Commit Graph

850 Commits

Author SHA1 Message Date
ahaas
18d9da0dcf [wasm] I added I64Eq to the Int64Lowering.
(a EQ b) is lowered to ((low(a) XOR low(b)) OR (high(a) XOR high(b))) EQ 0

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1729493002

Cr-Commit-Position: refs/heads/master@{#34249}
2016-02-24 12:09:34 +00:00
ahaas
a8d5d17659 [wasm] Added I64Xor to the Int64Lowering.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1723613002

Cr-Commit-Position: refs/heads/master@{#34241}
2016-02-24 09:52:52 +00:00
ahaas
cadc1e7780 [wasm] Added I64Ior to the Int64Lowering.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1716243002

Cr-Commit-Position: refs/heads/master@{#34219}
2016-02-23 16:30:42 +00:00
ahaas
4ddf252e85 [wasm] Unittest for Int64Lowering.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1714793003

Cr-Commit-Position: refs/heads/master@{#34213}
2016-02-23 15:33:13 +00:00
jarin
2ae5894da6 Revert of [turbofan] Connect ObjectIsNumber to effect and control chains. (patchset #1 id:1 of https://codereview.chromium.org/1709093002/ )
Reason for revert:
Tanks benchmarks (e.g., Octane box2d TF).

Original issue's description:
> [turbofan] Connect ObjectIsNumber to effect and control chains.
>
> In theory, we could connect the nodes when doing
> the schedule-in-the-middle pass, but that would require creating two
> versions of the operator (effectful and pure). I believe we do not
> lose anything by wiring the node up eagerly.
>
> Committed: https://crrev.com/2894e80a0a4a51a0d72e72aa48fcd01968f7949f
> Cr-Commit-Position: refs/heads/master@{#34141}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1718483002

Cr-Commit-Position: refs/heads/master@{#34147}
2016-02-19 10:13:56 +00:00
jarin
2894e80a0a [turbofan] Connect ObjectIsNumber to effect and control chains.
In theory, we could connect the nodes when doing
the schedule-in-the-middle pass, but that would require creating two
versions of the operator (effectful and pure). I believe we do not
lose anything by wiring the node up eagerly.

Review URL: https://codereview.chromium.org/1709093002

Cr-Commit-Position: refs/heads/master@{#34141}
2016-02-19 08:03:34 +00:00
bmeurer
8a7186b87a [turbofan] Remove the JSContextRelaxation reducer.
This reducer doesn't really add value, because:

 (a) it is only concerned with JSCallFunction and JSToNumber, but when
     we get to it, all JSCallFunction nodes will have been replaced by
     Call nodes, and in the not so far future, we will also have
     replaced almost all JSToNumber nodes with better code,
 (b) and the reducer tries to be smart and use one of the outermost
     contexts, but that might not be beneficial always; actually it
     might even create longer live ranges and lead to more spilling
     in some cases.

But most importantly, the JSContextRelaxation currently blocks inlining
based on SharedFunctionInfo, because it requires the inliner to check
the native context, which in turn requires JSFunction knowledge. So I'm
removing this reducer for now to unblock the more important inliner
changes.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1715633002

Cr-Commit-Position: refs/heads/master@{#34139}
2016-02-19 07:55:48 +00:00
mstarzinger
ef5ee8e1fd [turbofan] Remove language mode from JSCall operator.
This removes the language mode parameter from all JSCall operators. The
information is no longer used anywhere and is not threaded through the
interpreter bytecode. We should only thread it through the bytecode if
it has a semantic impact on the compilation.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1709493002

Cr-Commit-Position: refs/heads/master@{#34073}
2016-02-17 12:04:27 +00:00
mstarzinger
305a36e0d4 Remove strong mode support from property loads.
R=rossberg@chromium.org,bmeurer@chromium.org,verwaest@chromium.org
BUG=v8:3956
LOG=n

Review URL: https://codereview.chromium.org/1700993002

Cr-Commit-Position: refs/heads/master@{#34067}
2016-02-17 10:30:47 +00:00
bmeurer
0d595bb001 [intrinsics] Remove the %_IsDate intrinsic.
It's fine to only have the runtime call here, as it's only used in the
debug mirror.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1699133002

Cr-Commit-Position: refs/heads/master@{#34056}
2016-02-17 07:27:01 +00:00
bmeurer
8f87c0acb7 [builtins] Move the Boolean constructor to C++.
Drive-by-fix: Remove the (now) unused %_SetValueOf and %_JSValueGetValue
intrinsics from the various compilers and the runtime.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1698343002

Cr-Commit-Position: refs/heads/master@{#34037}
2016-02-16 14:03:07 +00:00
mstarzinger
1150092b29 Remove strong mode support from binary operations.
R=bmeurer@chromium.org
BUG=v8:3956
LOG=n

Review URL: https://codereview.chromium.org/1693833002

Cr-Commit-Position: refs/heads/master@{#34036}
2016-02-16 13:55:29 +00:00
martyn.capewell
14a5c18cc3 [turbofan] ARM: Use SBFX in instruction selector.
Support SBFX in the instruction selector for sign-extension patterns like
Sar(Shl(x, a), b), where a and b are immediate values.

BUG=

Review URL: https://codereview.chromium.org/1695293002

Cr-Commit-Position: refs/heads/master@{#34029}
2016-02-16 11:29:48 +00:00
titzer
e2f3003f2c [turbofan] Enforce that C calls do not use floating point params.
Passing floating point params to/from C has never quite worked correctly,
but we've never enforced the restriction early in the CallDescriptor
creation process because of unittests. Fix unittests to make their own
simple call descriptors and not rely on the C ones.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1701593003

Cr-Commit-Position: refs/heads/master@{#33993}
2016-02-15 13:25:23 +00:00
martyn.capewell
357e014329 Reland of [turbofan] ARM: Improve AND instruction selection
Improve instruction selector for mask and shift operations by using cheaper
instructions where possible, in preference to UBFX.

