Commit Graph

1131 Commits

Author SHA1 Message Date
ivica.bogosavljevic
ee7281f8ff MIPS[64]: Disable fusion multiple-accumulate instructions
MIPS[64]R6 supports only fusion multiply-accumulate instructions, and using
these causes failures of several tests that expect exact floating-point
results. Therefore we disable fusion multiply-accumulate in both emitted and
compiled code on R6.

TEST=cctest/test-run-machops/RunFloat64MulAndFloat64Add1,mjsunit/es6/math-expm1.js
mjsunit/es6/math-fround.js,mjsunit/compiler/multiply-add.js

BUG=

Review-Url: https://codereview.chromium.org/2569683002
Cr-Commit-Position: refs/heads/master@{#41717}
2016-12-15 11:50:12 +00:00
ishell
02f917f7ef [interpreter][stubs] Fixing issues found by machine graph verifier.
All issues in interpreter bytecode handlers are fixed.

BUG=

Review-Url: https://codereview.chromium.org/2552883012
Cr-Commit-Position: refs/heads/master@{#41649}
2016-12-12 14:53:04 +00:00
leszeks
7b64e8d102 [ignition/turbofan] Wrap bytecode liveness bitvectors
Wrap the liveness bitvectors from the bytecode liveness analysis with a
helper class, which makes the register/accumulator bits explicit.

Review-Url: https://codereview.chromium.org/2552723004
Cr-Commit-Position: refs/heads/master@{#41589}
2016-12-08 12:48:05 +00:00
leszeks
6f6795b508 [turbofan] Re-add bytecode analysis unit test
Now that the BASE_EMBEDDED macro is gone, this should be safe.

Originally removed in: https://codereview.chromium.org/2532103004/

Review-Url: https://codereview.chromium.org/2545723002
Cr-Commit-Position: refs/heads/master@{#41480}
2016-12-05 10:48:09 +00:00
jarin
09e4a11b25 [turbofan] Improve memory consumption for state values descriptors.
Review-Url: https://codereview.chromium.org/2546113002
Cr-Commit-Position: refs/heads/master@{#41469}
2016-12-05 06:33:55 +00:00
neis
9ef7ab1e2e [compiler] Remove context value input from JSLoadContext and JSStoreContext.
JS operators always have an implicit context input, so just use that instead.

BUG=

Review-Url: https://codereview.chromium.org/2541813002
Cr-Commit-Position: refs/heads/master@{#41392}
2016-11-30 15:46:08 +00:00
titzer
a0c518627f [wasm] Add a flag --wasm-opt to test optimizations in the WASM pipeline.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2528033002
Cr-Commit-Position: refs/heads/master@{#41381}
2016-11-30 10:36:14 +00:00
leszeks
7d10f69ca3 [turbofan] Remove bytecode analysis unit test
Blocking roll: https://codereview.chromium.org/2537173002/

NOTRY=true

Review-Url: https://codereview.chromium.org/2532103004
Cr-Commit-Position: refs/heads/master@{#41376}
2016-11-30 09:04:01 +00:00
leszeks
2bf71f888f [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}
2016-11-29 12:27:15 +00:00
leszeks
a2e2a39ff1 Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset #17 id:320001 of https://codereview.chromium.org/2523893003/ )
Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}
2016-11-29 10:51:45 +00:00
leszeks
1852300954 [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}
2016-11-29 10:46:20 +00:00
marija.antic
daedefd3fc MIPS64: Port "Reland of "MIPS: Optimize load/store with large offset"".
Port 961a45da69

BUG=

Review-Url: https://codereview.chromium.org/2505923002
Cr-Commit-Position: refs/heads/master@{#41284}
2016-11-25 09:12:29 +00:00
bmeurer
9da894edcb [turbofan] Improve typed lowering rules for JSToBoolean.
Also lower JSToBoolean(x) where x is either some detectable receiver or
null, or any kind of receiver, null or undefined. Also fix a couple of
minor issues with the JSToBoolean lowering and tests.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2530773002
Cr-Commit-Position: refs/heads/master@{#41241}
2016-11-24 06:37:14 +00:00
mvstanton
3d31d25152 [Turbofan]: generic lowering can use a constant vector
Since we are specializing on the native context, we don't have to load
the vector from the closure. For one thing, this reduces the machinery for
nodes that use a vector in their generic incarnation.

BUG=
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2529463002
Cr-Commit-Position: refs/heads/master@{#41221}
2016-11-23 13:23:50 +00:00
bmeurer
241c024c10 [turbofan] Properly optimize instanceof (even in the presence of @@hasInstance).
This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}
2016-11-18 06:31:42 +00:00
ahaas
020e2c8d26 [wasm] Break a cycle with a loop node in the int64-lowering.
The control edges in a TurboFan graph can form a cycle. To break this cycle in the int64-lowering we add special handling for loop nodes. Similar handling already exists for phi nodes and effectphi nodes, which breaks cycles formed by value edges and effect edges, respectively.

Review-Url: https://codereview.chromium.org/2511503002
Cr-Commit-Position: refs/heads/master@{#41071}
2016-11-17 11:51:32 +00:00
tebbi
d2a64c817e [turbofan] track source positions in EffectControlLinearizer
R=jarin@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2504913003
Cr-Commit-Position: refs/heads/master@{#41040}
2016-11-16 15:06:58 +00:00
dusan.simicic
961a45da69 Reland of "MIPS: Optimize load/store with large offset"
Currently, we are using the following sequence for load/store
with large offset (offset > 16b):
    lui at, 0x1234
    ori at, at, 0x5678
    add at, s0, at
    lw a0, 0(at)

This sequence can be optimized in the following way:
    lui at, 0x1234
    add at, s0, at
    lw a0, 0x5678(at)

BUG=

Review-Url: https://codereview.chromium.org/2503493002
Cr-Commit-Position: refs/heads/master@{#40988}
2016-11-15 12:00:45 +00:00
dusan.simicic
b725d5a797 MIPS[64]: Port '[turbofan] Use zr to store immediate zero'
Port 0322c20d17

Original commit message:
When storing an immediate integer or floating point zero, use the zero register
as the source value. This avoids the need to sometimes allocate a new register.

BUG=

Review-Url: https://codereview.chromium.org/2470133005
Cr-Commit-Position: refs/heads/master@{#40987}
2016-11-15 11:57:28 +00:00
tebbi
c3a6ca68d0 This CL enables precise source positions for all V8 compilers. It merges compiler::SourcePosition and internal::SourcePosition to a single class used throughout the codebase. The new internal::SourcePosition instances store an id identifying an inlined function in addition to a script offset.
SourcePosition::InliningId() refers to a the new table DeoptimizationInputData::InliningPositions(), which provides the following data for every inlining id:
 - The inlined SharedFunctionInfo as an offset into DeoptimizationInfo::LiteralArray
 - The SourcePosition of the inlining. Recursively, this yields the full inlining stack.
Before the Code object is created, the same information can be found in CompilationInfo::inlined_functions().

If SourcePosition::InliningId() is SourcePosition::kNotInlined, it refers to the outer (non-inlined) function.
So every SourcePosition has full information about its inlining stack, as long as the corresponding Code object is known. The internal represenation of a source position is a positive 64bit integer.

All compilers create now appropriate source positions for inlined functions. In the case of Turbofan, this required using AstGraphBuilderWithPositions for inlined functions too. So this class is now moved to a header file.

At the moment, the additional information in source positions is only used in --trace-deopt and --code-comments. The profiler needs to be updated, at the moment it gets the correct script offsets from the deopt info, but the wrong script id from the reconstructed deopt stack, which can lead to wrong outputs. This should be resolved by making the profiler use the new inlining information for deopts.

I activated the inlined deoptimization tests in test-cpu-profiler.cc for Turbofan, changing them to a case where the deopt stack and the inlining position agree. It is currently still broken for other cases.

The following additional changes were necessary:
 - The source position table (internal::SourcePositionTableBuilder etc.) supports now 64bit source positions. Encoding source positions in a single 64bit int together with the difference encoding in the source position table results in very little overhead for the inlining id, since only 12% of the source positions in Octane have a changed inlining id.
 - The class HPositionInfo was effectively dead code and is now removed.
 - SourcePosition has new printing and information facilities, including computing a full inlining stack.
 - I had to rename compiler/source-position.{h,cc} to compiler/compiler-source-position-table.{h,cc} to avoid clashes with the new src/source-position.cc file.
 - I wrote the new wrapper PodArray for ByteArray. It is a template working with any POD-type. This is used in DeoptimizationInputData::InliningPositions().
 - I removed HInlinedFunctionInfo and HGraph::inlined_function_infos, because they were only used for the now obsolete Crankshaft inlining ids.
 - Crankshaft managed a list of inlined functions in Lithium: LChunk::inlined_functions. This is an analog structure to CompilationInfo::inlined_functions. So I removed LChunk::inlined_functions and made Crankshaft use CompilationInfo::inlined_functions instead, because this was necessary to register the offsets into the literal array in a uniform way. This is a safe change because LChunk::inlined_functions has no other uses and the functions in CompilationInfo::inlined_functions have a strictly longer lifespan, being created earlier (in Hydrogen already).

BUG=v8:5432

Review-Url: https://codereview.chromium.org/2451853002
Cr-Commit-Position: refs/heads/master@{#40975}
2016-11-14 17:22:32 +00:00
bmeurer
fae0e710fc Revert of MIPS: Optimize load/store with large offset (patchset #1 id:1 of https://codereview.chromium.org/2486283003/ )
Reason for revert:
Breaks CQ trybots now, i.e. https://build.chromium.org/p/tryserver.v8/builders/v8_linux_mipsel_compile_rel/builds/24703/steps/compile%20with%20ninja/logs/stdio

Original issue's description:
> MIPS: Optimize load/store with large offset
>
> Currently, we are using the following sequence for load/store with large offset (offset > 16b):
>
>     lui at, 0x1234
>     ori at, at, 0x5678
>     add at, s0, at
>     lw  a0, 0(at)
>
> This sequence can be optimized in the following way:
>
>     lui at, 0x1234
>     add at, s0, at
>     lw  a0, 0x5678(at)
>
> BUG=

TBR=ivica.bogosavljevic@imgtec.com,miran.karic@imgtec.com,v8-mips-ports@googlegroups.com,dusan.simicic@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2500863003
Cr-Commit-Position: refs/heads/master@{#40959}
2016-11-14 11:44:05 +00:00
dusan.simicic
6d054f7658 MIPS: Optimize load/store with large offset
Currently, we are using the following sequence for load/store with large offset (offset > 16b):

    lui at, 0x1234
    ori at, at, 0x5678
    add at, s0, at
    lw  a0, 0(at)

This sequence can be optimized in the following way:

    lui at, 0x1234
    add at, s0, at
    lw  a0, 0x5678(at)

BUG=

Review-Url: https://codereview.chromium.org/2486283003
Cr-Commit-Position: refs/heads/master@{#40953}
2016-11-14 09:57:54 +00:00
franzih
6d84f2d9ed [turbofan] Optimize ToName conversion.
ToName conversion, i.e., ToPropertykey() is the
identify for strings and symbols.

BUG=v8:5623

Review-Url: https://codereview.chromium.org/2494073002
Cr-Commit-Position: refs/heads/master@{#40924}
2016-11-11 13:05:45 +00:00
bmeurer
7d24f1aefa [turbofan] Introduce an ExternalPointer type.
This adds a new ExternalPointer type, which is an Internal type that is
used for ExternalReferences and other pointer values, like the pointers
into the asm.js heap. It also adds a PointerConstant operator, which we
use to represents these raw constants (we can probably remove that
particular operator again once WebAssembly ships with the validator).

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2494753003
Cr-Commit-Position: refs/heads/master@{#40923}
2016-11-11 13:04:47 +00:00
ulan
758b317ce5 [turbofan] Fix more -Wsign-compare warnings.
BUG=v8:5614

Review-Url: https://codereview.chromium.org/2493173002
Cr-Commit-Position: refs/heads/master@{#40916}
2016-11-11 12:01:08 +00:00
ivica.bogosavljevic
0cf5623220 MIPS: Fix bad RegisterConfiguration usage in InstructionSequence unit tests.
Test InstructionSequenceTest has been initialized with a testing RegisterConfiguration
instance defined in instruction-sequence-unittest.h, whereas class ExplicitOperand which
is being tested used RegisterConfiguration from instruction.cc. In case these two
instances are different, the tests would fail. The issue is fixed by using the same
instance of RegisterConfiguration both for test code and code under test.

Additionally, the tests in register-allocator-unittest.cc use hardcoded values
for register and begin failing is the hardcoded register is not available for
allocation. Fix by forcing the use of allocatable registers only.

TEST=unittests.MoveOptimizerTest.RemovesRedundantExplicit,unittests.RegisterAllocatorTest.SpillPhi
BUG=

Review-Url: https://codereview.chromium.org/2433093002
Cr-Commit-Position: refs/heads/master@{#40862}
2016-11-09 13:47:46 +00:00
ivica.bogosavljevic
4125ba8bbd MIPS64: Port ARM64: [turbofan] Avoid zero-extension after a 32-bit load
Port f07d2cdd6a

Original commit message:
A load instruction will implicitely clear the top 32 bits when writing to a W
register. This patch avoids generating a `mov` instruction to zero-extend the
result in this case.

For example, this occurs in the generated code for dispatching to the next
bytecode in the interpreter:

  kind = BYTECODE_HANDLER
  name = LdaZero
  compiler = turbofan
  Instructions (size = 36)
  0x32e64c60     0  add x19, x19, #0x1 (1)
  0x32e64c64     4  ldrb w0, [x20, x19]
  0x32e64c68     8  mov w0, w0
                    ^^^^^^^^^^
  0x32e64c6c    12  lsl x0, x0, #3
  0x32e64c70    16  ldr x1, [x21, x0]
  0x32e64c74    20  movz x0, #0x0
  0x32e64c78    24  br x1

Review-Url: https://codereview.chromium.org/2469253002
Cr-Commit-Position: refs/heads/master@{#40758}
2016-11-04 10:51:04 +00:00
franzih
0f7ea219f0 [compiler] Delete extra map check.
Use HeapConstant for string_iterator_map rather than loading it
manually. This avoids unnecessary map checks.

BUG= v8:3822,v8:5267

Review-Url: https://codereview.chromium.org/2479563003
Cr-Commit-Position: refs/heads/master@{#40741}
2016-11-03 21:25:59 +00:00
danno
fe552636be [turbofan] Support variable size argument removal in TF-generated functions
This is preparation for using TF to create builtins that handle variable number of
arguments and have to remove these arguments dynamically from the stack upon
return.

The gist of the changes:
- Added a second argument to the Return node which specifies the number of stack
  slots to pop upon return in addition to those specified by the Linkage of the
  compiled function.
- Removed Tail -> Non-Tail fallback in the instruction selector. Since TF now should
  handles all tail-call cases except where the return value type differs, this fallback
  was not really useful and in fact caused unexpected behavior with variable
  sized argument popping, since it wasn't possible to materialize a Return node
  with the right pop count from the TailCall without additional context.
- Modified existing Return generation to pass a constant zero as the additional
  pop argument since the variable pop functionality

LOG=N

Review-Url: https://codereview.chromium.org/2446543002
Cr-Commit-Position: refs/heads/master@{#40699}
2016-11-02 13:15:57 +00:00
bmeurer
3f3bacc319 [turbofan] Assign proper types to Parameter nodes.
R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2223873002
Cr-Commit-Position: refs/heads/master@{#40695}
2016-11-02 09:34:08 +00:00
machenbach
c61902e072 Revert of [turbofan] Support variable size argument popping in TF-generated functions (patchset #13 id:240001 of https://codereview.chromium.org/2446543002/ )
Reason for revert:
Seems to break arm64 sim debug and blocks roll:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/3294

Original issue's description:
> [turbofan] Support variable size argument removal in TF-generated functions
>
> This is preparation for using TF to create builtins that handle variable number of
> arguments and have to remove these arguments dynamically from the stack upon
> return.
>
> The gist of the changes:
> - Added a second argument to the Return node which specifies the number of stack
>   slots to pop upon return in addition to those specified by the Linkage of the
>   compiled function.
> - Removed Tail -> Non-Tail fallback in the instruction selector. Since TF now should
>   handles all tail-call cases except where the return value type differs, this fallback
>   was not really useful and in fact caused unexpected behavior with variable
>   sized argument popping, since it wasn't possible to materialize a Return node
>   with the right pop count from the TailCall without additional context.
> - Modified existing Return generation to pass a constant zero as the additional
>   pop argument since the variable pop functionality
>
> LOG=N

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,epertoso@chromium.org,danno@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2473643002
Cr-Commit-Position: refs/heads/master@{#40691}
2016-11-02 07:49:17 +00:00
danno
5319b50c85 [turbofan] Support variable size argument removal in TF-generated functions
This is preparation for using TF to create builtins that handle variable number of
arguments and have to remove these arguments dynamically from the stack upon
return.

