Commit Graph

586 Commits

Author SHA1 Message Date
Sigurd Schneider
d44f75f5c8 [deoptimizer] Report if speculation bit changed with --trace-deopt
This CL adds output related to the no speculation bit on the feedback
vector. Messages appear on two occasions:
  - if a feedback vector is read from the deoptimization entry
  - if the no-speculation bit on a feedback vector is set
The latter only happens during object materialization.

Bug: v8:7127
Change-Id: I9676323d3223441472539a544d3309687dba27a3
Reviewed-on: https://chromium-review.googlesource.com/849092
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50496}
2018-01-11 08:32:33 +00:00
Georg Neis
8d8f8756ee [compiler] Clean up deoptimization reasons.
- Remove unused deoptimization reasons.
- Replace most uses of kNoReason with an actual reason (some are new).
- Rename kNoReason to kUnknown.

Bug: 
Change-Id: Ia8df54fca0f0f4885ef0c3523ce8f67b557a635d
Reviewed-on: https://chromium-review.googlesource.com/839421
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50440}
2018-01-09 13:30:51 +00:00
Georgia Kouveli
f687903383 Reland "[arm64] Preparation for padding of arguments"
This is a reland of bcf1172992

The test was timing out in no snapshot builds, as each CodeAssemblerTester
creates a new Context. Reduced the random iterations significantly.

Original change's description:
> [arm64] Preparation for padding of arguments
>
> As part of JSSP removal, we need to align the arguments passed to functions
> on the stack, by adding a padding slot when the total number of arguments
> is odd.
>
> This patch introduces the kPadArguments flag (which is currently set to
> false for all architectures), which will control padding of arguments in
> architecture-independent parts of the code (deoptimizer, instruction
> selector).
>
> It also adds some executable tests for tail calls with various stack
> parameter counts on the caller and callee sides.
>
> This will be turned on for arm64 together with arm64-specific changes to
> the code generator, the MacroAsembler and the builtins, in a later patch.
>
> Bug: v8:6644
> Change-Id: I79a5c149123fe8130cedd1ccffec3d9b50361e08
> Reviewed-on: https://chromium-review.googlesource.com/806554
> Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50134}

TBR=jarin@chromium.org

Bug: v8:6644
Change-Id: I795877ed9791e126ffac6841dbbb65189e95d207
Reviewed-on: https://chromium-review.googlesource.com/833046
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50238}
2017-12-20 13:50:36 +00:00
Michael Achenbach
fb8efb12fa Revert "[arm64] Preparation for padding of arguments"
This reverts commit bcf1172992.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/16791

The test cctest/test-run-tail-calls/FuzzStackParamCount hangs on
the nosnap debug bot and times out.

Original change's description:
> [arm64] Preparation for padding of arguments
> 
> As part of JSSP removal, we need to align the arguments passed to functions
> on the stack, by adding a padding slot when the total number of arguments
> is odd.
> 
> This patch introduces the kPadArguments flag (which is currently set to
> false for all architectures), which will control padding of arguments in
> architecture-independent parts of the code (deoptimizer, instruction
> selector).
> 
> It also adds some executable tests for tail calls with various stack
> parameter counts on the caller and callee sides.
> 
> This will be turned on for arm64 together with arm64-specific changes to
> the code generator, the MacroAsembler and the builtins, in a later patch.
> 
> Bug: v8:6644
> Change-Id: I79a5c149123fe8130cedd1ccffec3d9b50361e08
> Reviewed-on: https://chromium-review.googlesource.com/806554
> Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50134}

TBR=rmcilroy@chromium.org,jarin@chromium.org,georgia.kouveli@arm.com

Change-Id: Iff4d7da418204834822842b160eacb8980058172
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6644
Reviewed-on: https://chromium-review.googlesource.com/830847
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50144}
2017-12-16 10:20:38 +00:00
Georgia Kouveli
bcf1172992 [arm64] Preparation for padding of arguments
As part of JSSP removal, we need to align the arguments passed to functions
on the stack, by adding a padding slot when the total number of arguments
is odd.