Reverted because it was suspected of causing a couple of flaky tests to fail,
but investigation suggests this is unlikely.

Original review: https://codereview.chromium.org/1677023002

BUG=

Review URL: https://codereview.chromium.org/1684073006

Cr-Commit-Position: refs/heads/master@{#33988}
2016-02-15 11:10:12 +00:00
bmeurer
052dc9e019 [turbofan] Lower object and array literals in JSCreateLowering.
This adds initial support for inline allocation of object and array
literals to the JSCreateLowering pass. It's basically identical to
what Crankshaft does.

This also unstages the TurboFan escape analysis, as the lowering seems
to trigger a bunch of bugs in it; those bugs will be fixed separately,
and we will re-enable escape analysis afterwards.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1698783002

Cr-Commit-Position: refs/heads/master@{#33972}
2016-02-15 06:43:10 +00:00
titzer
d8122dc73e Move RPO unittests into their own file.
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1691373002

Cr-Commit-Position: refs/heads/master@{#33966}
2016-02-14 11:27:46 +00:00
epertoso
61a4c528b7 [turbofan] Fix a bug in the RawMachineAssembler
This was causing code like:

REX.W cmpq r9,r8
setzl r8l
movzxbl r8,r8
REX.W cmpq r8,0x0
jz 185

(note the cmpq instead of cmpl above) on x64 instead of:

REX.W cmpq r9,r8
jnz 149

http://crrev.com/1677503002 is now obsolete and has been reverted.

Review URL: https://codereview.chromium.org/1685183003

Cr-Commit-Position: refs/heads/master@{#33934}
2016-02-12 10:03:14 +00:00
bmeurer
09d8453547 [runtime] Introduce FastNewStrictArgumentsStub to optimize strict arguments.
The FastNewStrictArgumentsStub is very similar to the recently added
FastNewRestParameterStub, it's actually almost a copy of it, except that
it doesn't have the fast case we have for the empty rest parameter. This
patch improves strict arguments in TurboFan and fullcodegen by up to 10x
compared to the previous version.

Also introduce proper JSSloppyArgumentsObject and JSStrictArgumentsObject
for the in-object properties instead of having them as constants in the
Heap class.

Drive-by-fix: Use this stub and the FastNewRestParameterStub in the
interpreter to avoid the runtime call overhead for strict arguments
and rest parameter creation.

R=jarin@chromium.org
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1693513002

Cr-Commit-Position: refs/heads/master@{#33925}
2016-02-12 05:11:03 +00:00
rmcilroy
d1c28849c7 [Interpreter] Make InterpreterAssembler a subclass of CodeStubAssembler.
Moves InterpreterAssembler out of the compiler directory and into the
interpreter directory. Makes InterpreterAssembler as subclass of
CodeStubAssembler.

As part of this change, the special bytecode dispatch linkage type
is removed and instead we use a InterfaceDispatchDescriptor and
a normal CodeStub linkage type.

Removes a bunch of duplicated logic in InterpreterAssembler and
instead uses the CodeStubAssembler logic. Refactors Interpreter
with these changes.

Modifies CodeStubAssembler to add the extra operations required
by the Interpreter (extra call types, raw memory access and some extra
binary ops). Also adds the ability for subclasses to add extra
prologue and epilogue operations around calls, which is required
for the Interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1673333004

Cr-Commit-Position: refs/heads/master@{#33873}
2016-02-10 16:39:32 +00:00
martyn.capewell
5ac796b553 Revert of [turbofan] ARM: Improve AND instruction selection (patchset #1 id:1 of https://codereview.chromium.org/1677023002/ )
Reason for revert:
Possibly causing Mozilla test failures - will investigate.

Original issue's description:
> [turbofan] ARM: Improve AND instruction selection
>
> Improve instruction selector for mask and shift operations by using cheaper
> instructions where possible, in preference to UBFX.
>
> BUG=
>
> Committed: https://crrev.com/53d9c12977f07f55b6f2a72128b8d02c4c857845
> Cr-Commit-Position: refs/heads/master@{#33843}

TBR=bmeurer@chromium.org,jarin@chromium.org,danno@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1681953003

Cr-Commit-Position: refs/heads/master@{#33850}
2016-02-09 15:12:00 +00:00
martyn.capewell
53d9c12977 [turbofan] ARM: Improve AND instruction selection
Improve instruction selector for mask and shift operations by using cheaper
instructions where possible, in preference to UBFX.

BUG=

Review URL: https://codereview.chromium.org/1677023002

Cr-Commit-Position: refs/heads/master@{#33843}
2016-02-09 11:14:24 +00:00
bmeurer
07e9921f5a [turbofan] Introduce JSCreateLowering for optimizing JSCreate nodes.
This moves the JSCreate related functionality from JSTypedLowering into
a dedicated JSCreateLowering reducer. This is in preparation of landing
the support for optimized literals in TurboFan, which would blow up
JSTypedLowering quite seriously otherwise.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1678833002

Cr-Commit-Position: refs/heads/master@{#33813}
2016-02-08 12:33:59 +00:00
bmeurer
3ef573e9f1 [runtime] Optimize and unify rest parameters.
Replace the somewhat awkward RestParamAccessStub, which would always
call into the runtime anyway with a proper FastNewRestParameterStub,
which is basically based on the code that was already there for strict
arguments object materialization. But for rest parameters we could
optimize even further (leading to 8-10x improvements for functions with
rest parameters), by fixing the internal formal parameter count:

Every SharedFunctionInfo has a formal_parameter_count field, which
specifies the number of formal parameters, and is used to decide whether
we need to create an arguments adaptor frame when calling a function
(i.e. if there's a mismatch between the actual and expected parameters).
Previously the formal_parameter_count included the rest parameter, which
was sort of unfortunate, as that meant that calling a function with only
the non-rest parameters still required an arguments adaptor (plus some
other oddities). Now with this CL we fix, so that we do no longer
include the rest parameter in that count. Thereby checking for rest
parameters is very efficient, as we only need to check whether there is
an arguments adaptor frame, and if not create an empty array, otherwise
check whether the arguments adaptor frame has more parameters than
specified by the formal_parameter_count.