The gist of the changes:
- Added a second argument to the Return node which specifies the number of stack
  slots to pop upon return in addition to those specified by the Linkage of the
  compiled function.
- Removed Tail -> Non-Tail fallback in the instruction selector. Since TF now should
  handles all tail-call cases except where the return value type differs, this fallback
  was not really useful and in fact caused unexpected behavior with variable
  sized argument popping, since it wasn't possible to materialize a Return node
  with the right pop count from the TailCall without additional context.
- Modified existing Return generation to pass a constant zero as the additional
  pop argument since the variable pop functionality

LOG=N

Review-Url: https://codereview.chromium.org/2446543002
Cr-Commit-Position: refs/heads/master@{#40678}
2016-10-31 16:54:24 +00:00
bbudge
09ab8e6ad9 [Turbofan] Add concept of FP register aliasing on ARM 32.
- Modifies RegisterConfiguration to specify complex aliasing on ARM 32.
- Modifies RegisterAllocator to consider aliasing.
- Modifies ParallelMove::PrepareInsertAfter to handle aliasing.
- Modifies GapResolver to split wider register moves when interference
with smaller moves is detected.
- Modifies MoveOptimizer to handle aliasing.
- Adds ARM 32 macro-assembler pseudo move instructions to handle cases where
  split moves don't correspond to actual s-registers.
- Modifies CodeGenerator::AssembleMove and AssembleSwap to handle moves of
  different widths, and moves involving pseudo-s-registers.
- Adds unit tests for FP operand interference checking and PrepareInsertAfter.
- Adds more tests of FP for the move optimizer and register allocator.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2410673002
Cr-Commit-Position: refs/heads/master@{#40597}
2016-10-26 16:04:33 +00:00
ivica.bogosavljevic
99e845cc9f MIPS64: Port '[ARM64] Optimize load followed by shift.'
Port dc6b5109d7

BUG=

Review-Url: https://codereview.chromium.org/2437593006
Cr-Commit-Position: refs/heads/master@{#40567}
2016-10-25 14:40:54 +00:00
bmeurer
3a7eac15e8 [turbofan] Fix invalid Number.parseInt inlining.
The inlined version of Number.parseInt did a ToInt32 truncation, which
is not what the EcmaScript specification says.

R=jarin@chromium.org
BUG=v8:5538

Review-Url: https://chromiumcodereview.appspot.com/2432143002
Cr-Commit-Position: refs/heads/master@{#40418}
2016-10-19 05:17:52 +00:00
ivica.bogosavljevic
7499d92d7f MIPS64: Fix Word32Compare turbofan operator implementation when comparing signed with unsigned operand
MIPS64 doesn't support Word32 compare instructions. Instead it relies
that the values in registers are correctly sign-extended and uses
Word64 comparison instead. This behavior is correct in most cases,
but doesn't work when comparing signed with unsigned operands.
The solution proposed here tries to match a comparison of signed
with unsigned operand, and perform Word32Compare simulation only
in those cases. Unfortunately, the solution is not complete because
it might skip cases where Word32 compare simulation is needed, so
basically it is a hack.

BUG=
TEST=mjsunit/compiler/uint32

Review-Url: https://codereview.chromium.org/2391393003
Cr-Commit-Position: refs/heads/master@{#40398}
2016-10-18 12:13:58 +00:00
ahaas
34fa66c08c [wasm] Break effect cycles in the Int64Lowering.
EffectPhis can cause a cycle in a TurboFan graph. We delay the
processing of EffectPhis in the Int64Lowering to break these cycles. We
do the same already for Phis.

R=titzer@chromium.org
BUG=v8:5518
TEST=unittests/Int64LoweringTest.EffectPhiLoop

Review-Url: https://codereview.chromium.org/2428583002
Cr-Commit-Position: refs/heads/master@{#40378}
2016-10-18 06:31:22 +00:00
zhengxing.li
3145befb3d [turbofan][X64] Movzxbl/Movsxbl/Movzxwl/Movsxwl also zero extend to 64bit.
movzxbl/movsxbl/movzxwl/movsxwl operations implicitly zero-extend to 64-bit on x64, So It's not necessary to generate a "movl" instruction to zero-extend.

  For example, movzxbl/movl instruction sequence occurs frequently in v8 interpreter bytecode handler.
  such as:
  kind = BYTECODE_HANDLER
  name = LdaSmi
  compiler = turbofan
  Instructions (size = 76)
  0x184870a3ce40 0 430fbe442601 movsxbl rax,[r14+r12*1+0x1]
  0x184870a3ce46 6 48c1e020 REX.W shlq rax, 32
  0x184870a3ce4a 10 498d5c2402 REX.W leaq rbx,[r12+0x2]
  0x184870a3ce4f 15 420fb61433 movzxbl rdx,[rbx+r14*1]
  0x184870a3ce54 20 8bd2 movl rdx,rdx          <---------------------- here is a redundant "movl"
  0x184870a3ce56 22 4883fa1e REX.W cmpq rdx,0x1e
  0x184870a3ce5a 26 0f8518000000 jnz 56 (0x184870a3ce78)

  This CL also referenced to CL #36038 (https://codereview.chromium.org/1950013003 ) for adding test cases.

BUG=

Review-Url: https://codereview.chromium.org/2427483002
Cr-Commit-Position: refs/heads/master@{#40375}
2016-10-18 03:40:37 +00:00
heimbuef
e7fa9b0129 Named all zones in the project
This adds more useful information to the v8-heap-stats tool.

BUG=v8:5489

Review-Url: https://codereview.chromium.org/2394213003
Cr-Commit-Position: refs/heads/master@{#40361}
2016-10-17 12:12:42 +00:00
leszeks
0c1727ad79 [ignition/turbo] Add liveness analysis for the accumulator
Adds a boolean flag to the liveness analysis which makes it also analyze
the accumulator. This can help prevent the accumulator escaping loops,
as well as decreasing the number of distinct state values nodes in the
graph.

The flag is a kind of ugly way to hack this in, however it is probably
the simplest to add, and (more importantly) to remove once the AST graph
builder is gone.

I measure a 2.6% improvement on Mandreel on my x64 machine, and a ~2%
improvement on Navier-Stokes. Other improvements are expected.

Review-Url: https://codereview.chromium.org/2428503002
Cr-Commit-Position: refs/heads/master@{#40359}
2016-10-17 11:48:04 +00:00
mvstanton
1bf1c5303d [turbofan] Quit storing strings in types.
BUG=

Review-Url: https://codereview.chromium.org/2402313003
Cr-Commit-Position: refs/heads/master@{#40245}
2016-10-13 07:26:45 +00:00
heimbuef
a96c2129af Replaced different means of zone pooling/reusing by one zone segment pool
BUG=v8:5409

Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
Committed: https://crrev.com/fc840361e357a571c709e0239ae82cc089800b3f
Review-Url: https://codereview.chromium.org/2348303002
Cr-Original-Original-Commit-Position: refs/heads/master@{#39633}
Cr-Original-Commit-Position: refs/heads/master@{#40048}
Cr-Commit-Position: refs/heads/master@{#40138}
2016-10-10 19:00:55 +00:00
bbudge
5c4298a0ae [Turbofan] Allow FP operands and vregs in InstructionSequenceTest.
- Adds an optional representation field to VReg and TestOperand structs.
- Adds a simple FP allocation test to register-allocator-unittest.cc.
- Adds some simple FP tests to move-optimizer-unittest.cc.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2400513002
Cr-Commit-Position: refs/heads/master@{#40117}
2016-10-10 11:07:01 +00:00
bmeurer
f6bd23f244 [turbofan] Enforce native context specialization.
There were once plans to generate cross-context code with TurboFan,
however that doesn't fit into the model anymore, and so all of this
is essentially dead untested code (and thus most likely already broken
in subtle ways). With this mode still in place it would also be a lot
harder to make inlining based on SharedFunctionInfo work.

BUG=v8:2206,v8:5499
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2406803002
Cr-Commit-Position: refs/heads/master@{#40109}
2016-10-10 05:53:51 +00:00
hablich
25b4347507 Revert of Replaced different means of zone pooling/reusing by one zone segment pool (patchset #5 id:160001 of https://codereview.chromium.org/2348303002/ )
Reason for revert:
related to roll blocker: https://codereview.chromium.org/2400343002/

Original issue's description:
> Replaced different means of zone pooling/reusing by one zone segment pool
>
> BUG=v8:5409
>
> Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
> Committed: https://crrev.com/fc840361e357a571c709e0239ae82cc089800b3f
> Cr-Original-Commit-Position: refs/heads/master@{#39633}
> Cr-Commit-Position: refs/heads/master@{#40048}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,heimbuef@google.com
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
BUG=v8:5409

Review-Url: https://codereview.chromium.org/2401163002
Cr-Commit-Position: refs/heads/master@{#40099}
2016-10-07 21:18:13 +00:00
heimbuef
fc840361e3 Replaced different means of zone pooling/reusing by one zone segment pool
BUG=v8:5409

Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
Review-Url: https://codereview.chromium.org/2348303002
Cr-Original-Commit-Position: refs/heads/master@{#39633}
Cr-Commit-Position: refs/heads/master@{#40048}
2016-10-06 15:16:41 +00:00
mvstanton
978fe70beb [Turbofan] Introduce OtherNumberConstant.
With this CL, we devolve all Constants introduced as they are with an object handle into

* Range - for integers
* Nan
* MinusZero
* OtherNumberConstant - for doubles
* HeapConstant

We reduce the amount we have to inspect an object handle during optimization. Also, simplifications result. For example, you never have to check if a Range contains a HeapConstant.

BUG=

Review-Url: https://codereview.chromium.org/2381523002
Cr-Commit-Position: refs/heads/master@{#40041}
2016-10-06 14:13:53 +00:00
bmeurer
50c458a389 [turbofan] Properly specialize JSCreateIterResultObject map.
If possible, take the constant map from the (known) native context for
JSCreateIterResultObject, so that subsequent map checks can be
eliminated in case of iterator inlining.

R=jarin@chromium.org
BUG=v8:3822

Review-Url: https://codereview.chromium.org/2394783002
Cr-Commit-Position: refs/heads/master@{#39974}
2016-10-05 06:32:15 +00:00
bmeurer
19b3943607 [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

Drive-by-fixes: Make sure the JSRegExp::lastIndex field stays Smi
if possible (otherwise we tank the regexp benchmark in Octane).

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_mac64_rel,v8_mac64_dbg
R=jarin@chromium.org
BUG=v8:5267

Committed: 6a939714e9
Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
Committed: https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd
Review-Url: https://codereview.chromium.org/2367593003
Cr-Original-Original-Commit-Position: refs/heads/master@{#39692}
Cr-Original-Commit-Position: refs/heads/master@{#39748}
Cr-Commit-Position: refs/heads/master@{#39803}
2016-09-28 06:07:57 +00:00
mstarzinger
66e73b3a1b [turbofan] Remove unsafe JSToBoolean lowering.
The lowering of {JSToBoolean} operators in {JSTypedLowering} inserts
loads that are not part of the effect chain. This does not play well
with effect-sensitive data flow analysis (e.g. escape analysis). This
removes the lowering in question, we can implement it using a dedicated
simplified operator eventually if needed.

R=bmeurer@chromium.org
TEST=mjsunit/wasm/embenchen/lua_binarytrees

Review-Url: https://codereview.chromium.org/2366363003
Cr-Commit-Position: refs/heads/master@{#39773}
2016-09-27 13:55:25 +00:00
epertoso
e25b264957 [turbofan] Introduces the BitcastWordToTaggedSigned and BitcastTaggedToWord opcodes.
They are nops, but will be used when verifying the machine graph.

BUG=

Review-Url: https://codereview.chromium.org/2367413002
Cr-Commit-Position: refs/heads/master@{#39758}
2016-09-27 10:26:24 +00:00
epertoso
2db734df39 [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y).
The MachineOperatorReducer was only reducing word32 expressions of the type x << y | x >>> (32 - y) (and variants) to the equivalent Word32Ror. This CL applies the same pattern-matching logic to Word32Xor.

BUG=

Committed: https://crrev.com/a86397d890d3caa01a947e2a6e71beb1f58e6e6b
Review-Url: https://codereview.chromium.org/2199323003
Cr-Original-Commit-Position: refs/heads/master@{#38284}
Cr-Commit-Position: refs/heads/master@{#39757}
2016-09-27 10:15:44 +00:00
bmeurer
76b68915b3 Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #6 id:100001 of https://codereview.chromium.org/2367593003/ )
Reason for revert:
Still blows up on the main waterfall even after Jakob's fix:

https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11557/steps/Check/logs/typedarray-indexing
https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11557/steps/Check/logs/typedarray
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/12982/steps/Check/logs/typedarray

Original issue's description:
> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=jarin@chromium.org
> BUG=v8:5267
>
> Committed: 6a939714e9
> Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
> Committed: https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd
> Cr-Original-Commit-Position: refs/heads/master@{#39692}
> Cr-Commit-Position: refs/heads/master@{#39748}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2365353006
Cr-Commit-Position: refs/heads/master@{#39749}
2016-09-27 05:10:55 +00:00
bmeurer
ddf792beb3 [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=jarin@chromium.org
BUG=v8:5267

Committed: 6a939714e9
Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
Review-Url: https://codereview.chromium.org/2367593003
Cr-Original-Commit-Position: refs/heads/master@{#39692}
Cr-Commit-Position: refs/heads/master@{#39748}
2016-09-27 04:47:39 +00:00
bmeurer
b9cdb630dd Revert of [compiler] Properly guard the speculative optimizations for instanceof. (patchset #3 id:40001 of https://codereview.chromium.org/2370693002/ )
Reason for revert:
Tanks EarleyBoyer.

Original issue's description:
> [compiler] Properly guard the speculative optimizations for instanceof.
>
> Add a general feedback slot for instanceof similar to what we already have
> for for-in, which basically has a fast (indicated by the uninitialized
> sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
> we can only take the fast path when the feedback slot says it hasn't
> seen any funky inputs and nothing funky appeared in the prototype chain.
> In the TurboFan code we also deoptimize whenever we see a funky object
> (i.e. a proxy or an object that requires access checks) in the prototype
> chain (similar to what Crankshaft already did).
>
> Drive-by-fix: Also make Crankshaft respect the mode and therefore
> address the deopt loop in Crankshaft around instanceof.
>
> We might want to introduce an InstanceOfIC mechanism at some point and
> track the map of the right-hand side.
>
> BUG=v8:5267
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b
> Cr-Commit-Position: refs/heads/master@{#39718}

TBR=mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2365223003
Cr-Commit-Position: refs/heads/master@{#39736}
2016-09-26 17:40:35 +00:00
bmeurer
a0484bc611 [compiler] Properly guard the speculative optimizations for instanceof.
Add a general feedback slot for instanceof similar to what we already have
for for-in, which basically has a fast (indicated by the uninitialized
sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
we can only take the fast path when the feedback slot says it hasn't
seen any funky inputs and nothing funky appeared in the prototype chain.
In the TurboFan code we also deoptimize whenever we see a funky object
(i.e. a proxy or an object that requires access checks) in the prototype
chain (similar to what Crankshaft already did).

