This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).
The CL includes 4 unittests.
There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.
BUG=v8:4586
LOG=n
Review URL: https://codereview.chromium.org/1457683003
Cr-Commit-Position: refs/heads/master@{#32498}
non-constructors are not allowed to have initial maps. The optimizing compilers used to add initial maps unconditionally to functions used as right-hand-side in instanceof.
BUG=
Review URL: https://codereview.chromium.org/1490003003
Cr-Commit-Position: refs/heads/master@{#32497}
1. Let X be the aborted slot (slot in an evacuated object in an aborted page)
2. Assume X contains pointer to Y and Y is in the new space, so X is in the
store buffer.
3. Store buffer rebuilding will not filter out X (it checks InNewSpace(Y)).
4. The current mark-sweep finishes. The slot X is in free space and is also in
the store buffer.
5. A string of length 9 "abcdefghi" is allocated in the new space. The string
looks like |MAP|LENGTH|hgfedcba|NNNNNNNi| in memory, where NNNNNNN is
previous garbage. Let's assume that NNNNNNN0 was pointing to a new space
object before.
6. Scavenge happens.
7. Slot X is still in free space and in store buffer. [It causes scavenge of
the object Y in
store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject). But
it is not important].
8. Our string is promoted and is allocated over the slot X, such that NNNNNNNi
is written in X.
9. The scavenge finishes.
9. Another scavenge starts.
10. We crash in
store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject) when
processing slot X, because it doesn't point to valid map.
BUG=chromium:524425,chromium:564498
LOG=N
R=hpayer@chromium.org, ulan@chromium.org
Review URL: https://codereview.chromium.org/1493653002
Cr-Commit-Position: refs/heads/master@{#32495}
port 74434403f6 (r32261)
original commit message:
I implemented the optional Float32RoundDown operator on x64, ia32, arm,
and arm64.
For arm I also had to adjust the simulator.
BUG=
Review URL: https://codereview.chromium.org/1490113003
Cr-Commit-Position: refs/heads/master@{#32492}
Sanitize ConstructStub handling and add a test case to ensure that the
Symbol constructor is using the correct context.
R=jarin@chromium.org
BUG=v8:4413
LOG=n
Review URL: https://codereview.chromium.org/1489323002
Cr-Commit-Position: refs/heads/master@{#32491}
port dffecf31fc (r32005)
original commit message:
The TiesEven rounding mode rounds float64 numbers to the nearest
integer. If there are two nearest integers, then the number is rounded
to the even one. This is the default rounding mode according to
IEEE~754.
I implemented the operator on ia32, x64, arm, arm64, mips, and mips64.
I think there is a bug in the current implementation of the ppc
simulator, which kept me from implementing the operator on ppc.
According to my understanding of the ppc instruction manual, the FRIN
instruction provides the right behavior for Float64RoundTiesEven. In the
simulator, however, FRIN provides a different semantics. If there are
two nearest integers, then the simulator returns the one which is
further away form 0.
BUG=
Review URL: https://codereview.chromium.org/1486323003
Cr-Commit-Position: refs/heads/master@{#32490}
port d2f78c6b79 (r32476)
original commit message:
This becomes visible if an exception is thrown by the constructor.
We do this on "new Array(3.5)", throwing a RangeError.
BUG=
Review URL: https://codereview.chromium.org/1491153002
Cr-Commit-Position: refs/heads/master@{#32489}
port 66d5a9df62 (r32452)
original commit message:
CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that there
BUG=
Review URL: https://codereview.chromium.org/1491063003
Cr-Commit-Position: refs/heads/master@{#32488}
Rolling v8/build/gyp to e2313c02ad7b6d589b38fe578f5d39970a9bbc20
Rolling v8/tools/clang to 3cc3dac50b26c67176bfed187a300741f31651bf
TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
Review URL: https://codereview.chromium.org/1491133002
Cr-Commit-Position: refs/heads/master@{#32485}
port 1389b9f53c (r32004)
original commit message:
I implemented it on x64, ia32, arm, arm64, mips, mips64, and ppc.
