Polymorphic IC feedback can contain up to four (map, handler) pairs.
HandlePolymorphicCase already unrolled checks for the first two pairs; these
are guaranteed to exist and can omit bound checks.
This CL unrolls checks against the final two pairs as well.
BUG=v8:5917
Review-Url: https://codereview.chromium.org/2728293005
Cr-Commit-Position: refs/heads/master@{#43650}
This requires serialized data to track the number of API-provided
external references separately.
And it flushes out a case of serialized data corruption (stored "length"
field too large) that we didn't handle without crashing.
BUG=v8:6055
Review-Url: https://codereview.chromium.org/2736923002
Cr-Commit-Position: refs/heads/master@{#43649}
The receiver in the case of Promise.resolve is the promise
constructor, not an instance of Promise.
BUG=chromium:691875
Change-Id: I43e914aac51077b28c7954c8023780b9174df825
Reviewed-on: https://chromium-review.googlesource.com/450884
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43648}
malloc(0) returning 0 is expected behavior on AIX but
compiling with -D_LINUX_SOURCE_COMPAT, malloc(0) should
return a valid pointer (which we do define for AIX). However,
including cstdlib resets the behaviour of _LINUX_SOURCE_COMPAT.
GCC bug: 79839
R=jochen@chromium.org, titzer@chromium.org
BUG=
LOG=N
Review-Url: https://codereview.chromium.org/2732743002
Cr-Commit-Position: refs/heads/master@{#43647}
So far we only recognize the special
NumberFloor(NumberDivide(lhs, rhs))
subgraph when both lhs and rhs are in the Unsigned32 range, and the
result is a PlainNumber. Extend this pattern matching to also cover
NumberFloor(SpeculativeNumberDivide(lhs, rhs))
and to replace the NumberFloor with NumberToInt32 truncation if the
lhs value is in Signed32 range and the rhs is in Unsigned32 range.
R=jarin@chromium.org
BUG=v8:5267
Review-Url: https://codereview.chromium.org/2739573004
Cr-Commit-Position: refs/heads/master@{#43642}
This pretty much rewrites the preparsed scope data collection. We used to store
the allocation result, but it's faster to just store the raw data which is
needed for deciding it later. (This way we don't need to run the allocation
algorithm for just getting this data.)
For each variable: is_used, maybe_assigned,
has_forced_context_allocation, and for each scope:
inner_scope_calls_eval_.
In addition, this CL moves data handling out of Scope and into
PreParsedScopeData where it belongs and simplifies the API for
PreParsedScopeData.
BUG=v8:5516
R=vogelheim@chromium.org
Change-Id: Ia5a4fa52f585cd4f483ce9a92f2dd7d9754f34ed
Reviewed-on: https://chromium-review.googlesource.com/451273
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43641}
I originally needed this for the initialization of a constexpr array in
the wasm lazy compile builtin, but since it's a bigger change, I now
split it off as this separate CL.
The style guide recommends constexpr over const. I thus apply the
constexprificaton over all headers that I touched anyway.
I also remove the ARM64_DEFINE_REG_STATICS hack. It was introduced when
merging in arm64 support more than three years ago, and I don't see the
purpose for this.
Also, some #defines can now be constexpr definitions, which was not
possible before according to the comment.
R=bmeurer@chromium.org, mstarzinger@chromium.org, ishell@chromium.org
Change-Id: I6d743b4462c347d363f99e28007bc9e8c84ae617
Reviewed-on: https://chromium-review.googlesource.com/451277
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43637}
Several code patching paths actually flushed the icache twice.
This CL removes all icache flushing on wasm updates from
assembler.cc and pushes it into the platform specific
unchecked_update_wasm_size and
unchecked_update_wasm_memory_reference methods. They were already
receiving the ICacheFlushMode, and on some platforms would already
perform the flush.
R=ahaas@chromium.org
Change-Id: I388701f13d733cb5387d5bed4dbed33879179a91
Reviewed-on: https://chromium-review.googlesource.com/450246
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43635}
Otherwise, v8 embedders need to depend on targets in src.
BUG=chromium:688155
Change-Id: Idea90d8f550cd4d0141b92a7bdd18f4df664d11b
Reviewed-on: https://chromium-review.googlesource.com/447845
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43631}
This inlines common LoadIC cases into the LdaNamedProperty bytecode
handler. Smi handlers resulting in constant/field loads for
monomorphic ICs omit frame construction. The same counts for the
polymorphic case as long as the target handler is in the first two
vector slots.
Other cases (megamorphic, uninitialized) call the new
LoadIC_Noninlined stub.
Local benchmarks show up to 6% improvement on Sunspider with --future.
BUG=v8:5917
Review-Url: https://codereview.chromium.org/2733563002
Cr-Commit-Position: refs/heads/master@{#43630}
Oftentimes we can avoid the Smi check for ToBoolean truncations, since
we already know that the input is always going to be a HeapObject. So
introduce a dedicated TruncateTaggedPointerToBit operator, which uses
the fact that the input is known to be a HeapObject.
BUG=v8:5267
R=jarin@chromium.org
Review-Url: https://codereview.chromium.org/2738483002
Cr-Commit-Position: refs/heads/master@{#43629}
The parser already changes all negative equality comparison operations
to their positive pendants in {ParserBase::ParseBinaryExpression}. No
other source of the Token::NE exists in the system. We can remove all
handling from the compiler and interpreter backends.
R=bmeurer@chromium.org
Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10
Reviewed-on: https://chromium-review.googlesource.com/449716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43627}
Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByLength from JS
to CSA.
