Commit Graph

3060 Commits

Author SHA1 Message Date
Leszek Swirski
e39c9e020f [compiler] Drive optimizations with feedback vector
For interpreted functions, use the optimized code slot in the feedback vector
to store an optimization marker (optimize/in optimization queue) rather than
changing the JSFunction's code object. Then, adapt the self-healing mechanism
to also dispatch based on this optimization marker. Similarly, replace SFI
marking with optimization marker checks in CompileLazy.

This allows JSFunctions to share optimization information (replacing shared
function marking) without leaking this information across native contexts. Non
I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
generalises the old CompileOptimized/InOptimizationQueue builtins and also
checks the same optimization marker as CompileLazy and
InterpreterEntryTrampoline.

Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
Reviewed-on: https://chromium-review.googlesource.com/509716
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45901}
2017-06-13 12:27:40 +00:00
Ulan Degenbaev
35391e4363 [heap] Refactor JSFunction body descriptor.
Since code flushing is gone, we treat the code entry as a strong field.

Change-Id: Idfcaf6fbfd84f7e4435b81d30a2a0e1be71ec89d
Reviewed-on: https://chromium-review.googlesource.com/531285
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45894}
2017-06-13 10:00:25 +00:00
Leszek Swirski
09637ab3ce [runtime] Don't count profiler ticks on Code objects
With the deprecation of Crankshaft, it's no longer necessary for
FullCodeGen to keep track of its runtime profiler ticks on the code
object, and we can instead unify the behaviour of FCG and Ignition to
both increment the SFI counter instead.

Bug: v8:6408
Change-Id: Idcdd673aa39af06fe15a0fc14dfda2afafb5e417
Reviewed-on: https://chromium-review.googlesource.com/528117
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45892}
2017-06-13 09:54:13 +00:00
Marja Hölttä
b490fd66b8 [objects.h splitting] Move argument-related classes.
This is an unexciting CL (doesn't make the build step situation any better)
but enables moving FixedArray & co next.

BUG=v8:5402,v8:6474

Change-Id: Ia36eb3973e6242f6f68e02b9f583dc552d48422f
Reviewed-on: https://chromium-review.googlesource.com/529168
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45889}
2017-06-13 09:06:00 +00:00
Marja Hölttä
9a71683d9c [objects.h splitting] Move String and related classes.
BUG=v8:5402,v8:6474

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Id38249fe9dc88001218aa1faa1b31c9d2f9703d1
Reviewed-on: https://chromium-review.googlesource.com/528102
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45853}
2017-06-12 11:53:18 +00:00
Michael Starzinger
2b9e36e968 [cleanup] Bring back comment lost in refactoring.
R=cbruni@chromium.org
BUG=v8:6474

Change-Id: I84be45bab041082cc66b5fdd70a9e799a44facee
Reviewed-on: https://chromium-review.googlesource.com/529207
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45819}
2017-06-09 14:58:36 +00:00
Toon Verwaest
3eabf5a529 [runtime] Drop PrototypeOptimizationMode to unify prototype handling
Don't treat new prototypes differently depending on how they become a
prototype. This is work towards always keeping prototypes in slow-mode.


Bug: v8:6471
Change-Id: I62de1018e21d91fda3a5da044615f32c718910b1
Reviewed-on: https://chromium-review.googlesource.com/526596
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45781}
2017-06-08 08:00:37 +00:00
Camillo Bruni
cdd58d0899 [proxies] Add stackoverflow check for JSProxy::isArray
Bug: chromium:727000
Change-Id: I0fb6fecc9564aee97bcf7c0e9201c580572061be
Reviewed-on: https://chromium-review.googlesource.com/525717
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45767}
2017-06-07 14:47:31 +00:00
jgruber
b42415402f [coverage] Block coverage with support for IfStatements
This CL implements general infrastructure for block coverage together with
initial support for if-statements.