The FastNewRestParameterStub is written in a way that it can be directly
used by Ignition as well, and with some tweaks to the TurboFan backends
and the CodeStubAssembler, we should be able to rewrite it as
TurboFanCodeStub in the near future.

Drive-by-fix: Refactor and unify the CreateArgumentsType which was
different in TurboFan and Ignition; now we have a single enum class
which is used in both TurboFan and Ignition.

R=jarin@chromium.org, rmcilroy@chromium.org
TBR=rossberg@chromium.org
BUG=v8:2159
LOG=n

Review URL: https://codereview.chromium.org/1676883002

Cr-Commit-Position: refs/heads/master@{#33809}
2016-02-08 10:08:50 +00:00
mvstanton
3f36e658c8 Revert of Type Feedback Vector lives in the closure (patchset #2 id:40001 of https://codereview.chromium.org/1668103002/ )
Reason for revert:
Must revert for now due to chromium api natives issues.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> (RELAND: the problem before was a missing write barrier for adding the code
> entry to the new closure. It's been addressed with a new macro instruction
> and test. The only change to this CL is the addition of two calls to
> __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
> Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
> And Benedikt reviewed it as well.
>
> TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/bb31db3ad6de16f86a61f6c7bbfd3274e3d957b5
> Cr-Commit-Position: refs/heads/master@{#33741}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1670813005

Cr-Commit-Position: refs/heads/master@{#33766}
2016-02-05 10:48:35 +00:00
mvstanton
bb31db3ad6 Type Feedback Vector lives in the closure
(RELAND: the problem before was a missing write barrier for adding the code
entry to the new closure. It's been addressed with a new macro instruction
and test. The only change to this CL is the addition of two calls to
__ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...
Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
And Benedikt reviewed it as well.

TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1668103002

Cr-Commit-Position: refs/heads/master@{#33741}
2016-02-04 15:41:23 +00:00
mtrofin
1ecf58f409 [turbofan] fine grained in-block move optimization
So far, we've been moving down gaps wholesale. This change moves
individual move operations instead. This improves some benchmarks,
and should overall reduce code size, because it improves the chance of
reducing the number of moves.

For example, there are improvements on x64 in Emscripten (Bullet, in
particular) , JetStream geomean, Embenchen (zlib).

In the process of making this change, I noticed we can separate the
tasks performed by the move optimizer, as follows:

- group gaps into 1
- push gaps down, jumping instructions (these 2 were together before)
- merge blocks (and then push gaps down)
- finalize

We can do without a finalization list. This avoids duplicating storage -
we already have the list of instructions; it also simplifies the logic, since,
with this change, we may process an instruction's gap twice.

Compile time doesn't regress much (see pathological cases), but we
may want to avoid the allocations of the few sets used in the new code.
I'll do that in a subsequent change.

BUG=

Review URL: https://codereview.chromium.org/1634093002

Cr-Commit-Position: refs/heads/master@{#33715}
2016-02-04 06:30:34 +00:00
bmeurer
7be5829971 [turbofan] Move creation stub fallbacks to JSGenericLowering.
Move all the code that deals with falling back to object creation via
stubs to JSGenericLowering, where we can already deal well with stub
calls. This includes JSCreateLiteralArray, JSCreateLiteralObject,
JSCreateClosure, JSCreateFunctionContext and JSCreateArray.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1653353002

Cr-Commit-Position: refs/heads/master@{#33682}
2016-02-02 13:34:02 +00:00
bmeurer
6b2001b6b7 [turbofan] Introduce proper ObjectIsReceiver operator.
Avoid the hacking in JSIntrinsicLowering and provide a proper simplified
operator ObjectIsReceiver instead that is used to implement %_IsJSReceiver
which is used by our JavaScript builtins and the JSInliner.

R=jarin@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1657863004

Cr-Commit-Position: refs/heads/master@{#33675}
2016-02-02 11:43:02 +00:00
bmeurer
8c04a35c83 [intrinsics] Remove %_IsFunction inline intrinsic.
There's no point in having %_IsFunction as inline intrinsic, as it
is only used in non performance critical code, which is already full
of runtime calls anyway, so %IsFunction will do the trick as well.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1658123002

Cr-Commit-Position: refs/heads/master@{#33660}
2016-02-02 09:14:07 +00:00
jarin
ef35f11c43 Remove the template magic from types.(h|cc), remove types-inl.h.
This CL removes the Config templatization from the types. It is not
necessary anymore, after the HeapTypes have been removed.

The CL also changes the type hierarchy - the specific type kinds are
not inner classes of the Type class and they do not inherit from Type.
This is partly because it seems impossible to make this work without
templates. Instead, a new TypeBase class is introduced and all the
structural (i.e., non-bitset) types inherit from it.

The bitset type still requires the bit-munging hack and some nasty
reinterpret-casts to pretend bitsets are of type Type*. Additionally,
there is now the same hack for TypeBase - all pointers to the sub-types
of TypeBase are reinterpret-casted to Type*. This is to keep the type
constructors in inline method definitions (although it is unclear how
much that actually buys us).

In future, we would like to move to a model where we encapsulate Type*
into a class (or possibly use Type where we used to use Type*). This
would loosen the coupling between bitset size and pointer size, and
eventually we would be able to have more bits.