BUG=
Review URL: https://codereview.chromium.org/1488993002
Cr-Commit-Position: refs/heads/master@{#32484}
We currently use the outdated contexts list provided by the serializer
to update the receiver (the global proxy) in script contexts. However,
this is not actually necessary, since the global proxy is passed to the
deserializer and replaced as we deserialize.
Originally, the outdated contexts list is to update the global object
field in contexts. This was necessary since at the time the deserializer
creates the native context, the global object has not yet been created.
But the global proxy already exists.
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/1488873004
Cr-Commit-Position: refs/heads/master@{#32483}
Xori instruction can only have unisgned 16-bit immediates for right input,
as such it is not suitable for bit negation on mips.
TEST=unittests/InstructionSecetorTest.Word(32|64)XorMinusOneWithParameter
BUG=
Review URL: https://codereview.chromium.org/1485833003
Cr-Commit-Position: refs/heads/master@{#32478}
This becomes visible if an exception is thrown by the constructor.
We do this on "new Array(3.5)", throwing a RangeError.
BUG=
Review URL: https://codereview.chromium.org/1483053004
Cr-Commit-Position: refs/heads/master@{#32476}
Object.prototype.hasOwnProperty should use JSReceiver::HasOwnProperty for
proxies.
BUG=v8:1543
LOG=N
Review URL: https://codereview.chromium.org/1480213004
Cr-Commit-Position: refs/heads/master@{#32475}
This moves the bailout for functions containing new.target variable to
the correct place so that Crankshaft doesn't accidentally inline such
functions, yielding an "undefined" new.target value all the time.
R=bmeurer@chromium.org
TEST=mjsunit/es6/regress/regress-inlined-new-target
Review URL: https://codereview.chromium.org/1484163003
Cr-Commit-Position: refs/heads/master@{#32468}
Remove two unused fields.
Define register codes the same way register names are defined and eliminate static methods.
#error if target isn't defined.
LOG=N
BUG=v8:4124
Review URL: https://codereview.chromium.org/1482963003
Cr-Commit-Position: refs/heads/master@{#32467}
Reason for revert:
Still investigating bad canary.
Original issue's description:
> [heap] Remove eager shortcut in JSFunction visitor.
>
> This removes an optimization in the static JSFunction visitor that
> eagerly marked through to the SharedFunctionInfo for code flushing
> candidates. This causes all processing in VisitJSFunction to be
> side-stepped and hence might cause leaks.
>
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/a29f0576c32e8fda90bf7ab19c6d170568150a7f
> Cr-Commit-Position: refs/heads/master@{#32332}
TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/1488063002
Cr-Commit-Position: refs/heads/master@{#32463}
Reason for revert:
Still investigating bad canary.
Original issue's description:
> [heap] Refactor evacuation for young and old gen into visitors.
>
> Create a visitor for evacuating objects for young and old generation. This is
> the first step of preparing a task to process, both, newspace and oldspace
> pages in parallel.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/138d9bae5d7014e0d205634a49b5eac3697744c8
> Cr-Commit-Position: refs/heads/master@{#32349}
TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425
Review URL: https://codereview.chromium.org/1483393002
Cr-Commit-Position: refs/heads/master@{#32462}
Reason for revert:
Tanks sunspider/date-format-tofte because of the Date constructor being turbofanned.
Original issue's description:
> [turbofan] Ship TurboFan with new.target references.
>
> This correctly marks functions containing a new.target reference as
> being disabled with Crankshaft, which would have bailed out anyways.
> Also note that this will trigger TurboFan for such functions and hence
> widens the TurboFan intake valve.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/2ec6fcd1520bb8a09c9924ac5498eb9b437670b0
> Cr-Commit-Position: refs/heads/master@{#32444}
TBR=bmeurer@chromium.org,rossberg@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/1489833002
Cr-Commit-Position: refs/heads/master@{#32455}
CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that there is a request to make CallConstructStub look analogous. Enter ConstructICStub.
BUG=
Review URL: https://codereview.chromium.org/1476413003
Cr-Commit-Position: refs/heads/master@{#32452}