Coverage output can be generated in lcov format by d8 as follows:

$ d8 --block-coverage --lcov=$(echo ~/simple-if.lcov) ~/simple-if.js
$ genhtml ~/simple-if.lcov -o ~/simple-if
$ chrome ~/simple-if/index.html

A high level overview of the implementation follows:

The parser now collects source ranges unconditionally for relevant AST nodes.
Memory overhead is very low and this seemed like the cleanest and simplest
alternative.

Bytecode generation uses these ranges to allocate coverage slots and insert
IncBlockCounter instructions (e.g. at the beginning of then- and else blocks
for if-statements). The slot-range mapping is generated here and passed on
through CompilationInfo, and is later accessible through the
SharedFunctionInfo.

The IncBlockCounter bytecode fetches the slot-range mapping (called
CoverageInfo) from the shared function info and simply increments the counter.
We don't collect native-context-specific counts as they are irrelevant to our
use-cases.

Coverage information is finally generated on-demand through Coverage::Collect.
The only current consumer is a d8 front-end with lcov-style output, but the
short-term goal is to expose this through the inspector protocol.

BUG=v8:6000
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2882973002
Cr-Commit-Position: refs/heads/master@{#45737}
2017-06-06 15:44:55 +00:00
bmeurer
3028f8075e [turbofan] Optimize Function.prototype.bind for the common case.
When the input to Function.prototype.bind is a known function, we can
inline the allocation of the JSBoundFunction into TurboFan, which
provides a 2x speed-up for several hot functions in Node streams (as
discovered by Matteo Collina). One of example of this can be found in
https://github.com/nodejs/node/pull/13322, which can be optimized and
made more readable using bind instead of closures.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2916063002
Cr-Commit-Position: refs/heads/master@{#45679}
2017-06-02 12:30:04 +00:00
Ulan Degenbaev
d8a42e4c09 [runtime] Change backing store of LayoutDescriptor to ByteArray.
BUG=v8:6277

Change-Id: I80314e6c5146e1f5021d07081b9eda3da5da6834
Reviewed-on: https://chromium-review.googlesource.com/518047
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45632}
2017-05-31 13:58:31 +00:00
Marja Hölttä
37945f731c [objects.h splitting] Move Script.
BUG=v8:5402

Change-Id: Ia6639d69a31accf46c10e8d49ea72422225cc8ff
Reviewed-on: https://chromium-review.googlesource.com/517788
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45597}
2017-05-30 12:47:47 +00:00
ulan
23cc6be3fc Rename "NoBarrier" memory operations to "Relaxed".
This is consistent with C++ memory model and avoids confusion with GC
write barrier.

BUG=

Review-Url: https://codereview.chromium.org/2912773002
Cr-Commit-Position: refs/heads/master@{#45584}
2017-05-30 07:44:37 +00:00
Marja Hölttä
b90c98fc29 [objects.h splitting] Move SharedFunctionInfo.
BUG=v8:5402

Change-Id: If5f763e6a11d446e36719277a18b00a0cd8df8fa
Reviewed-on: https://chromium-review.googlesource.com/517162
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45565}
2017-05-29 14:03:48 +00:00
Camillo Bruni
e822488d76 [runtime] Directly support double values in CloneShallowObjectLiteral
Bug: v8:6211
Change-Id: If6d2ef7889ae6a0c3aa430d3f69c53f19cc1f1c6
Reviewed-on: https://chromium-review.googlesource.com/509571
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45563}
2017-05-29 13:27:17 +00:00
Sathya Gunasekaran
f4664d0257 [runtime] Implement SmallOrderedHashTable
Implements the Allocate, Add, and HasKey operations. Also, adds GC
support for this new instance type.

Bug: v8:6443
Change-Id: I1cc7ba2faead2a11f7b0381a57858629e123aee6
Reviewed-on: https://chromium-review.googlesource.com/500447
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45551}
2017-05-29 10:04:22 +00:00
Igor Sheludko
fdd8d15155 [runtime] Remove unnecessary casts of species constructor.
... which caused assertion failures in --enable-slow-asserts mode.
The surrounding code treated the constructor value properly so regression
test is not necessary.