Drive-by-fix: Also make Crankshaft respect the mode and therefore
address the deopt loop in Crankshaft around instanceof.

We might want to introduce an InstanceOfIC mechanism at some point and
track the map of the right-hand side.

BUG=v8:5267
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2370693002
Cr-Commit-Position: refs/heads/master@{#39718}
2016-09-26 12:32:33 +00:00
bmeurer
72b01e4a41 Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #5 id:80001 of https://codereview.chromium.org/2367593003/ )
Reason for revert:
Failing on the main waterfall again (again for typedarray, even tho it passed trybots?):

https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11515/steps/Check/logs/typedarray

Original issue's description:
> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=jarin@chromium.org
> BUG=v8:5267
>
> Committed: 6a939714e9
> Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
> Cr-Commit-Position: refs/heads/master@{#39692}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2367963002
Cr-Commit-Position: refs/heads/master@{#39694}
2016-09-23 20:17:02 +00:00
bmeurer
ee158e6c4c [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=jarin@chromium.org
BUG=v8:5267

Committed: 6a939714e9
Review-Url: https://codereview.chromium.org/2367593003
Cr-Commit-Position: refs/heads/master@{#39692}
2016-09-23 19:27:16 +00:00
ivica.bogosavljevic
7d48278119 MIPS: Fix compilation failures due to warnings on mips32r1
BUG=

Review-Url: https://codereview.chromium.org/2359923003
Cr-Commit-Position: refs/heads/master@{#39664}
2016-09-23 13:23:52 +00:00
bmeurer
c80ca79715 Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #3 id:40001 of https://codereview.chromium.org/2367593003/ )
Reason for revert:
Causes tree breakage:

https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/12916/steps/Check/logs/typedarray

Original issue's description:
> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=jarin@chromium.org
> BUG=v8:5267
>
> Committed: 6a939714e9

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2358123007
Cr-Commit-Position: refs/heads/master@{#39657}
2016-09-23 11:24:15 +00:00
Michael Starzinger
4b2c6d03e4 [turbofan] Add proper type guards to escape analysis.
This makes sure the {EscapeAnalysisReducer} inserts proper {TypeGuard}
nodes if the replacement node is not a subtype of the original node.
This happens predominantly for code that has been made unreachable by
type checks.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-640497
BUG=chromium:640497

Review URL: https://codereview.chromium.org/2363573003 .

Cr-Commit-Position: refs/heads/master@{#39656}
2016-09-23 11:02:13 +00:00
Benedikt Meurer
6a939714e9 [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=jarin@chromium.org
BUG=v8:5267

Review URL: https://codereview.chromium.org/2367593003 .

Cr-Commit-Position: refs/heads/master@{#39655}
2016-09-23 10:37:27 +00:00
Benedikt Meurer
dfbb3db5ef [turbofan] Improve representation selection for Smi checking.
Rename the high-level operators CheckTaggedSigned to CheckSmi and
CheckTaggedPointer to CheckHeapObject, to better match the naming
convention (i.e. ObjectIsSmi and CheckSmi, ObjectIsString and
CheckString, etc.).

For lowering CheckSmi, always report TaggedSigned representation
and let the RepresentationChanger come up with a reasonable conversion
from whatever input representation to TaggedSigned. This way we no
longer insert the useless ChangeSomethingToTagged and then Smi check
the result sequences, i.e. mostly reduces the amount of useless code
being generated. But we also observe a few performance improvements
on some crypto benchmarks.

This would enable us to avoid the Smi canonicalization when going from
Float64 to Tagged completely and thus match the representation selection
of Crankshaft in many areas (which might reduce the amount of
polymorphism until we fix our object model).

A follow-up CL will do the same for CheckHeapObject.

BUG=v8:5267
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/2362173003 .

Cr-Commit-Position: refs/heads/master@{#39654}
2016-09-23 10:32:35 +00:00
hablich
b88a848faf Revert of Replaced different means of zone pooling/reusing by one zone segment pool (patchset #3 id:120001 of https://codereview.chromium.org/2348303002/ )
Reason for revert:
Blocks Roll https://codereview.chromium.org/2366733002/

Original issue's description:
> Replaced different means of zone pooling/reusing by one zone segment pool
>
> BUG=v8:5409
>
> Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
> Cr-Commit-Position: refs/heads/master@{#39633}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,heimbuef@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5409

Review-Url: https://codereview.chromium.org/2360403003
Cr-Commit-Position: refs/heads/master@{#39651}
2016-09-23 06:02:46 +00:00
heimbuef
a124feb076 Replaced different means of zone pooling/reusing by one zone segment pool
BUG=v8:5409

Review-Url: https://codereview.chromium.org/2348303002
Cr-Commit-Position: refs/heads/master@{#39633}
2016-09-22 15:35:13 +00:00
georgia.kouveli
5b81f5868d [arm64] Check sign with TBZ/TBNZ.
Generate TBZ/TBNZ for certain comparisons against zero. E.g. instead of:

    cmp w0, 0x0
    b.lt/ge <addr>

we can generate:

    tbnz/tbz w0, 31, <addr>

BUG=

Review-Url: https://codereview.chromium.org/2359723004
Cr-Commit-Position: refs/heads/master@{#39620}
2016-09-22 10:24:57 +00:00
Ilija.Pavlovic
502b9aa71b MIPS: Port for (fused) multiply add/subtract.
Port for VisitFloat32Add, VisitFloat64Add, VisitFloat32Sub and
VisitFloat64Sub in InstructionSelector.

TEST=unittests/InstructionSelectorTest.Float32AddWithFloat32Mul,
     unittests/InstructionSelectorTest.Float64AddWithFloat64Mul,
     unittests/InstructionSelectorTest.Float32SubWithFloat32Mul,
     unittests/InstructionSelectorTest.Float64SubWithFloat64Mul
BUG=

Review-Url: https://codereview.chromium.org/2341303002
Cr-Commit-Position: refs/heads/master@{#39616}
2016-09-22 08:43:04 +00:00
mstarzinger
59a38a9ac8 [turbofan] Add early detection of object state cycles.
This makes sure cycles in the object states graph are detected early by
escape analysis instead of late in the scheduler. This is mainly done
for improved debuggability.

R=bmeurer@chromium.org
BUG=chromium:613923

Review-Url: https://codereview.chromium.org/2354263002
Cr-Commit-Position: refs/heads/master@{#39614}
2016-09-22 07:51:00 +00:00
marija.antic
3d97b804c9 MIPS: [turbofan] Optimize sign-extension patterns like Sar(Shl(x, a), b)).
Port of https://crrev.com/14a5c18cc35b2c55b37de3bd0ad27941cf21cb68

BUG=

Review-Url: https://codereview.chromium.org/2355743003
Cr-Commit-Position: refs/heads/master@{#39582}
2016-09-21 09:27:15 +00:00
heimbuef
7a4f8e4d83 Moved zones and zone related stuff in its own directory.
This is some initial cleanup to keep /src clean. The
AccountingAllocator is actually exclusively used by zones and this
common subfolder makes that more clear.

BUG=v8:5409

Review-Url: https://codereview.chromium.org/2344143003
Cr-Commit-Position: refs/heads/master@{#39558}
2016-09-20 16:08:07 +00:00
jochen
d7ef0b8c97 Fix BUILD.gn files and add presubmit step
Remove files that were removed from the build files but never deleted.

R=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2346103002
Cr-Commit-Position: refs/heads/master@{#39499}
2016-09-19 10:59:41 +00:00
jarin
f4c88a5e5b [turbofan] Support virtual register redirection in instruction selector.
Review-Url: https://codereview.chromium.org/2349983002
Cr-Commit-Position: refs/heads/master@{#39492}
2016-09-19 08:02:46 +00:00
martyn.capewell
5ae2d0e58a [turbofan] Reduce some Float64 division to multiplication
For denominators that are powers of two, replace Float64 division with
multiplication by the reciprocal.

Additionally, replace division by -1 with negation, and multiplication by two
with addition.

BUG=

Review-Url: https://codereview.chromium.org/2347573002
Cr-Commit-Position: refs/heads/master@{#39478}
2016-09-16 17:55:30 +00:00
bmeurer
7954b3f8fa [turbofan] Introduce TruncateTaggedToBit operator for ToBoolean truncation.
Add a dedicated simplified operator to inline the general case for the
ToBoolean conversion. In a follow up CL we will also use the ToBoolean
hints gathered by the baseline compiler.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_arm64_gc_stress_dbg
R=jarin@chromium.org
BUG=v8:5267

Committed: https://crrev.com/8c50b51ab3d21efcd2f6900d83962159f21e1590
Review-Url: https://codereview.chromium.org/2167593002
Cr-Original-Commit-Position: refs/heads/master@{#37882}
Cr-Commit-Position: refs/heads/master@{#39420}
2016-09-14 13:12:28 +00:00
georgia.kouveli
979f164813 [arm64] Resolve TODO in instruction selector tests.
BUG=

Review-Url: https://codereview.chromium.org/2337953003
Cr-Commit-Position: refs/heads/master@{#39409}
2016-09-14 09:56:22 +00:00
bmeurer
e786ef2474 [turbofan] Do constant folding for Float64Pow.
Also unify the Pow implementation somewhat. There are still some
inconsistencies with the FPU version for x64/ia32, but that has
to be resolved separately.

R=ahaas@chromium.org, mvstanton@chromium.org
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2333663002
Cr-Commit-Position: refs/heads/master@{#39368}
2016-09-13 07:10:40 +00:00
bmeurer
dfc4b47f66 [turbofan] Strength reduce CheckTaggedSigned/Pointer with checked inputs.
Add strength reduction rules to optimize

 CheckTaggedSigned(CheckTaggedSigned(x)) -> CheckTaggedSigned(x)

and

 CheckTaggedPointer(CheckTaggedPointer(x)) -> CheckTaggedPointer(x)

where we do some cleanup optimizations after loop peeling and redundancy
elimination, which can generate these constructs.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2336093002
Cr-Commit-Position: refs/heads/master@{#39366}
2016-09-13 06:32:08 +00:00
bmeurer
a63997599e [unittests] Reduce compilation overhead of opcodes-unittest.cc.
Reduce compilation time (with clang) for opcodes-unittest.cc from
1m38s to roughly 1s by not overusing the macro expansion magic.

TBR=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2331413002
Cr-Commit-Position: refs/heads/master@{#39365}
2016-09-13 05:16:18 +00:00
marija.antic
0ef20b51b2 MIPS: Fix compilation failure for GCC5
BUG=

Review-Url: https://codereview.chromium.org/2304133002
Cr-Commit-Position: refs/heads/master@{#39265}
2016-09-08 07:51:51 +00:00
georgia.kouveli
fdb0f07887 [arm64] Use CMN for cmp(a,sub(0,b)) only when checking equality/inequality.
We were previously incorrectly changing:
  sub r0, 0, r1
  cmp r2, r0
  b.cond <addr>
to:
  cmn r2, r1
  b.cond <addr>

for all conditions. This is incorrect for conditions involving the C (carry)
and V (overflow) flags, and in particular in the case where r1 = INT_MIN.
The optimization is still safe to perform for Equal and NotEqual since they
do not depend on the C and V flags.

BUG=

Review-Url: https://codereview.chromium.org/2318043002
Cr-Commit-Position: refs/heads/master@{#39246}
2016-09-07 12:43:00 +00:00
bmeurer
7ac19fe598 [builtins] Migrate Number predicates and make them optimizable.
Migrate the isNaN, isFinite, Number.isFinite, Number.isInteger,
Number.isSafeInteger and Number.isNaN predicates to TurboFan
builtins and make them optimizable (for certain input types) in
JavaScript callees being optimized by TurboFan. That means both
the baseline and the optimized version is now always at maximum,
consistent performance. Especially TurboFan suffered from poor
baseline (and optimized) performance because it cannot play the
same weird tricks that Crankshaft plays for %_IsSmi.

This also adds a bunch of new tests to properly cover the use
of the Harmony predicates in optimized code.

R=franzih@chromium.org
BUG=v8:5049,v8:5267

Review-Url: https://codereview.chromium.org/2313073002
Cr-Commit-Position: refs/heads/master@{#39242}
2016-09-07 10:14:40 +00:00
bmeurer
c071a8f0ca [turbofan] Introduce dedicated NumberToBoolean operator.
Previously we always lowered JSToBoolean(x:Number) to the subgraph
NumberLessThan(0.0, NumberAbs(x)), which deals with both 0, -0 and
NaNs appropriately. However this doesn't always generate the best,
especially when we can later derive from feedback that x is always
an Integral32 value, where the ideal code would be just a single
comparison to 0 w/o the absolute value computation.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309953002
Cr-Commit-Position: refs/heads/master@{#39194}
2016-09-06 08:54:55 +00:00
jochen
77c4ba0767 Store the ScopeInfo in WithContexts
This will allow for chaining ScopeInfos together to form the same chains
as contexts chains currently do.

BUG=v8:5215
R=mstarzinger@chromium.org,marja@chromium.org,bmeurer@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2314483002
Cr-Commit-Position: refs/heads/master@{#39192}
2016-09-06 08:27:52 +00:00
georgia.kouveli
9da7ac6fdb [arm] Improve generation of flag setting instructions.
Generate a flag-setting instruction for a binary operation when
the result is tested for equality/inequality to zero.

BUG=

Review-Url: https://codereview.chromium.org/2315453002
Cr-Commit-Position: refs/heads/master@{#39183}
2016-09-05 16:18:42 +00:00
mvstanton
c30cc0722e [turbofan] put src/types.[h/cc] into src/compiler/types.[h/cc]
BUG=

Review-Url: https://codereview.chromium.org/2309823002
Cr-Commit-Position: refs/heads/master@{#39181}
2016-09-05 15:58:45 +00:00
jochen
9b6ff3a8f6 Store the scope info in catch contexts
Since the extension field is already used for the catch name, store a
ContextExtension there instead.

In the future, this will allow for chaining ScopeInfos together, so we
no longer need a context chain for lazy parsing / compilation.

BUG=v8:5215
R=bmeurer@chromium.org,neis@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2302013002
Cr-Commit-Position: refs/heads/master@{#39164}
2016-09-05 12:10:53 +00:00
bmeurer
99e91aaeac [turbofan] Fold "boolean not"-like Selects into branches.
Fold a Select that negates a boolean value, i.e. returning true in the
false case and vice versa, into Branch users, similar to what we already
do for Branch nodes with BooleanNot inputs.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2308303003
Cr-Commit-Position: refs/heads/master@{#39149}
2016-09-05 07:02:36 +00:00
bmeurer
9f37e303c3 [turbofan] Properly look through FinishRegion in alias analysis.
For two FinishRegion nodes, the alias analysis returned "may alias" even
without properly looking through them.

Drive-by-fix: Add meaningful output for --trace-turbo-load-elimination.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2301903002
Cr-Commit-Position: refs/heads/master@{#39075}
2016-09-01 10:50:27 +00:00
bmeurer
83e1410320 [turbofan] Float32Constant/Float64Constant cannot occur in JS level graph.
Now that the hole NaN is no longer represented as Float64Constant early
on, we should never see such a constant node in any JS-level graph, but
we will only see them after representation selection. Change Typer and
SimplifiedLowering appropriately (and fix the invalid tests).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2299883003
Cr-Commit-Position: refs/heads/master@{#39063}
2016-09-01 06:27:06 +00:00
marja
0645135446 Separate CompilationInfo into its own file.
This way, many files which only need CompilationInfo but not compiler.h
and its dependencies can include just compilation-info.h.

