can improve Speedometer2.0 Elm-TodoMVC case by ~5% on ATOM
> Chromebook and ~9% on big-core Ubuntu.
>
> Change-Id: I56f9ce5183bbdd567b964890f623ef0ceed9b7db
> Reviewed-on: https://chromium-review.googlesource.com/1233433
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56303}

Change-Id: Idf0b7716b92a6a15bfe58721c2c34dbd02b31137
Reviewed-on: https://chromium-review.googlesource.com/c/1270261
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#56588}
2018-10-12 08:21:13 +00:00
Michael Achenbach
f4d0d7e9fd Revert "Create a fast path to get migration target when updating map"
This reverts commit c285380ca8.

Reason for revert: Lots of dcheck failures on GPU bots, e.g.:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/Win%20V8%20FYI%20Release%20(NVIDIA)/1997
https://ci.chromium.org/p/v8/builders/luci.v8.ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/2770

Original change's description:
> Create a fast path to get migration target when updating map
> 
> During map updating, store the pointer to new map in the
> raw_transitions slot of the old map that is deprecated from map
> transition tree. Thus, we can get the migration target directly
> instead of TryReplayPropertyTransitions when updating map.
> 
> This can improve Speedometer2.0 Elm-TodoMVC case by ~5% on ATOM
> Chromebook and ~9% on big-core Ubuntu.
> 
> Change-Id: I56f9ce5183bbdd567b964890f623ef0ceed9b7db
> Reviewed-on: https://chromium-review.googlesource.com/1233433
> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56303}

TBR=ishell@chromium.org,shiyu.zhang@intel.com

Change-Id: I9b268d662cfa3a7fec577468eafe6570389252bc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1253104
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56305}
2018-09-30 09:29:26 +00:00
Shiyu Zhang
c285380ca8 Create a fast path to get migration target when updating map
During map updating, store the pointer to new map in the
raw_transitions slot of the old map that is deprecated from map
transition tree. Thus, we can get the migration target directly
instead of TryReplayPropertyTransitions when updating map.

This can improve Speedometer2.0 Elm-TodoMVC case by ~5% on ATOM
Chromebook and ~9% on big-core Ubuntu.

Change-Id: I56f9ce5183bbdd567b964890f623ef0ceed9b7db
Reviewed-on: https://chromium-review.googlesource.com/1233433
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56303}
2018-09-30 05:38:24 +00:00
Marja Hölttä
c696376e0b Reland [in-place weak refs] Fix MaybeObject function names
E.g., "ToWeakHeapObject" was misleading, since it didn't convert to a weak heap
object, instead returned a weakly pointed heap object. Change the function names
(in this case, to "GetHeapObjectIfWeak") to reflect this.

Also make casts explicit, if a MaybeObject is an Object, we can call cast<Object>().

Previous version: https://chromium-review.googlesource.com/1219025

BUG=v8:7308
TBR=ishell@chromium.org, ulan@chromium.org, ahaas@chromium.org, yangguo@chromium.org, tebbi@chromium.org

Change-Id: I503d4a2a3a68f85e9e02e1c2f9fc1c4187c8e9a1
Reviewed-on: https://chromium-review.googlesource.com/1226800
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55934}
2018-09-17 08:27:59 +00:00
Marja Hölttä
3a79fe2363 Revert "[in-place weak refs] Fix MaybeObject function names"
This reverts commit ad72d19516.

Reason for revert: Build failures on *san

Original change's description:
> [in-place weak refs] Fix MaybeObject function names
> 
> E.g., "ToWeakHeapObject" was misleading, since it didn't convert to a weak heap
> object, instead returned a weakly pointed heap object. Change the function names
> (in this case, to "GetHeapObjectIfWeak") to reflect this.
> 
> Also make casts explicit, if a MaybeObject is an Object, we can call cast<Object>().
> 
> BUG=v8:7308
> 
> Change-Id: I4ef078572b4f4415afe7e2e706d3bd684e16e47d
> Reviewed-on: https://chromium-review.googlesource.com/1219025
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55906}

TBR=ulan@chromium.org,marja@chromium.org,yangguo@chromium.org,ahaas@chromium.org,tebbi@chromium.org,ishell@chromium.org

Change-Id: I054b578518e3f6fd7dbcddf0b56cc018726c1e7a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Reviewed-on: https://chromium-review.googlesource.com/1226874
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55918}
2018-09-14 15:30:05 +00:00
Marja Hölttä
ad72d19516 [in-place weak refs] Fix MaybeObject function names
E.g., "ToWeakHeapObject" was misleading, since it didn't convert to a weak heap
object, instead returned a weakly pointed heap object. Change the function names
(in this case, to "GetHeapObjectIfWeak") to reflect this.

