Commit Graph

586 Commits

Author SHA1 Message Date
Leszek Swirski
0010be5b23 [compiler] Always use deopt count for disabling optimization
Currently we count optimizations to decide to disable optimization, and
count deopts to detect this decision and allow re-enabling optimizations
after a while.

However, throwing out TurboFan OSR code and GC optimized code evictions
do not count as deopts, which means that the optimization count
increases without increasing the deopt count. This increased optimization
count disables further optimization -- which is bad, because these are
not "true" deopts -- and can stop the optimization from being re-enabled,
because the deopt count can't go high enough.

Instead, we now only ever look at deopts to disable/re-enable
optimization, and opt counts are only used for naming log files and in
tests.

Change-Id: I0c7d6be497545449a38cf952cd2f007ee51982ba
Reviewed-on: https://chromium-review.googlesource.com/468811
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44647}
2017-04-13 13:41:26 +00:00
bmeurer
8c0c5e8117 [turbofan] Properly represent the float64 hole.
The hole NaN should also have proper Type::Hole, and not silently hide
in the Type::Number. This way we can remove all the special casing for
the hole NaN, and we also finally get the CheckNumber right.

This also allows us to remove some ducktape from the Deoptimizer, as for
escape analyzed FixedDoubleArrays we always pass the hole value now to
represent the actual holes.

Also-By: jarin@chromium.org
BUG=chromium:684208,chromium:709753,v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2814013003
Cr-Commit-Position: refs/heads/master@{#44603}
2017-04-12 10:10:48 +00:00
kozyatinskiy
dc662e5b74 [inspector] store stack frame in struct instead of JSObject
JSObject is slow: creating strings for keys and storing values by these keys after takes significant amount of time.
With this CL console methods (most of them collect top stack frame to calculate source location) are ~33% faster.
V8Debugger::captureStackTrace is ~50% faster.

BUG=v8:6189
R=yangguo@chromium.org
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2789073002
Cr-Commit-Position: refs/heads/master@{#44344}
2017-04-03 14:58:49 +00:00
Caitlin Potter
bf463c4dc0 [async-iteration] implement AsyncGenerator
- Introduce new struct AsyncGeneratorRequest, which holds
  information pertinent to resuming execution of an
  AsyncGenerator, such as the Promise associated with the async
  generator request. It is intended to be used as a singly
  linked list, and holds a pointer to the next item in te queue.

- Introduce JSAsyncGeneratorObject (subclass of
  JSGeneratorObject), which includes several new internal fields
  (`queue` which contains a singly linked list of
  AsyncGeneratorRequest objects, and `await_input` which
  contains the sent value from an Await expression (This is
  necessary to prevent function.sent (used by yield*) from
  having the sent value observably overwritten during
  execution).

- Modify SuspendGenerator to accept a set of Flags, which
  indicate whether the suspend is for a Yield or Await, and
  whether it takes place on an async generator or ES6
  generator.

- Introduce interpreter intrinsics and TF intrinsic lowering for
  accessing the await input of an async generator

- Modify the JSGeneratorStore operator to understand whether or
  not it's suspending for a normal yield, or an AsyncGenerator
  Await. This ensures appropriate registers are stored.

- Add versions of ResumeGeneratorTrampoline which store the
  input value in a different field depending on wether it's an
  AsyncGenerator Await resume, or an ordinary resume. Also modifies
  whether debug code will assert that the generator object is a
  JSGeneratorObject or a JSAsyncGeneratorObject depending on the
  resume type.

BUG=v8:5855
R=bmeurer@chromium.org, rmcilroy@chromium.org, jgruber@chromium.org,
littledan@chromium.org, neis@chromium.org
TBR=marja@chromium.org

Change-Id: I9d58df1d344465fc937fe7eed322424204497187
Reviewed-on: https://chromium-review.googlesource.com/446961
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44240}
2017-03-29 17:33:12 +00:00
jarin
12d815b36e [profiler] Web UI: add summary of opts/deopts.
This adds optimization and deoptimization counts to the Web UI. Also, the function timeline
now shows optimization and deoptimization marks.

Review-Url: https://codereview.chromium.org/2753543006
Cr-Commit-Position: refs/heads/master@{#44033}
2017-03-22 16:02:25 +00:00
neis
94b088ca3c Disentangle assembler from isolate.
This is a first step towards moving Turbofan code generation off the main thread.

Summary of the changes:
- AssemblerBase no longer has a pointer to the isolate. Instead, its
  constructor receives the few things that it needs from the isolate (on most
  architectures this is just the serializer_enabled flag).
- RelocInfo no longer has a pointer to the isolate. Instead, the functions
  that need it take it as an argument.  (There are currently still a few that
  implicitly access the isolate through a HeapObject.)
- The MacroAssembler now explicitly holds a pointer to the isolate (before, it
  used to get it from the Assembler).
- The jit_cookie also moved from AssemblerBase to the MacroAssemblers, since
  it's not used at all in the Assemblers.
- A few architectures implemented parts of the Assembler with the help
  of a Codepatcher that is based on MacroAssembler.  Since the Assembler no
  longer has the isolate, but the MacroAssembler still needs it, this doesn't
  work anymore.  Instead, these Assemblers now use a new PatchingAssembler.

BUG=v8:6048

Review-Url: https://codereview.chromium.org/2732273003
Cr-Commit-Position: refs/heads/master@{#43890}
2017-03-17 11:18:06 +00:00
Marja Hölttä
beacd656f2 [iwyu|arm64] Pre-work for removing the illegal include macro-assembler.h -> assembler-inl.h
BUG=v8:5294

Change-Id: I6214c50c7d1344210a80763b066e5ec56df1265a
Reviewed-on: https://chromium-review.googlesource.com/453460
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43820}
2017-03-15 12:08:50 +00:00
jarin
fe704477d6 [deoptimizer] When deoptimizing code, unlink all functions referring to that code.
Drive by: remove two unused methods in optimized code visitor.

Review-Url: https://codereview.chromium.org/2730323002
Cr-Commit-Position: refs/heads/master@{#43611}
2017-03-06 12:22:05 +00:00
tebbi
e61ff99104 [turbofan] compute arguments length in deoptimizer
Following the design of https://codereview.chromium.org/2692753004, also compute the arguments length in the deoptimizer sucht that it does not have to be computed in optimized code.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2729163002
Cr-Commit-Position: refs/heads/master@{#43587}
2017-03-03 13:43:40 +00:00
tebbi
7467f16d73 [turbofan] escape analysis supports arguments object and rest elements
The new NewUnmappedArgumentsElements node now takes two inputs:
- the frame holding the arguments (current frame or arguments adaptor frame)
- the length of the suffix of passed arguments to be copied into the backing store

These inputs are computed with two new node types:
ArgumentsFrame()
ArgumentsLength[formal_parameter_count,is_rest_length](Node* arguments_frame)
The node type NewRestParameterElements can now be expressed with NewUnmappedArgumentsElements and an appropriate length and is thus not needed anymore.

In escape analysis, we lower loads from the length field of NewUnmappedArgumentsElements with its length input and if we find out that no write access to the arguments elements exists, we replace element loads with direct stack access and replace the NewUnmappedArgumentsElements node with a node of the new node type ArgumentsElementsState. This corresponds to an ObjectState node and gets translated into a deoptimizer instruction to allocate the backing store. Together with the already existing deoptimizer support for the actual arguments object/rest parameters, this allows to remove all allocations for arguments objects/rest parameters in this case.
In the deoptimizer, we read the actual parameters from the stack while transforming the static deopt info into TranslatedValue objects.

If escape analysis cannot remove the backing store allocation, NewUnmappedArgumentsElements gets lo

BUG=v8:5726

Review-Url: https://codereview.chromium.org/2692753004
Cr-Commit-Position: refs/heads/master@{#43475}
2017-02-28 11:16:27 +00:00
caitp
0423341034 [async-iteration] implement Async-from-Sync Iterator
Introduce a new Object to allow GetIterator("async") to function when the
iterable does not have a Symbol.asyncIterator method.

This patch has been split out from https://codereview.chromium.org/2622833002/
and incorporates test cases.

BUG=v8:5855, v8:4483
R=jgruber@chromium.org, rmcilroy@chromium.org, neis@chromium.org
TBR=hpayer@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2645313003
Cr-Commit-Position: refs/heads/master@{#43419}
2017-02-24 17:48:49 +00:00
Leszek Swirski
fd596007f2 [everywhere] Custom representation for frame type
Use an opaque format for the frame type marker on the stack, where the
marker is simply shifted left by 1 instead of being a Smi. This allows
us to generate simpler code for frame initialisation, as we can push a
smaller value, decreasing the prologue by 4 bytes and one instruction.

Drive-by: Use the same format for JsFrameMarker.

Change-Id: I812dde9b37869fe20de4148a665d06cf23ce7372
Reviewed-on: https://chromium-review.googlesource.com/443426
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43347}
2017-02-21 16:13:55 +00:00
Toon Verwaest
0a8de761ff Remove unused Box type
BUG=

Change-Id: Ie7a8327fac62a0608b60cf9f0f072f979ac4fd76
Reviewed-on: https://chromium-review.googlesource.com/443528
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@google.com>
Cr-Commit-Position: refs/heads/master@{#43269}
2017-02-17 10:06:22 +00:00
bbudge
deabb19abc Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43169}
Committed: a9b59a11f1
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43176}
2017-02-14 06:57:25 +00:00
franzih
a386eb4f04 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
Breaks Node integration build.

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,v8:5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Original-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43169}
> Committed: a9b59a11f1

TBR=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,machenbach@chromium.org,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,v8:5948

Review-Url: https://codereview.chromium.org/2695653005
Cr-Commit-Position: refs/heads/master@{#43170}
2017-02-13 21:33:46 +00:00
bbudge
a9b59a11f1 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43169}
2017-02-13 20:43:08 +00:00
bradnelson
43fc15bb79 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
red

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
> (notry since trybots can't patch directory deletes)
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9

TBR=bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,5948

Review-Url: https://codereview.chromium.org/2692933002
Cr-Commit-Position: refs/heads/master@{#43164}
2017-02-13 18:12:14 +00:00
bbudge
d170c57ab9 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
(notry since trybots can't patch directory deletes)
NOTRY=true

Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43162}
2017-02-13 15:59:22 +00:00
Michael Starzinger
6ee0b6cec6 [turbofan] Correct lazy deopt by {JSCreate} operation.
This adds support for deoptimizing into the JSConstructStub after the
receiver instantiation but before the actual constructor invocation.
Such a deoptimization point is needed for cases where instantiation
might be observed (e.g. when new.target is a proxy) and hence might
trigger a deopt.

We use this new deoptimization point for the "after" frame-state the
inliner attaches to {JSCreate} nodes being inserted when constructor
calls are being inlined.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-5638b
BUG=v8:5638

Change-Id: I7c72c807ee8fb76d12e0e9ccab86d970ab1a0efd
Reviewed-on: https://chromium-review.googlesource.com/440125
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43149}
2017-02-13 10:14:54 +00:00
mvstanton
aea3ce3df3 [TypeFeedbackVector] Root feedback vectors at function literal site.
TypeFeedbackVectors are strongly rooted by a closure. However, in modern
JavaScript closures are created and abandoned more freely. An important
closure may not be present in the root-set at time of garbage collection,
even though we've cached optimized code and use it regularly. For
example, consider leaf functions in an event dispatching system. They may
well be "hot," but tragically non-present when we collect the heap.

Until now, we've relied on a weak root to cache the feedback vector in
this case. Since there is no way to signal intent or relative importance,
this weak root is as susceptible to clearing as any other weak root at
garbage collection time.

Meanwhile, the feedback vector has become more important. All of our
ICs store their data there. Literal and regex boilerplates are stored there.
If we lose the vector, then we not only lose optimized code built from
it, we also lose the very feedback which allowed us to create that optimized
code. Therefore it's vital to express that dependency through the root
set.

This CL does this by creating a strong link to a feedback
vector at the instantiation site of the function closure.
This instantiation site is in the code and feedback vector
of the outer closure.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2674593003
Cr-Commit-Position: refs/heads/master@{#42953}
2017-02-06 10:18:05 +00:00
mvstanton
93f05b64ae [TypeFeedbackVector] Combine the literals array and the feedback vector.
They have the same lifetime. It's a match!

Both structures are native context dependent and dealt with (creation,
clearing, gathering feedback) at the same time. By treating the spaces used
for literal boilerplates as feedback vector slots, we no longer have to keep
track of the materialized literal count elsewhere.