TBR=bradnelson@chromium.org

Review URL: https://codereview.chromium.org/1655833002

Cr-Commit-Position: refs/heads/master@{#33656}
2016-02-02 07:26:06 +00:00
ahaas
645880373b [turbofan] Add the StackSlot operator to turbofan.
The StackSlot operator allows to allocate a spill slot on the stack. We
are going to use this operator to pass floats through pointers to c
functions, which we need for floating point rounding in the case where
the architecture does not provide rounding instructions.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Committed: https://crrev.com/7a693437787090d62d937b862e29521debcc5223
Cr-Commit-Position: refs/heads/master@{#33600}

Review URL: https://codereview.chromium.org/1645653002

Cr-Commit-Position: refs/heads/master@{#33606}
2016-01-29 09:43:54 +00:00
ahaas
11f7c2e63c Revert of [turbofan] Add the StackSlot operator to turbofan. (patchset #4 id:60001 of https://codereview.chromium.org/1645653002/ )
Reason for revert:
problems on Mac64

Original issue's description:
> [turbofan] Add the StackSlot operator to turbofan.
>
> The StackSlot operator allows to allocate a spill slot on the stack. We
> are going to use this operator to pass floats through pointers to c
> functions, which we need for floating point rounding in the case where
> the architecture does not provide rounding instructions.
>
> R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com
>
> Committed: https://crrev.com/7a693437787090d62d937b862e29521debcc5223
> Cr-Commit-Position: refs/heads/master@{#33600}

TBR=titzer@chromium.org,v8-arm-ports@googlegroups.com,v8-mips-ports@googlegroups.com,v8-ppc-ports@googlegroups.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1644283002

Cr-Commit-Position: refs/heads/master@{#33601}
2016-01-29 08:19:06 +00:00
ahaas
7a69343778 [turbofan] Add the StackSlot operator to turbofan.
The StackSlot operator allows to allocate a spill slot on the stack. We
are going to use this operator to pass floats through pointers to c
functions, which we need for floating point rounding in the case where
the architecture does not provide rounding instructions.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1645653002

Cr-Commit-Position: refs/heads/master@{#33600}
2016-01-29 08:08:22 +00:00
mvstanton
a702785156 Revert of Type Feedback Vector lives in the closure (patchset #2 id:20001 of https://codereview.chromium.org/1642613002/ )
Reason for revert:
Bug: failing to use write barrier when writing code entry into closure.

Original issue's description:
> Reland of Type Feedback Vector lives in the closure
>
> (Fixed a bug found by nosnap builds.)
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
>
> TBR=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/d984b3b0ce91e55800f5323b4bb32a06f8a5aab1
> Cr-Commit-Position: refs/heads/master@{#33548}

TBR=bmeurer@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1643533003

Cr-Commit-Position: refs/heads/master@{#33556}
2016-01-27 15:05:38 +00:00
mvstanton
d984b3b0ce Reland of Type Feedback Vector lives in the closure
(Fixed a bug found by nosnap builds.)

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...

TBR=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1642613002

Cr-Commit-Position: refs/heads/master@{#33548}
2016-01-27 12:53:42 +00:00
oth
95bec7e7b1 [interpreter] Reduce move operations for wide register support.
Introduces the concept of transfer direction to register operands. This
enables the register translator to emit exactly the moves that a
bytecode having it's register operands translated needs.

BUG=v8:4280,v8:4675
LOG=N

Review URL: https://codereview.chromium.org/1633153002

Cr-Commit-Position: refs/heads/master@{#33544}
2016-01-27 11:15:56 +00:00
mvstanton
e2e7dc32ef Revert of Type Feedback Vector lives in the closure (patchset #12 id:260001 of https://codereview.chromium.org/1563213002/ )
Reason for revert:
FAilure on win32 bot, need to investigate webkit failures.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
>
> TBR=hpayer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/a5200f7ed4d11c6b882fa667da7a1864226544b4
> Cr-Commit-Position: refs/heads/master@{#33518}

TBR=bmeurer@chromium.org,akos.palfi@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1632993003

Cr-Commit-Position: refs/heads/master@{#33520}
2016-01-26 15:02:29 +00:00
mvstanton
a5200f7ed4 Type Feedback Vector lives in the closure
We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...

TBR=hpayer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1563213002

Cr-Commit-Position: refs/heads/master@{#33518}
2016-01-26 14:21:08 +00:00
sigurds
2b84cb4f56 [turbofan] Minor performance tweaks in escape analysis
* Add caching to handling of dangling loads
* Add two unittests for load elimination on escaped objects

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1619103004

Cr-Commit-Position: refs/heads/master@{#33498}
2016-01-25 17:31:17 +00:00
mtrofin
78b55f2ebc If all the predecessors of a node have, at the last gap, the exact same
moves, we move those to the node, and remove them from the
predecessors ("merge" them to the common node).

If only some of the moves are common, we don't do anything. This is
what this change addresses.

The bug linked below should be addressed by this change. The only
difference in codegen before/after the change that introduced the bug
was un-merged moves.

BUG=chromium:549262
LOG=N

Review URL: https://codereview.chromium.org/1527203002

Cr-Commit-Position: refs/heads/master@{#33481}
2016-01-25 06:33:14 +00:00
rmcilroy
677e54e244 [Interpreter] Always store current context in the frames context slot.
Change the interpreter to always store the current context in the frame's
context slot instead of the function context. This makes it possible to
restore the correct context during deopt.

BUG=v8:4678,v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1604923002

Cr-Commit-Position: refs/heads/master@{#33477}
2016-01-23 00:07:49 +00:00
sigurds
4efbeac115 [turbofan] Improve escape analysis.
* Treat Select nodes as escaping
* Correctly void virtual field information
  after a store to a non-const index
* Add a shortcut if all allocates escape
* Add a shortcut if no allocates are discovered
* Only reduce FrameState/StateValues nodes if they
  have virtual allocates as input (transitively)
* Fix bug in FrameState/StateValues duplication
* Add check to verifier: First 3 inputs of FrameState
  must be StateValues

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1583213003

Cr-Commit-Position: refs/heads/master@{#33406}
2016-01-20 13:26:31 +00:00
oth
68654b6476 [Interpreter] Preparation for wide registers.
o Adds wide variants of bytecodes that have operands describing ranges
  of registers. The upcoming wide register support does not suppport
  re-mapping ranges.
o Adds kRegPair16 and kRegTriple16 operands required for new wide
  bytecodes and renames Count8/Count16 operands to RegCount8/RegCount16.
o Removes Exchange bytecodes

BUG=v8:4675
LOG=NO

Review URL: https://codereview.chromium.org/1595103006

Cr-Commit-Position: refs/heads/master@{#33389}
2016-01-19 16:07:00 +00:00
rmcilroy
1ea0b91a83 [Interpreter] Make ForInPrepare take a kRegTriple8 and ForInNext take kRegPair8 for cache state
Make ForInPrepare take a kRegTriple8 operand and ForInNext take kRegPair8
operand for cache state. This is to ensure that the cache state output of
ForInPrepare is in consecutive registers to allow us to deopt the
ForInPrepare node from TF->Ignition (to be done in a followup CL).