This patch introduces the kPadArguments flag (which is currently set to
false for all architectures), which will control padding of arguments in
architecture-independent parts of the code (deoptimizer, instruction
selector).

It also adds some executable tests for tail calls with various stack
parameter counts on the caller and callee sides.

This will be turned on for arm64 together with arm64-specific changes to
the code generator, the MacroAsembler and the builtins, in a later patch.

Bug: v8:6644
Change-Id: I79a5c149123fe8130cedd1ccffec3d9b50361e08
Reviewed-on: https://chromium-review.googlesource.com/806554
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50134}
2017-12-15 16:35:36 +00:00
Michael Achenbach
71641f4e27 Revert "[turbofan] Add performance counters for speculation mode change"
This reverts commit ce2a9e1608.

Reason for revert: Breaks all gpu bots, e.g.:
https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Release%20%28NVIDIA%29/builds/4628

Original change's description:
> [turbofan] Add performance counters for speculation mode change
> 
> Bug: v8:7127, v8:7216
> Change-Id: I57f8bc3f486c53b11475bd174961c4547bb07b04
> Reviewed-on: https://chromium-review.googlesource.com/827073
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50121}

TBR=sigurds@chromium.org,hablich@chromium.org,bmeurer@chromium.org

Change-Id: Ic658699a3c267758b925c4a6832992a638125d27
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7127, v8:7216
Reviewed-on: https://chromium-review.googlesource.com/828874
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50125}
2017-12-15 11:03:12 +00:00
Sigurd Schneider
ce2a9e1608 [turbofan] Add performance counters for speculation mode change
Bug: v8:7127, v8:7216
Change-Id: I57f8bc3f486c53b11475bd174961c4547bb07b04
Reviewed-on: https://chromium-review.googlesource.com/827073
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50121}
2017-12-15 07:56:20 +00:00
Jaroslav Sevcik
d6e68f4334 Reland "[deoptimizer] Use empty fixed array when materializing empty arguments elements."
This reverts commit 917b9cb9fc.

In this CL, we canonicalize the fixed array when allocating storage for
empty fixed array. During initialization, we also make sure that we do
not write to the empty fixed array. This is quite hacky, but it
seems to be the least intrusive change.

Bug: chromium:793863
Change-Id: I1449ebac7c1e390467566a759bf70e7e2fabda31
Reviewed-on: https://chromium-review.googlesource.com/827013
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50119}
2017-12-15 05:55:39 +00:00
Sigurd Schneider
a0b9a235d5 [turbofan] Add counter for disabling of speculation bit
This CL adds a performace counter similar to
https://www.chromestatus.com/metrics/feature/timeline/popularity/2238
to estimate how often speculation is disabled in the wild.

Bug: v8:7216, v8:7127
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I421637b386534da4a3aed549a9665870e3b97eb1
Reviewed-on: https://chromium-review.googlesource.com/827012
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50112}
2017-12-14 15:00:56 +00:00
Michael Hablich
917b9cb9fc Revert "[deoptimizer] Use empty fixed array when materializing empty arguments elements."
This reverts commit bee8c16895.

Reason for revert: blocks roll https://chromium-review.googlesource.com/c/chromium/src/+/822232

Original change's description:
> [deoptimizer] Use empty fixed array when materializing empty arguments elements.
>
> Bug: chromium:793863
> Change-Id: I68860924c3252184f63dbea8561e5c4fe6bfa4ca
> Reviewed-on: https://chromium-review.googlesource.com/822071
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50028}

TBR=jarin@chromium.org,tebbi@chromium.org

NOTRY=true

Bug: chromium:793863
Change-Id: Iee622cd96333671277029fdd766f4ea137c9efc2
Reviewed-on: https://chromium-review.googlesource.com/826962
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50098}
2017-12-14 08:33:20 +00:00
Sigurd Schneider
1edca59ffa [turbofan] Mark builtin stub frames as deoptimized again
For eager deopts within builtin stub frames we skiped marking the
underlying function as deoptimized. This avoided deopt loops where
we would just generate the same optimized code all over again.