There are still other callers to typed_array_initialize in
typedarray.js, so we share the implementation using DoInitialize.
In a later CL we can split apart DoInitialize once we have more
TA constructors written in CSA, so that we can reuse specific
parts more easily.
BUG=v8:5977
Change-Id: Ia51e8363970e9a025a82933e56a7baaf82cb1eec
Reviewed-on: https://chromium-review.googlesource.com/448220
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43626}
- Remove TypedArrayIncludes in src/js/typedarray.js
- Implement it to C++ using the IncludesValue implementation
in ElementsAccessor
BUG=v8:5929
Review-Url: https://codereview.chromium.org/2732823002
Cr-Commit-Position: refs/heads/master@{#43625}
Deletion can cause collisions to be moved in the map which breaks iteration.
For now just remove this support. Also add some additional collision tests
to the test.
BUG=v8:5203
Change-Id: I54a0a4af51da08b3f963dc1d7661dba291e4efea
Reviewed-on: https://chromium-review.googlesource.com/445900
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43621}
If the top-level function cannot be found, we previously assumed an
invocation count of 1. This is wrong when we expect the invocation
counts to be reset for precise coverage.
TBR=jgruber@chromium.orgR=caseq@chromium.org,pfeldman@chromium.org
BUG=v8:5808
Review-Url: https://codereview.chromium.org/2723003007
Cr-Commit-Position: refs/heads/master@{#43620}
This CL provide type with each break location, type could be: call, return or debugger statement.
BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org
Review-Url: https://codereview.chromium.org/2728563002
Cr-Commit-Position: refs/heads/master@{#43619}
The concurrent marker uses ObjectVisitor to iterate pointers in objects
and local marking bitmaps to keep track of visited objects.
To keep it simple for now, I removed support for multiple tasks
and canceling unfinished tasks.
BUG=chromium:694255
Review-Url: https://codereview.chromium.org/2732053002
Cr-Commit-Position: refs/heads/master@{#43618}
This extends https://codereview.chromium.org/2728983002 to all of Turbofan, for the same reasons: The machine reducer is unreliable in signalling changed nodes and value numbering is unpredictable if not always re-run on changed nodes. Putting value numbering last in all graph reducers patches this.
BUG=v8:6036
R=mstarzinger@chromium.org
Review-Url: https://codereview.chromium.org/2730753003
Cr-Commit-Position: refs/heads/master@{#43617}
This method could be called on pause and will do stepInto next scheduled callback if any will happen until next break.
First implementation support only callbacks chained by Promise.prototype.then.
BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org
Review-Url: https://codereview.chromium.org/2723273002
Cr-Commit-Position: refs/heads/master@{#43616}
This patch adds a trivial ConcurrentMarking class that can start
background tasks.
BUG=chromium:694255
Review-Url: https://codereview.chromium.org/2728363002
Cr-Commit-Position: refs/heads/master@{#43615}
From asm.js code we might get an empty ArrayBuffer as heap memory. In
this case, both the old memory start and the new memory start will be
nullptr. The size however has to be patched from default_size to 0.
This CL changes code specialization to be able to either patch memory
references, or patch memory sizes or both.
R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:698587
Change-Id: I4d9d811d75cb83842f23df317e8e7fc02aeb5146
Reviewed-on: https://chromium-review.googlesource.com/450257
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43613}
This makes the collection logic of {Projection} nodes (i.e. value
projections for multi-value returning calls) more robust. The projection
nodes by now have a control input, which in turn can make them appear
more than once in the use list of a call. We should limit the use list
inspection to value edges only. This is in preparation of eliding any
redundant {IfSuccess} control node.
R=jarin@chromium.org
Change-Id: I9bb4cc0e2e877976be55a894af972aa83d07d7d7
Reviewed-on: https://chromium-review.googlesource.com/450244
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43608}
Instead of creating a signed comparison with INT_MAX, create an unsigned
comparison with 0. This saves a few bytes in the generated code.
R=jarin@chromium.org
BUG=
Review-Url: https://codereview.chromium.org/2715513007
Cr-Commit-Position: refs/heads/master@{#43606}
DataPropertyParameters are not specific to StoreDataProperty.
Rename it to FeedbackParameter, so it can be used for similar
ICs, e.g., future CollectTypeProfile. Also, the parameter for spread calls contains just one parameter, remove the plural s.
BUG=
Review-Url: https://codereview.chromium.org/2725263003
Cr-Commit-Position: refs/heads/master@{#43604}
The previous fix (http://crrev.com/2720813002) was problematic for
functions containing i64 parameters or returns. Those would throw a
TypeError when called via WASM_TO_JS and JS_TO_WASM.
Instead, we now unwrap the WASM_INTERPRETER_ENTRY function and call it
directly. This removes the option to later redirect back to the
original wasm function, but this functionality is not needed currently.
Plus drive-by fix to put functions in anonymous namespace in
wasm-compiler.cc.
R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5971, v8:5822
Review-Url: https://codereview.chromium.org/2725333002
Cr-Commit-Position: refs/heads/master@{#43603}
The function list is now filtered by category by default, and sorting improved to break ties better.
Since the butterfly trees get massive, I had to start expanding the call trees on demand. This is implemented by keeping track of all ticks that cross given tree node (+ position where they crosses it). This seems to work quite well - in subsequent CL, I am planning to flip the bottom-up and top-down trees to use this.
Review-Url: https://codereview.chromium.org/2730293002
Cr-Commit-Position: refs/heads/master@{#43602}