A follow-on CL removes even more parser infrastructure related to this count.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2655853010
Cr-Commit-Position: refs/heads/master@{#42771}
2017-01-30 12:31:35 +00:00
mstarzinger
7376e12e00 [deoptimizer] Preserve double bit patterns correctly.
This makes sure that the deoptimizer preserves the exact bit pattern of
floating-point values (both 32-bit and 64-bit) up to the point where a
potential {HeapNumber} is allocated. It in turn allows us to correctly
recognize the {hole_nan_value} when stored into a {FixedDouleArray}.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-684208
BUG=chromium:684208

Review-Url: https://codereview.chromium.org/2652303002
Cr-Commit-Position: refs/heads/master@{#42679}
2017-01-26 09:25:59 +00:00
jarin
6d1894e4f4 [deoptimizer] Materialize string iterators.
BUG=chromium:683617

Review-Url: https://codereview.chromium.org/2651553003
Cr-Commit-Position: refs/heads/master@{#42606}
2017-01-23 16:46:42 +00:00
jarin
a0230f6359 [deoptimizer] Initialize array iterator index to zero to make heap-verify happy.
BUG=chromium:682671

Review-Url: https://codereview.chromium.org/2644283002
Cr-Commit-Position: refs/heads/master@{#42538}
2017-01-20 09:22:56 +00:00
jkummerow
3e915e12a1 Internalize strings in-place (reland^3)
using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe69)
(Previously landed as #42193 / 4c699e349a)
(Previously landed as #42235 / ec45e6ed2e)

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42503}
2017-01-19 13:27:59 +00:00
jarin
9091eb19be [deoptimizer] Materialize array iterators in the deoptimizer.
This also introduces exhaustive switch-cases for instance types.

BUG=chromium:681383

Review-Url: https://codereview.chromium.org/2646433002
Cr-Commit-Position: refs/heads/master@{#42447}
2017-01-18 10:55:22 +00:00
ishell
322a37856a [runtime] Add DescriptorArray::GeneralizeAllFields().
... and rename [Copy]GeneralizeAllRepresentations() -> [Copy]GeneralizeAllFields().

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2632373002
Cr-Commit-Position: refs/heads/master@{#42418}
2017-01-17 15:39:06 +00:00
jarin
e0a850318f [deoptimizer] Insert more consistency checks.
This is mainly to catch a crash that we see in Canary with escape
analysis on.

Review-Url: https://codereview.chromium.org/2625893003
Cr-Commit-Position: refs/heads/master@{#42223}
2017-01-11 12:48:42 +00:00
mstarzinger
50c5ac57de [deoptimizer] Fix Deoptimizer::GetDeoptInfo for last entry.
This fixes the corner-case where the method in question failed to lookup
the very last deoptimization bailout without subsequent entries within
the relocation info. Also enable a test covering this.

R=tebbi@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2565733002
Cr-Commit-Position: refs/heads/master@{#41623}
2016-12-09 15:06:26 +00:00
mstarzinger
7854e64908 [turbofan] Remove --turbo-asm-deoptimization flag.
R=bmeurer@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2557693006
Cr-Commit-Position: refs/heads/master@{#41579}
2016-12-08 09:21:12 +00:00
mstarzinger
204babf5a0 [deoptimizer] Fix deoptimization in {TranslatedState}.
This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}
2016-11-29 11:34:22 +00:00
mstarzinger
7a82d8e9e4 [runtime] Simplify handler table lookup semantics.
The range-based exception handler table is by now only used for bytecode
arrays. The semantics of the interpreter are that bytecode offsets point
to the beginning of the currently executing bytecode instruction. Uses
hence need to compensate for lookups based on a "retrun address". This
change removes the need for such off-by-one compensations by changing
lookup semantics to be based on "current instruction" offsets.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2534893002
Cr-Commit-Position: refs/heads/master@{#41339}
2016-11-29 09:17:09 +00:00
mstarzinger
ac88607375 [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
Review-Url: https://codereview.chromium.org/2529343003
Cr-Original-Commit-Position: refs/heads/master@{#41318}
Cr-Commit-Position: refs/heads/master@{#41323}
2016-11-28 15:58:36 +00:00
mstarzinger
54aac1f778 Revert of [deoptimizer] Remove dead Code::LookupRangeInHandlerTable. (patchset #2 id:20001 of https://codereview.chromium.org/2529343003/ )
Reason for revert:
Seems to break TSAN builds.

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12897/steps/Check/logs/stack-traces

Original issue's description:
> [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
>
> This removes the supporting function to perform a range-lookup in the
> exception handler table for unoptimized code. Such tables are by now
> guaranteed to be empty, the deoptimizer cannot encounter this case.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
> Cr-Commit-Position: refs/heads/master@{#41318}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2536673002
Cr-Commit-Position: refs/heads/master@{#41319}
2016-11-28 14:07:40 +00:00
mstarzinger
1f27ed9d7d [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2529343003
Cr-Commit-Position: refs/heads/master@{#41318}
2016-11-28 13:25:20 +00:00
jarin
72b5a0d40e [deoptimizer] Use the correct function for handler lookup for bytecode.
BUG=chromium:668760

Review-Url: https://codereview.chromium.org/2530403002
Cr-Commit-Position: refs/heads/master@{#41314}
2016-11-28 12:45:29 +00:00
Miran.Karic
a18be72c8e Add v8_os_page_size flag for cross compilation
When generating snapshot on a machine with a different page size than
the target machine, we can run into problems as the v8 page area size
changes. This is because v8 has page guards which depend on os page
size, so if the target has larger os page, v8 page area is smaller and
may not fit the contents.

The solution proposed here is adding a flag, v8_os_page_size, that
would, if used, override local os page size and use the one specified
during snapshot generation.

BUG=

Review-Url: https://codereview.chromium.org/2488403003
Cr-Commit-Position: refs/heads/master@{#40997}
2016-11-15 14:41:03 +00:00
tebbi
c3a6ca68d0 This CL enables precise source positions for all V8 compilers. It merges compiler::SourcePosition and internal::SourcePosition to a single class used throughout the codebase. The new internal::SourcePosition instances store an id identifying an inlined function in addition to a script offset.
SourcePosition::InliningId() refers to a the new table DeoptimizationInputData::InliningPositions(), which provides the following data for every inlining id:
 - The inlined SharedFunctionInfo as an offset into DeoptimizationInfo::LiteralArray
 - The SourcePosition of the inlining. Recursively, this yields the full inlining stack.
Before the Code object is created, the same information can be found in CompilationInfo::inlined_functions().

If SourcePosition::InliningId() is SourcePosition::kNotInlined, it refers to the outer (non-inlined) function.
So every SourcePosition has full information about its inlining stack, as long as the corresponding Code object is known. The internal represenation of a source position is a positive 64bit integer.

All compilers create now appropriate source positions for inlined functions. In the case of Turbofan, this required using AstGraphBuilderWithPositions for inlined functions too. So this class is now moved to a header file.

At the moment, the additional information in source positions is only used in --trace-deopt and --code-comments. The profiler needs to be updated, at the moment it gets the correct script offsets from the deopt info, but the wrong script id from the reconstructed deopt stack, which can lead to wrong outputs. This should be resolved by making the profiler use the new inlining information for deopts.

I activated the inlined deoptimization tests in test-cpu-profiler.cc for Turbofan, changing them to a case where the deopt stack and the inlining position agree. It is currently still broken for other cases.

The following additional changes were necessary:
 - The source position table (internal::SourcePositionTableBuilder etc.) supports now 64bit source positions. Encoding source positions in a single 64bit int together with the difference encoding in the source position table results in very little overhead for the inlining id, since only 12% of the source positions in Octane have a changed inlining id.
 - The class HPositionInfo was effectively dead code and is now removed.
 - SourcePosition has new printing and information facilities, including computing a full inlining stack.
 - I had to rename compiler/source-position.{h,cc} to compiler/compiler-source-position-table.{h,cc} to avoid clashes with the new src/source-position.cc file.
 - I wrote the new wrapper PodArray for ByteArray. It is a template working with any POD-type. This is used in DeoptimizationInputData::InliningPositions().
 - I removed HInlinedFunctionInfo and HGraph::inlined_function_infos, because they were only used for the now obsolete Crankshaft inlining ids.
 - Crankshaft managed a list of inlined functions in Lithium: LChunk::inlined_functions. This is an analog structure to CompilationInfo::inlined_functions. So I removed LChunk::inlined_functions and made Crankshaft use CompilationInfo::inlined_functions instead, because this was necessary to register the offsets into the literal array in a uniform way. This is a safe change because LChunk::inlined_functions has no other uses and the functions in CompilationInfo::inlined_functions have a strictly longer lifespan, being created earlier (in Hydrogen already).

BUG=v8:5432

Review-Url: https://codereview.chromium.org/2451853002
Cr-Commit-Position: refs/heads/master@{#40975}
2016-11-14 17:22:32 +00:00
mstarzinger
93c6595200 [turbofan] Advance bytecode offset after lazy deopt.
This changes {FrameState} nodes modeling "after" states to use bytecode
offsets pointing to the deoptimizing bytecode. This is in sync with the
normal execution, as the bytecode offset is advanced after operations
complete in regular bytecode handlers.

The change is necessary to ensure lazy deoptimized frames contain an
accurate bytecode offset while they are on the stack. Such frames can be
inspected by various stack walks. The continuation builtin will advance
the bytecode offset upon return.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-660379
BUG=chromium:660379

Review-Url: https://codereview.chromium.org/2487173002
Cr-Commit-Position: refs/heads/master@{#40887}
2016-11-10 11:35:22 +00:00
heimbuef
495354ffda Used ZoneChunkList in deoptimizer to conserve memory.
Exchanged the ZoneList for a ZoneChunkList to avoid
unnecessary growing.

Review-Url: https://codereview.chromium.org/2468183004
Cr-Commit-Position: refs/heads/master@{#40736}
2016-11-03 17:16:21 +00:00
bmeurer
77419488a9 [builtins] Remove the unused AllocationSite slot from ConstructFrame.
This slot is completely unused and always undefined anyways, so there's
no need to maintain the slot during object construction.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2423323002
Cr-Commit-Position: refs/heads/master@{#40377}
2016-10-18 06:07:00 +00:00
heimbuef
e7fa9b0129 Named all zones in the project
This adds more useful information to the v8-heap-stats tool.

BUG=v8:5489

Review-Url: https://codereview.chromium.org/2394213003
Cr-Commit-Position: refs/heads/master@{#40361}
2016-10-17 12:12:42 +00:00
jgruber
9ef4c3af25 Add Smi::Zero and replace all Smi::FromInt(0) calls
BUG=

Committed: https://crrev.com/7db0ecdec3cf330766575cb7973b983f3f1e3020
Review-Url: https://codereview.chromium.org/2381843002
Cr-Original-Commit-Position: refs/heads/master@{#40080}
Cr-Commit-Position: refs/heads/master@{#40087}
2016-10-07 13:05:26 +00:00
jgruber
d1545f8ecc Revert "Add Smi::Zero and replace all Smi::FromInt(0) calls"
This reverts commit 7db0ecdec3.

Manual revert since automatic revert is too large for the web interface.

BUG=
TBR=bmeurer@chromium.org,mstarzinger@chromium.org,yangguo@chromium.org,ahaas@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2396353002
Cr-Commit-Position: refs/heads/master@{#40082}
2016-10-07 12:22:56 +00:00
jgruber
7db0ecdec3 Add Smi::Zero and replace all Smi::FromInt(0) calls
BUG=

Review-Url: https://codereview.chromium.org/2381843002
Cr-Commit-Position: refs/heads/master@{#40080}
2016-10-07 11:03:43 +00:00
jarin
f1be39072f [deoptimizer] Remove some dead code.
Review-Url: https://codereview.chromium.org/2365343002
Cr-Commit-Position: refs/heads/master@{#39732}
2016-09-26 14:09:01 +00:00
tebbi
d9c6f517d1 [deoptimizer] Added separators in deoptimization tracing output for full-codegen and ignition
BUG=v8:5330

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2311153002
Cr-Commit-Position: refs/heads/master@{#39713}
2016-09-26 11:13:50 +00:00
mstarzinger
b097c6c4f1 [turbofan] Support for ConsString by escape analysis.
This add support for ConsString objects allocated inline to the escape
analysis pass. The raw hash field in such strings needs special handling
similar to existing raw fields. This also contains materialization code
within the deoptimizer as usual.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-648737
BUG=chromium:648737

Review-Url: https://codereview.chromium.org/2357153002
Cr-Commit-Position: refs/heads/master@{#39594}
2016-09-21 12:30:00 +00:00
mstarzinger
9d6872cdf1 [deoptimizer] Materialize JSFunction objects without context.
This fixes the materialization of JSFunction objects to not rely on a
context being available. The context has been cleared because it might
be de-materiallized itself.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/escape-analysis-materialize
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2320983002
Cr-Commit-Position: refs/heads/master@{#39277}
2016-09-08 12:15:50 +00:00
mstarzinger
517a54286d [deoptimizer] Materialize JSArray objects without context.
This fixes the materialization of JSArray objects to not rely on a
context being available. The context has been cleared because it might
be de-materiallized itself.