BUG=

Review-Url: https://codereview.chromium.org/2284313003
Cr-Commit-Position: refs/heads/master@{#39038}
2016-08-31 08:49:59 +00:00
bmeurer
b98d64f909 [turbofan] Extend LoadElimination to introduce TypeGuards.
If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}
2016-08-31 05:48:28 +00:00
bmeurer
285e1e157a [turbofan] Remove invalid typing rules.
Drop the typing rules for the machine operators and replace them
with UNREACHABLE. These typing rules were never correct and there's
also no need to have those rules at all.

Drive-by-fix: Remove the extremely annoying test-simplified-lowering.cc
file, which is not very useful, but consumes a large amount of time to
keep it compiling and passing. Instead we should introduce appropriate
tests for the SimplifiedLowering that also test something meaningful
w/o just cementing the implementation.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2292463002
Cr-Commit-Position: refs/heads/master@{#38970}
2016-08-29 09:20:09 +00:00
bmeurer
f154c75a39 [turbofan] Separate typed optimizations from JSTypedLowering.
Introduce a new TypedOptimization reducer that contains the type
based optimization reduction steps, which are not (directly)
related to lowering JavaScript operators based on types (which is
what JSTypedLowering is supposed to do).

This also addresses a chicken-and-egg problem that we see in the
Octane/Mandreel benchmark where type based constant folding isn't
applied to the numeric comparison operators introduced by the
JSTypedLowering itself, and thus gives up to 10% speedup for the
benchmark.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2280673003
Cr-Commit-Position: refs/heads/master@{#38928}
2016-08-26 07:58:30 +00:00
baptiste.afsa
65ba1cdeb6 [turbofan] Allow tests to enable/disable instruction scheduling.
Some instruction selection tests rely on the instructions to be emitted
in a specific order.

R=jarin@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2276003002
Cr-Commit-Position: refs/heads/master@{#38886}
2016-08-25 08:05:15 +00:00
bmeurer
a124bf773f [turbofan] Add regression tests for LoadElement/Field in diamond.
This introduces appropriate unit tests to ensure that merging of
elements/fields information is correct for diamonds.

BUG=chromium:639210,v8:5266
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2278043002
Cr-Commit-Position: refs/heads/master@{#38881}
2016-08-25 05:09:21 +00:00
bmeurer
b5629a108c [turbofan] Improve fast case of JSInstanceOf lowering.
For O instanceof C, we only need to check the instance type while
iterating the prototypes of O instead of checking both the instance
type and the access check bit of the map. This is because we have
the explicit range of "special object types", which include both
JSProxy as well as the global object and proxy and all API objects
that might have access checks or interceptors. Also restructure the
loop exits somewhat to ensure that the branch cloning gets a chance
to actually eliminate the bit materialization for the results.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2263273003
Cr-Commit-Position: refs/heads/master@{#38860}
2016-08-24 09:38:48 +00:00
marja
1776fd09fa Include only stuff you need, part 4: ast, scopes + fallout.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

Fixing it:
- Don't include stuff in headers unless necessary.
- Include the stuff you need, not some other stuff that happens to include the
 stuff you need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2268303002
Cr-Commit-Position: refs/heads/master@{#38818}
2016-08-23 12:35:36 +00:00
Miran.Karic
239f981653 MIPS: [stubs,interpreter] Optimise SMI loading for 64-bit targets.
Port 28e3467a72 (r38361)

  original commit message:
    Adding new methods to the code stub assembler and interpreter
    assembler to combine loading and untagging SMIs, so that on 64-bit
    architectures we can avoid loading the full 64 bits and load the
    32 interesting bits directly instead.

BUG=

Review-Url: https://codereview.chromium.org/2265043002
Cr-Commit-Position: refs/heads/master@{#38811}
2016-08-23 09:35:51 +00:00
verwaest
4b7dc57f0a There are only 2 language modes, not 3
Use bool is_strict_ to encode language_mode in scopes using a single bit.

BUG=

Review-Url: https://codereview.chromium.org/2261463002
Cr-Commit-Position: refs/heads/master@{#38724}
2016-08-18 15:57:11 +00:00
hablich
8fd0ce04e5 Revert of There are only 2 language modes, not 3 (patchset #4 id:60001 of https://codereview.chromium.org/2250703003/ )
Reason for revert:
Breaks ARM and MIPS builds e.g. https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug%20builder/builds/2479/steps/compile/logs/stdio

Original issue's description:
> There are only 2 language modes, not 3
>
> BUG=
>
> Committed: https://crrev.com/39764ba293412adde99a77a66d0750695312e006
> Cr-Commit-Position: refs/heads/master@{#38704}

TBR=neis@chromium.org,marja@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2257133002
Cr-Commit-Position: refs/heads/master@{#38714}
2016-08-18 12:06:14 +00:00
hablich
8fdf6031a5 Revert of Replace LANGUAGE_END with LAST_LANGUAGE_MODE (patchset #1 id:1 of https://codereview.chromium.org/2257703003/ )
Reason for revert:
Needed to land revert https://codereview.chromium.org/2257133002/

Original issue's description:
> Replace LANGUAGE_END with LAST_LANGUAGE_MODE
>
> BUG=
>
> Committed: https://crrev.com/9324efca85710ebb14f21ef8476447e21cbe3f35
> Cr-Commit-Position: refs/heads/master@{#38707}

TBR=neis@chromium.org,marja@chromium.org,verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2259853002
Cr-Commit-Position: refs/heads/master@{#38713}
2016-08-18 12:05:08 +00:00
epertoso
06cde13e7c [turbofan/x64] Load word64 followed by a shift right 32 -> load (and sign-extend if necessary) high 32bit.
We were missing this optimization in a few cases because TruncateInt64ToInt32 was also interfering.
Also removed the equivalent from simplified-lowering.cc, as the arm64 instruction selector has a similar optimization.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2252333002
Cr-Commit-Position: refs/heads/master@{#38711}
2016-08-18 11:24:56 +00:00
verwaest
9324efca85 Replace LANGUAGE_END with LAST_LANGUAGE_MODE
BUG=

Review-Url: https://codereview.chromium.org/2257703003
Cr-Commit-Position: refs/heads/master@{#38707}
2016-08-18 10:20:21 +00:00
verwaest
39764ba293 There are only 2 language modes, not 3
BUG=

Review-Url: https://codereview.chromium.org/2250703003
Cr-Commit-Position: refs/heads/master@{#38704}
2016-08-18 08:59:12 +00:00
georgia.kouveli
dc6b5109d7 [ARM64] Optimize load followed by shift.
Instead of loading 64 bits and shifting:

      ldr x0, [x1, #offset]
      asr x0, x0, #32

    directly load the interesting 32 bits and sign-extend:

      ldrsw x0, [x1, #offset+4]

BUG=

Review-Url: https://codereview.chromium.org/2243843002
Cr-Commit-Position: refs/heads/master@{#38622}
2016-08-12 13:55:46 +00:00
georgia.kouveli
227353b76a [ARM64] Change TruncateInt64ToInt32 to a NOP.
BUG=

Review-Url: https://codereview.chromium.org/2240803003
Cr-Commit-Position: refs/heads/master@{#38612}
2016-08-12 11:30:05 +00:00
bmeurer
b8f475045c [turbofan] Add inlined Array.prototype.pop support.
This adds a very first version of inlined Array.prototype.pop into
TurboFan optimized code. We currently limit the inlining to fast
object or smi elements, until the unclear situation around hole NaNs
is resolved and we have a clear semantics inside the compiler.

It's also probably overly defensive in when it's safe to inline
the call to Array.prototype.pop, but we can always extend that
later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229,v8:3952,v8:5267
R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2239703002
Cr-Commit-Position: refs/heads/master@{#38578}
2016-08-11 13:13:21 +00:00
bgeron
7c3be98986 [turbofan] Fix more places where IfSuccess lacks on a non-NoThrow node.
These places were found by the trybots.

- regress-crbug-485410

BUG=

Review-Url: https://codereview.chromium.org/2230923002
Cr-Commit-Position: refs/heads/master@{#38572}
2016-08-11 09:02:09 +00:00
bmeurer
3cc4e25cbf [turbofan] Avoid unnecessary minus zero checks for Float64->Tagged.
When we change representation from Float64 to Tagged and we know that
the input value can never be -0, we don't need to bother introducing
the check for -0 during effect/control linearization.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2231963002
Cr-Commit-Position: refs/heads/master@{#38568}
2016-08-11 05:45:01 +00:00
epertoso
779e3d6df0 Revert of [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y). (patchset #1 id:1 of https://codereview.chromium.org/2199323003/ )
Reason for revert:
It may or may not have caused a regression in kraken-crypto-ccm.

Original issue's description:
> [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y).
>
> The MachineOperatorReducer was only reducing word32 expressions of the type x << y | x >>> (32 - y) (and variants) to the equivalent Word32Ror. This CL applies the same pattern-matching logic to Word32Xor.
>
> BUG=
>
> Committed: https://crrev.com/a86397d890d3caa01a947e2a6e71beb1f58e6e6b
> Cr-Commit-Position: refs/heads/master@{#38284}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
NOPRESUBMIT=true
BUG=

Review-Url: https://codereview.chromium.org/2230213002
Cr-Commit-Position: refs/heads/master@{#38545}
2016-08-10 14:47:17 +00:00
bmeurer
a12aa89151 [turbofan] Simplify BinaryOperationHints and CompareOperationHints.
Remove the useless information from the BinaryOperationHints and
CompareOperationHints, and cache the JS operators appropriately.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2228983002
Cr-Commit-Position: refs/heads/master@{#38506}
2016-08-09 18:12:08 +00:00
bmeurer
76949ba4cc [turbofan] Consume number type hints for strict equality.
This allows us to consume the type hints gathered by the CompareIC
for the strict equality and inequality operators. Similar to abstract
equality We need to distinguish Number and NumberOrOddball feedback,
as strict equality doesn't truncate Oddball to Number.

R=epertoso@chromium.org
BUG=v8:4583

Review-Url: https://codereview.chromium.org/2222993003
Cr-Commit-Position: refs/heads/master@{#38438}
2016-08-08 12:36:02 +00:00
ahaas
f8938e5096 [turbofan] Remove the FloatXXSubPreserveNan operators.
This CL changes the semantics of FloatXXSub to match the semantics of
the semantics of FloatXXSubPreserveNan. Therefore there is no need
anymore for the FloatXXSubPreserveNan operators.

The optimizations in VisitFloatXXSub which are removed in this CL have
already been moved to machine-operator-reducer.cc in
https://codereview.chromium.org/2226663002

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2220973002
Cr-Commit-Position: refs/heads/master@{#38437}
2016-08-08 12:09:50 +00:00
epertoso
b79d7b0486 [x64] Zero/sign-extend loads to 64-bit registers.
Before this change we would first load an 8/16/32-bit value from memory into a 32-bit register, then zero/sign-extend from that register to a 64-bit one. Now we replace that pattern with a single movsx/movzx.

Ported from http://crrev.com/2183923003

R=bmeurer@chromium.org

Committed: https://crrev.com/4abecb7a27bd5fa073d0ff5fadb0c2bb248ef9f4
Review-Url: https://codereview.chromium.org/2220483003
Cr-Original-Commit-Position: refs/heads/master@{#38388}
Cr-Commit-Position: refs/heads/master@{#38428}
2016-08-08 10:00:45 +00:00
ahaas
552601bb5f [turbofan] Lower "-0.0 - x" in the MachineOperatorReducer.
Up until now "-0.0 - x" was lowered in the instruction selector. I moved
the lowering now to the MachineOperatorReducer.

I did not remove the lowering from the instruction selector yet, I would
prefer to do that in a separate CL.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2226663002
Cr-Commit-Position: refs/heads/master@{#38417}
2016-08-08 08:40:36 +00:00
bmeurer
2c8b51448c [turbofan] Add NumberOperationHint for speculative number operations.
Introduce a dedicated NumberOperationHint enum that represents the
feedback we can use for speculative number operations.

BUG=v8:4930

Review-Url: https://codereview.chromium.org/2220573002
Cr-Commit-Position: refs/heads/master@{#38411}
2016-08-08 06:10:45 +00:00
ahaas
6c44ab30fd [turbofan] Make Float32Neg and Float64Neg mandatory operators.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2215403002
Cr-Commit-Position: refs/heads/master@{#38399}
2016-08-05 18:52:05 +00:00
bmeurer
b659a0ac23 [turbofan] Add support for copy-on-write element stores.
This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Review-Url: https://codereview.chromium.org/2218703003
Cr-Original-Commit-Position: refs/heads/master@{#38370}
Cr-Commit-Position: refs/heads/master@{#38392}
2016-08-05 15:32:13 +00:00
machenbach
0f4468b4a6 Revert of [x64] Zero/sign-extend loads to 64-bit registers. (patchset #1 id:20001 of https://codereview.chromium.org/2220483003/ )
Reason for revert:
Breaks tree:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/10969

Original issue's description:
> [x64] Zero/sign-extend loads to 64-bit registers.
>
> Before this change we would first load an 8/16/32-bit value from memory into a 32-bit register, then zero/sign-extend from that register to a 64-bit one. Now we replace that pattern with a single movsx/movzx.
>
> Ported from http://crrev.com/2183923003
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/4abecb7a27bd5fa073d0ff5fadb0c2bb248ef9f4
> Cr-Commit-Position: refs/heads/master@{#38388}

TBR=bmeurer@chromium.org,epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2221473002
Cr-Commit-Position: refs/heads/master@{#38389}
2016-08-05 14:30:11 +00:00
epertoso
4abecb7a27 [x64] Zero/sign-extend loads to 64-bit registers.
Before this change we would first load an 8/16/32-bit value from memory into a 32-bit register, then zero/sign-extend from that register to a 64-bit one. Now we replace that pattern with a single movsx/movzx.

Ported from http://crrev.com/2183923003

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2220483003
Cr-Commit-Position: refs/heads/master@{#38388}
2016-08-05 13:34:24 +00:00
ivica.bogosavljevic
20c56bdd6e Fix compilation failure when v8 compiled with GCC 5.x due to -Werror=unused-variable
BUG=

Review-Url: https://codereview.chromium.org/2212133003
Cr-Commit-Position: refs/heads/master@{#38385}
2016-08-05 12:56:40 +00:00
bmeurer
d3d7069d38 Revert of [turbofan] Add support for copy-on-write element stores. (patchset #2 id:20001 of https://codereview.chromium.org/2218703003/ )
Reason for revert:
Breaks tree?

Original issue's description:
> [turbofan] Add support for copy-on-write element stores.
>
> This extends JSNativeContextSpecialization with support for stores to
> fast object/smi element backing stores that are marked as copy-on-write.
> In this case we first call the CopyFixedArray builtin to take a copy of
> the elements backing store, and then store the new elements back to the
> object, and finally perform the actual element store.
>
> R=epertoso@chromium.org
> BUG=v8:4470
>
> Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
> Cr-Commit-Position: refs/heads/master@{#38370}

TBR=epertoso@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2220513002
Cr-Commit-Position: refs/heads/master@{#38376}
2016-08-05 12:07:01 +00:00
bmeurer
ac98ad22f0 [turbofan] Add support for copy-on-write element stores.
This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2218703003
Cr-Commit-Position: refs/heads/master@{#38370}
2016-08-05 10:58:39 +00:00
georgia.kouveli
28e3467a72 [stubs,interpreter] Optimise SMI loading for 64-bit targets.
Adding new methods to the code stub assembler and interpreter
assembler to combine loading and untagging SMIs, so that on 64-bit
architectures we can avoid loading the full 64 bits and load the
32 interesting bits directly instead.

Review-Url: https://codereview.chromium.org/2183923003
Cr-Commit-Position: refs/heads/master@{#38361}
2016-08-05 09:34:08 +00:00
epertoso
a86397d890 [turbofan] Reduces x << y ^ x >>> (32 - y) to x ror (32 - y).
The MachineOperatorReducer was only reducing word32 expressions of the type x << y | x >>> (32 - y) (and variants) to the equivalent Word32Ror. This CL applies the same pattern-matching logic to Word32Xor.