Bug: chromium:726622
Change-Id: Icd43d9117a1125bec8feca8eca5708993de2c3ef
Reviewed-on: https://chromium-review.googlesource.com/516626
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45543}
2017-05-26 15:21:32 +00:00
mattloring
6803eef142 Allow embedder to set promise internal field count
Asynchronous context tracking mechanisms in Node.js need to store some
state on all promise objects. This change will allow embedders to
configure the number of internal fields on promises as is already done
for ArrayBuffers.

BUG=v8:6435

Review-Url: https://codereview.chromium.org/2889863002
Cr-Commit-Position: refs/heads/master@{#45496}
2017-05-23 17:54:12 +00:00
Camillo Bruni
8655861e0a Revert accidental comment change in objects.h
NOTRY=true

Change-Id: Id2085b36ccbf5e039b725fad477c7292735a27b5
Reviewed-on: https://chromium-review.googlesource.com/512543
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45492}
2017-05-23 14:51:24 +00:00
Sathya Gunasekaran
aca3c14f15 [collections] Port Map constructor to CSA
Bug: v8:5717, v8:6354
Change-Id: I4be80eabcb0f98446e695a2ab1ad5804b7181ac7
Reviewed-on: https://chromium-review.googlesource.com/506818
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45489}
2017-05-23 13:21:47 +00:00
jgruber
d74ece4180 [objects] Extract DebugInfo and BreakPointInfo to own file
BUG=v8:5402

Review-Url: https://codereview.chromium.org/2900713004
Cr-Commit-Position: refs/heads/master@{#45486}
2017-05-23 12:17:09 +00:00
machenbach
3d40a47a9d Revert of [es2015] Precompute the descriptive string for symbols. (patchset id:40001 of https://codereview.chromium.org/2900703002/ )
Reason for revert:
Speculative revert for:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/8901

Original issue's description:
> [es2015] Precompute the descriptive string for symbols.
>
> Previously the String constructor and the Symbol.prototype.toString
> methods had to compute the descriptive string for a Symbol on the fly,
> which can produce a lot of garbage when this happens a lot, i.e. when
> the String representation of a Symbol is used often. Now instead of
> doing this on-demand we can just do it upfront when creating the Symbol.
>
> That way we also ensure that we won't throw an exception when accessing
> the descriptive string of a Symbol, due to potential String length
> overflow, but have the exception during Symbol creation upfront, which
> is a lot less surprising behavior.
>
> BUG=v8:6278,v8:6344,v8:6350
> TBR=mlippautz@chromium.org
> R=ishell@chromium.org
>
> Review-Url: https://codereview.chromium.org/2900703002
> Cr-Commit-Position: refs/heads/master@{#45479}
> Committed: e87573822e

TBR=ishell@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6278,v8:6344,v8:6350

Review-Url: https://codereview.chromium.org/2903533002
Cr-Commit-Position: refs/heads/master@{#45483}
2017-05-23 11:58:15 +00:00
bmeurer
e87573822e [es2015] Precompute the descriptive string for symbols.
Previously the String constructor and the Symbol.prototype.toString
methods had to compute the descriptive string for a Symbol on the fly,
which can produce a lot of garbage when this happens a lot, i.e. when
the String representation of a Symbol is used often. Now instead of
doing this on-demand we can just do it upfront when creating the Symbol.

That way we also ensure that we won't throw an exception when accessing
the descriptive string of a Symbol, due to potential String length
overflow, but have the exception during Symbol creation upfront, which
is a lot less surprising behavior.

BUG=v8:6278,v8:6344,v8:6350
TBR=mlippautz@chromium.org
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2900703002
Cr-Commit-Position: refs/heads/master@{#45479}
2017-05-23 09:49:08 +00:00
Michael Lippautz
652c9522d3 [heap] MinorMC: Identify unmodified global handles on the fly
For the Scavenger we require a first pass over global handles for identifying
unmodified nodes because the Scavenger might have already written forwarding
pointers during scanning, making it hard to perform the proper checks.