R=bmeurer@chromium.org
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2323713002
Cr-Commit-Position: refs/heads/master@{#39274}
2016-09-08 11:38:03 +00:00
mstarzinger
9984d6f689 [deoptimizer] Support materialization of ContextExtension.
This adds support to the deoptimizer to materialize ContextExtension
objects that have been de-materialized by escape analysis. This is
follow-up to the inline allocation of such objects during the create
lowering phase (i.e. JSCreateWithContext and JSCreateCatchContext).

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-644245
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2317353003
Cr-Commit-Position: refs/heads/master@{#39270}
2016-09-08 10:33:20 +00:00
mstarzinger
96164b74f1 [deoptimizer] Clear context before NotifyDeoptimized.
This clears the context register by setting it to Smi(0) before calling
the Runtime::kNotifyDeoptimized helper. The deoptimizer must be able to
materialize all heap objects without any context available. The context
itself might be dematerialized.

With this change we make sure that invariant is maintained even without
escape analysis kicking in. We also satisfy the check that the context
register is either Smi(0) or a valid context. It might have been the
special {arguments_marker} in this particular case.

R=bmeurer@chromium.org
BUG=chromium:644245

Review-Url: https://codereview.chromium.org/2320673002
Cr-Commit-Position: refs/heads/master@{#39267}
2016-09-08 09:52:07 +00:00
mstarzinger
279bc5096b [deoptimizer] Support virtual context in interpreted frame.
This adds support for dematerialized context values as part of an
interpreted frame (similar to an FCG frame). Both frame translations
should be kept in sync as much as possible.

R=rmcilroy@chromium.org
BUG=chromium:644728

Review-Url: https://codereview.chromium.org/2313343002
Cr-Commit-Position: refs/heads/master@{#39256}
2016-09-07 16:02:13 +00:00
fmeawad
e5ba156d88 [RuntimeCallStats] Move tracing runtime instrumentation closer to the original version.
After we landed the tracing runtime call stats, which gave
us a lot of V8 insight in tracing, we noticed that there is
some arising issues and discrepancies.

Issues include:
Missing trace events, that happened due to
transforming those trace events into runtime calls

Discrepancies include:
Missing categories in Runtime call stats like GC,
because we are not handling the Scoped runtime calls
properly in the tracing version.

To reduce/eliminate those issue, we are taking a small
step back. We are unifying the RuntimeStats code and
using the original one. That would allow us to use all
the original probes but emit trace events from them.
We are also putting back the trace-events in their place.

The output from both system should be intact (Except of
the addition of the missing trace-events).

Also as a byproduct, we are reducing the number of context
scopes by half since we are using the same scope as
runtime call stats.

As a follow up to this CL, we will address the non-scoped
Runtime Call Stats (mainly in GC).
BUG=642373

Review-Url: https://codereview.chromium.org/2296243002
Cr-Commit-Position: refs/heads/master@{#39180}
2016-09-05 15:40:12 +00:00
lpy
7a7c0ec5af [Tracing] Re-add trace-events used by metrics accidentally removed.
We removed some TRACE_EVENT0 instrumentation when we landed runtime call stats
tracing, however some of them are used in metrics, this patch adds these
TRACE_EVENT0 back.

BUG=642373
LOG=N

Review-Url: https://codereview.chromium.org/2301743002
Cr-Commit-Position: refs/heads/master@{#39104}
2016-09-01 20:08:38 +00:00
mstarzinger
9c8f4775bd [deoptimizer] Fix for non-topmost interpreted frame.
The accumulator is always part of the translation for every interpreted
frame. The assumption is that all frames are in {TOS_REGISTER} state.
This however is not supported for non-topmost frames and we need to
avoid pushing the accumulator onto the machine stack.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2271153003
Cr-Commit-Position: refs/heads/master@{#38945}
2016-08-26 13:12:32 +00:00
mstarzinger
1f0c8d1e9a [deoptimizer] Remove obsolete BailoutType switches.
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2274273003
Cr-Commit-Position: refs/heads/master@{#38907}
2016-08-25 13:26:33 +00:00
mstarzinger
b34d352e4c [deoptimizer] Remove obsolete constructor argument.
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2272653002
Cr-Commit-Position: refs/heads/master@{#38887}
2016-08-25 08:14:44 +00:00
mstarzinger
09a7ac5fca [deoptimizer] Potentially deopt into debug bytecode.
This makes sure the deoptimizer picks bytecode prepared for debugging
when materializing an interpreted frame if one is available. This is
normally done by the interpreter entry trampoline and hence needs to be
replicated by the deoptimizer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2271443003
Cr-Commit-Position: refs/heads/master@{#38815}
2016-08-23 11:55:47 +00:00
yangguo
3494a3dcbc [deoptimizer] use correct code/bytecode to compute source position.
With --ignition-preserve-bytecode, we don't have the guarantee that
SharedFunctionInfo::abstract_code() returns the code we deopt to.

R=mstarzinger@chromium.org
BUG=v8:5265

Review-Url: https://codereview.chromium.org/2239773003
Cr-Commit-Position: refs/heads/master@{#38614}
2016-08-12 12:01:52 +00:00
lpy
7a3631e7e1 [Reland][Tracing] Embed V8 runtime call stats into tracing.
Currently we have V8 RuntimeCallStats that is independently from tracing when
running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
stats into tracing, by having a global table of runtime call counters each
isolate, resetting the table each time we enter a top level trace event, and
dumping the table for each top level trace event. This will make trace file more
compat, as well as enable runtime call stats in tracing system.

This patch adds ~5% overhead to V8 when the category is enabled, we measure the
overhead by running a script when category is enabled.

BUG=v8:5089

Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
Committed: https://crrev.com/1ca3b73bba4a7253ca8eeef39321d70e7d414331
Committed: https://crrev.com/3f936a5b17754783e92d2146eaf66c88a78ee45b
Review-Url: https://codereview.chromium.org/2187693002
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#38270}
Cr-Original-Original-Commit-Position: refs/heads/master@{#38314}
Cr-Original-Commit-Position: refs/heads/master@{#38403}
Cr-Commit-Position: refs/heads/master@{#38510}
2016-08-10 01:19:01 +00:00
machenbach
12ee7ec0a8 Revert of [Tracing] Embed V8 runtime call stats into tracing. (patchset #8 id:140001 of https://codereview.chromium.org/2187693002/ )
Reason for revert:
Leaks block chromium roll:
https://codereview.chromium.org/2219083003/

Example build:
https://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_asan_rel_ng/builds/205435

You can add the trybot from tryserver.chromium.linux, linux_chromium_asan_rel_ng, on reland.

Original issue's description:
> [Reland][Tracing] Embed V8 runtime call stats into tracing.
>
> Currently we have V8 RuntimeCallStats that is independently from tracing when
> running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
> stats into tracing, by having a global table of runtime call counters each
> isolate, resetting the table each time we enter a top level trace event, and
> dumping the table for each top level trace event. This will make trace file more
> compat, as well as enable runtime call stats in tracing system.
>
> This patch adds ~5% overhead to V8 when the category is enabled, we measure the
> overhead by running a script when category is enabled.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
> Committed: https://crrev.com/1ca3b73bba4a7253ca8eeef39321d70e7d414331
> Committed: https://crrev.com/3f936a5b17754783e92d2146eaf66c88a78ee45b
> Cr-Original-Original-Commit-Position: refs/heads/master@{#38270}
> Cr-Original-Commit-Position: refs/heads/master@{#38314}
> Cr-Commit-Position: refs/heads/master@{#38403}

TBR=cbruni@chromium.org,fmeawad@chromium.org,bmeurer@chromium.org,adamk@chromium.org,rmcilroy@chromium.org,lpy@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5089
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2221853002
Cr-Commit-Position: refs/heads/master@{#38412}
2016-08-08 07:10:11 +00:00
lpy
3f936a5b17 [Reland][Tracing] Embed V8 runtime call stats into tracing.
Currently we have V8 RuntimeCallStats that is independently from tracing when
running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
stats into tracing, by having a global table of runtime call counters each
isolate, resetting the table each time we enter a top level trace event, and
dumping the table for each top level trace event. This will make trace file more
compat, as well as enable runtime call stats in tracing system.

This patch adds ~5% overhead to V8 when the category is enabled, we measure the
overhead by running a script when category is enabled.

BUG=v8:5089

Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
Committed: https://crrev.com/1ca3b73bba4a7253ca8eeef39321d70e7d414331
Review-Url: https://codereview.chromium.org/2187693002
Cr-Original-Original-Commit-Position: refs/heads/master@{#38270}
Cr-Original-Commit-Position: refs/heads/master@{#38314}
Cr-Commit-Position: refs/heads/master@{#38403}
2016-08-05 22:24:43 +00:00
lpy
c9c448c305 Revert of [Tracing] Embed V8 runtime call stats into tracing. (patchset #8 id:140001 of https://codereview.chromium.org/2187693002/ )
Reason for revert:
Mac64 ASAN failure. https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/7810/steps/Check/logs/Threading4

Original issue's description:
> [Reland][Tracing] Embed V8 runtime call stats into tracing.
>
> Currently we have V8 RuntimeCallStats that is independently from tracing when
> running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
> stats into tracing, by having a global table of runtime call counters each
> isolate, resetting the table each time we enter a top level trace event, and
> dumping the table for each top level trace event. This will make trace file more
> compat, as well as enable runtime call stats in tracing system.
>
> This patch adds ~5% overhead to V8 when the category is enabled, we measure the
> overhead by running a script when category is enabled.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
> Committed: https://crrev.com/1ca3b73bba4a7253ca8eeef39321d70e7d414331
> Cr-Original-Commit-Position: refs/heads/master@{#38270}
> Cr-Commit-Position: refs/heads/master@{#38314}

TBR=cbruni@chromium.org,fmeawad@chromium.org,machenbach@chromium.org,bmeurer@chromium.org,adamk@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5089

Review-Url: https://codereview.chromium.org/2200373003
Cr-Commit-Position: refs/heads/master@{#38315}
2016-08-03 21:47:10 +00:00
lpy
1ca3b73bba [Reland][Tracing] Embed V8 runtime call stats into tracing.
Currently we have V8 RuntimeCallStats that is independently from tracing when
running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
stats into tracing, by having a global table of runtime call counters each
isolate, resetting the table each time we enter a top level trace event, and
dumping the table for each top level trace event. This will make trace file more
compat, as well as enable runtime call stats in tracing system.

This patch adds ~5% overhead to V8 when the category is enabled, we measure the
overhead by running a script when category is enabled.

BUG=v8:5089

Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
Review-Url: https://codereview.chromium.org/2187693002
Cr-Original-Commit-Position: refs/heads/master@{#38270}
Cr-Commit-Position: refs/heads/master@{#38314}
2016-08-03 20:48:38 +00:00
yangguo
26b30e4007 Revert of [Tracing] Embed V8 runtime call stats into tracing. (patchset #6 id:100001 of https://codereview.chromium.org/2187693002/ )
Reason for revert:
Sanitizer failures:

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/10989/
https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/7786/

Original issue's description:
> [Tracing] Embed V8 runtime call stats into tracing.
>
> Currently we have V8 RuntimeCallStats that is independently from tracing when
> running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
> stats into tracing, by having a global table of runtime call counters each
> isolate, resetting the table each time we enter a top level trace event, and
> dumping the table for each top level trace event. This will make trace file more
> compat, as well as enable runtime call stats in tracing system.
>
> This patch adds ~5% overhead to V8 when the category is enabled, we measure the
> overhead by running a script when category is enabled.
>
> BUG=v8:5089
>
> Committed: https://crrev.com/d014866173eaa2b548c566217b2c94b1d49385fa
> Cr-Commit-Position: refs/heads/master@{#38270}

TBR=cbruni@chromium.org,fmeawad@chromium.org,machenbach@chromium.org,bmeurer@chromium.org,adamk@chromium.org,rmcilroy@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5089

Review-Url: https://codereview.chromium.org/2203913004
Cr-Commit-Position: refs/heads/master@{#38275}
2016-08-03 07:28:02 +00:00
lpy
d014866173 [Tracing] Embed V8 runtime call stats into tracing.
Currently we have V8 RuntimeCallStats that is independently from tracing when
running d8 with flag --runtime_call_stats. This patch embeds V8 runtime call
stats into tracing, by having a global table of runtime call counters each
isolate, resetting the table each time we enter a top level trace event, and
dumping the table for each top level trace event. This will make trace file more
compat, as well as enable runtime call stats in tracing system.