BUG=

Review-Url: https://codereview.chromium.org/2199323003
Cr-Commit-Position: refs/heads/master@{#38284}
2016-08-03 10:58:07 +00:00
mstarzinger
0c8e3cea4b [turbofan] Remove eager frame state from bitwise ops.
This removes the frame state input representing the before-state from
nodes having any int32 bitwise operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=epertoso@chromium.org
BUG=v8:5021,v8:4746

Review-Url: https://codereview.chromium.org/2194383004
Cr-Commit-Position: refs/heads/master@{#38280}
2016-08-03 08:38:51 +00:00
mstarzinger
a4743baec1 [turbofan] Remove IfExceptionHint from exception projections.
This completely removes translation of exception handler predictions
from the graph IR. We now rely on the runtime using deoptimization
infomation via {FrameSummary} for predictions in optimized code.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2207533002
Cr-Commit-Position: refs/heads/master@{#38250}
2016-08-02 14:49:10 +00:00
epertoso
524abd76b7 [turbofan] Adds speculative operator for bitwise and, or and xor.
BUG=

Review-Url: https://codereview.chromium.org/2201073002
Cr-Commit-Position: refs/heads/master@{#38246}
2016-08-02 13:43:58 +00:00
mstarzinger
dc505196e6 [turbofan] Remove eager frame state from shift operations.
This removes the frame state input representing the before-state from
nodes having any shift operator. Any lowering that woult insert number
conversions of the inputs has already been disabled when deoptimization
is enabled, because the frame state layout is no longer known.

R=epertoso@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2190743003
Cr-Commit-Position: refs/heads/master@{#38194}
2016-08-01 08:33:53 +00:00
jyan
77c9cb8341 [compiler] [wasm] Introduce Word32/64ReverseBytes as TF Optional Opcode
This commit fixes wasm little-endian load issue on big-endian platform
by introducing reverse byte operation immediately after a load.

R=bmeurer@chromium.org, titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2045943002
Cr-Commit-Position: refs/heads/master@{#38183}
2016-07-29 19:33:28 +00:00
epertoso
79ebd37d65 [turbofan] Adds speculative opcodes for shift right.
Drive-by fix: actually match the hint in the IsSpeculativeBinopMatcher.

Review-Url: https://codereview.chromium.org/2191883002
Cr-Commit-Position: refs/heads/master@{#38176}
2016-07-29 11:04:24 +00:00
bbudge
55b01ccbfc [Turbofan] Revert FP register aliasing support on Arm.
- Changes register allocation to only use even numbered registers on Arm.
- Turns on float32 testing in test-gap-resolver.cc.

This is effectively a revert of:
https://codereview.chromium.org/2086653003/

LOG=N
BUG=V8:4124, V8:5202

Review-Url: https://codereview.chromium.org/2176173003
Cr-Commit-Position: refs/heads/master@{#38151}
2016-07-29 00:50:57 +00:00
epertoso
94ab292fba [turbofan] Adds handling of number or oddball type feedback to SpeculativeNumberShiftLeft.
This required the introduction of the CheckedNumberOrOddballAsWord32 use info, and a change in the RepresentationChanger to handle it.

BUG=

Review-Url: https://codereview.chromium.org/2184513003
Cr-Commit-Position: refs/heads/master@{#38086}
2016-07-27 09:04:19 +00:00
mvstanton
0a36b5cd2c [Turbofan] Make the -0 deopt case more efficient in multiplication.
After multiplying two integers we emit code like:

  if (result == 0) {
    if (OR_OPERATION(rhs, lhs) < 0) {
      DEOPT;
    }
  }

This CL allows us to eliminate the OR and comparison if either rhs or
lhs is a negative number, reducing the code to:

  if (result == 0) DEOPT;

BUG=

Review-Url: https://codereview.chromium.org/2167643002
Cr-Commit-Position: refs/heads/master@{#38016}
2016-07-25 12:15:22 +00:00
bmeurer
a2ad4c8f62 [turbofan] New GraphReducer based LoadElimination.
Turn the LoadElimination into a proper graph Reducer so that it can run
together with ValueNumbering and RedundancyElimination to a fixpoint
for maximum load/check elimination. This also adds initial support for
eliminating redundant LoadElement/StoreElement nodes.

BUG=v8:4930,v8:5141

Review-Url: https://codereview.chromium.org/2164253002
Cr-Commit-Position: refs/heads/master@{#38015}
2016-07-25 12:05:16 +00:00
jochen
0a6ccaf268 Replace SmartPointer<T> with unique_ptr<T>
R=ishell@chromium.org,bmeurer@chromium.org
TBR=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2175233003
Cr-Commit-Position: refs/heads/master@{#38009}
2016-07-25 11:14:34 +00:00
bmeurer
5bed1516c8 [turbofan] Avoid introducing machine operators during typed lowering.
Introducing machine operators early causes trouble for the typing,
truncation analysis and representation selection, so we should rather
stick to simplified operators instead. Now there's only the for-in case
left, which is not clear how we can handle this in a better way.

Drive-by-fix: Also don't introduce Int32Constant and Word32Shl in
JSTypedLowering, but use NumberConstant and proper NumberShiftLeft
operators instead.

R=jarin@chromium.org
BUG=chromium:630951

Review-Url: https://codereview.chromium.org/2182453002
Cr-Commit-Position: refs/heads/master@{#38008}
2016-07-25 10:38:00 +00:00
ivica.bogosavljevic
580fdf3c05 Implement UnaligedLoad and UnaligedStore turbofan operators.
Implement UnalignedLoad and UnalignedStore optional
turbofan operators and use them in WasmCompiler for unaligned
memory access.

BUG=

Review-Url: https://codereview.chromium.org/2122853002
Cr-Commit-Position: refs/heads/master@{#37988}
2016-07-22 20:56:24 +00:00
bmeurer
ba092fb09a [turbofan] Change Float64Max/Float64Min to JavaScript semantics.
So far we don't have a useful way to inline Math.max or Math.min in
TurboFan optimized code. This adds new operators NumberMax and NumberMin
and changes the Float64Max/Float64Min operators to have JavaScript
semantics instead of the C++ semantics that it had previously.

This also removes support for recognizing the tenary case in the
CommonOperatorReducer, since that doesn't seem to have any positive
impact (and actually doesn't show up in regular JavaScript, where
people use Math.max/Math.min instead).

Drive-by-fix: Also nuke the unused Float32Max/Float32Min operators.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2170343002
Cr-Commit-Position: refs/heads/master@{#37971}
2016-07-22 08:25:11 +00:00
bmeurer
52a66bf1a8 Revert of [turbofan] Introduce TruncateTaggedToBit operator for ToBoolean truncation. (patchset #2 id:20001 of https://codereview.chromium.org/2167593002/ )
Reason for revert:
Breaks arm64 gc stress:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/1605

Original issue's description:
> [turbofan] Introduce TruncateTaggedToBit operator for ToBoolean truncation.
>
> Add a dedicated simplified operator to inline the general case for the
> ToBoolean conversion. In a follow up CL we will also use the ToBoolean
> hints gathered by the baseline compiler.
>
> Committed: https://crrev.com/8c50b51ab3d21efcd2f6900d83962159f21e1590
> Cr-Commit-Position: refs/heads/master@{#37882}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2170433002
Cr-Commit-Position: refs/heads/master@{#37899}
2016-07-20 10:18:46 +00:00
bmeurer
8c50b51ab3 [turbofan] Introduce TruncateTaggedToBit operator for ToBoolean truncation.
Add a dedicated simplified operator to inline the general case for the
ToBoolean conversion. In a follow up CL we will also use the ToBoolean
hints gathered by the baseline compiler.

Review-Url: https://codereview.chromium.org/2167593002
Cr-Commit-Position: refs/heads/master@{#37882}
2016-07-20 06:49:17 +00:00
georgia.kouveli
c598796643 [ARM] Generate flag setting instructions for arm.
Based on 317dc0578.

BUG=

Review-Url: https://codereview.chromium.org/2152253002
Cr-Commit-Position: refs/heads/master@{#37828}
2016-07-18 10:21:37 +00:00
bmeurer
db635d5b72 [turbofan] Add support for eager/soft deoptimization reasons.
So far TurboFan wasn't adding the deoptimization reasons for eager/soft
deoptimization exits that can be used by either the DevTools profiler or
the --trace-deopt flag. This adds basic support for deopt reasons on
Deoptimize, DeoptimizeIf and DeoptimizeUnless nodes and threads through
the reasons to the code generation.

Also moves the DeoptReason to it's own file (to resolve include cycles)
and drops unused reasons.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2161543002
Cr-Commit-Position: refs/heads/master@{#37823}
2016-07-18 09:25:16 +00:00
jarin
54a0389309 [turbofan] Loop peeling with explicit loop exits.
Review-Url: https://codereview.chromium.org/2143163002
Cr-Commit-Position: refs/heads/master@{#37791}
2016-07-15 10:24:25 +00:00
epertoso
d93fd41aaa [turbofan] Introduces the SpeculativeNumberShiftLeft opcode.
Typed lowering now produces SpeculativeNumberShiftLeft for JSShiftLeft if the type feedback is kSignedSmall or kSigned32.

BUG=v8:4583
LOG=n

Review-Url: https://codereview.chromium.org/2150553002
Cr-Commit-Position: refs/heads/master@{#37762}
2016-07-14 12:49:32 +00:00
bmeurer
d9cb130d0b [turbofan] Strength reduction for Int32MulWithOverflow.
Add simple strength reduction for Int32MulWithOverflow to the
MachineOperatorReducer.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2139733003
Cr-Commit-Position: refs/heads/master@{#37751}
2016-07-14 09:25:34 +00:00
bmeurer
ac50c1ca8d [turbofan] JSTypedLowering can just look at the type hints.
If --turbo-type-feedback is off, the type hints on the operators will
just be kAny, so we don't need to do additional checks in the
JSTypedLowering reducer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2144203002
Cr-Commit-Position: refs/heads/master@{#37750}
2016-07-14 09:20:03 +00:00
jarin
97b886a2b0 [turbofan] Make sure value numbering only narrows types.
Review-Url: https://codereview.chromium.org/2145683004
Cr-Commit-Position: refs/heads/master@{#37745}
2016-07-14 08:10:21 +00:00
marija.antic
edf8c03547 MIPS64: Implement Mips64And32, Mips64Or32, Mips64Nor32 and Mips64Xor32 operators.
If operands are loaded as unsigned 32-bit integer, they need to be sign extended to 64 bits.

TEST=cctest/test-run-machops/RunWord32AndAndWord32ShrP, cctest/test-run-machops/RunWord32OrP,
cctest/test-run-machops/RunWord32ShrP, cctest/test-run-machops/RunWord32XorP

BUG=

Review-Url: https://codereview.chromium.org/2147883002
Cr-Commit-Position: refs/heads/master@{#37705}
2016-07-13 09:04:33 +00:00
danno
574f6fe127 [turbofan] Support subtraction displacements in BaseWithIndexAndDisplacementMatcher
Previously, the following schedule fragment:

 1: Parameter[0](0)
 2: Parameter[1](0)
 7: Int32Constant[1]
 8: Int32Sub(2, 7)
 9: Load[kRepTagged|kTypeAny](1, 8)

would generate the following code (on ia32):

 mov eax,[ebp+0x8]
 mov ecx,[ebp+0xc]
 sub eax,0x1
 mov eax,[eax+ecx*1]

Now it generates:

 mov eax,[ebp+0x8]
 mov ecx,[ebp+0xc]
 mov eax,[eax+ecx*1-1]

Similar pattern matching also now works on x64.

BUG=v8:5192
LOG=N

Review-Url: https://codereview.chromium.org/2137323003
Cr-Commit-Position: refs/heads/master@{#37701}
2016-07-13 08:03:38 +00:00
bmeurer
3861e51322 [turbofan] Properly optimize JSToBoolean with Number inputs.
For JSToBoolean with Number inputs we still called out to the
ToBooleanStub, even though we easily handle them inline nowadays.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2145923002
Cr-Commit-Position: refs/heads/master@{#37699}
2016-07-13 08:00:22 +00:00
epertoso
60c95d85ab [turbofan] Move TryCloneBranch in the EffectControlLinearizer pass.
When trying to clone a branch, the ControlFlowOptimizer gave up as soon as it found a Phi/EffectPhi node that could not be placed directly below the IfTrue or IfFalse control paths.

Moving the step in the EffectControlLinearizer phase, after the first schedule, works around the problem by looking at the successor blocks.

BUG=

Review-Url: https://codereview.chromium.org/2139593002
Cr-Commit-Position: refs/heads/master@{#37687}
2016-07-12 15:23:36 +00:00
mstarzinger
f3ca214222 [turbofan] Speed up structural graph verification.
This removes the checking for use-def and def-use chain links from the
graph verification. Presence of such links can only be violated by a bug
in the actual {Node} implementation itself. That container class is also
covered by unit tests.

The verification in question was useful in the early days when the graph
implementation itself was prone to bugs. By now it has stabilized and
spending O(n^2) time during graph verification is too wasteful to still
be considered a reasonable trade-off.

R=jarin@chromium.org
TEST=unittests/NodeTest.*

Review-Url: https://codereview.chromium.org/2140973003
Cr-Commit-Position: refs/heads/master@{#37670}
2016-07-12 09:31:12 +00:00
bmeurer
85969edead [turbofan] Unify BooleanToNumber, StringToNumber and PlainPrimitiveToNumber.
The PlainPrimitiveToNumber operator performs a superset of the operations
previously performed by the BooleanToNumber and StringToNumber operators,
so we can just use the special lowering rules for PlainPrimitiveToNumber
based on the input type and get rid of the specialized operators.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2139183002
Cr-Commit-Position: refs/heads/master@{#37669}
2016-07-12 09:15:11 +00:00
danno
e92e911814 [turbofan] Robustify tail parameter stack size computations
This CL separates the check whether something is tail-callable from
the computation of the size of the stack parameters that a function
takes.

In order to track this precisely, the stack parameter size calculation
uses the recently landed MachineType information that's embedded
in return and parameter value LinkageLocations.

Review-Url: https://codereview.chromium.org/2121753002
Cr-Commit-Position: refs/heads/master@{#37668}
2016-07-12 08:40:49 +00:00
danno
3e2085eba4 [turbofan] Add MachineType to LinkageLocation
By adding MachineType to LinkageLocation, it is possible not only to reason
about the location of a LinkageLocation on the stack, but also about it's
size. This will be useful in follow-on CLs that attempt to merge some of the
parameter passing logic of tail calls and normal (non-tail) calls.

As a nice side-effect, it is no longer necessary to separately keep a
MachineSignature in a CallDescriptor, because the MachineTypes contianed in
LinkageLocation for all of the Descriptor's parameters and return types are
sufficient. This CL therefore removes the MachineSignature from the
CallDescriptor and adjusts all the calling code accordingly, simplifying and
de-duplicating code in a bunch of places.

R=titzer@chromium.org, bmeurer@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2124023003
Cr-Commit-Position: refs/heads/master@{#37633}
2016-07-11 10:39:34 +00:00
bmeurer
d70dc1ace4 [turbofan] Initial version of the new LoadElimination.
This adds a new optimization phase to the TurboFan pipeline, which walks
over the effect chain and tries to eliminate redundant loads (and even
some stores) of object fields. We currently ignore element access, but
that will probably need to be handled as well at some point. We also
don't have any special treatment to properly track object maps, which is
also on the list of things that will happen afterwards.

The implementation is pretty simple currently, and probably way to
inefficient. It's meant to be a proof-of-concept to iterate on.