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1584813002

Cr-Commit-Position: refs/heads/master@{#33357}
2016-01-18 12:40:22 +00:00
sigurds
fc9a73e8a6 [turbofan] Various performance enhancements for escape analysis
This bug improves performance of escape analysis.

* A allocation discovery phase  (EscapeAnalysis::AssignAliases)
  ensures compact representation of virtual state
* Node revisiting in EscapeStatusAnalysis has been improved
* Escape analysis no longer requires a trimmed graph

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1559123003

Cr-Commit-Position: refs/heads/master@{#33267}
2016-01-13 15:30:48 +00:00
rmcilroy
1a063d944d [Interpreter] Add support for calling runtime functions which return a pair.
Adds support for calling runtime functions which return a pair of
values. Adds the bytecode CallRuntimePair. Also adds support to TurboFan
for calling stubs which return multiple values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1568493002

Cr-Commit-Position: refs/heads/master@{#33181}
2016-01-08 15:16:28 +00:00
sigurds
3b473d7aad [turbofan] Deopt support for escape analysis
Deopt support is added on two levels. On the IR level,
a new ObjectState node is added, which represenents an
object to be materialized. ObjectState nodes appear as
inputs of FrameState and StateValues nodes. On the
instruction select/code-generation level, the
FrameStateDescriptor class handles the nesting
introduced by ObjectState, and ensures that deopt code
with CAPTURED_OBJECT/DUPLICATED_OBJECT entries are
generated similarly to what crankshaft's escape
analysis does.

Two unittests test correctness of the IR level implementation.

Correctness for instruction selection / code generation
is tested by mjsunit tests.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1485183002

Cr-Commit-Position: refs/heads/master@{#33115}
2016-01-05 13:31:02 +00:00
mvstanton
c89ddbb7bc Optimized TurboFan support for rest args.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1557883002

Cr-Commit-Position: refs/heads/master@{#33105}
2016-01-05 09:40:41 +00:00
oth
c958c98c4f [Interpreter] Bytecodes for exchanging registers.
New bytecodes for making registers with indicies wider than 1-byte
accessible.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1555713002

Cr-Commit-Position: refs/heads/master@{#33091}
2016-01-04 17:38:26 +00:00
bmeurer
97def8070c [runtime] Introduce dedicated JSBoundFunction to represent bound functions.
According to the ES2015 specification, bound functions are exotic
objects, and thus don't need to be implemented as JSFunctions. So
we introduce a new JSBoundFunction type to represent bound functions
and make them optimizable. This already improves the performance of
calling or constructing bound functions by 10-100x depending on the
use case because we avoid the crazy dance between JavaScript and C++
that was implemented in v8natives.js previously.

There's still room for improvement in the performance of actually
creating bound functions, which is also relevant in practice, but
we already have a plan how to accomplish that later.

The mips/mips64 ports were contributed by akos.palfi@imgtec.com.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=chromium:535408, chromium:571299, v8:4629
LOG=n

Committed: https://crrev.com/ca8623eaa468cba65a5adafcdfb4615966f43ce2
Cr-Commit-Position: refs/heads/master@{#33042}

Review URL: https://codereview.chromium.org/1542963002

Cr-Commit-Position: refs/heads/master@{#33044}
2015-12-27 06:31:44 +00:00
bmeurer
1cf8b105d6 Revert of [runtime] Introduce dedicated JSBoundFunction to represent bound functions. (patchset #14 id:260001 of https://codereview.chromium.org/1542963002/ )
Reason for revert:
Breaks arm64 sim nosnap: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/805/steps/Check/logs/function-bind

Original issue's description:
> [runtime] Introduce dedicated JSBoundFunction to represent bound functions.
>
> According to the ES2015 specification, bound functions are exotic
> objects, and thus don't need to be implemented as JSFunctions. So
> we introduce a new JSBoundFunction type to represent bound functions
> and make them optimizable. This already improves the performance of
> calling or constructing bound functions by 10-100x depending on the
> use case because we avoid the crazy dance between JavaScript and C++
> that was implemented in v8natives.js previously.
>
> There's still room for improvement in the performance of actually
> creating bound functions, which is also relevant in practice, but
> we already have a plan how to accomplish that later.
>
> The mips/mips64 ports were contributed by akos.palfi@imgtec.com.
>
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> BUG=chromium:535408, chromium:571299, v8:4629
> LOG=n
>
> Committed: https://crrev.com/ca8623eaa468cba65a5adafcdfb4615966f43ce2
> Cr-Commit-Position: refs/heads/master@{#33042}

TBR=cbruni@chromium.org,hpayer@chromium.org,yangguo@chromium.org,akos.palfi@imgtec.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:535408, chromium:571299, v8:4629

Review URL: https://codereview.chromium.org/1552473002

Cr-Commit-Position: refs/heads/master@{#33043}
2015-12-27 04:42:13 +00:00
bmeurer
ca8623eaa4 [runtime] Introduce dedicated JSBoundFunction to represent bound functions.
According to the ES2015 specification, bound functions are exotic
objects, and thus don't need to be implemented as JSFunctions. So
we introduce a new JSBoundFunction type to represent bound functions
and make them optimizable. This already improves the performance of
calling or constructing bound functions by 10-100x depending on the
use case because we avoid the crazy dance between JavaScript and C++
that was implemented in v8natives.js previously.