Also make casts explicit, if a MaybeObject is an Object, we can call cast<Object>().

BUG=v8:7308

Change-Id: I4ef078572b4f4415afe7e2e706d3bd684e16e47d
Reviewed-on: https://chromium-review.googlesource.com/1219025
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55906}
2018-09-14 13:58:06 +00:00
Leszek Swirski
6de8560209 [cleanup] Remove unused Isolate parameters
ReadOnlyRoots means that some added Isolate parameters are no longer
needed. So, we can remove them.

This patch was generated mostly automatically with a bespoke tool.

Bug: v8:7786
Bug: v8:7754
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ia44fd2a66652253f780e3674bf7fb431caef0493
Reviewed-on: https://chromium-review.googlesource.com/1136305
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54526}
2018-07-18 16:47:22 +00:00
Dan Elphick
c55875b493 [explicit isolates] Remove GetIsolate from objects.cc
All auto-generated with some fix-ups including marking the following
classes as NeverReadOnlySpaceObject so their GetIsolate/GetHeap methods
are safe to use:
Code, CodeDataContainer, AbstractCode, DeoptimizationData,
CompilationCacheTable, NormalizedMapCache, Script, SharedFunctionInfo

TBR=yangguo@chromium.org

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I6cb5dcca88a0bc99b5afe80f553e06a661b5da3c
Reviewed-on: https://chromium-review.googlesource.com/1135306
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54439}
2018-07-13 12:42:14 +00:00
Leszek Swirski
13b899a5f9 [cleanup] Remove Isolate parameter from object print
With ReadOnlyRoots and GetIsolate on JSReceiver, we can remove almost
every isolate parameter from <Object>::Print. The remaining ones, like
Map, are special-caseable for read-only maps, and as a result we can
remove isolate parameters from <Object>::Print entirely.

This patch also opportunistically cleans up a few places where isolates
were only needed for Object::Print, such as TransitionAccessors and
DescriptorArrays.

TBR=yangguo@chromium.org,mstarzinger@chromium.org

Bug: v8:7786
Change-Id: Id44bd53b9893e679eea5f37b9548257595a1bfd9
Reviewed-on: https://chromium-review.googlesource.com/1133385
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54401}
2018-07-12 11:31:57 +00:00
Dan Elphick
b19ccf7221 [explicit isolates] Convert src/* to ReadOnlyRoots
In future the RO_SPACE root accessors in Heap will become private, so
instead convert them all to use ReadOnlyRoots.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I2f2c031c03d56d360ef940fc925e0583e6ae31dc
Reviewed-on: https://chromium-review.googlesource.com/1125720
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54202}
2018-07-04 10:29:45 +00:00
Leszek Swirski
b686ca2171 [GetIsolate] Remove (most) GetIsolate from src/objects-debug.cc
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic00953a5375f60b61a093234c03ce0df41dbe228
Reviewed-on: https://chromium-review.googlesource.com/1110125
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53944}
2018-06-21 16:34:27 +00:00
Dan Elphick
4ce2adc326 [explicit isolates] Eliminate GetIsolate from transitions.cc
Removes all explicit calls to GetIsolate() in transitions.cc by passing
it through calling functions and implicit calls via the single argument
Handle constructor and handle function.

Unfortunately in the interests of making these changes vaguely
manageable, I've also pushed some new GetIsolates down into
objects-debug.cc, objects-printer.cc and objects.cc.

Bug: v8:7786
Change-Id: I1f98530dec6c004e17dc3336f3cef09fbb446bae
Reviewed-on: https://chromium-review.googlesource.com/1085451
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53518}
2018-06-05 11:00:43 +00:00
Marja Hölttä
57cc9eaeb1 [in-place weak refs] Remove WeakFixedArray::Shrink.
WeakFixedArray::Shrink is fragile when not used properly (might invalidate GC
bookeeping (location of weak slots)).

BUG=v8:7308

Change-Id: Id84329e2a78907f5f0bfafae32fc2a71b77edbe7
Reviewed-on: https://chromium-review.googlesource.com/1076236
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53410}
2018-05-29 13:44:57 +00:00
Marja Hölttä
8bf738300b [in-place weak refs] Replace WeakCells in TransitionArray::PrototypeTransitions.
BUG=v8:7308

Change-Id: Ib3926bfa22b8639d84374cf423d26d6362e3f46e
Reviewed-on: https://chromium-review.googlesource.com/1019141
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52694}
2018-04-19 15:12:03 +00:00
Marja Hölttä
7560b33eba [in-place weak refs] Replace WeakCells in TransitionArray.
BUG=v8:7308

Change-Id: I1976cd7e542a0304f6e14744e634c62dd06a83f5
Reviewed-on: https://chromium-review.googlesource.com/1014090
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52672}
2018-04-18 14:08:47 +00:00
Marja Hölttä
e784719b4f [cleanup] Remove dead TransitionAccessor::Encoding::kHandler + related code.
This is also pre-work for in-place weak refs.