This patch adds ~5% overhead to V8 when the category is enabled, we measure the
overhead by running a script when category is enabled.

BUG=5089

Review-Url: https://codereview.chromium.org/2187693002
Cr-Commit-Position: refs/heads/master@{#38270}
2016-08-03 06:13:30 +00:00
yangguo
43ab247f56 Remove NaCl support.
Review-Url: https://codereview.chromium.org/2175193003
Cr-Commit-Position: refs/heads/master@{#38081}
2016-07-27 07:50:31 +00:00
jochen
37ba8f961b Replace SmartArrayPointer<T> with unique_ptr<T[]>
R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2173403002
Cr-Commit-Position: refs/heads/master@{#38007}
2016-07-25 10:27:47 +00:00
mstarzinger
ca72704783 [turbofan] Allow deopt reasons without source positions.
This allows to pass deoptimization reasons to the profiler without the
requirement of always providing a source position. The absence of deopt
reasons is now communicated via a sentinel as the deopt id value. The
deoptimization reasons recently added to TurboFan are now passed to the
profiler.

R=bmeurer@chromium.org
TEST=cctest/test-cpu-profiler

Review-Url: https://codereview.chromium.org/2159793002
Cr-Commit-Position: refs/heads/master@{#37852}
2016-07-19 08:23:00 +00:00
bmeurer
db635d5b72 [turbofan] Add support for eager/soft deoptimization reasons.
So far TurboFan wasn't adding the deoptimization reasons for eager/soft
deoptimization exits that can be used by either the DevTools profiler or
the --trace-deopt flag. This adds basic support for deopt reasons on
Deoptimize, DeoptimizeIf and DeoptimizeUnless nodes and threads through
the reasons to the code generation.

Also moves the DeoptReason to it's own file (to resolve include cycles)
and drops unused reasons.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2161543002
Cr-Commit-Position: refs/heads/master@{#37823}
2016-07-18 09:25:16 +00:00
yangguo
d5b89c28cf Remove position info from relocation info.
R=mstarzinger@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109613004
Cr-Commit-Position: refs/heads/master@{#37397}
2016-06-29 13:49:50 +00:00
yangguo
4474858412 Use source position table in turbofan code.
R=bmeurer@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109673003
Cr-Commit-Position: refs/heads/master@{#37392}
2016-06-29 12:04:11 +00:00
titzer
4a8ac723ae [debugger] Simplify deletion of DeoptimizedFrameInfo.
R=yangguo@chromium.org,jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2112443002
Cr-Commit-Position: refs/heads/master@{#37377}
2016-06-29 09:44:56 +00:00
bbudge
257336d26a [RegisterConfiguration] Streamline access to arch defaults, simplify Registers.
Replaces ArchDefault method with Crankshaft and Turbofan getters.
Eliminates IsAllocated method on Register, FloatRegister, DoubleRegister.
Eliminates ToString method too.
Changes call sites to access appropriate arch default RegisterConfiguration.

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2092413002
Cr-Commit-Position: refs/heads/master@{#37297}
2016-06-27 15:31:31 +00:00
franzih
e9a93a9c2b Refactor Object.prototype.toString() to use the instance type instead of class_name().
Now we can turn it into a turbofan stub.

Create new instance types JS_ARGUMENTS_TYPE and JS_ERROR_TYPE.

Review-Url: https://codereview.chromium.org/2080243003
Cr-Commit-Position: refs/heads/master@{#37219}
2016-06-23 14:40:47 +00:00
alph
9df23510ea Introduce JIT code events dispatcher for the isolate.
The patch introduces a dedicated dispatching class for JIT code events. It is
set as a helper on the isolate.
This allows classes across v8 to break their dependency on Logger and CpuProfiler.
These two became just regular clients of the dispatcher.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2061623002
Cr-Commit-Position: refs/heads/master@{#37005}
2016-06-15 13:24:26 +00:00
ishell
7446a74f94 [stubs] Ensure that StoreTransitionStub does not bailout after the properties backing store is enlarged.
In addition, this CL fixes --trace-hydrogen-stubs mode.

BUG=chromium:601420
LOG=Y

Review-Url: https://codereview.chromium.org/2068693003
Cr-Commit-Position: refs/heads/master@{#36971}
2016-06-14 14:38:41 +00:00
cbruni
bc0798ca1a Introduce IsUndefined(Isolate*) and IsTheHole(Isolate*)
Passing in the isolate and pointer compare the instnance against the
corresponding constant is always faster than decoding the instance types.

BUG=

Review-Url: https://codereview.chromium.org/2028983002
Cr-Commit-Position: refs/heads/master@{#36744}
2016-06-06 13:00:49 +00:00
bbudge
a09fb95bc0 [deoptimizer] Support float registers and slots.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2031873002
Cr-Commit-Position: refs/heads/master@{#36715}
2016-06-03 14:16:55 +00:00
mstarzinger
addfd00a20 [runtime] Allow generic allocation of sloppy arguments.
This allows sloppy arguments objects to be allocated by the generic
Heap::AllocateJSObjectFromMap allocation function. An empty elements
backing store for such objects is provided. This is needed in order to
materialize such objects without access to a specific native context.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919

Review-Url: https://codereview.chromium.org/2014343004
Cr-Commit-Position: refs/heads/master@{#36547}
2016-05-27 12:38:53 +00:00
mstarzinger
3cc2adb319 [deoptimizer] Fix materialization of sloppy arguments.
This makes sure the deoptimizer can materialize sloppy arguments objects
with the FAST_SLOPPY_ARGUMENTS_ELEMENTS elements kind. TurboFan's escape
analysis treates those as normal JSObject types and hence materializes
them differently than Crankshaft does.

R=verwaest@chromium.org
TEST=mjsunit/regress/regress-crbug-613919
BUG=chromium:613919

Review-Url: https://codereview.chromium.org/2001133002
Cr-Commit-Position: refs/heads/master@{#36440}
2016-05-23 13:52:35 +00:00
mstarzinger
66d76797df [deoptimizer] Support materialization of closures.
This adds support to materialize JSFunction objects from deoptimization
information. By now we need to support this because TurboFan's escape
analysis can produce virtual (i.e. non-escaping) closures.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1998143002
Cr-Commit-Position: refs/heads/master@{#36400}
2016-05-20 09:20:02 +00:00
rmcilroy
39738bc905 [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.
In order to support compiling to baseline on return we need to be able to
return to the actual return address. With this change this is what the
Return bytecode now does, removing the need for the
InterpreterExitTrampoline.

This change also removes the InterpreterNotifyDeoptXXX builtins and
unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
change, FullCodegenerator::State is moved to Deoptimize::BailoutState.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/34c9626e2ee56fe805de549697ca5323aed7cb66
Cr-Commit-Position: refs/heads/master@{#36288}

Review-Url: https://codereview.chromium.org/1969423002
Cr-Commit-Position: refs/heads/master@{#36310}
2016-05-18 07:52:13 +00:00
machenbach
c473f2931d Revert of [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline. (patchset #6 id:170001 of https://codereview.chromium.org/1969423002/ )
Reason for revert:
Breaks
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm%20-%20sim/builds/619

Might only affect pure release builds?

Original issue's description:
> [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.
>
> In order to support compiling to baseline on return we need to be able to
> return to the actual return address. With this change this is what the
> Return bytecode now does, removing the need for the
> InterpreterExitTrampoline.
>
> This change also removes the InterpreterNotifyDeoptXXX builtins and
> unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
> change, FullCodegenerator::State is moved to Deoptimize::BailoutState.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/34c9626e2ee56fe805de549697ca5323aed7cb66
> Cr-Commit-Position: refs/heads/master@{#36288}

TBR=mstarzinger@chromium.org,oth@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review-Url: https://codereview.chromium.org/1986353002
Cr-Commit-Position: refs/heads/master@{#36294}
2016-05-17 19:47:00 +00:00
rmcilroy
34c9626e2e [Interpreter] Remove InterpreterExitTrampoline and replace with returning to the entry trampoline.
In order to support compiling to baseline on return we need to be able to
return to the actual return address. With this change this is what the
Return bytecode now does, removing the need for the
InterpreterExitTrampoline.

This change also removes the InterpreterNotifyDeoptXXX builtins and
unifies FCG and Igntion to both use NotifyDeoptXXX. As part of this
change, FullCodegenerator::State is moved to Deoptimize::BailoutState.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1969423002
Cr-Commit-Position: refs/heads/master@{#36288}
2016-05-17 16:46:33 +00:00
cbruni
407d9fcec7 [counters] Annotate v8 with more runtime call counters.
By fully annotating the API with runtime counters we can properly measure
how much time we spend in total in v8. When --runtime-call-stats is specified
we now disable the fast-paths for callbacks to properly measure them.
As a drive-by-fix this CL unifies the LOG messages in api.cc.
Additionally we added missing timers to gain better resolution in the parser
and callbacks.

BUG=

Review-Url: https://codereview.chromium.org/1923893002
Cr-Commit-Position: refs/heads/master@{#36248}
2016-05-13 15:54:49 +00:00
mstarzinger
29001f44fc [compiler] Profiler reconstructs inlined frames for deopts.
This makes the profiler reconstruct inlined function frames at eager
deopt points from the deoptimization data. The main goal of this is to
remove the last side-channel where Crankshaft communicates directly to
the profiler. This is the last preparatory step towards deprecating the
side-channel in question.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/1973993002
Cr-Commit-Position: refs/heads/master@{#36229}
2016-05-13 08:51:24 +00:00
cbruni
f87014ebde [runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat
Currently we do not check for @@isConcatSpreadable properly. If the Symbol is
set on the Array.prototype or Object.prototype the current fast paths fail.
This CL adds a fix to globally invalidate a isConcatSpreadable_protector.

Drive-by-fix: use named accessors for context variables

LOG=N
BUG=chromium:542504, v8:903

Review-Url: https://codereview.chromium.org/1409123003
Cr-Commit-Position: refs/heads/master@{#36201}
2016-05-12 08:52:36 +00:00
mstarzinger
32049620d2 [compiler] Pass inlining_id via relocation info.
This passes the inlining_id of deoptimization points via the relocation
info instead of via a side-channel to the CPU profiler. This is one step
towards deprecating the side-channel in question and avoid the need for
performing a lookup of the return address of the deopt point.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1956693002
Cr-Commit-Position: refs/heads/master@{#36177}
2016-05-11 14:06:38 +00:00
ishell
e17a283f92 [es6] Properly handle the case when an inlined getter/setter/constructor does a tail call.
Deoptimizer is now able to reconstruct topmost accessor and constructor frames.

BUG=chromium:608278, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1936043002
Cr-Commit-Position: refs/heads/master@{#36075}
2016-05-06 12:37:13 +00:00
mstarzinger
85572b0189 [deoptimizer] Remove obsolete DeoptInfo::mnemonic field.
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1945363002
Cr-Commit-Position: refs/heads/master@{#36069}
2016-05-06 10:04:50 +00:00
mlippautz
45f52fcb60 Reland of "[heap] Uncommit pooled pages concurrently"
- Move the concurrent unmapping to MemoryAllocator
- Hide (private) members where possible
- MemoryAllocator:Free is now the bottleneck for freeing
- Pooled pages are either allocated from a set of pooled pages are obtained
  through work stealing from the concurrent unmapper

BUG=chromium:605866, chromium:581412
LOG=N

This reverts commit 25ff296c4c.

Review-Url: https://codereview.chromium.org/1929503002
Cr-Commit-Position: refs/heads/master@{#35910}
2016-04-29 14:28:18 +00:00
hablich
25ff296c4c Revert of [heap] Uncommit pooled pages concurrently (patchset #5 id:120001 of https://codereview.chromium.org/1913083002/ )
Reason for revert:
Creates a spike of OOM(v8) crashers on Win32.