There's still room for improvement in the performance of actually
creating bound functions, which is also relevant in practice, but
we already have a plan how to accomplish that later.

The mips/mips64 ports were contributed by akos.palfi@imgtec.com.

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=chromium:535408, chromium:571299, v8:4629
LOG=n

Review URL: https://codereview.chromium.org/1542963002

Cr-Commit-Position: refs/heads/master@{#33042}
2015-12-26 20:28:17 +00:00
dusan.m.milosavljevic
7bc8fac472 MIPS: [turbofan] Optimize Float32 to Int32 rep. changes with Float32 round ops.
TEST=unittests/InstructionSelectorTest.CombineChangeFloat32ToInt32WithRoundFloat32,
     ChangeFloat64ToInt32OfChangeFloat32ToFloat64, TruncateFloat64ToFloat32OfChangeInt32ToFloat64
BUG=

Review URL: https://codereview.chromium.org/1520503002

Cr-Commit-Position: refs/heads/master@{#32969}
2015-12-18 16:12:51 +00:00
paul.lind
a0c7e25f99 Update MIPS owners.
Add Ivica B.

NOTRY=true

Review URL: https://codereview.chromium.org/1525413003

Cr-Commit-Position: refs/heads/master@{#32933}
2015-12-17 09:07:00 +00:00
sigurds
4390514154 [turbofan] Escape Analysis improvements
Move replacements out of virtual object. Replacements are
global to the graph and are not dependent on the virtual
state (after they are discovered).

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1527533002

Cr-Commit-Position: refs/heads/master@{#32838}
2015-12-14 14:13:31 +00:00
danno
bf24486b22 [tubofan] Remove .dot output of --trace-turbo
Review URL: https://codereview.chromium.org/1514323002

Cr-Commit-Position: refs/heads/master@{#32813}
2015-12-11 16:58:31 +00:00
jarin
56673804e0 [turbofan] Store nodes use only MachineRepresentation, not MachineType.
Review URL: https://codereview.chromium.org/1513383003

Cr-Commit-Position: refs/heads/master@{#32803}
2015-12-11 15:34:16 +00:00
bmeurer
7e5ff19ee2 [turbofan] Some more cleanup on the intrinsics.
Remove unused obsolete %_StringGetStringLength intrinsic, and properly
optimize the %_SubString, %_RegExpExec, %_RegExpFlags, %_RegExpSource
and %_RegExpConstructResult intrinsics.

Review URL: https://codereview.chromium.org/1516753006

Cr-Commit-Position: refs/heads/master@{#32782}
2015-12-11 09:12:12 +00:00
rmcilroy
42718a4c88 Remove dummy control / effect edges from RMA Load / Store / Div nodes.
Review URL: https://codereview.chromium.org/1510173004

Cr-Commit-Position: refs/heads/master@{#32762}
2015-12-10 17:07:41 +00:00
rmcilroy
c4745aa187 Remove dummy control / effect edges from RMA Call nodes.
Removes the dummy control and effect edges from the RMA Call nodes. This
requires a change to the node matchers to allow them to cope with nodes
which don't have control or effect matchers.

Review URL: https://codereview.chromium.org/1518673002

Cr-Commit-Position: refs/heads/master@{#32752}
2015-12-10 13:36:28 +00:00
jarin
9c87bd4b82 [turbofan] Get rid of truncation by store.
Nowadays, representation inference and simplified lowering can insert the
right truncations based on the use.

Review URL: https://codereview.chromium.org/1512243002

Cr-Commit-Position: refs/heads/master@{#32747}
2015-12-10 11:23:55 +00:00
jarin
bb2a830deb [turbofan] Make MachineType a pair of enums.
MachineType is now a class with two enum fields:
- MachineRepresentation
- MachineSemantic

Both enums are usable on their own, and this change switches some places from using MachineType to use just MachineRepresentation. Most notably:
- register allocator now uses just the representation.
- Phi and Select nodes only refer to representations.

Review URL: https://codereview.chromium.org/1513543003

Cr-Commit-Position: refs/heads/master@{#32738}
2015-12-10 09:03:53 +00:00
bmeurer
6a1328452a [turbofan] The JSCreateWithContext operator doesn't need a frame state.
Creating a with context cannot lazy/eager deoptimize, so we don't need
to pass a frame state.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1508373002

Cr-Commit-Position: refs/heads/master@{#32711}
2015-12-09 12:00:26 +00:00
bmeurer
82fd004745 [turbofan] Also lower JSCreateCatchContext in typed lowering.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1515513002

Cr-Commit-Position: refs/heads/master@{#32709}
2015-12-09 11:52:22 +00:00
dusan.m.milosavljevic
0d4f8a913d MIPS: [turbofan] Combine ChangeFloat64ToInt32 with Float64Round ops.
TEST=unittests/InstructionSlectorTest.CombineChangeFloat64ToInt32WithRoundFloat64
BUG=

Review URL: https://codereview.chromium.org/1510493002

Cr-Commit-Position: refs/heads/master@{#32668}
2015-12-07 23:36:30 +00:00
dusan.m.milosavljevic
472e2ba9b9 MIPS:[turbofan] Match shift left and bitwise And with mask when possible.
TEST=unittests/InstructionSelectorTest.Word(32|64)ShlWithWord(32|64)And
BUG=

Review URL: https://codereview.chromium.org/1496013003

Cr-Commit-Position: refs/heads/master@{#32612}
2015-12-04 13:13:04 +00:00
bmeurer
9298b43029 [turbofan] Introduce ToBooleanHints on ToBoolean operators.
Extract ToBoolean hints from the fullcodegen code object and put them
into the ToBoolean nodes created by the AstGraphBuilder.  We currently
do not yet consume this feedback, that will be done in a followup CL.