The minor MC does not mutate the object graph during marking and can thus merge
this phase into the regular phase executed during marking roots.

Furthermore, moves processing into the parallel marking phase of the minor MC
collector.

Bug: chromium:720477, chromium:651354
Change-Id: Id33552124264e3ab0bdf34d22ac30c19c1522707
Reviewed-on: https://chromium-review.googlesource.com/509550
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45461}
2017-05-22 13:31:41 +00:00
Ross McIlroy
f5d0df35d7 [Heap] Remove code flushing.
Only FullCodegen code ever gets flushed by code flushing. Since we are
deprecating the old pipeline, the added complexity introduced by code
flushing is no longer worth it. This CL removes it (but keeps code aging,
which is used to unlink SFIs from the compilation cache).

BUG=v8:6389,v8:6379,v8:6409

Change-Id: I90de113a101f86dbeaaf0511c61a090ef12aa365
Reviewed-on: https://chromium-review.googlesource.com/507388
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45446}
2017-05-22 09:34:43 +00:00
Eric Holk
3603fb05a6 [wasm] Use ArrayBuffer::Allocator API for guard regions
The WebAssembly code now uses these new APIs to allocate memory with guard
regions. Guarded array buffers are no longer always external, which eliminates
a lot of special cases around WebAssembly memory.

Bug: chromium:720302
Change-Id: I355b74ac30a05a18c8b363bd256d57458742849f
Reviewed-on: https://chromium-review.googlesource.com/505715
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45436}
2017-05-19 21:54:50 +00:00
Eric Holk
18a26cfe17 Add memory protection API to ArrayBuffer::Allocator
WebAssembly needs to be able to allocate memory with guard regions, which
requires more functionality from the array buffer allocator. This change adds
functions for reserving memory regions and changing the memory protection.

This CL also includes some minor refactoring of the code to free array buffers.

Bug: chromium:720302
Change-Id: Iab9a266003043b0d36592a79668d1eea53952abf
Reviewed-on: https://chromium-review.googlesource.com/506377
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45407}
2017-05-18 20:35:09 +00:00
ulan
6b5e443972 [heap] Fix verification of unsafe object layout changes.
This patch adds HeapObject::set_map_after_allocation method that
initializes the map of the object without object layout checks.

All other map setters now check that transitions unsafe for
concurrent marking properly notify the GC.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2885883004
Cr-Commit-Position: refs/heads/master@{#45403}
2017-05-18 19:24:22 +00:00
Camillo Bruni
5e9fd38564 [runtime] Support arbitrary number of properties for FastCloneShallowObject
Change-Id: I4b19700b613f81601321a336cc758cfd7f826f3e
Reviewed-on: https://chromium-review.googlesource.com/504347
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45390}
2017-05-18 08:20:33 +00:00
tebbi
d4f80f4c01 [builtins] Implement %TypedArray%.prototype.map in the CSA
R=danno@chromium.org

Review-Url: https://codereview.chromium.org/2814683002
Cr-Commit-Position: refs/heads/master@{#45380}
2017-05-17 15:27:37 +00:00
Tobias Tebbi
1be27497ba [csa] add FastArrayShift builtin
Bug: v8:6380
Change-Id: I85728099bcf188929c81e234a34b2bc308ddab16
Reviewed-on: https://chromium-review.googlesource.com/506016
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45378}
2017-05-17 15:21:08 +00:00
Marja Hölttä
35f3e9d0e6 Reland: [objects.h splitting] Move Map and related classes.
Previous version was https://chromium-review.googlesource.com/502808

BUG=v8:5402

Change-Id: If327f4d7884577b7e5e6159372bf28a80cd21e51
Reviewed-on: https://chromium-review.googlesource.com/506073
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45369}
2017-05-17 12:12:18 +00:00
Leszek Swirski
4becbe345f [ignition] Change --trace-ignition to a runtime flag
Generate the code (extra runtime calls) for --trace-ignition support at
compile time, based on a #define (similar to TRACE_MAPS). Then check for
--trace-ignition at run-time when deciding whether to actually print
anything. This should make --trace-ignition less painful to use.