Original issue's description:
> [heap] Uncommit pooled pages concurrently
>
> - Move the concurrent unmapping to MemoryAllocator
> - Hide (private) members where possible
> - MemoryAllocator:Free is now the bottleneck for freeing
> - Pooled pages are either allocated from a set of pooled pages are obtained
>   through work stealing from the concurrent unmapper
>
> BUG=chromium:605866, chromium:581412
> LOG=N
>
> Committed: https://crrev.com/2158df87116906160cebc3ad20c97f454822da03
> Cr-Commit-Position: refs/heads/master@{#35797}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:605866, chromium:581412

Review URL: https://codereview.chromium.org/1925563003

Cr-Commit-Position: refs/heads/master@{#35819}
2016-04-27 12:40:01 +00:00
mlippautz
2158df8711 [heap] Uncommit pooled pages concurrently
- Move the concurrent unmapping to MemoryAllocator
- Hide (private) members where possible
- MemoryAllocator:Free is now the bottleneck for freeing
- Pooled pages are either allocated from a set of pooled pages are obtained
  through work stealing from the concurrent unmapper

BUG=chromium:605866, chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1913083002

Cr-Commit-Position: refs/heads/master@{#35797}
2016-04-26 16:45:40 +00:00
jarin
fcbe95c8dc Introduce approximate mode for StandardFrame::Summarize.
The approximate mode enables taking an approximate stack trace from GC,
where the top frames might be missing if inlined. Note that in that case,
the frame summary will refer to optimized code, so it will not be possible
to take source position. (The user of the summary will have to handle the
case frame_summary.abstract_code()->kind() == AbstractCode::OPTIMIZED_CODE
specially.)

Review URL: https://codereview.chromium.org/1907443002

Cr-Commit-Position: refs/heads/master@{#35728}
2016-04-22 12:39:00 +00:00
ishell
b4dbb2f710 [deoptimizer] Do not modify stack_fp which is used as a key for lookup of previously materialized objects.
BUG=chromium:604680, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1904663003

Cr-Commit-Position: refs/heads/master@{#35693}
2016-04-21 09:54:33 +00:00
ishell
26c480d13c [deoptimizer] Extend assert to also expect kTailCallerFunction as bottommost frame when accessing arguments for inlined function.
BUG=chromium:601617, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1876753002

Cr-Commit-Position: refs/heads/master@{#35385}
2016-04-11 12:20:37 +00:00
bmeurer
974721c661 [generators] Decouple generator resume from fullcodegen.
Introduce a ResumeGeneratorTrampoline, which does the actual stack state
reconstruction (currently always restores a fullcodegen frame), and
introduce appropriate TurboFan builtins for %GeneratorPrototype%.next,
%GeneratorPrototype%.return and %GeneratorPrototype%.throw based on
this native builtin.

Also unify the flooding in case of step-in to always work based on
JSFunction and remove the special casing for JSGeneratorObject.

R=mstarzinger@chromium.org, neis@chromium.org
TBR=rossberg@chromium.org
BUG=chromium:513471
LOG=n

Review URL: https://codereview.chromium.org/1865833002

Cr-Commit-Position: refs/heads/master@{#35283}
2016-04-06 08:39:24 +00:00
ishell
792bf2a093 [crankshaft] Fix environment handling after leaving inlined tail call.
BUG=chromium:537444, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1859763005

Cr-Commit-Position: refs/heads/master@{#35253}
2016-04-05 09:43:56 +00:00
jochen
cb7aa79b12 Expose a lower bound of malloc'd memory via heap statistics
We expect that the majority of malloc'd memory held by V8 is allocated
in Zone objects. Introduce an Allocator class that is used by Zones to
manage memory, and allows for querying the current usage.

BUG=none
R=titzer@chromium.org,bmeurer@chromium.org,jarin@chromium.org
LOG=n
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1847543002

Cr-Commit-Position: refs/heads/master@{#35196}
2016-04-01 10:01:56 +00:00
ishell
dd0e6ca04c [deoptimizer] Removed asserts that do not hold in case of tail call elimination.
These checks can fail if there bottommost function is a tail caller and the next function has different number of arguments than the bottommost one.

BUG=chromium:593697,v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1785253003

Cr-Commit-Position: refs/heads/master@{#34718}
2016-03-11 12:32:54 +00:00
mbrandy
01589fe708 Fix "[turbofan] [deoptimizer] Support inlining of ES6 tail calls" for embedded constant pools.
Correct handling of the bottom frame in DoComputeArgumentsAdaptorFrame.

R=ishell@chromium.org, jarin@chromium.org, michael_dawson@ca.ibm.com
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1784633002

Cr-Commit-Position: refs/heads/master@{#34681}
2016-03-10 15:07:00 +00:00
ishell
c29a4560bb [turbofan] [deoptimizer] Support inlining of ES6 tail calls.
In case when F was called with incompatible number of arguments (and therefore
the arguments adator frame was created), F inlines a tail call of G which then
deopts the deoptimizer should also remove the arguments adaptor frame for F.

This CL adds required machinery to the deoptimizer.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1768263004

Cr-Commit-Position: refs/heads/master@{#34610}
2016-03-09 11:35:37 +00:00
mythria
01f603d2b2 [Interpreter] Fixes translation from bailout id to code offset.
BailoutId points to the next bytecode in the bytecode array. Code offset
is set to one less than the bail out id. This would point to the end of the
current instruction. Since we use it only for summarizing the frame and to
compute the source position, it should be safe to set it to the end of current
instruction.

BUG=v8:4280, v8:4689
LOG=N

Review URL: https://codereview.chromium.org/1763783003

Cr-Commit-Position: refs/heads/master@{#34580}
2016-03-08 12:09:11 +00:00
danno
9dcd0857d6 [runtime] Unify and simplify how frames are marked
Before this CL, various code stubs used different techniques
for marking their frames to enable stack-crawling and other
access to data in the frame. All of them were based on a abuse
of the "standard" frame representation, e.g. storing the a
context pointer immediately below the frame's fp, and a
function pointer after that. Although functional, this approach
tends to make stubs and builtins do an awkward, unnecessary
dance to appear like standard frames, even if they have
nothing to do with JavaScript execution.

This CL attempts to improve this by:

* Ensuring that there are only two fundamentally different
  types of frames, a "standard" frame and a "typed" frame.
  Standard frames, as before, contain both a context and
  function pointer. Typed frames contain only a minimum
  of a smi marker in the position immediately below the fp
  where the context is in standard frames.
* Only interpreted, full codegen, and optimized Crankshaft and
  TurboFan JavaScript frames use the "standard" format. All
  other frames use the type frame format with an explicit
  marker.
* Typed frames can contain one or more values below the
  type marker. There is new magic macro machinery in
  frames.h that simplifies defining the offsets of these fields
  in typed frames.
* A new flag in the CallDescriptor enables specifying whether
  a frame is a standard frame or a typed frame. Secondary
  register location spilling is now only enabled for standard
  frames.
* A zillion places in the code have been updated to deal with
  the fact that most code stubs and internal frames use the
  typed frame format. This includes changes in the
  deoptimizer, debugger, and liveedit.
* StandardFrameConstants::kMarkerOffset is deprecated,
  (CommonFrameConstants::kContextOrFrameTypeOffset
  and StandardFrameConstants::kFrameOffset are now used
  in its stead).

LOG=N

Review URL: https://codereview.chromium.org/1696043002

Cr-Commit-Position: refs/heads/master@{#34571}
2016-03-08 08:36:36 +00:00
ishell
a917319a46 [deoptimizer] Simplify handling of bottommost output frames.
This is a prerequisite for teaching deoptimizer to drop possible arguments adapter frame below current input frame which is needed to support tail call inlining.

Review URL: https://codereview.chromium.org/1761303002

Cr-Commit-Position: refs/heads/master@{#34533}
2016-03-07 12:19:35 +00:00
jarin
c534201e8d Remove the unused DEBUGGER bailout type.
Review URL: https://codereview.chromium.org/1772563002

Cr-Commit-Position: refs/heads/master@{#34518}
2016-03-07 08:19:27 +00:00
ishell
e982f95023 [deoptimizer] Removed dynamic frame alignment support.
The support was already removed from the Crankshaft and this CL removes the last piece.

Review URL: https://codereview.chromium.org/1764593002

Cr-Commit-Position: refs/heads/master@{#34456}
2016-03-03 07:01:42 +00:00
danno
55071954bc More simplification and unification of frame handling
Frame slots indexes numbers are used more consistently for
computation in both TurboFan and Crankshaft. Specifically,
Crankshaft now uses frame slot indexes in LChunk, removing
the need for some special-case maths when building the
deoptimization translation table.

LOG=N
R=mstarzinger@chromium.org

Committed: https://crrev.com/81423b84dbb2eaf7e1a57b0f6029fc8e643b4755
Cr-Commit-Position: refs/heads/master@{#34078}

Review URL: https://codereview.chromium.org/1702593002

Cr-Commit-Position: refs/heads/master@{#34114}
2016-02-18 12:52:03 +00:00
rmcilroy
9a26c1aee2 [Interpreter] Fix deopt when accumulator needs to be materialized.
Moves the accumulator value on-heap to be restored in the
InterpreterNotifyDeopt handler rather than explicitly
setting the accumulator register. This allows it to be
materialized correctly if required.

BUG=v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1707133003

Cr-Commit-Position: refs/heads/master@{#34113}
2016-02-18 12:50:38 +00:00
fmeawad
c6279388c7 Split the TRACE_EVENTs from the LOG/HistogramTimers/TimerEvents functionality.
This CL adds a TRACE_EVENT where there is an isolated LOG, a HistogramTimer
or a TimerEvent.

Once we have a d8 tracing controller, all TimerEvents will be removed since
they do not provide an added value over TRACE_EVENTs. HistogramTimers will
remain, but their functionality will be limited to Histograms only.

BUG=v8:4562
LOG=N

Review URL: https://codereview.chromium.org/1707563002

Cr-Commit-Position: refs/heads/master@{#34099}
2016-02-18 06:13:33 +00:00
rmcilroy
8218fc4686 [Interpreter] Add support for getting inlined functions from interpreted frames.
BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1700143002

Cr-Commit-Position: refs/heads/master@{#34058}
2016-02-17 08:26:07 +00:00
rmcilroy
27204d6e05 [Interpreter] Push BytecodeArray onto interpreted stack frames.
Replaces the push of the dispatch table on the interpreted stack frame with a
push of the bytecode array. This enables the debugger to replace the bytecode
array with a patched version containing breakpoints.

BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1699013002

Cr-Commit-Position: refs/heads/master@{#34032}
2016-02-16 12:36:16 +00:00
danno
3aa2dd34f7 Use explicit context translation in CodeStub deoptimization
Before this CL, the context of the parent frame was used when deoptimizing a
stub failure rather than the context value passed to the stub itself. In order
to guarantee that the right context is passed to the runtime upon stub failure,
this CL adds the context explicitly to the stub's environment that's used to
compute the failure deoptimizing translations. The context can then be extracted
during deoptimization translation to ensure that the precise context that was
passed to the stub is also passed to the runtime.

R=jarin@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1694183003

Cr-Commit-Position: refs/heads/master@{#34030}
2016-02-16 11:48:13 +00:00
cbruni
8eb09facb5 [counters] adding more counters and trace-events
V8 tracks already most useful information, but lacks proper tracing scopes
that make it possible to distinguish certain events from each other.
- add trace-scope to track lazy-parsing due to optimization
- add trace-scope to track code optimization

BUG=

Review URL: https://codereview.chromium.org/1661883003

Cr-Commit-Position: refs/heads/master@{#34002}
2016-02-15 17:29:32 +00:00
jarin
5418896400 Make the frame inspector use TranslatedState rather than the full deoptimizer.
This is mostly preparation for allowing the function closure to be materialized.

As a drive-by fix, I have added ignition source position support to the frame inspector (this fixed some ignition test failures).

Review URL: https://codereview.chromium.org/1698743002

Cr-Commit-Position: refs/heads/master@{#33975}
2016-02-15 07:36:57 +00:00
titzer
54404c4731 Clean up some random TODO(titzer)s and spelling mistakes.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1698473003

Cr-Commit-Position: refs/heads/master@{#33955}
2016-02-12 17:30:20 +00:00
jarin
ab3b3bec86 [turbofan] Unwind and jump to the catch handler in the deoptimizer.
The idea here is to perform the handler lookup in the deoptimizer, and then take the information from the handler table to build the catch handler frame in the deoptimizer. Specifically, we use the pc offset, context location and stack height (in full-code) to tweak the output frame.