R=mstarzinger@chromium.org
BUG=v8:4583
LOG=n

Review URL: https://codereview.chromium.org/1494973002

Cr-Commit-Position: refs/heads/master@{#32576}
2015-12-03 16:48:19 +00:00
titzer
27433918f5 Move machine-type.h from src/compiler to src/.
R=bmeurer@chromium.org,jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1498833002

Cr-Commit-Position: refs/heads/master@{#32564}
2015-12-03 13:34:02 +00:00
mstarzinger
33142c120d [turbofan] Make RawMachineAssembler handle the end node.
This moves the proper handling for the end node withing the constructed
graph into the RawMachineAssembler. This simplifies all assemblers and
makes the handling of {Start} and {End} symmetrical.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1493963003

Cr-Commit-Position: refs/heads/master@{#32563}
2015-12-03 13:30:06 +00:00
bmeurer
411c5b7fb0 [turbofan] Desugar JSUnaryNot(x) to Select(x, false, true).
Also remove the ResultMode from ToBooleanStub and always return true or
false and use the same mechanism in fullcodegen.  This is in preparation
for adding ToBoolean hints to TurboFan.

Drive-by-fix: We can use the power of the ToBooleanIC in TurboFan now
that the ResultMode is gone (and the runtime always returns true or
false from the miss handler).

R=mstarzinger@chromium.org
BUG=v8:4583
LOG=n

Review URL: https://codereview.chromium.org/1491223002

Cr-Commit-Position: refs/heads/master@{#32524}
2015-12-02 15:22:13 +00:00
sigurds
6095d0af30 [turbofan] Refactor escape analysis to only expose one class.
R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1491903002

Cr-Commit-Position: refs/heads/master@{#32523}
2015-12-02 15:21:21 +00:00
bmeurer
ddb9f461f1 [turbofan] Optimize %_IsJSReceiver based on input type.
We can constant fold %_IsJSReceiver(x) based on whether x is always a
receiver or can never be a receiver.  This is important as
%_IsJSReceiver is inserted by the JSInliner.

R=jarin@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1486383003

Cr-Commit-Position: refs/heads/master@{#32519}
2015-12-02 14:35:54 +00:00
sigurds
aa0ddf7db4 [turbofan] Initial support for escape analysis.
This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).

The CL includes 4 unittests.

There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1457683003

Cr-Commit-Position: refs/heads/master@{#32498}
2015-12-02 10:53:50 +00:00
dusan.m.milosavljevic
2d0e9abebf MIPS:[turbofan] Use Ins, Dins to clear bits instead of And with inverted immediate.
TEST=unittests/InstructionSelectorTest.Word(32|64)AndToClearBits
BUG=

Review URL: https://codereview.chromium.org/1485023004

Cr-Commit-Position: refs/heads/master@{#32479}
2015-12-01 22:16:48 +00:00
dusan.m.milosavljevic
6b11cc830b MIPS:[turbofan] Use Nor instruction for bit negation instead of xori.
Xori instruction can only have unisgned 16-bit immediates for right input,
as such it is not suitable for bit negation on mips.

TEST=unittests/InstructionSecetorTest.Word(32|64)XorMinusOneWithParameter
BUG=

Review URL: https://codereview.chromium.org/1485833003

Cr-Commit-Position: refs/heads/master@{#32478}
2015-12-01 21:58:43 +00:00
bmeurer
5af6017d4b [turbofan] Add binary operation hints for javascript operators.
This is the initial support for binary operation hints on javascript
binary operators, i.e. JSAdd, JSSubtract and so on. The hints are
extracted from the fullcodegen code object before graph building and the
AstGraphBuilder puts those hints on the operators if available.

R=jarin@chromium.org
BUG=v8:4583
LOG=n

Review URL: https://codereview.chromium.org/1487973002

Cr-Commit-Position: refs/heads/master@{#32443}
2015-12-01 09:03:32 +00:00
mythria
b587aa2bc7 [Interpreter] Add support for cast operators to bytecode graph builder and
an optomization to remove redundant cast operations.

1. Adds an optimization to remove redundant ToBoolean and ToName operations.
2. Adds implementation and tests for cast operatorts to bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1468003002

Cr-Commit-Position: refs/heads/master@{#32408}
2015-11-30 13:50:20 +00:00
neis
9334308a12 Rename %_IsSpecObject to %_IsJSReceiver.
This depends on issue 1476403004.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1479293002

Cr-Commit-Position: refs/heads/master@{#32401}
2015-11-30 11:56:45 +00:00
vogelheim
d3ba9afee2 Move RMA::Label out of the class, so it can be forward declared.
R=bmeurer@chromium.org, mstarzinger@chromium.org
BUG=chromium:508898
LOG=Y

Review URL: https://codereview.chromium.org/1477413002

Cr-Commit-Position: refs/heads/master@{#32400}
2015-11-30 11:29:23 +00:00
bmeurer
f7226a798a [turbofan] Support for typed lowering of "prototype" load from functions.
Add initial support to optimize certain "prototype" loads from known
JSFunctions which have a prototype. This includes an appropriate typing
rule plus a matching rule for typed lowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1482213002

Cr-Commit-Position: refs/heads/master@{#32390}
2015-11-30 08:42:11 +00:00
bmeurer
47502a238b [runtime] Replace global object link with native context link in all contexts.
Previously all contexts had a link to the global object, but what is
required in most cases (except for the global load, store and delete
case) is the native context.

This also removes the second dummy global object that was still linked
to every native context. We will add a different mechanism to ensure
that builtins do not pollute the actual global object during
bootstrapping.