Bug: v8:6898
Change-Id: Ie3d7ee4dfcbeb63e6087112d5740a423c4730599
Reviewed-on: https://chromium-review.googlesource.com/822491
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50066}
2017-12-13 09:17:17 +00:00
Sigurd Schneider
cd99bada9a [turbofan] Add support to deoptimizer for setting no speculation bit
This CL adds support to the deoptimizer for setting the no speculation
bit on a provided feedback vector if desired.

Bug: v8:7127
Change-Id: I31fd1ea306cf5a4e919faeb896a83c1afdfccd63
Reviewed-on: https://chromium-review.googlesource.com/819370
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50064}
2017-12-13 08:52:34 +00:00
Jaroslav Sevcik
bee8c16895 [deoptimizer] Use empty fixed array when materializing empty arguments elements.
Bug: chromium:793863
Change-Id: I68860924c3252184f63dbea8561e5c4fe6bfa4ca
Reviewed-on: https://chromium-review.googlesource.com/822071
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50028}
2017-12-12 12:56:13 +00:00
Jaroslav Sevcik
a6b8251b0f [deoptimizer] Fix children counting for object allocation.
For the JS object allocation case, we materialize children_count - 1 objects.
However, we already materialized the map and property array, so this could
materialize one object beyond the JS object. If there is no such object,
we would go out-of-bounds.

Bug: chromium:792330
Change-Id: I5ed5e4ddde9de9789bb2531a48a0d87c80bd156c
Reviewed-on: https://chromium-review.googlesource.com/817315
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49986}
2017-12-11 10:18:43 +00:00
Jaroslav Sevcik
1da91b8389 Reland "[deoptimizer] Staged materialization of objects."
This relands commit e71b802279.

This can now back in as the fix for chromium:787301 had enough time to
be tested in Canary.

Original change's description:
> [deoptimizer] Staged materialization of objects.
>
> The existing object materialization in the deoptimizer has the following problems:
>
> - Objects do not necessarily verify during materialization (because during the
>   depth first walk we might have inconsistent objects).
>
> - Stack can overflow (because we just materialize using recursive calls).
>
> - We generalize object fields.
>
>
> This CL re-implements the materialization algorithm to solve this problem. The
> new implementation creates the objects in two steps:
>
> 1. We allocate space for all the objects. In general, we allocate ByteArrays
>    of the right size. For leaf objects that cannot participate in cycles,
>    we build and initialize the materialized objects completely.
>
>    For JS objects, we insert markers into the byte array at the positions
>    where unboxed doubles are expected.
>
> 2. We initialize all the objects with the proper field values and change the
>    map from the ByteArray map to the correct map. This requires some sync
>    with the concurrent marker (Heap::NotifyObjectLayoutChange).
>
>    When initializing the JS object fields, we make sure that we respect
>    the unboxed double marker.
>
> Bug: chromium:770106, v8:3836
> Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
> Reviewed-on: https://chromium-review.googlesource.com/777559
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49821}

Bug: chromium:770106, v8:3836
Change-Id: Ied6c4e0fbae52713e55ae6dc13794a7521dbb8a5
Reviewed-on: https://chromium-review.googlesource.com/817745
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49982}
2017-12-11 08:45:58 +00:00
Martyn Capewell
1614388fd6 Align deopt frame for JSConstructStub
Add an element of padding to the frame constructed by the deoptimiser
when entering JSConstructStub, and update the non-arm64 backends such
that the frames agree for normal and deopt entry.

Bug: v8:6644
Change-Id: I99625e75760f0695b2389446c2ac3cac97c220f4
Reviewed-on: https://chromium-review.googlesource.com/814397
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#49954}
2017-12-08 10:30:42 +00:00
Igor Sheludko
42a7c0be4c [runtime] Introduce Load/StoreHandler heap objects.
They will eventually be used instead of Tuple3/FixedArray by the IC system.