Sadly, this still requires nasty voodoo for the liveness analyzer so that it keeps variables alive if they are used in the catch handler.

Review URL: https://codereview.chromium.org/1416543006

Cr-Commit-Position: refs/heads/master@{#33936}
2016-02-12 10:15:32 +00:00
jarin
c0198937d8 Handlify DeoptimizedFrameInfo, remove custom GC iteration.
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1695433002

Cr-Commit-Position: refs/heads/master@{#33926}
2016-02-12 05:50:23 +00:00
rmcilroy
a2935d63df [Interpreter] Save and restore dispatch table pointer during calls.
Saves and restores the dispatch pointer during calls to enable the debugger to
switch the dispatch table used by a function during it's execution.

Also moves the accumulator and context nodes to be Variables so that they will
be properly merged across branches.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1684073002

Cr-Commit-Position: refs/heads/master@{#33894}
2016-02-11 13:11:07 +00:00
jarin
9dd5fe296b Use SharedFunctionInfo rather than the JSFunction in the deoptimizer (first step).
This removes uses of JSFunction by the (proper) deoptimizer. This will be useful
when we escape analyze JSFunction away. Unfortunately, the debugger still needs
JSFunction, so escape analysis would not work yet.

Review URL: https://codereview.chromium.org/1686183003

Cr-Commit-Position: refs/heads/master@{#33891}
2016-02-11 12:03:55 +00:00
jarin
6de51c4dc7 Remove the JS_FRAME_FUNCTION deoptimizer translation.
JS_FRAME_FUNCTION can be expressed using the STACK_SLOT translation.

Review URL: https://codereview.chromium.org/1688023003

Cr-Commit-Position: refs/heads/master@{#33882}
2016-02-11 08:25:04 +00:00
bmeurer
f6db05660e [builtins] Remove bunch of uses of %_Arguments and %_ArgumentsLength.
There are a bunch of places in our builtins where we use %_Arguments and
%_ArgumentsLength for no good reason, as arguments object and/or rest
parameter is as good and performant in these cases. Now the only uses
of %_Arguments and %_ArgumentsLength left are in string.js, which
requires dedicated investigation.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg
R=yangguo@chromium.org

Committed: https://crrev.com/2160429fd458e3c095475e718c97f77ac90d906f
Cr-Commit-Position: refs/heads/master@{#33834}

Review URL: https://codereview.chromium.org/1678953004

Cr-Commit-Position: refs/heads/master@{#33881}
2016-02-11 07:13:15 +00:00
yangguo
55438d6084 [interpreter, debugger] abstraction for source position calculation.
This change adds AbstractCode, which can be either Code or
BytecodeArray, and adds methods to calculate source position based
on that. Also cleans up to use code offsets instead of raw PC
where possible, and consistently uses the offset from instruction
start (as opposed to code object start).

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1618343002

Cr-Commit-Position: refs/heads/master@{#33579}
2016-01-28 12:12:29 +00:00
rmcilroy
32eade634f [Interpreter] Fix deopting from inline functions.
Rename IntepreterExceptionEntryHandler builtin to InterpreterEnterBytecodeDispatch
and use it as the return address when building interpreter frames during deopt.
This ensures that we restart execution of the outer frame at the correct
bytecode.

BUG=v8:4280,v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1633633002

Cr-Commit-Position: refs/heads/master@{#33512}
2016-01-26 12:23:02 +00:00
sigurds
b5a34b3d29 [turbofan] Make context deoptmizable
Escape analysis will eliminate the context, if possible. Materialization
must then ensure that the materialized object has the right map, and that
the context register is set accordingly.

R=jarin@chromium.org
BUG=569530,v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1572293002

Cr-Commit-Position: refs/heads/master@{#33201}
2016-01-11 12:48:13 +00:00
sigurds
3b473d7aad [turbofan] Deopt support for escape analysis
Deopt support is added on two levels. On the IR level,
a new ObjectState node is added, which represenents an
object to be materialized. ObjectState nodes appear as
inputs of FrameState and StateValues nodes. On the
instruction select/code-generation level, the
FrameStateDescriptor class handles the nesting
introduced by ObjectState, and ensures that deopt code
with CAPTURED_OBJECT/DUPLICATED_OBJECT entries are
generated similarly to what crankshaft's escape
analysis does.

Two unittests test correctness of the IR level implementation.

Correctness for instruction selection / code generation
is tested by mjsunit tests.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1485183002

Cr-Commit-Position: refs/heads/master@{#33115}
2016-01-05 13:31:02 +00:00
rmcilroy
b10d24ff2c [Interpreter] Add basic deoptimization support from TurboFan to Ignition.
Adds support for generating deoptimization translations for interpreter
stack frames, and building interpreter frames for these translations
when a function deopts. Also adds builtins for
InterpreterNotifyDeoptimized which resume the function's continuation at
the correct point in the interpreter after deopt.

MIPS patch contributed by balazs.kilvady@igmtec.com

BUG=v8:4280
LOG=N
TEST=test-deoptimization.cc with --ignition and --turbo

Review URL: https://codereview.chromium.org/1528913003

Cr-Commit-Position: refs/heads/master@{#32971}
2015-12-18 18:35:00 +00:00
mstarzinger
eaa0e59611 Remove new.target value from construct stub frames.
This drops the specific slot containing the new.target value from our
construct stub frames. This side-channel has been deprecated and will
no longer be accessed by any consumers.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1489353004

Cr-Commit-Position: refs/heads/master@{#32550}
2015-12-03 11:33:39 +00:00
rossberg
199bbdb40f Create ast/ and parsing/ subdirectories and move appropriate files
Moves all files related to AST and scopes into ast/,
and all files related to scanner & parser to parsing/.

Also eliminates a couple of spurious dependencies.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1481613002

Cr-Commit-Position: refs/heads/master@{#32351}
2015-11-26 16:23:07 +00:00
jochen
aa9cfc8222 Make whether or not a Code object should be created by masm explicit
We always want to have an Isolate, so just use an extra ctor arg

BUG=2487
R=yangguo@chromium.org,mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1476763002

Cr-Commit-Position: refs/heads/master@{#32277}
2015-11-25 14:23:56 +00:00
verwaest
07c1d181e7 Rename original constructor to new target
BUG=

Review URL: https://codereview.chromium.org/1442643009

Cr-Commit-Position: refs/heads/master@{#32023}
2015-11-17 08:21:32 +00:00
jarin
673baa3cf4 [deoptimizer] Remove unused function argument.
Review URL: https://codereview.chromium.org/1439583002

Cr-Commit-Position: refs/heads/master@{#31940}
2015-11-11 10:45:37 +00:00
jarin
aea89b93d2 [deoptimizer] Fixes to printing, remove unused parameters.
Review URL: https://codereview.chromium.org/1425143008

Cr-Commit-Position: refs/heads/master@{#31870}
2015-11-09 06:08:13 +00:00
bmeurer
d08f9045a1 [turbofan] Introduce simplified NumberBitwise{Or,Xor,And} operators.
Currently we still (mis)used some machine operators in typed lowering
(namely Word32Or, Word32Xor and Word32And). But these operators are
"polymorphic" in the signedness of their inputs and output, hence the
representation selection (and thereby simplified lowering) was unable to
figure out whether a bitwise operation that was seen would produce an
unsigned or a signed result. If such nodes also have frame state uses,
the only safe choice was float64, which was not only a lot less ideal,
but also the main cause of the for-in related deoptimizer loops.

Adding dedicated NumberBitwiseOr, NumberBitwiseAnd and NumberBitwiseXor
simplified operators not only gives us precise (and correct) typing for
the bitwise operations, but also allows us to actually verify the graph
properly after typed lowering.

Drive-by-fix: Remove the double-to-smi magic from the Deoptimizer, which
is responsible for various deopt-loops in TurboFan, and is no longer
needed with the addition of the NumberBitwise operators.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1422213002

Cr-Commit-Position: refs/heads/master@{#31594}
2015-10-27 09:08:19 +00:00
danno
5cf1c0bcf6 Re-reland: Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
Cr-Commit-Position: refs/heads/master@{#30913}

Committed: https://crrev.com/7b7a8205d9a00c678fb7a6e032a55fecbc1509cf
Cr-Commit-Position: refs/heads/master@{#31075}

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#31087}
2015-10-02 16:55:22 +00:00
danno
00e07b0057 Revert of Reland: Remove register index/code indirection (patchset #20 id:380001 of https://codereview.chromium.org/1287383003/ )
Reason for revert:
Failures on MIPS

Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
>   so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
>   different platforms is now shared.
> * The list of allocatable registers on each platform is declared
>   as a list rather than implicitly via the register index <->
>   code mapping.
>
> Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}
>
> Committed: https://crrev.com/7b7a8205d9a00c678fb7a6e032a55fecbc1509cf
> Cr-Commit-Position: refs/heads/master@{#31075}

TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1380863004

Cr-Commit-Position: refs/heads/master@{#31083}
2015-10-02 15:37:06 +00:00
danno
7b7a8205d9 Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
Cr-Commit-Position: refs/heads/master@{#30913}

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#31075}
2015-10-02 13:59:06 +00:00
alph
e0606c9f00 Move heap and CPU profilers into a dedicated directory.
Drive-by: remove unnecessary includes.

Review URL: https://codereview.chromium.org/1356223004

Cr-Commit-Position: refs/heads/master@{#30987}
2015-09-28 19:34:18 +00:00
danno
3ac27431a9 Revert of Remove register index/code indirection (patchset #17 id:320001 of https://codereview.chromium.org/1287383003/ )
Reason for revert:
Failures on greedy RegAlloc, Fuzzer

Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
>   so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
>   different platforms is now shared.
> * The list of allocatable registers on each platform is declared
>   as a list rather than implicitly via the register index <->
>   code mapping.
>
> Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}

TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1365073002

Cr-Commit-Position: refs/heads/master@{#30914}
2015-09-24 13:39:03 +00:00
danno
80bc6f6e11 Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#30913}
2015-09-24 12:53:13 +00:00
mlippautz
9fc4fc141f Make FlushICache part of Assembler(Base) and take Isolate as parameter.
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1332283002

Cr-Commit-Position: refs/heads/master@{#30695}
2015-09-11 12:59:47 +00:00
mstarzinger
8d54fc2e87 [heap] Limit friendship of the Heap class to essentials.
This makes it clear that only components within the "heap" directory
should be friends with the Heap class. The two notable exceptions are
Factory and Isolate which represent external interfaces into the heap.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1320843002

Cr-Commit-Position: refs/heads/master@{#30408}
2015-08-27 12:30:15 +00:00
rmcilroy
53ac9fe8f9 Add CompileInfo::GetDebugName()
Replaces all instances of the code which computed the debug
name of a stub or function with calls to CompileInfo::GetDebugName instead.

Also:
  - Removes useless parameter on CodeStub::GetMajorName
  - Removes FakeStubForTesting since it is no longer required
  - Adds CompileInfo::ShouldEnsureSpaceForLazyDeopt() to replace unclear calls to IsStub().

Review URL: https://codereview.chromium.org/1297203002

Cr-Commit-Position: refs/heads/master@{#30324}
2015-08-24 10:23:55 +00:00
mstarzinger
98a0fe0f32 Remove grab-bag includes of v8.h from everywhere.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1285183010

Cr-Commit-Position: refs/heads/master@{#30263}
2015-08-20 07:44:15 +00:00
danno
cbbaf9ea6a [turbofan] Unify referencing of stack slots
Previously, it was not possible to specify StackSlotOperands for all
slots in both the caller and callee stacks. Specifically, the region
of the callee's stack including the saved return address, frame
pointer, function pointer and context pointer could not be addressed
by the register allocator/gap resolver.

In preparation for better tail call support, which will use the gap
resolver to reconcile outgoing parameters, this change makes it
possible to address all slots on the stack, because slots in the
previously inaccessible dead zone may become parameter slots for
outgoing tail calls. All caller stack slots are accessible as they
were before, with slot -1 corresponding to the last stack
parameter. Stack slot indices >= 0 access the callee stack, with slot
0 corresponding to the callee's saved return address, 1 corresponding
to the saved frame pointer, 2 corresponding to the current function
context, 3 corresponding to the frame marker/JSFunction, and slots 4
and above corresponding to spill slots.