R=jarin@chromium.org
BUG=v8:4930,v8:5141

Review-Url: https://codereview.chromium.org/2120253002
Cr-Commit-Position: refs/heads/master@{#37528}
2016-07-05 12:20:18 +00:00
mstarzinger
ee2d06e65f [unittests] Remove spurious language mode test dimension.
This just removes some left-overs from when the {JSTypedLoweringTest}
covered strong mode and an iteration over all language modes was used
for testing all binary operations. The language mode in question has
been removed since then.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2121113002
Cr-Commit-Position: refs/heads/master@{#37526}
2016-07-05 12:10:28 +00:00
mstarzinger
2620c4264a [turbofan] Remove eager frame state from add and subtract.
This removes the frame state input representing the before-state from
nodes having the {JSAdd} or the {JSSubtract} operator. Lowering that
inserts number conversions of the inputs has to be disabled when
deoptimization is enabled, because the frame state layout is no longer
known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2125593002
Cr-Commit-Position: refs/heads/master@{#37522}
2016-07-05 10:46:34 +00:00
bmeurer
72275e6620 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
Review-Url: https://codereview.chromium.org/2126453002
Cr-Original-Commit-Position: refs/heads/master@{#37512}
Cr-Commit-Position: refs/heads/master@{#37519}
2016-07-05 10:05:40 +00:00
bmeurer
f50721d56d [turbofan] Recognize fast path for Number.parseInt.
The Number.parseInt (and therefore the parseInt function on the global
object) are often used instead of Math.floor or just plain int32
truncation, and we can easily recognize those cases and provide a fast
path in TurboFan.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2125583002
Cr-Commit-Position: refs/heads/master@{#37518}
2016-07-05 09:52:41 +00:00
machenbach
0960beb0ef Revert of [intrinsic] Drop the %_ValueOf intrinsic. (patchset #2 id:20001 of https://codereview.chromium.org/2126453002/ )
Reason for revert:
[Sheriff] Breaks without i18n:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/8466

Original issue's description:
> [intrinsic] Drop the %_ValueOf intrinsic.
>
> This drops the %_ValueOf intrinsic, but keeps the runtime entry
> %ValueOf for now, by either migrating the functionality (mostly
> Debug mirror or toString/valueOf methods) to C++ or TurboFan
> builtins, or switching to the %ValueOf runtime call when it's
> not performance critical anyways.
>
> The %_ValueOf intrinsic was one of the last blockers for fixing
> the unsound machine operator typing in TurboFan.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
> Cr-Commit-Position: refs/heads/master@{#37512}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2117273002
Cr-Commit-Position: refs/heads/master@{#37514}
2016-07-05 08:01:06 +00:00
bmeurer
293bd78829 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2126453002
Cr-Commit-Position: refs/heads/master@{#37512}
2016-07-05 06:47:53 +00:00
danno
bd0d9e7d87 [turbofan]: Support using push instructions for setting up tail call parameters
This optimizes the passing of stack parameters in function calls.

For some architectures (ia32/x64), using pushes when possible instead
of bumping the stack and then storing parameters generates much
smaller code, and in some cases is faster (e.g. when a push of a memory
location can implement a memory-to-memory copy and thus elide an
intermediate load. On others (e.g. ARM), the benefit is smaller, where
it's only possible to elide direct stack pointer adjustment in certain cases
or combine multiple register stores into a single instruction in other limited
situations. On yet other platforms (ARM64, MIPS), there are no push instructions,
and this optimization isn't used at all.

Ideally, this mechanism would be used for both tail calls and normal calls,
but "normal" calls are currently pretty efficient, and tail calls are very
inefficient, so this CL sets the bar low for building a new mechanism to
handle parameter pushing that only needs to raise the bar on tail calls for now.

The key aspect of this change is that adjustment to the stack pointer
for tail calls (and perhaps later real calls) is an explicit step separate from
instruction selection and gap resolution, but aware of both, making it possible
to safely recognize gap moves that are actually pushes.

Review-Url: https://codereview.chromium.org/2082263002
Cr-Commit-Position: refs/heads/master@{#37477}
2016-07-01 11:28:19 +00:00
bmeurer
0a0fe8fb8b [builtins] Unify most of the remaining Math builtins.
Import fdlibm versions of acos, acosh, asin and asinh, which are more
precise and produce the same result across platforms (we were using
libm versions for asin and acos so far, where both speed and precision
depended on the operating system so far). Introduce appropriate TurboFan
operators for these functions and use them both for inlining and for the
generic builtin.

Also migrate the Math.imul and Math.fround builtins to TurboFan builtins
to ensure that their behavior is always exactly the same as the inlined
TurboFan version (i.e. C++ truncation semantics for double to float
don't necessarily meet the JavaScript semantics).

For completeness, also migrate Math.sign, which can even get some nice
love in TurboFan.

Drive-by-fix: Some alpha-sorting on the Math related functions, and
cleanup the list of Math intrinsics that we have to export via the
native context currently.

BUG=v8:3266,v8:3496,v8:3509,v8:3952,v8:5169,v8:5170,v8:5171,v8:5172
TBR=rossberg@chromium.org
R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2116753002
Cr-Commit-Position: refs/heads/master@{#37476}
2016-07-01 11:13:02 +00:00
titzer
fa69cbb86b [turbofan] Allow OptionalOperator to return a placeholder.
R=bmeurer@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2112733003
Cr-Commit-Position: refs/heads/master@{#37445}
2016-06-30 14:18:35 +00:00
bbudge
aca3716a50 [Turbofan] Add Simd128 registers to RegisterConfiguration.
-Defines SIMD128_REGISTERS for all platforms.
-Adds Simd128 register information to RegisterConfiguration, and implements
aliasing calculations.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2092103004
Cr-Commit-Position: refs/heads/master@{#37437}
2016-06-30 11:29:36 +00:00
mvstanton
cede9ce5e1 [builtins] Unify Cosh, Sinh and Tanh as exports from flibm
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2083573002
Cr-Commit-Position: refs/heads/master@{#37424}
2016-06-30 08:44:46 +00:00
georgia.kouveli
317dc0578f [arm64] Generate adds/ands.
Perform the following transformation:

    | Before           | After               |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp w2, #0x0     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp #0x0, w2     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |

and the same for and instructions instead of add.  When the result of the
add/and is not used, generate cmn/tst instead. We need to take care with which
conditions we can handle and what new condition we map them to.

BUG=

Review-Url: https://codereview.chromium.org/2065243005
Cr-Commit-Position: refs/heads/master@{#37400}
2016-06-29 14:57:49 +00:00
bmeurer
6f920d7d59 [turbofan] Disallow typing for change/checked operators.
There are no useful typing rules for Change and Checked operators, so we
better make sure we don't run them through the Typer at all.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2107783004
Cr-Commit-Position: refs/heads/master@{#37382}
2016-06-29 10:32:19 +00:00
bmeurer
be32c055f1 [turbofan] Drop the obsolete TypeGuard operator.
The only real use case left for TypeGuard was the renaming inside the
LoadElimination, but this case only occurs in dead code (guarded by a
previous Check), so it's not relevant, and we can drop the TypeGuard
operator completely.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2108793003
Cr-Commit-Position: refs/heads/master@{#37361}
2016-06-29 06:36:05 +00:00
bmeurer
e607e12ea0 [turbofan] Introduce Float64Pow and NumberPow operators.
Introduce a new machine operator Float64Pow that for now is backed by
the existing MathPowStub to start the unification of Math.pow, and at
the same time address the main performance issue that TurboFan still has
with the imaging-darkroom benchmark in Kraken.

Also migrate the Math.pow builtin itself to a TurboFan builtin and
remove a few hundred lines of hand-written platform code for special
handling of the fullcodegen Math.pow version.

BUG=v8:3599,v8:5086,v8:5157

Review-Url: https://codereview.chromium.org/2103733003
Cr-Commit-Position: refs/heads/master@{#37323}
2016-06-28 10:26:10 +00:00
neis
41f5f0c0ba Rip out most of our outdated modules implementation.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2081733004
Cr-Commit-Position: refs/heads/master@{#37311}
2016-06-28 07:25:38 +00:00
bmeurer
f50a601ffa [turbofan] Introduce simplified operator NumberAbs.
Add NumberAbs operator to implement an inline version of Math.abs, that
can be optimized and eliminated. We don't use any speculation here, but
for now stick to the information we can infer (this way we avoid the
inherent deopt loops that Crankshaft has around Math.abs).

CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
R=jarin@chromium.org
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2096403002
Cr-Commit-Position: refs/heads/master@{#37306}
2016-06-28 04:37:02 +00:00
bbudge
257336d26a [RegisterConfiguration] Streamline access to arch defaults, simplify Registers.
Replaces ArchDefault method with Crankshaft and Turbofan getters.
Eliminates IsAllocated method on Register, FloatRegister, DoubleRegister.
Eliminates ToString method too.
Changes call sites to access appropriate arch default RegisterConfiguration.

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2092413002
Cr-Commit-Position: refs/heads/master@{#37297}
2016-06-27 15:31:31 +00:00
bbudge
5107f1c135 [Turbofan] Allow compiler to elide complex aliasing code.
- Add a const bool kSimpleFPAliasing variable for each platform so it's
easier for the compiler to eliminate dead code.
- Modify RegisterAllocator to use it.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2101473002
Cr-Commit-Position: refs/heads/master@{#37288}
2016-06-27 11:57:51 +00:00
bbudge
a933b7044a [Turbofan] Add the concept of aliasing to RegisterConfiguration.
- Adds the concept of FP register aliasing to RegisterConfiguration.
- Changes RegisterAllocator to distinguish between FP representations
when allocating.
- Changes LinearScanAllocator to detect interference when FP register
aliasing is combining, as on ARM.
- Changes ARM code generation to allow all registers s0 - s31 to be
accessed.
- Adds unit tests for RegisterConfiguration, mostly to test aliasing
calculations.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2086653003
Cr-Commit-Position: refs/heads/master@{#37251}
2016-06-24 12:45:05 +00:00
ivica.bogosavljevic
42ac51c82e Fix int64 lowering on big-endian architectures.
Lowering of Int64Load, Int64Store, BitcastInt64ToFloat64 and
BitcastFloat64ToInt64 was using LE word ordering in memory,
causing failures on some tests.

BUG=mjsunit/regress/regress-599719,mjsunit/regress/regress-599717

Review-Url: https://codereview.chromium.org/2080213004
Cr-Commit-Position: refs/heads/master@{#37213}
2016-06-23 11:41:07 +00:00
georgia.kouveli
f5d90fc9f2 [arm64] Fix handling of CMN and ADD/SUB with overflow in VisitBinop.
CMN is a flag-setting add operation, and therefore is commutative.
{Add,Sub}WithOverflow generate ADD/SUB instructions that cannot
support a ROR shift.

BUG=

Review-Url: https://codereview.chromium.org/2087233005
Cr-Commit-Position: refs/heads/master@{#37212}
2016-06-23 11:29:20 +00:00
bmeurer
c30b854aa3 [turbofan] Some strength reduction on Smi/HeapObject checks.
Let the SimplifiedOperatorReducer perform some strength reduction for
certain CheckTaggedSigned and CheckTaggedPointer inputs (reusing the
existing logic for ObjectIsSmi).

R=jarin@chromium.org
BUG=v8:5141

Review-Url: https://codereview.chromium.org/2080703006
Cr-Commit-Position: refs/heads/master@{#37167}
2016-06-22 07:52:19 +00:00
bmeurer
00889cc29c [turbofan] Address the useless overflow bit materialization.
Add control dependencies to Projection and Int32Add/SubWithOverflow
operators, to prevent the scheduler from moving the Projection nodes
into the wrong place. This way the instruction selection can combine
the Int32Add/SubWithOverflow operations with the DeoptimizeIf and/or
DeoptimizeUnless nodes. This needs new operators CheckedInt32Add and
CheckedInt32Sub so that we can delay the actual lowering until the
effect/control linearizer.

This also makes CheckIf operator obsolete, so we can drop it.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2082993002
Cr-Commit-Position: refs/heads/master@{#37148}
2016-06-21 15:46:40 +00:00
bmeurer
99eb5686e9 [turbofan] Introduce CheckTaggedSigned and CheckTaggedPointer operators.
These are used to check for Smi or HeapObject, and we use them
appropriately in JSNativeContextSpecialization, so we don't need
to introduce dependencies on concrete control flow and/or concrete
frame states.

They will be optimized by a proper check elimination reducer,
which will be added in a separate CL.

R=jarin@chromium.org
BUG=v8:4470

Review-Url: https://codereview.chromium.org/2082523002
Cr-Commit-Position: refs/heads/master@{#37096}
2016-06-20 10:48:55 +00:00
bmeurer
c87168bc8c [builtins] Introduce proper Float64Tan operator.
Import base::ieee754::tan() from fdlibm and introduce Float64Tan TurboFan
operator based on that, similar to what we do for Float64Cos and Float64Sin.
Rewrite Math.tan() as TurboFan builtin and use those operators to also
inline Math.tan() into optimized TurboFan functions.

Drive-by-fix: Kill the %_ConstructDouble intrinsics, and provide only
the %ConstructDouble runtime entry for writing tests.

BUG=v8:5086,v8:5126
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2083453002
Cr-Commit-Position: refs/heads/master@{#37087}
2016-06-20 05:51:52 +00:00
bmeurer
c781e83194 [builtins] Introduce proper Float64Cos and Float64Sin.
Import base::ieee754::cos() and base::ieee754::sin() from fdlibm and
introduce Float64Cos and Float64Sin TurboFan operator based on that,
similar to what we do for Float64Log. Rewrite Math.cos() and Math.sin()
as TurboFan builtins and use those operators to also inline Math.cos()
and Math.sin() into optimized TurboFan functions.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
R=mvstanton@chromium.org
BUG=v8:5086,v8:5118

Review-Url: https://codereview.chromium.org/2073123002
Cr-Commit-Position: refs/heads/master@{#37072}
2016-06-17 15:24:15 +00:00
mvstanton
4d4eb61111 [builtins] Unify Atanh, Cbrt and Expm1 as exports from flibm.
BUG=v8:5103

Review-Url: https://codereview.chromium.org/2068743002
Cr-Commit-Position: refs/heads/master@{#37058}
2016-06-17 09:14:38 +00:00
bmeurer
d5f2ac5e33 [builtins] Introduce proper Float64Exp operator.
Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.exp() as TurboFan builtin and use that operator to also
inline Math.exp() into optimized TurboFan functions.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108,chromium:620786
R=mvstanton@chromium.org

Committed: https://crrev.com/93e26314afc9da9b5b8bd998688262444ed73260
Review-Url: https://codereview.chromium.org/2077533002
Cr-Original-Commit-Position: refs/heads/master@{#37037}
Cr-Commit-Position: refs/heads/master@{#37047}
2016-06-17 05:20:59 +00:00
martyn.capewell
d3597aee1f [turbofan] Replace shr of masked bits with zero
If (mask >>> s) == 0, ((x & mask) >> s) == 0, so replace the node with zero in
MachineOperatorReducer.

BUG=

Review-Url: https://codereview.chromium.org/2069973002
Cr-Commit-Position: refs/heads/master@{#37046}
2016-06-17 04:49:32 +00:00
machenbach
789b0ad77a Revert of [builtins] Introduce proper Float64Exp operator. (patchset #5 id:80001 of https://codereview.chromium.org/2077533002/ )
Reason for revert:
[Sheriff] Leads to some different rounding as it seems in some audio layout tests. Please rebase upstream first if intended:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/7508

Original issue's description:
> [builtins] Introduce proper Float64Exp operator.
>
> Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
> TurboFan operator based on that, similar to what we do for Float64Log.
> Rewrite Math.exp() as TurboFan builtin and use that operator to also
> inline Math.exp() into optimized TurboFan functions.
>
> BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
> R=mvstanton@chromium.org
>
> Committed: https://crrev.com/93e26314afc9da9b5b8bd998688262444ed73260
> Cr-Commit-Position: refs/heads/master@{#37037}

TBR=mvstanton@chromium.org,ahaas@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108

Review-Url: https://codereview.chromium.org/2070813002
Cr-Commit-Position: refs/heads/master@{#37039}
2016-06-16 12:49:53 +00:00
bmeurer
93e26314af [builtins] Introduce proper Float64Exp operator.
Import base::ieee754::exp() from FreeBSD msun and introduce a Float64Exp
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.exp() as TurboFan builtin and use that operator to also
inline Math.exp() into optimized TurboFan functions.