Bug: v8:5561, v8:7159
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I39faad1b2dc10ce7d42cb7477ea87b64d1e0b44c
Reviewed-on: https://chromium-review.googlesource.com/806178
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49908}
2017-12-06 18:19:07 +00:00
Jaroslav Sevcik
9a6f4422c6 [deoptimizer] Fix materialization of iterators.
Bug: chromium:787301
Change-Id: If32310f9f2f3f04daa5bdaa9779302f4a012d397
Reviewed-on: https://chromium-review.googlesource.com/806223
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49843}
2017-12-04 17:57:45 +00:00
Jaroslav Sevcik
104a2db3c7 Revert "[deoptimizer] Staged materialization of objects."
This reverts commit e71b802279.

Reason for revert: Need to have a back-mergeable fix.

Original change's description:
> [deoptimizer] Staged materialization of objects.
> 
> The existing object materialization in the deoptimizer has the following problems:
> 
> - Objects do not necessarily verify during materialization (because during the
>   depth first walk we might have inconsistent objects).
> 
> - Stack can overflow (because we just materialize using recursive calls).
> 
> - We generalize object fields.
> 
> 
> This CL re-implements the materialization algorithm to solve this problem. The
> new implementation creates the objects in two steps:
> 
> 1. We allocate space for all the objects. In general, we allocate ByteArrays
>    of the right size. For leaf objects that cannot participate in cycles,
>    we build and initialize the materialized objects completely.
> 
>    For JS objects, we insert markers into the byte array at the positions
>    where unboxed doubles are expected.
> 
> 2. We initialize all the objects with the proper field values and change the
>    map from the ByteArray map to the correct map. This requires some sync
>    with the concurrent marker (Heap::NotifyObjectLayoutChange).
> 
>    When initializing the JS object fields, we make sure that we respect
>    the unboxed double marker.
> 
> Bug: chromium:770106, v8:3836
> Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
> Reviewed-on: https://chromium-review.googlesource.com/777559
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49821}

TBR=ulan@chromium.org,mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I0657fb75330700dd7883c600dacb25676ebb47f9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:770106, v8:3836
Reviewed-on: https://chromium-review.googlesource.com/806160
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49834}
2017-12-04 16:02:21 +00:00
Jaroslav Sevcik
e71b802279 [deoptimizer] Staged materialization of objects.
The existing object materialization in the deoptimizer has the following problems:

- Objects do not necessarily verify during materialization (because during the
  depth first walk we might have inconsistent objects).

- Stack can overflow (because we just materialize using recursive calls).

- We generalize object fields.


This CL re-implements the materialization algorithm to solve this problem. The
new implementation creates the objects in two steps:

1. We allocate space for all the objects. In general, we allocate ByteArrays
   of the right size. For leaf objects that cannot participate in cycles,
   we build and initialize the materialized objects completely.

   For JS objects, we insert markers into the byte array at the positions
   where unboxed doubles are expected.

2. We initialize all the objects with the proper field values and change the
   map from the ByteArray map to the correct map. This requires some sync
   with the concurrent marker (Heap::NotifyObjectLayoutChange).

   When initializing the JS object fields, we make sure that we respect
   the unboxed double marker.

Bug: chromium:770106, v8:3836
Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
Reviewed-on: https://chromium-review.googlesource.com/777559
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49821}
2017-12-04 09:23:03 +00:00
Georgia Kouveli
1228c556b6 [arm64] ArgumentsAdaptorTrampoline fix for jssp removal.
Even though a previous patch made the number of slots pushed/claimed on
the stack aligned, the boundary between frames was not a multiple of
two slots as well. We were pushing the number of arguments (which belongs
in the ArgumentAdaptor frame) together with the arguments to pass to the
callee (which belong to the frame of the callee). Those need to be
separated so we can drop the arguments without messing up the alignment.