The following changes were specifically	needed:

* Frame	has been changed to explicitly manage three areas of the
  callee frame, the fixed header, the spill slot area, and the
  callee-saved register area.
* Conversions from stack slot indices to fp offsets all now go through
  a common bottleneck: OptimizedFrame::StackSlotOffsetRelativeToFp
* The generation of deoptimization translation tables has been changed
  to support the new stack slot indexing scheme. Crankshaft, which
  doesn't support the new slot numbering in its register allocator,
  must adapt the indexes when creating translation tables.
* Callee-saved parameters are now kept below spill slots, not above,
  to support saving only the optimal set of used registers, which is
  only known after register allocation is finished and spill slots
  have been allocated.

Review URL: https://codereview.chromium.org/1261923007

Cr-Commit-Position: refs/heads/master@{#30224}
2015-08-18 14:48:11 +00:00
mstarzinger
19a49abf02 Realize IWYU pattern for frames-inl.h header.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1283183002

Cr-Commit-Position: refs/heads/master@{#30127}
2015-08-12 10:28:47 +00:00
jarin
156a155be3 [deoptimizer] Fix the frame size calculation for debugger-inspectable frame construction.
The calculation now takes into account the size of the arguments object
if it is present in the optimized frame.

(Yang, many thanks for the awesome repro!)

BUG=chromium:514362
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1264483008

Cr-Commit-Position: refs/heads/master@{#29973}
2015-08-03 12:59:59 +00:00
jarin
f8dcbf4695 [deoptimizer] Do not pass arguments markers to the debugger.
This fixes a bug introduced by r28826 (Unify decoding of deoptimization
translations, https://codereview.chromium.org/1136223004), where we
started leaking arguments marker sentinel to the debugger, which would
then cause crashes. This change replaces the sentinel with the undefined
value in the debugger-inspectable frame.

BUG=chromium:514362
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1263333002

Cr-Commit-Position: refs/heads/master@{#29971}
2015-08-03 10:43:31 +00:00
yangguo
3be39a24bf Move Full-codegen into its own folder.
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1248443003

Cr-Commit-Position: refs/heads/master@{#29840}
2015-07-24 10:11:57 +00:00
mvstanton
3334b830a5 HydrogenCodeStubs consume stack arguments via descriptor.
All of this is controlled by the CallDescriptor. It's simply the case
that if you specify less registers than the function arity calls for,
the rest are assumed to be on the stack.

Bailout handlers accept these constant stack arguments too.

BUG=

Review URL: https://codereview.chromium.org/1250563004

Cr-Commit-Position: refs/heads/master@{#29813}
2015-07-23 14:00:15 +00:00
hpayer
4829bbc5d1 Revert "Directly remove slot buffer entries in deoptimized code objects."
This reverts commit 80b3f16951.

Revert "Record code slots that may point to evacuation candidate objects after deoptimizing them."

This reverts commit 4621210cfe.

BUG=chromium:507840
LOG=n

Review URL: https://codereview.chromium.org/1239383004

Cr-Commit-Position: refs/heads/master@{#29778}
2015-07-21 16:14:44 +00:00
mlippautz
3285e3bf07 Fix memento initialization when constructing from new call
Additionally, push the allocation site or undefined independently of creating a memento to preserve a fixed size for the construct frames.

BUG=

Review URL: https://codereview.chromium.org/1239593003

Cr-Commit-Position: refs/heads/master@{#29719}
2015-07-17 08:51:41 +00:00
rmcilroy
d02f62484e Move SmartPointer to base.
Review URL: https://codereview.chromium.org/1221433021

Cr-Commit-Position: refs/heads/master@{#29604}
2015-07-13 12:38:17 +00:00
mstarzinger
2027335f1c Remove unused byte from Map::instance_sizes field.
Note that there are currently no objects that require a pre-allocated
properties backing store, all such slots are in-object properties from
the begining. Hence {unused + pre_allocated - inobject == 0} holds.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1226203011

Cr-Commit-Position: refs/heads/master@{#29590}
2015-07-13 08:26:36 +00:00
mstarzinger
e50c861b09 Remove separate construct stub for new.target users.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1213623020

Cr-Commit-Position: refs/heads/master@{#29562}
2015-07-10 08:50:33 +00:00
hpayer
4621210cfe Record code slots that may point to evacuation candidate objects after deoptimizing them.
BUG=chromium:506811
LOG=n

Review URL: https://codereview.chromium.org/1225573002

Cr-Commit-Position: refs/heads/master@{#29466}
2015-07-03 12:13:57 +00:00
ishell
3997ae1b46 Remove deprecated v8::Object::TurnOnAccessCheck() from the V8 API.
The only right way to enable access checks is to install access check callbacks on an object template via v8::ObjectTemplate::SetAccessCheckCallbacks(). It does not make sense to enable access checks on an arbitrary object.

Review URL: https://codereview.chromium.org/1217893012

Cr-Commit-Position: refs/heads/master@{#29439}
2015-07-02 09:05:48 +00:00
danno
7015fd2053 Make context register implicit for CallInterfaceDescriptors
Up until now the context register was listed explicitly in each stub's
CallInterfaceDescriptor. This was problematic, because it was listed
first in the list of register parameters--which is fine for Crankshaft,
which is more or less built to handle the context as the first
parameter-- but not ideal for TurboFan, which adds the context at
the end of all function parameters. Now the context register is no
longer in the register list and can be handled appropriately by both
compilers. Specifically, this allows the FunctionType specified for
each CallInterfaceDescriptor to exactly match the parameter register
list.

Review URL: https://codereview.chromium.org/1211333003

Cr-Commit-Position: refs/heads/master@{#29402}
2015-07-01 08:45:12 +00:00
hpayer
80b3f16951 Directly remove slot buffer entries in deoptimized code objects.
BUG=

Review URL: https://codereview.chromium.org/1221643004

Cr-Commit-Position: refs/heads/master@{#29379}
2015-06-30 13:32:13 +00:00
arv
876ae42598 Unify the stack layout for construct frames
The stack layout was different for different ports.

BUG=v8:3887
LOG=N
R=dslomov@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1203103003

Cr-Commit-Position: refs/heads/master@{#29292}
2015-06-25 12:52:36 +00:00
balazs.kilvady
0acc511e62 MIPS: Fix unaligned memory access.
On MIPS32 we can't read a 8 bytes long data from a not 8 bytes aligned memory address.

BUG=
TEST=mjsunit/debug-backtrace

Review URL: https://codereview.chromium.org/1193433002

Cr-Commit-Position: refs/heads/master@{#29100}
2015-06-18 07:01:38 +00:00
jarin
ed977c972e Fix debug printing of inputs in the deoptimizer, pull out printing into separate methods.
Also fixed the duplicated output of context deopt.

BUG=

Review URL: https://codereview.chromium.org/1187533002

Cr-Commit-Position: refs/heads/master@{#29019}
2015-06-15 10:14:40 +00:00
bmeurer
cf21da7e48 [deoptimizer] Basic support inlining based on SharedFunctionInfo.
Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1169103004

Cr-Commit-Position: refs/heads/master@{#28906}
2015-06-10 11:52:49 +00:00
bmeurer
e044f0a67e [deoptimizer] Remove uses of TranslationIterator outside the deoptimizer.
Use the new TranslatedState and friends, which work at a higher level
than the TranslationIterator, which will make it easier to change the
deoptimization commands in subsequent CLs.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1166353004

Cr-Commit-Position: refs/heads/master@{#28862}
2015-06-09 13:10:16 +00:00
paul.lind
b9588a1d7b Fix another -Wsign-compare issue for GCC 4.9.2
BUG=

Review URL: https://codereview.chromium.org/1151523014

Cr-Commit-Position: refs/heads/master@{#28853}
2015-06-09 06:12:57 +00:00
jarin
9127d4eef4 Unify decoding of deoptimization translations.
This unifies methods Deoptimizer::DoTranslateCommand, Deotpimizer::DoTranslateObject and the arguments object materializer.

To unify these, we have to separate reading of the input frame from writing to the output frame because the argument materializer does not write to output frames.

Instead, we now deoptimize in following stages:

1. Read out the input frame/registers, decode them using the translations from the deoptimizer and store them in the deoptimizer (Deoptimizer::translated_state_). This is done in TranslatedState::Init.

2. Write out into the output frame buffer all the values that do not require allocation. We also remember references to the values that require materialization. As before, this is done in Deoptimizer::DoCompute*Frame method, but instead calling to DoTranslateCommand, we use the translated frame to obtain the values and write them to the output frames.

3. The platform specific code then sets up the output frames and calls into the deoptimization notification. This has not been changed at all.

4. Once the stack is setup, we handlify all the references in the saved translated values (TranslatedState::Prepare).

5. Finally, we materialize all the values we remembered in step (1) and write them to their frames on the stack (using the TranslatedValue::GetValue method).

BUG=

Review URL: https://codereview.chromium.org/1136223004

Cr-Commit-Position: refs/heads/master@{#28826}
2015-06-08 10:04:56 +00:00
mbrandy
eac7f04669 Add support for Embedded Constant Pools for PPC and Arm
Embed constant pools within their corresponding Code
objects.

This removes support for out-of-line constant pools in favor
of the new approach -- the main advantage being that it
eliminates the need to allocate and manage separate constant
pool array objects.

Currently supported on PPC and ARM.  Enabled by default on
PPC only.

This yields a 6% improvment in Octane on PPC64.

R=bmeurer@chromium.org, rmcilroy@chromium.org, michael_dawson@ca.ibm.com
BUG=chromium:478811
LOG=Y

Review URL: https://codereview.chromium.org/1162993006

Cr-Commit-Position: refs/heads/master@{#28801}
2015-06-04 14:44:15 +00:00
bmeurer
51439db3b2 Revert of Embedded constant pools. (patchset #12 id:220001 of https://codereview.chromium.org/1131783003/)
Reason for revert:
Breaks Linux nosnap cctest/test-api/FastReturnValuesWithProfiler, see http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/609/steps/Check/logs/FastReturnValuesWithP..

Original issue's description:
> Add support for Embedded Constant Pools for PPC and Arm
>
> Embed constant pools within their corresponding Code
> objects.
>
> This removes support for out-of-line constant pools in favor
> of the new approach -- the main advantage being that it
> eliminates the need to allocate and manage separate constant
> pool array objects.
>
> Currently supported on PPC and ARM.  Enabled by default on
> PPC only.
>
> This yields a 6% improvment in Octane on PPC64.
>
> R=danno@chromium.org, svenpanne@chromium.org, bmeurer@chromium.org, rmcilroy@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
> BUG=chromium:478811
> LOG=Y
>
> Committed: https://crrev.com/a9404029343d65f146e3443f5280c40a97e736af
> Cr-Commit-Position: refs/heads/master@{#28770}

TBR=rmcilroy@chromium.org,ishell@chromium.org,rodolph.perfetta@arm.com,mbrandy@us.ibm.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:478811

Review URL: https://codereview.chromium.org/1155703006

Cr-Commit-Position: refs/heads/master@{#28772}
2015-06-03 03:02:40 +00:00
mbrandy
a940402934 Add support for Embedded Constant Pools for PPC and Arm
Embed constant pools within their corresponding Code
objects.

This removes support for out-of-line constant pools in favor
of the new approach -- the main advantage being that it
eliminates the need to allocate and manage separate constant
pool array objects.

Currently supported on PPC and ARM.  Enabled by default on
PPC only.

This yields a 6% improvment in Octane on PPC64.