BUG=v8:7308, v8:5988

Change-Id: Ie78b0c59695c1e6af9780fffb363c931e2ee34e2
Reviewed-on: https://chromium-review.googlesource.com/1013583
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52658}
2018-04-18 07:21:25 +00:00
Marja Hölttä
ceaf02d613 [reland] [in-place weak refs] Replace the WeakCell potentially in Map::raw_transitions_.
Previous: https://chromium-review.googlesource.com/972962

BUG=v8:7308

Change-Id: I6882e36ad9f9360d006937a2f41b07839a73a768
Reviewed-on: https://chromium-review.googlesource.com/995014
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52404}
2018-04-05 16:24:06 +00:00
Marja Hölttä
6f144af6c7 Revert "[in-place weak refs] Replace the WeakCell potentially in Map::raw_transitions_."
This reverts commit 61195eb681.

Reason for revert: breaks gc stress

Original change's description:
> [in-place weak refs] Replace the WeakCell potentially in Map::raw_transitions_.
> 
> BUG=v8:7308
> 
> Change-Id: I3021df5f6dfd02d85ed9fe1903f9c0850f92168d
> Reviewed-on: https://chromium-review.googlesource.com/972962
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52272}

TBR=ulan@chromium.org,marja@chromium.org

Change-Id: I218b4d767da5095e5c5fee650567eb41343b347e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Reviewed-on: https://chromium-review.googlesource.com/983812
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52275}
2018-03-28 13:08:28 +00:00
Marja Hölttä
61195eb681 [in-place weak refs] Replace the WeakCell potentially in Map::raw_transitions_.
BUG=v8:7308

Change-Id: I3021df5f6dfd02d85ed9fe1903f9c0850f92168d
Reviewed-on: https://chromium-review.googlesource.com/972962
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52272}
2018-03-28 12:32:36 +00:00
Igor Sheludko
78c6bbd930 [ic] Use Map as transition handlers instead of StoreHandler objects.
This eases transition handlers caching and avoids memory overhead of
respective StoreHandler objects. In addition, it allows to use such
transition handlers on runtime side to make Object.assign implementation
a bit faster.

Bug: v8:5988
Change-Id: Iba660a11d4b300cd5f80615fb7e2608e53da8fee
Reviewed-on: https://chromium-review.googlesource.com/931701
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52187}
2018-03-23 15:37:40 +00:00
Igor Sheludko
65c54c7ac8 [runtime] Change return type of TransitionsAccessor::FindTransitionToField().
... to MaybeHandle<Map> and add TransitionsAccessor::FindTransitionToDataProperty()
which will be used in follow-up CLs.

Bug: v8:7310
Change-Id: I98cc4fe16dc1ef335885101aa457f27c90ecf1a4
Reviewed-on: https://chromium-review.googlesource.com/968222
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52018}
2018-03-19 10:58:32 +00:00
Yang Guo
43ac9d5151 Fix TransitionArray::Sort.
R=ulan@chromium.org

Bug: v8:7303
Change-Id: Ica6db623fbb5a4c4dd3ccf1dcbd6f796bb4406fc
Reviewed-on: https://chromium-review.googlesource.com/865907
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50575}
2018-01-15 12:52:03 +00:00
Igor Sheludko
4a596cf518 [ic] Unify handling of Load/StoreHandler objects in load/store IC dispatchers.
This CL also adds support for "lookup on dictionary receivers" to store ICs.

Bug: v8:7206, v8:5561
Change-Id: Icebbc2d52c71f5d25b43f2f2a8adf674e4ec2cbc
Reviewed-on: https://chromium-review.googlesource.com/819232
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50113}
2017-12-14 15:14:16 +00:00
Clemens Hammacher
5f6510825a [cleanup] Fix remaining (D)CHECK macro usages
This CL fixes all occurences that don't require special OWNER reviews,
or can be reviewed by Michi.

After this one, we should be able to reenable the readability/check
cpplint check.