BUG=v8:3266,v8:3468,v8:3493,v8:5086,v8:5108
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2077533002
Cr-Commit-Position: refs/heads/master@{#37037}
2016-06-16 12:10:27 +00:00
mvstanton
d9bf520a22 [builtins] Introduce proper Float64Log2 and Float64Log10 operators.
BUG=v8:5095

Review-Url: https://codereview.chromium.org/2063693002
Cr-Commit-Position: refs/heads/master@{#37035}
2016-06-16 11:25:06 +00:00
jarin
a49c4b0a47 [turbofan] Type feedback for numeric comparisons.
Review-Url: https://codereview.chromium.org/2035383003
Cr-Commit-Position: refs/heads/master@{#37024}
2016-06-16 06:37:31 +00:00
bmeurer
ed0039a72e [turbofan] Unify the PlainPrimitive as Number treatment.
Now that we have the PlainPrimitiveToNumber operator(s), we can unify
all the places where we expect a number, but can also safely handle any
plain-primitive (via ToNumber truncation).

Drive-by-fix: Also handle Math.min consistently with Math.max.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2064953004
Cr-Commit-Position: refs/heads/master@{#36984}
2016-06-15 05:45:53 +00:00
cbruni
dc2e3069e7 Reland of place all remaining Oddball checks with new function (patchset #1 id:1 of https://codereview.chromium.org/2060213002/ )
Reason for revert:
Cannot reproduce gc-stress failures locally.

Original issue's description:
> Revert of Replace all remaining Oddball checks with new function (patchset #10 id:180001 of https://codereview.chromium.org/2043183003/ )
>
> Reason for revert:
> failing tests
>
> Original issue's description:
> > Replace all remaining Oddball checks with new function
> >
> > This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
> > The new method all take the isolate as parameter.
> >
> > BUG=
> >
> > Committed: https://crrev.com/ccefb3ae5fe967288d568013fb04e8761eafebc5
> > Cr-Commit-Position: refs/heads/master@{#36921}
>
> TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/33b8bc24a12fb062100c0be84456faeb0b9fa5d1
> Cr-Commit-Position: refs/heads/master@{#36923}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2059173002
Cr-Commit-Position: refs/heads/master@{#36957}
2016-06-14 10:09:38 +00:00
cbruni
33b8bc24a1 Revert of Replace all remaining Oddball checks with new function (patchset #10 id:180001 of https://codereview.chromium.org/2043183003/ )
Reason for revert:
failing tests

Original issue's description:
> Replace all remaining Oddball checks with new function
>
> This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
> The new method all take the isolate as parameter.
>
> BUG=
>
> Committed: https://crrev.com/ccefb3ae5fe967288d568013fb04e8761eafebc5
> Cr-Commit-Position: refs/heads/master@{#36921}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2060213002
Cr-Commit-Position: refs/heads/master@{#36923}
2016-06-13 11:40:35 +00:00
cbruni
ccefb3ae5f Replace all remaining Oddball checks with new function
This CL removes the IsUndefined() and Co. methods from Object and HeapObject.
The new method all take the isolate as parameter.

BUG=

Review-Url: https://codereview.chromium.org/2043183003
Cr-Commit-Position: refs/heads/master@{#36921}
2016-06-13 10:21:02 +00:00
bmeurer
89d8c57b9c [builtins] Introduce proper Float64Atan and Float64Atan2 operators.
Import base::ieee754::atan() and base::ieee754::atan2() from fdlibm and
introduce Float64Atan and Float64Atan2 TurboFan operators based on those,
similar to what we already did for Float64Log and Float64Log1p. Rewrite
Math.atan() and Math.atan2() as TurboFan builtin and use the operators
to also inline Math.atan() and Math.atan2() into optimized TurboFan functions.

R=yangguo@chromium.org
BUG=v8:5086,v8:5095

Review-Url: https://codereview.chromium.org/2065503002
Cr-Commit-Position: refs/heads/master@{#36916}
2016-06-13 07:08:17 +00:00
bmeurer
7ceed92ac0 [builtins] Introduce proper Float64Log1p operator.
Import base::ieee754::log1p() from fdlibm and introduce a Float64Log1p
TurboFan operator based on that, similar to what we do for Float64Log.
Rewrite Math.log1p() as TurboFan builtin and use that operator to also
inline Math.log1p() into optimized TurboFan functions.

Also unify the handling of the special IEEE 754 functions somewhat in
the TurboFan backends. At some point we can hopefully express this
completely in the InstructionSelector (once we have an idea what to do
with the ST(0) return issue on IA-32/X87).

Drive-by-fix: Add some more test coverage for the log function.

R=yangguo@chromium.org
BUG=v8:5086,v8:5092

Review-Url: https://codereview.chromium.org/2060743002
Cr-Commit-Position: refs/heads/master@{#36914}
2016-06-13 05:48:02 +00:00
mtrofin
8e1ccba3b0 [turbofan] Retiring Greedy Allocator
We were able to achieve our goals for register allocation independent of
the allocation algorithm. Performance data so far is inconclusive re. the
value of the Greedy algorithm, compared to the particular Linear Scan
implementation we're currently using, and the performance measurement
techniques we currently use are too imprecise to help with this matter.

Retiring the algorithm to lower maintenance and evolution cost (e.g. lower
cost of adding aliasing support). Once we improve benchmarking stability,
and establish a suite sensitive enough for codegen improvement studies,
we may revive the algorithm, should the need arise.

BUG=

Review-Url: https://codereview.chromium.org/2060673002
Cr-Commit-Position: refs/heads/master@{#36912}
2016-06-13 04:24:12 +00:00
jarin
2890137bdc [turbofan] Introduce PlainPrimitiveToNumber.
This should solve the problem with missing checkpoints after JSToNumber
(PlainPrimitiveToNumber is marked no-write, so the frame-state
propagation should see through it.)

Unfortunately, this also duplicates the word32- and float64-truncation
magic that we have for JSToNumber in "simplified lowering".

Review-Url: https://codereview.chromium.org/2059653002
Cr-Commit-Position: refs/heads/master@{#36881}
2016-06-10 07:45:23 +00:00
bmeurer
d0c7775d7c [builtins] Introduce proper base::ieee754::log.
This switches Math.log to use an fdlibm based version of log, imported
as base::ieee754::log, and use that consistently everywhere, i.e. change
the Float64Log TurboFan operators on Intel to use the C++ implementation
as well (same for Crankshaft).

R=yangguo@chromium.org
BUG=v8:5065,v8:5086

Review-Url: https://codereview.chromium.org/2053893003
Cr-Commit-Position: refs/heads/master@{#36880}
2016-06-10 05:54:12 +00:00
bmeurer
c91c396112 [turbofan] Do strength reduction for ObjectIsSmi based on inputs.
Ideally we would have a dedicated MachineRepresentation for Smis during
representation selection and use that to properly optimize ObjectIsSmi
(and other ObjectIs<Type> predicates), but that will take some time to
get that done. So in the meantime we can just do simple (local) strength
reduction on ObjectIsSmi to avoid Smi checks in the simplest cases at
least.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2047213002
Cr-Commit-Position: refs/heads/master@{#36809}
2016-06-08 07:13:05 +00:00
neis
6ddd8314a5 [compiler] Deal with some old TODOs in the typer.
This is mostly about DCHECKs. Enabling some requires a few
changes to tests that were not careful about types.

BUG=

Review-Url: https://codereview.chromium.org/2033703002
Cr-Commit-Position: refs/heads/master@{#36734}
2016-06-06 09:18:30 +00:00
bbudge
39442cf714 Add FloatRegister names to RegisterConfiguration.
- Adds names for float registers to RegisterConfiguration and uses them
when we have the MachineRepresentation.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2030143002
Cr-Commit-Position: refs/heads/master@{#36712}
2016-06-03 13:02:13 +00:00
mstarzinger
28e6753acc [turbofan] Remove frame state input from speculative ops.
These speculative binary operators are simplified operators and should
not need a frame state themselves. These eager bailout points can by now
be found via checkpoints in the graph, whereas frame states attached to
nodes directly should always represent lazy bailout points.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2037673002
Cr-Commit-Position: refs/heads/master@{#36705}
2016-06-03 10:02:04 +00:00
bmeurer
f2da19fe39 [builtins] Migrate Math.log to TurboFan.
Introduce a dedicated Float64Log machine operator, that is either
implemented by a direct C call or by platform specific code, i.e.
using the FPU on x64 and ia32.

This operator is used to implement Math.log as a proper TurboFan
builtin on top of the CodeStubAssembler.

Also introduce a NumberLog simplified operator on top of Float64Log
and use that for the fast inline path of Math.log inside TurboFan
optimized code.

BUG=v8:5065

Review-Url: https://codereview.chromium.org/2029413005
Cr-Commit-Position: refs/heads/master@{#36703}
2016-06-03 09:48:25 +00:00
mstarzinger
bf7034bfed [turbofan] Remove eager frame state from property access.
This removes the frame state input representing the before-state from
nodes performing property accesses. These frame states can by now be
found via checkpoints in the graph.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2034673002
Cr-Commit-Position: refs/heads/master@{#36699}
2016-06-03 08:59:32 +00:00
jarin
216bcf9fb3 [turbofan] Initial version of number type feedback.
This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to
     definitions until checkpoint is reached. It also records type-check decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types (and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes and/or checks.

3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one place and
  with clearer input/output protocol for each sub-phase. I would prefer to do this once
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would affect
  the kind of truncations that they can handle. E.g., if we know that a node produces
  a number, we can omit the oddball check in the CheckedTaggedToFloat64 lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n

Review-Url: https://codereview.chromium.org/1921563002
Cr-Commit-Position: refs/heads/master@{#36674}
2016-06-02 09:23:13 +00:00
Benedikt Meurer
bea121aaa5 [turbofan] Eager frame state gone from JSCallFunction.
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2038463003 .

Cr-Commit-Position: refs/heads/master@{#36672}
2016-06-02 08:49:30 +00:00
mstarzinger
864b07e9eb [turbofan] Remove eager frame state from call nodes.
This removes the frame state input representing the before-state from
nodes having the {JSCallFunction} or {JSCallConstruct} operator. These
frame states can by now be found via checkpoints in the graph.

R=bmeurer@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2025573003
Cr-Commit-Position: refs/heads/master@{#36669}
2016-06-02 08:04:29 +00:00
bmeurer
5a3a6dafae [turbofan] Add new StringFromCharCode simplified operator.
We use StringFromCharCode to optimize calls to String.fromCharCode with
a single Number argument for now. We will use it to also implement the
charAt method on the String prototype.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2037453003
Cr-Commit-Position: refs/heads/master@{#36668}
2016-06-02 08:01:48 +00:00
mstarzinger
d673d8908a [turbofan] Rename {CheckPoint} to {Checkpoint} everywhere.
R=bmeurer@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2022033004
Cr-Commit-Position: refs/heads/master@{#36637}
2016-06-01 09:07:19 +00:00
mstarzinger
7ecf1a059b [turbofan] Implement simplistic checkpoint reducer.
This adds a very simplistic reduction of {CheckPoint} nodes via the new
{CheckpointElimination}, eliminating redundant check points that appear
in an effect chain of operations that are all {kNoWrite}. Such a chain
allows an arbitrary check point to be chosen. The current approach will
end up choosing the first one for all deopts in the chain.

R=bmeurer@chromium.org
TEST=unittests/CheckpointEliminationTest.CheckPointChain
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2022913003
Cr-Commit-Position: refs/heads/master@{#36634}
2016-06-01 08:39:11 +00:00
pierre.langlois
27bd1747b4 [turbofan] ARM64: Match 64 bit compare with zero and branch
This patch enables the following transformations in the instruction
selector:

| Before           | After                  |
|------------------+------------------------|
| and x3, x1, #0x1 | tb{,n}z w1, #0, #+0x78 |
| cmp x3, #0x0     |                        |
| b.{eq,ne} #+0x80 |                        |
|------------------+------------------------|
| cmp x0, #0x0     | cb{,n}z x0, #+0x48     |
| b.{eq,ne} #+0x4c |                        |

I have not seen these patterns beeing generated by turbofan, however the
stubs hit these cases frequently. A particular reason is that we are
turning operations that check for a Smi into a single `tbz`.

As a concequence, the interpreter is affected thanks to inlining
turbofan stubs into it's bytecode handlers. I have noticed the size of
the interpreter was reduced by 200 instructions.

BUG=

Review-Url: https://codereview.chromium.org/2022073002
Cr-Commit-Position: refs/heads/master@{#36632}
2016-06-01 08:03:01 +00:00
bbudge
270a284fd0 Turbofan: Rename IsFloat -> IsFP
Rename some methods to reflect the fact that there are multiple FP
machine representations.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2013193002
Cr-Commit-Position: refs/heads/master@{#36552}
2016-05-27 17:44:41 +00:00
georgia.kouveli
612bad1d22 [arm] [arm64] Add optional operators Float32Neg and Float64Neg.
Adding optional operators for FNeg for WebAssembly, as the current implementation was significantly suboptimal for ARM.

Review-Url: https://codereview.chromium.org/2011303002
Cr-Commit-Position: refs/heads/master@{#36544}
2016-05-27 11:22:07 +00:00
bmeurer
dd609a5d3d [turbofan] Remove the EmptyFrameState caching on JSGraph.
Caching nodes with mutable inputs is a bad idea and already blew up
twice now, so in order to avoid further breakage, let's kill the
EmptyFrameState caching on JSGraph completely and only cache the empty
state values there.

We can remove the hacking from JSTypedLowering completely once we have
the PlainPrimitiveToNumber in action.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2006423003
Cr-Commit-Position: refs/heads/master@{#36511}
2016-05-25 11:05:13 +00:00
mstarzinger
7ca1f80d31 [runtime] Fix number of literals for builtin functions.
This fixes the SharedFunctionInfo::num_literals field for global builtin
functions (e.g. {Object} and friends) to be accurate. The field was not
being updated by Runtime_SetCode. It also removes the dangerous and by
now obsolete JSFunction::NumberOfLiterals accessor.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2007943002
Cr-Commit-Position: refs/heads/master@{#36480}
2016-05-24 15:12:58 +00:00
pierre.langlois
11b661f414 [turbofan] ARM: Support shifted indexes in loads and stores
This patch is a follow up to https://codereview.chromium.org/1972103002/
adding support for the `Operand_R_LSL_I` addressing mode to loads and
stores for ARM.

Just as the ARM64 implementation, the shift + load/store pattern is only
really relevant to the interpreter. For this reason, this patch does not
add support for the other addressing modes (`R_LSR_I`, `R_ASR_I` and
`R_ROR_I`) as I haven't seen those pattern being generated. Additionally,
the optimization is restricted 32 bit loads and stores.

kind = BYTECODE_HANDLER
name = Star
compiler = turbofan
Instructions (size = 40)
0x22a5f860     0  e2851001       add r1, r5, #1
0x22a5f864     4  e19610d1       ldrsb r1, [r6, +r1]
0x22a5f868     8  e1a0200b       mov r2, fp
0x22a5f86c    12  e7820101       str r0, [r2, +r1, lsl #2]
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^
0x22a5f870    16  e2855002       add r5, r5, #2
0x22a5f874    20  e7d61005       ldrb r1, [r6, +r5]
0x22a5f878    24  e7981101       ldr r1, [r8, +r1, lsl #2]
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^
0x22a5f87c    28  e12fff11       bx r1

BUG=

Review-Url: https://codereview.chromium.org/1974263002
Cr-Commit-Position: refs/heads/master@{#36381}
2016-05-19 19:18:25 +00:00
jacob.bramley
feeaac4061 [arm] Remove CpuFeature::MLS.
The MLS instruction is available in all ARMv7 devices, and in no ARMv6
devices, aside from the usual ARMv6T2 caveat. We don't need a separate
feature flag for it.