Bug: v8:6644
Change-Id: I259c58db33a7c2726e5a3c74bcd67496f607d1d0
Reviewed-on: https://chromium-review.googlesource.com/793047
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#49759}
2017-11-30 15:30:16 +00:00
Ulan Degenbaev
cf7fa2eb08 [runtime] Refactor RuntimeCallStats counters to use enums.
Currently RuntimeCallStats stores CounterIds as inner pointers.
This patch replaces them with enums and removes static table.

Bug: chromium:758183
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icb4030fc3ad3dd02e9c2648ce7c43b6f2d47fa9d
Reviewed-on: https://chromium-review.googlesource.com/796477
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49743}
2017-11-30 11:32:53 +00:00
Marja Hölttä
c08ab6dacc [cleanup] Add STATIC_ASSERTs for JSFunction size to relevant places.
Makes it easier to modify JSFunction; the failing asserts will tell which places
need to be modified.

Change-Id: I70c7cd0b89cf05964b4730990fb3d7f23927437a
Reviewed-on: https://chromium-review.googlesource.com/781689
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49732}
2017-11-30 08:03:16 +00:00
Benedikt Meurer
c061734f39 [turbofan] Introduce dedicated NewConsString operator.
This is in preparation of adding a dedicated StringLength operator that
loads the string length. This way operations on strings don't sit in the
effect chain anymore until the EffectControlLinearizer, which wires them.

The NewConsString semantics could still be better, i.e. it could try to
figure out the proper map instead of going for the CONS_STRING_TYPE
always. But this change is meant to be just about pushing the logic down
to the EffectControlLinearizer, which we didn't have initially when the
ConsString handling was done.

This also allows us to remove the handling of CONS_STRING_TYPE from the
Deoptimizer, since the escape analysis no longer sees cons strings.

Bug: v8:5269, v8:6936, v8:7109, v8:7137
Change-Id: If6c4a6d7cf63a3a3f7a34a920c8e50a94dfa67fa
Reviewed-on: https://chromium-review.googlesource.com/796413
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49729}
2017-11-30 04:27:15 +00:00
Igor Sheludko
932aafb91f [runtime] Introduce instance type for descriptor arrays.
This simplifies handling of DescriptorArray objects in deserializer.

Bug: v8:5799
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie4f9c6903afd8273d6320e6b0e0b05231db6cc00
Reviewed-on: https://chromium-review.googlesource.com/785676
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49605}
2017-11-23 11:42:29 +00:00
Michael Starzinger
4a7698fcdd [runtime] Remove support for missing deoptimization.
This removes support for optimized frame which lack deoptimization
information. All optimized JavaScript frames now imply that the
underlying bytecode is available too.

R=rmcilroy@chromium.org
BUG=v8:6409

Change-Id: Ie73c0a376002466884388f1da9e1ec2741884596
Reviewed-on: https://chromium-review.googlesource.com/612162
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49442}
2017-11-17 12:33:28 +00:00
Michael Starzinger
b8b622c94a [builtins] Set {builtin_index} during code allocation.
This ensures that the {Code::builtin_index} field is only set during
allocation of new {Code} objects, making this field truly immutable.

R=jgruber@chromium.org
BUG=v8:6792

Change-Id: Ic793346976183149e2d077e92cb9da3c925ea865
Reviewed-on: https://chromium-review.googlesource.com/774439
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49414}
2017-11-16 13:56:49 +00:00
Michael Starzinger
a596bef708 [deoptimizer] Heap API to invalidate code objects.
This introduces two dedicated API methods to invalidate references from
a given {Code} object. They are needed to reduce lifetime of objects
referenced from deoptimized code. The new methods are aim at embedded
objects and deoptimization data, called {InvalidateCodeEmbeddedObjects}
and {InvalidateCodeDeoptimizationData} respectively.