R=mstarzinger@chromium.org

Bug: v8:6837, v8:6921
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ic81d68d5534eaa795b7197fed5c41ed158361d62
Reviewed-on: https://chromium-review.googlesource.com/721120
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48670}
2017-10-18 10:12:31 +00:00
Mathias Bynens
62f929ff4c Use nullptr instead of NULL where possible
New code should use nullptr instead of NULL.

This patch updates existing use of NULL to nullptr where applicable,
making the code base more consistent.

BUG=v8:6928,v8:6921

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I4687f5b96fcfd88b41fa970a2b937b4f6538777c
Reviewed-on: https://chromium-review.googlesource.com/718338
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48557}
2017-10-13 17:21:49 +00:00
Toon Verwaest
f178361763 [ic] Make transition-code unaware of handler encodings
Bug: 
Change-Id: I6894c097a994527b5e749527966c5de6c42d964b
Reviewed-on: https://chromium-review.googlesource.com/668405
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48195}
2017-09-28 08:15:39 +00:00
Ulan Degenbaev
8d1ad4b8aa [heap] Remove adhoc weakness in TransitionArray.
Currently transition array targets have conditional weakness depending
on the type of the target. Map targets are weak and all other targets
are strong. This patch wraps maps in transitions arrays in weak cells,
which allows us to treat all elements of transition arrays strongly.

Conditional weakness is unsafe for concurrent marking because the
condition can change during marking.

Bug: chromium:694255
Change-Id: I64e5d0699698fc7c1758f3fbc52da43014c247af
Reviewed-on: https://chromium-review.googlesource.com/641271
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48034}
2017-09-15 11:08:16 +00:00
Jakob Kummerow
a3ef2489f2 Cache fewer StoreIC-Transition handlers
Many handlers are not used again, so we can improve the cache hit rate
by caching fewer handlers. Specifically, in this CL, when a StoreIC
miss causes a new map transition to be created, then the handler is not
cached right away yet (it will be cached next time, when the transition
exists already).

Also, fix an embarrassing bug where growing a TransitionArray dropped
cached handlers. That further improves the cache hit rate. ;-)

Bug: chromium:752867, chromium:753819
Change-Id: Id8db5ca1e780a5fe8fc61db7f20996e61c65a90e
Reviewed-on: https://chromium-review.googlesource.com/619851
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47433}
2017-08-18 16:06:44 +00:00
Ulan Degenbaev
d9a036317c [heap] Track transition arrays using worklists.
This allows handling transitions arrays in concurrent marking

Bug: chromium:694255
Change-Id: I28196fccbf03bfba7d7dada1884813be372ddb54
Reviewed-on: https://chromium-review.googlesource.com/610961
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47303}
2017-08-11 09:11:20 +00:00
Jakob Kummerow
e567dd3ab4 Refactor TransitionArray access
in preparation for caching StoreIC-Transition handlers in there.
This CL should not change behavior or performance.

The TransitionArray class no longer serves a dual purpose; it is now
simply the data structure serving that role. Further, it now supports
storing transitioning handlers in its "target" slot, which in turn have
a WeakCell pointing to the transition target (but this functionality
is not being used yet).

The interface for accessing a map's transitions, previously implemented
as a set of static functions, is now handled by the TransitionsAccessor
class. It distinguishes the following internal states:
- kPrototypeInfo: map is a prototype map, will never cache any transitions.
- kUninitialized: map can cache transitions, but doesn't have any.
- kWeakCell: map caches a single transition, stored inline. Formerly known
             as "IsSimpleTransition".
- kFullTransitionArray: map uses a TransitionArray to store transitions.
- kTuple3Handler, kFixedArrayHandler: to be used in the future for caching
                                      transitioning handlers.

Change-Id: If2aa68390981f96f317b958445a6e0b935c2a14e
Reviewed-on: https://chromium-review.googlesource.com/550118
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46981}
2017-07-28 19:41:21 +00:00
Igor Sheludko
5520cae3fd Revert "Reland "[runtime] Add shortcuts for elements kinds transitions.""
This reverts commit 6e27386d68.

Reason for revert: There will be another much simpler and
back-mergeable fix.