R=danno@chromium.org, svenpanne@chromium.org, bmeurer@chromium.org, rmcilroy@chromium.org, dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:478811
LOG=Y

Review URL: https://codereview.chromium.org/1131783003

Cr-Commit-Position: refs/heads/master@{#28770}
2015-06-02 22:50:12 +00:00
erikcorry
4f5337a2b6 Cosmetic changes to tests to make it easier to concatenate them.
When compiling on a laptop I like to concatenate the small test files.
This makes a big difference to compile times. These changes make that
easier.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1163803002

Cr-Commit-Position: refs/heads/master@{#28742}
2015-06-01 22:47:08 +00:00
hpayer
3e2fec75d2 Treat links that organize weak objects weakly.
BUG=

Review URL: https://codereview.chromium.org/1158423002

Cr-Commit-Position: refs/heads/master@{#28693}
2015-05-29 08:06:30 +00:00
bmeurer
b1e2d1e4c7 [deoptimizer] Materialize double values as smis whenever possible.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1156393002

Cr-Commit-Position: refs/heads/master@{#28675}
2015-05-28 10:31:03 +00:00
bmeurer
c9a49da0d8 [turbofan] Enable deoptimization for non-asm.js TurboFan code.
Replace the --turbo-deoptimization flag with --turbo-asm-deoptimization
and enable deoptimization for non-asm.js TurboFan code unconditionally.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1153483002

Cr-Commit-Position: refs/heads/master@{#28543}
2015-05-21 11:33:25 +00:00
hpayer
9dc99e9cc8 Get more debugging data when crashing in Deoptimizer::GetOutputInfo.
BUG=

Review URL: https://codereview.chromium.org/1138493004

Cr-Commit-Position: refs/heads/master@{#28373}
2015-05-12 15:48:06 +00:00
mvstanton
f9c46ed1bb TurboFan: commit dependencies only on update of the opt. code list.
TurboFan compilation was committing dependencies long before the
optimized function made it's way into the optimized code list for
the native context. The problem is that once the code pointer is out
there in dependency arrays, it is eligible for deopt. But the deopt
logic needs the code to be in the optimized code list to fully do it's
job.

BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1136693003

Cr-Commit-Position: refs/heads/master@{#28312}
2015-05-08 09:13:12 +00:00
jarin
b5b47e1f88 Remove materialized objects on stack unwind.
BUG=v8:3985
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1122083002

Cr-Commit-Position: refs/heads/master@{#28206}
2015-05-04 16:44:01 +00:00
wingo
09ae1c3ddc Fix -Wsign-compare bugs with GCC 4.9.2
R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1105653002

Cr-Commit-Position: refs/heads/master@{#28039}
2015-04-24 06:56:37 +00:00
jarin
aaddea11b2 Materialize booleans in the turbofan deoptimizer.
BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1055453006

Cr-Commit-Position: refs/heads/master@{#28022}
2015-04-23 08:06:55 +00:00
erikcorry
db04a5ad6f Properly report OOM when deoptimizer allocation fails
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1052823003

Cr-Commit-Position: refs/heads/master@{#27900}
2015-04-16 18:05:22 +00:00
jkummerow
e02807ee8a Fix a few potential integer negation overflows
AFAICT none of these can actually be triggered currently; but it's still good to harden the code a little.

Review URL: https://codereview.chromium.org/1058533007

Cr-Commit-Position: refs/heads/master@{#27848}
2015-04-15 13:55:21 +00:00
vegorov
021f738127 Treat HArgumentsObject as a safe use during Uint32 analysis phase.
Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}
2015-04-13 10:47:15 +00:00
loislo
66ab309e73 CpuProfiler: fix for GetDeoptReason code.
The original code always returned the first entry from RelocInfo that matched with
bailout_id. But we may have a few different deopt reasons for one bailout_id.
So we need to get the one which matches with a particular call from JumpTable.

We can do this by checking not 'target_address' (it maps to bailout_id)
but 'from' address which maps to a particular JumpTable entry.

The test was reworked so it tests identical functions against different reasons.

BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/984773003

Cr-Commit-Position: refs/heads/master@{#27076}
2015-03-09 14:43:40 +00:00
loislo
32ee9fa6ab CpuProfiler: replace raw position with SourcePosition for DeoptReason
Save Unknown position as zero in RelocInfo.
Remove copy constructor of SourcePosition because it is trivial.
Mechanical replace int raw_position with SourcePosition position.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/959203002

Cr-Commit-Position: refs/heads/master@{#26916}
2015-02-27 13:34:38 +00:00
loislo
8ba89cce6d CpuProfiler: eliminate cpu-profiler dependency from heap-inl.h
We accessed to cpu_profiler for tracking SharedFunctionInfo objects movements and used their addresses for generating function_id. Actually we could replace the manually generated shared_id by the pair script_id + position. In this case we can drop SharedFunctionInfo events support from cpu_profiler and remove the dependency.

BTW GetCallUid was used as an unique identifier of the function on the front-end side. Actually it is a hash which might not be unique. So I renamed GetCallUid with GetHash and implemented GetFunctionId method.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/941973002

Cr-Commit-Position: refs/heads/master@{#26775}
2015-02-20 13:28:58 +00:00
jarin
3f3558f365 Convert to immutable heap number when materializing arguments object.
BUG=chromium:457935
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/935623002

Cr-Commit-Position: refs/heads/master@{#26704}
2015-02-17 18:08:59 +00:00
jarin
0a4047a69b During arguments materialization, do not store materialized objects without lazy deopt.
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/919173003

Cr-Commit-Position: refs/heads/master@{#26695}
2015-02-17 15:24:34 +00:00
dslomov
bf49be39f3 new classes: implement new.target passing to superclass constructor.
R=arv@chromium.org,rossberg@chromium.org
BUG=v8:3834
LOG=N

Committed: https://crrev.com/8aed43e82c6d2742fe5988603cb8841324cc942b
Cr-Commit-Position: refs/heads/master@{#26560}

Review URL: https://codereview.chromium.org/908883002

Cr-Commit-Position: refs/heads/master@{#26572}
2015-02-11 09:47:51 +00:00
dslomov
8e4ec9dd13 Revert of new classes: implement new.target passing to superclass constructor. (patchset #9 id:150001 of https://codereview.chromium.org/908883002/)
Reason for revert:
Breaks Linux64 release

Original issue's description:
> new classes: implement new.target passing to superclass constructor.
>
> R=arv@chromium.org,rossberg@chromium.org
> BUG=v8:3834
> LOG=N
>
> Committed: https://crrev.com/8aed43e82c6d2742fe5988603cb8841324cc942b
> Cr-Commit-Position: refs/heads/master@{#26560}

TBR=arv@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3834

Review URL: https://codereview.chromium.org/911363002

Cr-Commit-Position: refs/heads/master@{#26561}
2015-02-11 01:36:32 +00:00
dslomov
8aed43e82c new classes: implement new.target passing to superclass constructor.
R=arv@chromium.org,rossberg@chromium.org
BUG=v8:3834
LOG=N

Review URL: https://codereview.chromium.org/908883002

Cr-Commit-Position: refs/heads/master@{#26560}
2015-02-11 01:23:11 +00:00
loislo
86cae1633c Propagate DeoptInfo to cpu-profiler
1) Deoptimizer::Reason was replaced with Deoptimizer::DeoptInfo
because it also has raw position. Also the old name clashes with DeoptReason enum.

2) c_entry_fp assignment call was added to EntryGenerator::Generate
So we can calculate sp and have a chance to record the stack for the deopting function.
btw it makes the test stable.

3) new kind of CodeEvents was added to cpu-profiler

4) GetDeoptInfo method was extracted from PrintDeoptLocation.
So it could be reused in cpu profiler.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/910773002

Cr-Commit-Position: refs/heads/master@{#26545}
2015-02-10 14:33:00 +00:00
loislo
2491a639bf Externalize deoptimization reasons.
1) The hardcoded strings were converted into DeoptReason enum.

2) Deopt comment were converted into a pair location and deopt reason entries so
the deopt reason tracking mode would less affect the size of the RelocInfo table and heap.

3) DeoptReason entry in RelocInfo reuses kCommentTag value and generates short entry in RelocInfo table.

BUG=452067
LOG=n

Committed: https://crrev.com/c49820e45b57f128a98690940875c049f612dde6
Cr-Commit-Position: refs/heads/master@{#26434}

Committed: https://crrev.com/ec42e002da03adb2db968dd5b7453341ddc59a5c
Cr-Commit-Position: refs/heads/master@{#26448}

Review URL: https://codereview.chromium.org/874323003

Cr-Commit-Position: refs/heads/master@{#26463}
2015-02-05 14:51:58 +00:00
bmeurer
368a503cc1 Revert of Externalize deoptimization reasons. (patchset #7 id:120001 of https://codereview.chromium.org/874323003/)
Reason for revert:
This CL breaks RelocInfo::INTERNAL_REFERENCE (and maybe others that come after DEOPT_REASON), which is currently (mostly) unused on tip-of-tree, but will be used for jump tables soon(ish) and should therefore work. It seems to be a problem with implicitly assumptions about the number of reloc info modes. Needs further investigation.

Original issue's description:
> Externalize deoptimization reasons.
>
> 1) The hardcoded strings were converted into DeoptReason enum.
>
> 2) Deopt comment were converted into a pair location and deopt reason entries so
> the deopt reason tracking mode would less affect the size of the RelocInfo table and heap.
>
> 3) DeoptReason entry in RelocInfo reuses kCommentTag value and generates short entry in RelocInfo table.
>
> BUG=452067
> LOG=n
>
> Committed: https://crrev.com/c49820e45b57f128a98690940875c049f612dde6
> Cr-Commit-Position: refs/heads/master@{#26434}
>
> Committed: https://crrev.com/ec42e002da03adb2db968dd5b7453341ddc59a5c
> Cr-Commit-Position: refs/heads/master@{#26448}

TBR=alph@chromium.org,mstarzinger@chromium.org,svenpanne@chromium.org,yurys@chromium.org,loislo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=452067

Review URL: https://codereview.chromium.org/900223002

Cr-Commit-Position: refs/heads/master@{#26457}
2015-02-05 12:03:26 +00:00
loislo
ec42e002da Externalize deoptimization reasons.
1) The hardcoded strings were converted into DeoptReason enum.

2) Deopt comment were converted into a pair location and deopt reason entries so
the deopt reason tracking mode would less affect the size of the RelocInfo table and heap.

3) DeoptReason entry in RelocInfo reuses kCommentTag value and generates short entry in RelocInfo table.

BUG=452067
LOG=n

Committed: https://crrev.com/c49820e45b57f128a98690940875c049f612dde6
Cr-Commit-Position: refs/heads/master@{#26434}

Review URL: https://codereview.chromium.org/874323003

Cr-Commit-Position: refs/heads/master@{#26448}
2015-02-05 06:25:18 +00:00
loislo
bfc5d83bd0 Revert of Externalize deoptimization reasons. (patchset #6 id:100001 of https://codereview.chromium.org/874323003/)
Reason for revert:
it broke the build

Original issue's description:
> Externalize deoptimization reasons.
>
> 1) The hardcoded strings were converted into DeoptReason enum.
>
> 2) Deopt comment were converted into a pair location and deopt reason entries so
> the deopt reason tracking mode would less affect the size of the RelocInfo table and heap.
>
> 3) DeoptReason entry in RelocInfo reuses kCommentTag value and generates short entry in RelocInfo table.
>
> BUG=452067
> LOG=n
>
> Committed: https://crrev.com/c49820e45b57f128a98690940875c049f612dde6
> Cr-Commit-Position: refs/heads/master@{#26434}

TBR=alph@chromium.org,mstarzinger@chromium.org,svenpanne@chromium.org,yurys@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=452067

Review URL: https://codereview.chromium.org/892843007

Cr-Commit-Position: refs/heads/master@{#26435}
2015-02-04 16:48:34 +00:00
loislo
c49820e45b Externalize deoptimization reasons.
1) The hardcoded strings were converted into DeoptReason enum.

2) Deopt comment were converted into a pair location and deopt reason entries so
the deopt reason tracking mode would less affect the size of the RelocInfo table and heap.

3) DeoptReason entry in RelocInfo reuses kCommentTag value and generates short entry in RelocInfo table.

BUG=452067
LOG=n

Review URL: https://codereview.chromium.org/874323003

Cr-Commit-Position: refs/heads/master@{#26434}
2015-02-04 16:35:30 +00:00
bmeurer
c65ae4f10c Reland "Initial switch to Chromium-style CHECK_* and DCHECK_* macros.".
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/877753007

Cr-Commit-Position: refs/heads/master@{#26346}
2015-01-30 09:29:41 +00:00
Benedikt Meurer
883852293a Revert "Make GCC happy again." and "Initial switch to Chromium-style CHECK_* and DCHECK_* macros.".
This reverts commit 6a4c0a3bae and commit
0deaa4b629 for breaking GCC bots.

TBR=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/893533003

Cr-Commit-Position: refs/heads/master@{#26342}
2015-01-30 07:19:57 +00:00
bmeurer
0deaa4b629 Initial switch to Chromium-style CHECK_* and DCHECK_* macros.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/888613002

Cr-Commit-Position: refs/heads/master@{#26340}
2015-01-30 06:25:36 +00:00