Note that --trace-igition is disabled by default, even on debug builds.
It has to be enabled with the gn arg "v8_enable_trace_ignition=true"

As a drive-by, TRACE_MAPS is renamed to V8_TRACE_MAPS, for consistency,
and SFI unique index (needed both by --trace-ignition and --trace-maps)
is cleaned up to be behind another #define.

Change-Id: I8dd0c62d0e6b7ee9c75541d45eb729dc03acbee9
Reviewed-on: https://chromium-review.googlesource.com/506203
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45346}
2017-05-16 16:11:14 +00:00
Tobias Tebbi
cd33ec5542 [runtime] avoid trim/grow loop when adding and removing one element
We currently grow the backing store to (old_capacity*1.5)+16 if we exceed capacity, 
but shrink the capacity to the current length when 2*length <= capacity.
For short arrays (up to length 32), this can lead to a copy on every operation when using push/pop or push/shift.

Example:
Array of length 32, capacity 32
push
Array grown to length 33, capacity 32*1.5+16 = 64
pop
Array trimmed to length 32, capacity 32 because 2*32 <= 64
...

This CL leaves additional slag space when calling pop and restricts the trimming to backing stores with at least 16 elements to prevent excessive re-trimming on short arrays.

Bug: 
Change-Id: I9dd13e5e2550c7ac819294c8e29f04c8855e02a4
Reviewed-on: https://chromium-review.googlesource.com/502911
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45324}
2017-05-16 08:56:30 +00:00
Marja Hölttä
cc2c11441c Revert "[objects.h splitting] Move Map and related classes."
This reverts commit 7be0159e4b.

Reason for revert: Broke node by generating a broken debug-support.cc

Original change's description:
> [objects.h splitting] Move Map and related classes.
> 
> BUG=v8:5402
> 
> Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59
> Reviewed-on: https://chromium-review.googlesource.com/502808
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45305}

TBR=marja@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5402

Change-Id: Ifa65537447eb0a1ef947b9d0dae6f07a8b150968
Reviewed-on: https://chromium-review.googlesource.com/506011
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45307}
2017-05-15 15:01:03 +00:00
Marja Hölttä
7be0159e4b [objects.h splitting] Move Map and related classes.
BUG=v8:5402

Change-Id: I64fae0a0271eb0f1b71f4ec5d9bd5d22deb1cf59
Reviewed-on: https://chromium-review.googlesource.com/502808
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45305}
2017-05-15 14:41:01 +00:00
Camillo Bruni
3a80814d53 [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
With this CL SloppyArguments immediately go to dictionary elements on
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I90d1972179447bf6810e7fe2b8e0bc8703b38d9d
Reviewed-on: https://chromium-review.googlesource.com/486921
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45286}
2017-05-15 07:36:41 +00:00
Ross McIlroy
11a211ff1b Reland: [TypeFeedbackVector] Store optimized code in the vector
Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246,chromium:718891
TBR=yangguo@chromium.org,ulan@chromium.org

Change-Id: I3bb9ec0cfff32e667cca0e1403f964f33a6958a6
Reviewed-on: https://chromium-review.googlesource.com/500134
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45234}
2017-05-10 15:04:35 +00:00
Tobias Tebbi
2026d5cb79 [turbofan] [builtins] Unify construct builtins for JS functions and classes and add inlining and deoptimizer support
BUG=v8:6180
R=mstarzinger@chromium.org

Change-Id: Iac5782a0f6b0ff92293421656d907073cfc3f5dd
Reviewed-on: https://chromium-review.googlesource.com/489525
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45232}
2017-05-10 13:17:13 +00:00
bmeurer
6d38f89d26 [turbofan] Boost performance of Array.prototype.shift by 4x.
For small arrays, it's way faster to just move the elements instead of
doing the fairly complex and heavy-weight left-trimming. Crankshaft has
had this optimization for small arrays already; this CL more or less
ports this functionality to TurboFan, which yields a 4x speed-up when
using shift on small arrays (with up to 16 elements).