Original change's description:
> Reland "[runtime] Add shortcuts for elements kinds transitions."
> 
> This is a reland of b90e83f5da
> Original change's description:
> > [runtime] Add shortcuts for elements kinds transitions.
> >
> > The shortcuts ensure that field type generalization is properly
> > propagated in the transition graph.
> >
> > Bug: chromium:738763
> > Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> > Reviewed-on: https://chromium-review.googlesource.com/567992
> > Commit-Queue: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46622}
> 
> Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
> Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
> Reviewed-on: https://chromium-review.googlesource.com/575227
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46759}

TBR=ulan@chromium.org,jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I203dc748c47db554e0a86d61f0e2b7b8b96f2370
Reviewed-on: https://chromium-review.googlesource.com/581547
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46826}
2017-07-24 05:31:29 +00:00
Igor Sheludko
6e27386d68 Reland "[runtime] Add shortcuts for elements kinds transitions."
This is a reland of b90e83f5da
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}
2017-07-19 11:31:21 +00:00
Yang Guo
a2ab1353f6 [snapshot] Rehash strings after deserialization.
See https://goo.gl/6aN8xA

Bug: v8:6593
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic8b0b57195d01d41591397d5d45de3f0f3ebc3d9
Reviewed-on: https://chromium-review.googlesource.com/574527
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46732}
2017-07-18 10:48:43 +00:00
Michael Achenbach
682832a0f5 Revert "[runtime] Add shortcuts for elements kinds transitions."
This reverts commit b90e83f5da.

Reason for revert: Blocks roll:
https://chromium-review.googlesource.com/c/570002/

Confirmed by:
https://chromium-review.googlesource.com/c/571700/2

Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
> 
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
> 
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

TBR=jkummerow@chromium.org,ishell@chromium.org

Change-Id: I5ede80db6bc209f16c6fd43f6bf3c8865c9577d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:738763
Reviewed-on: https://chromium-review.googlesource.com/571741
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46660}
2017-07-14 08:04:05 +00:00
Igor Sheludko
b90e83f5da [runtime] Add shortcuts for elements kinds transitions.
The shortcuts ensure that field type generalization is properly
propagated in the transition graph.

Bug: chromium:738763
Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
Reviewed-on: https://chromium-review.googlesource.com/567992
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46622}
2017-07-13 09:16:56 +00:00
Camillo Bruni
b7a9c0223f [cleanup] Introduce more const methods
Change-Id: I703c90cfbb91f4afc035fb32a44f33af9fe736f3
Reviewed-on: https://chromium-review.googlesource.com/548459
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46392}
2017-07-03 14:44:42 +00:00
ishell
d3d57ebaf6 [runtime] Use PropertyKind/PropertyLocation instead of PropertyType.
This is a necessary cleanup before introducing PropertyConstness bit.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2624903003
Cr-Commit-Position: refs/heads/master@{#42277}
2017-01-12 16:37:12 +00:00
jgruber
9ef4c3af25 Add Smi::Zero and replace all Smi::FromInt(0) calls
BUG=

Committed: https://crrev.com/7db0ecdec3cf330766575cb7973b983f3f1e3020
Review-Url: https://codereview.chromium.org/2381843002
Cr-Original-Commit-Position: refs/heads/master@{#40080}
Cr-Commit-Position: refs/heads/master@{#40087}
2016-10-07 13:05:26 +00:00
jgruber
d1545f8ecc Revert "Add Smi::Zero and replace all Smi::FromInt(0) calls"
This reverts commit 7db0ecdec3.

Manual revert since automatic revert is too large for the web interface.

BUG=
TBR=bmeurer@chromium.org,mstarzinger@chromium.org,yangguo@chromium.org,ahaas@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2396353002
Cr-Commit-Position: refs/heads/master@{#40082}
2016-10-07 12:22:56 +00:00
jgruber
7db0ecdec3 Add Smi::Zero and replace all Smi::FromInt(0) calls
BUG=

Review-Url: https://codereview.chromium.org/2381843002
Cr-Commit-Position: refs/heads/master@{#40080}
2016-10-07 11:03:43 +00:00
hpayer
ad51e8b1e8 [heap] Black allocation.
When black allocation is active, all objects allocated in old space are allocated black. Important: With that change, you cannot assume anymore that new objects are white right after their allocation. Currently, black allocation is enabled when incremental marking is started.

This feature can be turned off via flag: --noblack-allocation

BUG=chromium:561449
LOG=n

Review URL: https://codereview.chromium.org/1420423009

Cr-Commit-Position: refs/heads/master@{#34743}
2016-03-14 14:03:01 +00:00
verwaest
9bebb028a0 [runtime] Force internalize names used before lookup in in DescriptorArray and TransitionArray
BUG=

Review URL: https://codereview.chromium.org/1704353002

Cr-Commit-Position: refs/heads/master@{#34118}
2016-02-18 14:33:44 +00:00
hpayer
0c778116bd Pretenure prototype transitions array.
BUG=

Review URL: https://codereview.chromium.org/1513313003

Cr-Commit-Position: refs/heads/master@{#32790}
2015-12-11 11:25:26 +00:00