R=jarin@chromium.org
BUG=v8:6792

Change-Id: I6bf8806c8b00c6e0ec8f0551e9066729a86845b1
Reviewed-on: https://chromium-review.googlesource.com/757010
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49373}
2017-11-15 10:23:49 +00:00
Michael Starzinger
d80d85bfc1 [heap] Introduce {Movability} enum for type safety.
R=mlippautz@chromium.org

Change-Id: Ie5ff0347d7c849e1941f8c8237a0bd56fdb68a4e
Reviewed-on: https://chromium-review.googlesource.com/768672
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49372}
2017-11-15 10:11:26 +00:00
Michael Starzinger
62a720354c [heap] Fix immovable {Code} allocation in no-snap builds.
R=mlippautz@chromium.org
BUG=v8:6792

Change-Id: I4b148b4bcb6e3cb73bc58eaad61d52a14da19a35
Reviewed-on: https://chromium-review.googlesource.com/760739
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49278}
2017-11-09 17:50:51 +00:00
Jaroslav Sevcik
9eb92da618 [deoptimizer] Make sure property arrays don't contain mutable heap numbers.
Since the deoptimizer generalizes maps for all materialized objects, it
must make sure that none of the object's fields contain mutable heap numbers
(only double fields are allowed to point to mutable heap numbers). With this CL,
we simply change any mutable heap numbers in property arrays to immutable ones.

This could be dangerous if some non-materialized object could point to this
property array, but this cannot happen because interpreter registers cannot
refer to naked property arrays.

Bug: chromium:776309
Change-Id: I897b604fa804de673710cfa3ba0595dbd9f80eeb
Reviewed-on: https://chromium-review.googlesource.com/759781
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49263}
2017-11-09 12:02:47 +00:00
Michael Starzinger
23883b85f2 [deoptimizer] Turn deopt entries into immovable Code objects.
This turns the deoptimization entries from free-floating memory chunks
that were not considered part of the heap into true {Code} objects. By
marking them as immovable we get the same guarantees without the need
for side-stepping heap API methods.

R=jarin@chromium.org
BUG=v8:6792

Change-Id: I88e1795e52fb586f7ca960d08cd6d9d082f4df9b
Reviewed-on: https://chromium-review.googlesource.com/756851
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49257}
2017-11-09 09:31:15 +00:00
Toon Verwaest
c82cd31325 Drop custom accessor deoptimization support
Previously StaNamedProperty and StaKeyedProperty were in a weird state where
they claimed to not touch the accumulator, but actually did in case they were
deopted in the middle. A frame was added in the middle to overwrite the 
accumulator again with the right value before returning from the setter, using
a lot of complexity in the deoptimizer.

This changes those instructions to be marked as writing to the accumulator
(e.g., the result of the setter), and uses to manually store and reload into
the accumulator the value being stored.

If we want to avoid the additional bytecodes, we could make sure that bytecodes
that claim to leave the accumulator alone don't deopt back to Advance/Dispatch
but LoadAccumulatorWithValue/Advance/Dispatch. That's in a way similar to what
happened before this CL, but I believe could be implemented much simpler.


Bug: 
Change-Id: I4850a690ef5a30976701d0e050951faa46fd1c18
Reviewed-on: https://chromium-review.googlesource.com/753487
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49159}
2017-11-06 20:20:58 +00:00
Michael Starzinger
0e15a7a477 Annotate all sites that still mutate {Code} objects.
This adds code-space modification scopes to all sites that still rely on
mutation of {Code} objects after allocation. Currently some scopes also
potentially are in performance-critical places that might regress if the
protection would be enabled in its current form.

R=clemensh@chromium.org
BUG=v8:6792

Change-Id: I8d511e0e452324dae027e50a9da8e6f77224b86f
Reviewed-on: https://chromium-review.googlesource.com/751521
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49147}
2017-11-06 16:35:46 +00:00
Hannes Payer
34d3fbaaa3 [heap] Sweeper sets code memory to rwx to allow concurrent sweeping while executing code.
Bug: chromium:774108,v8:6792
Change-Id: Ibdb00bee4dc563663ef2151b489600a2b100f146
Reviewed-on: https://chromium-review.googlesource.com/739601
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49143}
2017-11-06 14:59:26 +00:00
Hans Wennborg
c9168fc5de Remove unused member variable TranslatedFrame::isolate_
Recent Clang versions (r317076+) warn about this.