This should recover some of the regressions reported in the Node.js issues

  https://github.com/nodejs/node/issues/12657

and discovered for the syncthrough module using

  https://github.com/mcollina/syncthrough/blob/master/benchmarks/basic.js

as benchmark.

R=jarin@chromium.org
BUG=v8:6376

Review-Url: https://codereview.chromium.org/2874453002
Cr-Commit-Position: refs/heads/master@{#45216}
2017-05-10 05:48:21 +00:00
danno
fc274fbe99 Unify implementations of Map handles vectors and lists
This CL introduces a new type, MapHandles, which is a STL vector of Handle<Map>.
It is now used everywhere where lists of Handle<Maps> are required, replacing
usages of V8's internal List type.

Also-By: franzih@chromium.org
BUG=v8:6333,v8:6325
LOG=N

Review-Url: https://codereview.chromium.org/2809923002
Cr-Commit-Position: refs/heads/master@{#45211}
2017-05-09 22:36:00 +00:00
Ross McIlroy
fd749344bf Revert "Reland: [TypeFeedbackVector] Store optimized code in the vector"
This reverts commit 662aa425ba.

Reason for revert: Crashing on Canary
BUG=chromium:718891

Original change's description:
> Reland: [TypeFeedbackVector] Store optimized code in the vector
> 
> Since the feedback vector is itself a native context structure, why
> not store optimized code for a function in there rather than in
> a map from native context to code? This allows us to get rid of
> the optimized code map in the SharedFunctionInfo, saving a pointer,
> and making lookup of any optimized code quicker.
> 
> Original patch by Michael Stanton <mvstanton@chromium.org>
> 
> BUG=v8:6246
> TBR=yangguo@chromium.org,ulan@chromium.org
> 
> Change-Id: Ic83e4011148164ef080c63215a0c77f1dfb7f327
> Reviewed-on: https://chromium-review.googlesource.com/494487
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45084}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org,jarin@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
BUG=v8:6246

Change-Id: Idab648d6fe260862c2a0e35366df19dcecf13a82
Reviewed-on: https://chromium-review.googlesource.com/498633
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45174}
2017-05-08 20:57:30 +00:00
ulan
1b064d9cd0 [heap] Reland "Use shared markbits in the concurrent marker."
The concurrent marker now colors objects grey and black using
the atomic markbit operations.

The heap visitor is changed in two ways:
1) It iterates the map pointer of each object.
2) It guards object visitation with a predicate, which is overridden
in the concurrent marker with the result of GreyToBlack transition.

BUG=chromium:694255
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2866473003
Cr-Commit-Position: refs/heads/master@{#45144}
2017-05-05 17:41:44 +00:00
Michael Achenbach
0c590f45a8 Revert https://codereview.chromium.org/2857713002 and dependencies
Revert "[heap] Make non-atomic markbit operations consistent with atomic ones."

This reverts commit dd37366fb5

Revert "[heap] Use atomic marking operations in incremental marking if"

This reverts commit 1f2c3596e9

Revert "[heap] Prepare IncrementalMarking::VisitObject for concurrent marking."

This reverts commit 00d1e2cf76

Revert "[heap] Use shared markbits in the concurrent marker."

This reverts commit b0db0541ee

https://codereview.chromium.org/2857713002 blocks the current roll:
https://codereview.chromium.org/2857423002/

Doesn't revert cleanly.