BUG=

Review-Url: https://codereview.chromium.org/1988133004
Cr-Commit-Position: refs/heads/master@{#36378}
2016-05-19 18:04:28 +00:00
neis
75140f39dd [compiler] Remove obsolete JSYield operator.
R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1981323002
Cr-Commit-Position: refs/heads/master@{#36312}
2016-05-18 08:55:33 +00:00
bmeurer
91a2ea815b [turbofan] We never use Int64Constant for branch/select conditions.
Remove dead code to optimize Int64Constants as branch/select conditions,
because we either have tagged booleans or bits represented as word32.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994533002
Cr-Commit-Position: refs/heads/master@{#36308}
2016-05-18 07:20:19 +00:00
bmeurer
c5a71f029f [turbofan] Turn common Guard operator into simplified TypeGuard.
The type guard should never be used after the effect/control
linearization pass, so making it a simplified operator better
expresses the intended use. Also this way none of the common
operators actually has any dependency on the type system.

Drive-by-fix: Properly print the type parameter to a TypeGuard operator.

BUG=chromium:612142
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1994503002
Cr-Commit-Position: refs/heads/master@{#36304}
2016-05-18 06:19:30 +00:00
bmeurer
551e0aa11b [es6] Reintroduce the instanceof operator in the backends.
This adds back the instanceof operator support in the backends and
introduces a @@hasInstance protector cell on the isolate that guards the
fast path for the InstanceOfStub. This way we recover the ~10%
regression on Octane EarleyBoyer in Crankshaft and greatly improve
TurboFan and Ignition performance of instanceof.

R=ishell@chromium.org
TBR=hpayer@chromium.org,rossberg@chromium.org
BUG=chromium:597249, v8:4447
LOG=n

Review-Url: https://codereview.chromium.org/1980483003
Cr-Commit-Position: refs/heads/master@{#36275}
2016-05-17 11:25:59 +00:00
pierre.langlois
60fb6ea1b8 [turbofan] ARM64: Support shifted indexes in loads and stores
This patch adds support for the `Operand2_R_LSL_I` addressing mode to
loads and stores. This allows merging a shift instruction into a
MemoryOperand. Since the shift immediate is restricted to the log2 of
the operation width, the opportunities to hit this are slim. However,
Ignition's bytecode handlers hit this case all the time:

kind = BYTECODE_HANDLER
name = Star
compiler = turbofan
Instructions (size = 44)
0x23e67280     0  add x1, x19, #0x1 (1)
0x23e67284     4  ldrsb x1, [x20, x1]
0x23e67288     8  sxtw x1, w1
0x23e6728c    12  mov x2, fp
0x23e67290    16  str x0, [x2, x1, lsl #3]
                  ^^^^^^^^^^^^^^^^^^^^^
0x23e67294    20  add x19, x19, #0x2 (2)
0x23e67298    24  ldrb w1, [x20, x19]
0x23e6729c    28  ldr x1, [x21, x1, lsl #3]
                  ^^^^^^^^^^^^^^^^^^^^^
0x23e672a0    32  br x1

Additionally, I noticed the optimisation occurs once in both the
`StringPrototypeCharAt` and `StringPrototypeCharCodeAt` turbofan stubs.

BUG=

Review-Url: https://codereview.chromium.org/1972103002
Cr-Commit-Position: refs/heads/master@{#36227}
2016-05-13 07:58:59 +00:00
bmeurer
fa7460adbc [turbofan] Fix optimized lowering of Math.imul.
We eagerly inserted Int32Mul for Math.imul during builtin lowering and
messed up with the types, which confused the representation selection.
This adds a proper NumberImul operator, and fixes the builtin reducer to
do the right thing according to the spec.

R=mstarzinger@chromium.org
BUG=v8:5006
LOG=n

Review-Url: https://codereview.chromium.org/1971163002
Cr-Commit-Position: refs/heads/master@{#36219}
2016-05-12 18:43:32 +00:00
bmeurer
1270caeda4 [turbofan] Unify function prototype constant folding.
Up until now we had two places where we did the function prototype
folding, once in the Typer and once in JSTypedLowering. Put this logic
into JSNativeContextSpecialization instead.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1965293002
Cr-Commit-Position: refs/heads/master@{#36157}
2016-05-11 08:12:49 +00:00
bmeurer
2301473a88 [turbofan] Slighly improve JSCreateArguments lowering.
Make JSCreateArguments eliminatable, and remove the need for frame
states on JSCreateArguments nodes being lowered to (optimized) stub
calls. Only the runtime fallback needs a frame state, because in that
case we need to ask the deoptimizer for arguments to inlined functions.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1965013005
Cr-Commit-Position: refs/heads/master@{#36154}
2016-05-11 06:12:00 +00:00
bmeurer
b8229ec446 [turbofan] Initial version of allocation folding and write barrier elimination.
This adds a new pass MemoryOptimizer that walks over the effect chain
from Start and lowers all Allocate, LoadField, StoreField, LoadElement,
and StoreElement nodes, trying to fold allocations into allocation
groups and eliminate write barriers on StoreField and StoreElement if
possible (i.e. if the object belongs to the current allocation group and
that group allocates in new space).

R=hpayer@chromium.org, jarin@chromium.org
BUG=v8:4931, chromium:580959
LOG=n

Review-Url: https://codereview.chromium.org/1963583004
Cr-Commit-Position: refs/heads/master@{#36128}
2016-05-10 10:12:25 +00:00
jkummerow
148e7076ca Turn on -Wmissing-field-initializers on Linux.
Because not initializing fields can be, you know, dangerous.

Review-Url: https://codereview.chromium.org/1952703002
Cr-Commit-Position: refs/heads/master@{#36071}
2016-05-06 10:20:30 +00:00
bmeurer
8e5e6333cf [turbofan] Remove obsolete EffectSet common operator.
This operator was initially designed to handle arbitrary effect merging
for effect relaxation, but we don't do that (at least currently). So no
need to keep the dead operator around.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1954983002
Cr-Commit-Position: refs/heads/master@{#36063}
2016-05-06 07:46:44 +00:00
pierre.langlois
f07d2cdd6a ARM64: [turbofan] Avoid zero-extension after a 32-bit load
A load instruction will implicitely clear the top 32 bits when writing to a W
register. This patch avoids generating a `mov` instruction to zero-extend the
result in this case.

For example, this occurs in the generated code for dispatching to the next
bytecode in the interpreter:

  kind = BYTECODE_HANDLER
  name = LdaZero
  compiler = turbofan
  Instructions (size = 36)
  0x32e64c60     0  add x19, x19, #0x1 (1)
  0x32e64c64     4  ldrb w0, [x20, x19]
  0x32e64c68     8  mov w0, w0
                    ^^^^^^^^^^
  0x32e64c6c    12  lsl x0, x0, #3
  0x32e64c70    16  ldr x1, [x21, x0]
  0x32e64c74    20  movz x0, #0x0
  0x32e64c78    24  br x1

BUG=

Review-Url: https://codereview.chromium.org/1950013003
Cr-Commit-Position: refs/heads/master@{#36038}
2016-05-04 18:35:56 +00:00
bmeurer
ce38a8a92a [turbofan] Inline the allocation fast path.
Now that everything is properly wired to the effect chain when we get to
ChangeLowering, we can safely inline the allocation fast path and only
need to consule the slow path stub fallback when bump pointer allocation
fails.

R=jarin@chromium.org
BUG=v8:4931
LOG=n

Review-Url: https://codereview.chromium.org/1951853002
Cr-Commit-Position: refs/heads/master@{#36022}
2016-05-04 12:44:32 +00:00
martyn.capewell
0322c20d17 [turbofan] ARM64: Use zr to store immediate zero
When storing an immediate integer or floating point zero, use the zero register
as the source value. This avoids the need to sometimes allocate a new register.

BUG=

Review-Url: https://codereview.chromium.org/1945783002
Cr-Commit-Position: refs/heads/master@{#36013}
2016-05-04 10:19:48 +00:00
ahaas
b6db2255e6 [wasm] Mark all 64-bit instructions as supported on 32-bit platforms.
Additionally I removed some stale comments.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1941323002
Cr-Commit-Position: refs/heads/master@{#35976}
2016-05-03 11:47:59 +00:00
bmeurer
4aa02441da [turbofan] Remove left-over change bits from ChangeLowering.
Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
Cr-Commit-Position: refs/heads/master@{#35924}

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35929}
2016-05-02 10:23:43 +00:00
machenbach
b4c3864ba4 Revert of [turbofan] Remove left-over change bits from ChangeLowering. (patchset #2 id:20001 of https://codereview.chromium.org/1941673002/ )
Reason for revert:
[Sheriff] Breaks mac gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/5821

Original issue's description:
> [turbofan] Remove left-over change bits from ChangeLowering.
>
> Now ChangeLowering is only concerned with lowering memory access and
> allocation operations, and all changes are consistently lowered during
> the effect/control linearization pass. The next step is to move the
> left over lowerings to a pass dedicated to eliminate redundant loads and
> stores, eliminate write barriers, fold and inline allocations.
>
> Also remove the atomic regions now that we wire everything into the
> effect chain properly. This is an important step towards allocation
> inlining.
>
> Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
> ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
> ChangeInt31ToTaggedSigned for consistency.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
>
> Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
> Cr-Commit-Position: refs/heads/master@{#35924}

TBR=ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1942733002
Cr-Commit-Position: refs/heads/master@{#35927}
2016-05-02 09:29:19 +00:00
bmeurer
ceca5ae308 [turbofan] Remove left-over change bits from ChangeLowering.
Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Also remove the atomic regions now that we wire everything into the
effect chain properly. This is an important step towards allocation
inlining.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35924}
2016-05-02 08:42:03 +00:00
bbudge
d565ba8ff3 RegisterAllocator: Clean up before adding aliasing.
Remove some unused fields in RegisterAllocationData.
Move some DCHECKS about configuration constraints.
Rename kMaxDoubleRegisters -> kMaxFPRegisters

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1518573002

Cr-Commit-Position: refs/heads/master@{#35777}
2016-04-25 20:11:40 +00:00
bmeurer
dcf178fb29 [turbofan] Move ChangeTaggedToFoo lowerings to EffectControlLinearizer.
These also lower to subgraphs that have to be connected to the effect
and control chains, otherwise removing the atomic regions around heap
allocations would still be unsound.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1916763003

Cr-Commit-Position: refs/heads/master@{#35762}
2016-04-25 12:41:17 +00:00
jarin
692eec3969 [turbofan] Remove obsolete parts of change lowering.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1917753002

Cr-Commit-Position: refs/heads/master@{#35756}
2016-04-25 09:27:18 +00:00
jarin
9cae24b8cc [turbofan] Wire in floating control during effect linearization phase.
Review URL: https://codereview.chromium.org/1921483002

Cr-Commit-Position: refs/heads/master@{#35747}
2016-04-25 04:29:23 +00:00
bmeurer
0231a7efa2 [turbofan] Introduce TruncateTaggedToWord32 simplified operator.
This allows us to get rid of the "push TruncateFloat64ToInt32 into Phi"
trick that was used in the MachineOperatorReducer to combine the
ChangeTaggedToFloat64 and TruncateFloat64ToInt32 operations. Instead of
doing that later, we can just introduce the proper operator during the
representation selection directly.

Also separate the TruncateFloat64ToInt32 machine operator, which had two
different meanings depending on a flag (either JavaScript truncation or
C++ style round to zero). Now there's a TruncateFloat64ToWord32 which
represents the JavaScript truncation (implemented via TruncateDoubleToI
macro + code stub) and the RoundFloat64ToInt32, which implements the C++
round towards zero operation (in the same style as the other WebAssembly
driven Round* machine operators).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1919513002

Cr-Commit-Position: refs/heads/master@{#35743}
2016-04-24 11:41:20 +00:00
bmeurer
550c0f9f55 [turbofan] Move more type checks to the representation selector.
Get rid of further typing checks from ChangeLowering and put them into
the representation selection pass instead (encoding the information in
the operator instead).

Drive-by-change: Rename ChangeSmiToInt32 to ChangeTaggedSignedToInt32
for consistency about naming Tagged, TaggedSigned and TaggedPointer.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1909343002

Cr-Commit-Position: refs/heads/master@{#35723}
2016-04-22 11:03:17 +00:00
bmeurer
861295bf16 [turbofan] Optimize tagged conversion based on type.
If we have to convert a float64 value to tagged representation and we
already know that the value is either in Signed31/Signed32 or
Unsigned32 range, then we can just convert the float64 to word32 and
use the fast word32 to tagged conversion. Doing this in
ChangeLowering (or the effect linearization pass) would be unsound, as
the types on the nodes are no longer usable.

This removes all Type uses from effect linearization. There's still some
work to be done for ChangeLowering tho.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1908093002

Cr-Commit-Position: refs/heads/master@{#35713}
2016-04-22 08:40:05 +00:00
rmcilroy
623ad7de88 [Interpreter] Remove register file register and replace with LoadParentFramePointer.
Removes the register file machine register from the interpreter and
replaces it will loads from the parent frame pointer. As part of this
change the raw operand values for register values changes to enable the
interpreter to keep using the operand value as the offset from the
parent frame pointer.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1894063002

Cr-Commit-Position: refs/heads/master@{#35618}
2016-04-19 12:48:41 +00:00
jarin
b9e287c6d9 [turbofan] Effect linearization after representation inference.
This introduces a compiler pass that schedules the graph and re-wires effect chain according to the schedule. It also connects allocating representation changes to the effect chain, and removes the BeginRegion and EndRegion nodes - they should not be needed anymore because all effectful nodes should be already wired-in.

This is an intermediate CL - the next step is to move lowering of the Change*ToTaggedEffect nodes to StateEffectIntroduction so that we do not have to introduce the effectful versions of nodes.

Review URL: https://codereview.chromium.org/1849603002

Cr-Commit-Position: refs/heads/master@{#35565}
2016-04-18 08:29:51 +00:00
bmeurer
662caac9d2 [turbofan] JSTypeOf, JSStrictEqual, JSStrictNotEqual and JSToBoolean are pure.
These operators are really pure on the JavaScript level, and were only
part of the effect chain to make sure we don't accidentially schedule
them right after raw allocations, which is no longer an issue since we
now have the concept of atomic regions.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1893543004

Cr-Commit-Position: refs/heads/master@{#35552}
2016-04-16 19:28:12 +00:00
mstarzinger
43c7c76f1d [turbofan] Use inline allocation for closures.
This changes closure creation to lower to inline allocations when
possible instead of going through the FastNewClosureStub. It allows us
to leverage all advantages of inline allocations on closures. Note that
it is only safe to embed the raw entry point of the compile lazy stub
into the code, because that stub is immortal and immovable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1573153002

Cr-Commit-Position: refs/heads/master@{#35499}
2016-04-14 15:19:17 +00:00
jarin
f5961f90b1 [turbofan] Change number operations to handle Undefined as well.
This allows us to remove the turbofan bailout that we introduced
as a response to crbug.com/589792.

BUG=chromium:589792
LOG=n

Review URL: https://codereview.chromium.org/1884713003

Cr-Commit-Position: refs/heads/master@{#35493}
2016-04-14 13:13:56 +00:00
bmeurer
5b99eec342 [turbofan] Remove unused PlainPrimitiveToNumber operator.
At some point we thought about using this instead of JSToNumber, but now
there doesn't seem to be any reason for this anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1890763002

Cr-Commit-Position: refs/heads/master@{#35469}
2016-04-14 07:42:22 +00:00