Bug: chromium:780523
Change-Id: Iccc8d675ce4700f67dedfaa60bc6662b03b55ceb
Reviewed-on: https://chromium-review.googlesource.com/749117
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Hans Wennborg <hans@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49066}
2017-11-01 20:46:22 +00:00
Hannes Payer
668b1e6843 [deoptimizer] Make deoptimizer entry code memory rx.
Bug: chromium:774108,v8:6792
Change-Id: If91b709779912c37b88f3c57e46f7910b59cc240
Reviewed-on: https://chromium-review.googlesource.com/737870
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48967}
2017-10-26 12:05:06 +00:00
Michael Starzinger
3b67d7a0f4 Reland "[objects] Introduce {CodeDataContainer} object type."
This is a reland of eeaffa9f33
Original change's description:
> [objects] Introduce {CodeDataContainer} object type.
> 
> This introduces the {CodeDataContainer} as a container for all mutable
> fields associated with a {Code} object. For now only the kind-specific
> flags are moved, but more fields can/will be moved gradually. The goal
> is to make all fields in the {Code} header be immutable eventually.
> 
> R=jarin@chromium.org
> BUG=v8:6792
> 
> Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
> Reviewed-on: https://chromium-review.googlesource.com/732987
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48902}

Bug: v8:6792
Change-Id: I31a127df4bb8ee5fedb4d73755df4deae6e1d352
Reviewed-on: https://chromium-review.googlesource.com/738109
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48928}
2017-10-25 12:43:56 +00:00
Michael Achenbach
9249df1d73 Revert "[objects] Introduce {CodeDataContainer} object type."
This reverts commit eeaffa9f33.

Reason for revert: Breaks msan compile (uninitialized value in snapshot):
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/17824

Original change's description:
> [objects] Introduce {CodeDataContainer} object type.
> 
> This introduces the {CodeDataContainer} as a container for all mutable
> fields associated with a {Code} object. For now only the kind-specific
> flags are moved, but more fields can/will be moved gradually. The goal
> is to make all fields in the {Code} header be immutable eventually.
> 
> R=​jarin@chromium.org
> BUG=v8:6792
> 
> Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
> Reviewed-on: https://chromium-review.googlesource.com/732987
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48902}

TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I74fe833b074752d640cff4aa4680f250e1bd8780
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6792
Reviewed-on: https://chromium-review.googlesource.com/738029
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48904}
2017-10-25 09:24:59 +00:00
Michael Starzinger
eeaffa9f33 [objects] Introduce {CodeDataContainer} object type.
This introduces the {CodeDataContainer} as a container for all mutable
fields associated with a {Code} object. For now only the kind-specific
flags are moved, but more fields can/will be moved gradually. The goal
is to make all fields in the {Code} header be immutable eventually.

R=jarin@chromium.org
BUG=v8:6792

Change-Id: I2eeba893afaba877fb6117e1f18371898c3a175e
Reviewed-on: https://chromium-review.googlesource.com/732987
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48902}
2017-10-25 08:46:29 +00:00
Mike Stanton
b3d849905e [Turbofan] Reland Array.prototype.filter inlining.
Support inlining of Array.prototype.filter in TurboFan.

Bug: v8:1956
Change-Id: If50e230d14461063d378c0591dc27dea43371afa
Reviewed-on: https://chromium-review.googlesource.com/733089
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48846}
2017-10-23 19:29:50 +00:00
Michael Starzinger
8dfebbc381 [objects] Turn {PromiseCapability} into a {Tuple3}.
R=gsathya@chromium.org
BUG=v8:6792

Change-Id: I68a5f9e7e52dbc9512e6919fce2064d748a3e7c4
Reviewed-on: https://chromium-review.googlesource.com/730726
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48824}
2017-10-23 11:15:07 +00:00
Toon Verwaest
4cb88e3ab4 Cleanup codegen.h includes
Bug: 
Change-Id: I67cfd5634e86472425c161b461684bd975e58a41
Reviewed-on: https://chromium-review.googlesource.com/730204
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48783}
2017-10-20 11:56:01 +00:00
Mike Stanton
f0aa474e9a Revert "[Turbofan] Array.prototype.filter inlining."
This reverts commit 9fd029ef25.