NOTRY=true
TBR=ulan@chromium.org

Bug: chromium:694255
Change-Id: Iada35af5c2529cd9e604802700604b16cc30aa2d
Reviewed-on: https://chromium-review.googlesource.com/497387
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45118}
2017-05-05 06:57:45 +00:00
gdeepti
82503e9ba3 [wasm] Avoid js-typed-lowering optimization for wasm Memory objects
If an ArrayBuffer is setup through the WebAssembly.Memory constructor, identify these with a flag and avoid optimizations in js-typed-lowering.cc. This is needed becasue buffers associated with memory objects can be grown/detached leading to crashes.

BUG=chromium:717194

Review-Url: https://codereview.chromium.org/2862763002
Cr-Commit-Position: refs/heads/master@{#45105}
2017-05-04 17:21:56 +00:00
ulan
b0db0541ee [heap] Use shared markbits in the concurrent marker.
The concurrent marker now colors objects grey and black using
the atomic markbit operations.

The heap visitor is changed in two ways:
1) It iterates the map pointer of each object.
2) It guards object visitation with a predicate, which is overridden
in the concurrent marker with the result of GreyToBlack transition.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2855003004
Cr-Commit-Position: refs/heads/master@{#45099}
2017-05-04 13:55:45 +00:00
Ross McIlroy
662aa425ba Reland: [TypeFeedbackVector] Store optimized code in the vector
Since the feedback vector is itself a native context structure, why
not store optimized code for a function in there rather than in
a map from native context to code? This allows us to get rid of
the optimized code map in the SharedFunctionInfo, saving a pointer,
and making lookup of any optimized code quicker.

Original patch by Michael Stanton <mvstanton@chromium.org>

BUG=v8:6246
TBR=yangguo@chromium.org,ulan@chromium.org

Change-Id: Ic83e4011148164ef080c63215a0c77f1dfb7f327
Reviewed-on: https://chromium-review.googlesource.com/494487
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45084}
2017-05-04 11:21:59 +00:00
neis
973ec26eb1 [modules] Factor out cell load into helper function.
This is just a refactoring, no changes in behavior.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2839623003
Cr-Commit-Position: refs/heads/master@{#45071}
2017-05-03 18:34:36 +00:00
Jochen Eisinger
668246a1b5 Reland "Make unittest link correctly again"
This reverts commit 5db25a0906.

Original change's description:
> Make unittest link correctly again
>
> Remains to port these fixes over to gyp.
>
> R=machenbach@chromium.org, jkummerow@chromium.org, mstarzinger@chromium.org
> BUG=v8:6325
>
> Change-Id: I3bebbc6d0ec52fcb60e3d51acd27e616f51d3dbb
> Reviewed-on: https://chromium-review.googlesource.com/490108
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45026}

R=jkummerow@chromium.org
TBR=mstarzinger@chromium.org,clemensh@chromium.org
BUG=v8:6325

Change-Id: Ic3c0ffdf1f13045ea5a3929b720908e0b27a11c3
Reviewed-on: https://chromium-review.googlesource.com/494566
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45056}
2017-05-03 10:44:07 +00:00
Michael Achenbach
5db25a0906 Revert "Make unittest link correctly again"
This reverts commit 0f5ebcca4e.

Reason for revert: Still blocks rolling:
https://codereview.chromium.org/2857903002/

Original change's description:
> Make unittest link correctly again
> 
> Remains to port these fixes over to gyp.
> 
> R=​machenbach@chromium.org, jkummerow@chromium.org, mstarzinger@chromium.org
> BUG=v8:6325
> 
> Change-Id: I3bebbc6d0ec52fcb60e3d51acd27e616f51d3dbb
> Reviewed-on: https://chromium-review.googlesource.com/490108
> Commit-Queue: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45026}

TBR=jkummerow@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,jochen@chromium.org,clemensh@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6325

Change-Id: Icb11e6e12cb6c7bd6c68677359596fee740b6531
Reviewed-on: https://chromium-review.googlesource.com/494467
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45049}
2017-05-03 09:03:10 +00:00