Due to a ClusterFuzz issue.

TBR=mstarzinger@chromium.org

Bug: chromium:776511
Change-Id: I0f30e2e8de97f3c437a1756c82e645828358ad91
Reviewed-on: https://chromium-review.googlesource.com/730006
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48775}
2017-10-20 08:43:58 +00:00
Mike Stanton
9fd029ef25 [Turbofan] Array.prototype.filter inlining.
Support inlining of Array.prototype.filter in TurboFan.

(relanding with fix for chromium:766635, visible in the
 diff between patchsets 2 and 3)

Bug: v8:1956,chromium:766635
Change-Id: Ia50be6770602513e3d91d17e2b2ca9d3b0e8b42a
Reviewed-on: https://chromium-review.googlesource.com/721119
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48697}
2017-10-18 17:09:27 +00:00
Michael Starzinger
855a6b5d0c [objects] Rename DeoptimizationInputData.
Now that {DeoptimizationOutputData} does not exists anymore we can
rename {DeoptimizationInputData} to just {DeoptimizationData}.

R=jarin@chromium.org

Change-Id: Ib67967539d33714cc15e5d5b6dde522a9ede64b2
Reviewed-on: https://chromium-review.googlesource.com/725349
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48684}
2017-10-18 12:36:10 +00:00
Clemens Hammacher
5f6510825a [cleanup] Fix remaining (D)CHECK macro usages
This CL fixes all occurences that don't require special OWNER reviews,
or can be reviewed by Michi.

After this one, we should be able to reenable the readability/check
cpplint check.

R=mstarzinger@chromium.org

Bug: v8:6837, v8:6921
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ic81d68d5534eaa795b7197fed5c41ed158361d62
Reviewed-on: https://chromium-review.googlesource.com/721120
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48670}
2017-10-18 10:12:31 +00:00
Jaroslav Sevcik
57c6c97904 [deoptimizer] Remove incorrect cast for materialized property array.
Bug: chromium:774824
Change-Id: Id3d0af0bb55c0985393fe3b139308b6b706e7bc0
Reviewed-on: https://chromium-review.googlesource.com/725339
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48665}
2017-10-18 08:13:51 +00:00
Mathias Bynens
62f929ff4c Use nullptr instead of NULL where possible
New code should use nullptr instead of NULL.

This patch updates existing use of NULL to nullptr where applicable,
making the code base more consistent.

BUG=v8:6928,v8:6921

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I4687f5b96fcfd88b41fa970a2b937b4f6538777c
Reviewed-on: https://chromium-review.googlesource.com/718338
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48557}
2017-10-13 17:21:49 +00:00
Igor Sheludko
36860509fb Reland "[runtime] Make JSFunction::prototype_or_initial_map field optional."
This is a reland of 3d023952f2
Original change's description:
> [runtime] Make JSFunction::prototype_or_initial_map field optional.
> 
> Functions that don't have prototype need to store neither prototype nor
> initial map, so the |prototype_or_initial_map| field is not required for
> such maps.
> 
> Bug: v8:6459
> Change-Id: I4b3066bd6a4fed42c19f217bae82a8bce552bdca
> Reviewed-on: https://chromium-review.googlesource.com/570250
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46840}

Bug: v8:6459
Change-Id: I54e3516ea70474c6d4f873f7b91e74cb8a7d622a
Reviewed-on: https://chromium-review.googlesource.com/583307
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48523}
2017-10-13 09:09:28 +00:00