Drive-by-fix: Unify some MacroAssembler magic and drop obsolete stuff.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=yangguo@chromium.org,mstarzinger@chromium.org

Committed: https://crrev.com/d290f204938295bfecc5c8e645ccfcff6e80ddb8
Cr-Commit-Position: refs/heads/master@{#32375}

Review URL: https://codereview.chromium.org/1480003002

Cr-Commit-Position: refs/heads/master@{#32381}
2015-11-27 17:00:11 +00:00
machenbach
673108d000 Revert of [runtime] Replace global object link with native context link in all contexts. (patchset #3 id:40001 of https://codereview.chromium.org/1480003002/ )
Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/5472

Original issue's description:
> [runtime] Replace global object link with native context link in all contexts.
>
> Previously all contexts had a link to the global object, but what is
> required in most cases (except for the global load, store and delete
> case) is the native context.
>
> This also removes the second dummy global object that was still linked
> to every native context. We will add a different mechanism to ensure
> that builtins do not pollute the actual global object during
> bootstrapping.
>
> Drive-by-fix: Unify some MacroAssembler magic and drop obsolete stuff.
>
> R=yangguo@chromium.org
>
> Committed: https://crrev.com/d290f204938295bfecc5c8e645ccfcff6e80ddb8
> Cr-Commit-Position: refs/heads/master@{#32375}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1478303002

Cr-Commit-Position: refs/heads/master@{#32377}
2015-11-27 14:30:23 +00:00
bmeurer
d290f20493 [runtime] Replace global object link with native context link in all contexts.
Previously all contexts had a link to the global object, but what is
required in most cases (except for the global load, store and delete
case) is the native context.

This also removes the second dummy global object that was still linked
to every native context. We will add a different mechanism to ensure
that builtins do not pollute the actual global object during
bootstrapping.

Drive-by-fix: Unify some MacroAssembler magic and drop obsolete stuff.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1480003002

Cr-Commit-Position: refs/heads/master@{#32375}
2015-11-27 13:32:20 +00:00
bmeurer
e3ecfdfecc [turbofan] Properly wire effects for JSLoadContext and JSStoreContext.
The effect chain should be respected for context loads and stores.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1479793003

Cr-Commit-Position: refs/heads/master@{#32363}
2015-11-27 09:22:56 +00:00
bmeurer
e3a46bc766 [compiler] Decouple ToObject from CreateWithContext.
Decouple the implicit ToObject for with statements from the actual
creation of the with context. This way we can handle/optimize those
constructs separately.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1481753003

Cr-Commit-Position: refs/heads/master@{#32341}
2015-11-26 14:30:22 +00:00
oth
c0bc19fc7f [Interpreter] Deprecate bytecode-graph-builder-unittest.
Removing bytecode graph builder tests as they are high maintenance and
have limited use, ie they track changes in the implementation rather
than behaviour.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1477783003

Cr-Commit-Position: refs/heads/master@{#32333}
2015-11-26 11:50:20 +00:00
bmeurer
5d18e93bd6 Revert of binary-operator-reducer: reduce mul+div(shift) (patchset #11 id:200001 of https://codereview.chromium.org/1350223006/ )
Reason for revert:
This is also unsound for the reasons outlined in
https://codereview.chromium.org/1473073004/
Will help Fedor to implement a solution based on simplified operators.

Original issue's description:
> binary-operator-reducer: reduce mul+div(shift)
>
> Reduction Input:
>
>     ChangeInt32ToFloat64=>          TruncateFloat64ToInt32
>                          Float64Mul=>
>     ChangeInt32ToFloat64=>          Float64Div=>TruncateFloat64ToInt32
>
> Output:
>
>          =>  TruncateInt64ToInt32
> Int64Mul
>          =>  Int64Shr => TruncateInt64ToInt32
>
> Test code:
>
>     function mul(a, b) {
>       var l = a & 0x3ffffff;
>       var h = b & 0x3ffffff;
>       var m = l * h;
>
>       var rl = m & 0x3ffffff;
>       var rh = (m / 0x4000000) | 0;
>
>       return rl | rh;
>     }
>
>     mul(1, 2);
>     var a0 = mul(0x3ffffff, 0x3ffffff);
>     mul(0x0, 0x0);
>     %OptimizeFunctionOnNextCall(mul);
>     var a1 = mul(0x3ffffff, 0x3ffffff);
>
>     print(a0 + ' == ' + a1);
>
> BUG=
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/461e5b49d022335a7fc4e9d172397a4bd48b93d4
> Cr-Commit-Position: refs/heads/master@{#31899}

TBR=mstarzinger@chromium.org,danno@chromium.org,titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1478923002

Cr-Commit-Position: refs/heads/master@{#32313}
2015-11-26 06:16:01 +00:00
bmeurer
dc55405992 Revert of [machine-operator-reducer] fix float truncation (patchset #8 id:140001 of https://codereview.chromium.org/1433353006/ )
Reason for revert:
This is also unsound for the reasons outlined in
https://codereview.chromium.org/1473073004/
Will reland the mjsunit test separately and help Fedor to implement a solution based on simplified operators.

Original issue's description:
> [machine-operator-reducer] fix float truncation
>
> Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
> `value`. Generally, `value` may have a range bigger than the one that
> could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
> instead, and only if the `value` fits into Float64 without precision
> loss.
>
> Add missing mjsunit test for 52bit multiplication/division optimization
> that has landed in refs/heads/master@{#31899}.
>
> BUG=
> R=titzer@google.com
>
> Committed: https://crrev.com/64efa2a904773816968992628f0bf0f1b7ae82be
> Cr-Commit-Position: refs/heads/master@{#32227}

TBR=titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1468313009

Cr-Commit-Position: refs/heads/master@{#32312}
2015-11-26 06:12:22 +00:00
bmeurer
b0c179daf6 Revert of [compiler] merge binary-operator-reducer (patchset #2 id:20001 of https://codereview.chromium.org/1473073004/ )
Reason for revert:
Unsound use of types in the MachineOperatorReducer. Will work on a sound solution with Fedor.

Original issue's description:
> [compiler] merge binary-operator-reducer
>
> Merge BinaryOperatorReducer into the MachineOperatorReducer class.
> It does not need `Revisit()` calls, because the newly inserted nodes are
> visited anyway, and there are no other methods that need AdvancedReducer
> there.
>
> BUG=
> R=titzer@chromium.org
>
> Committed: https://crrev.com/993ba9d2529a6401b3040b9263f8d06db7dbb4f1
> Cr-Commit-Position: refs/heads/master@{#32298}

TBR=titzer@chromium.org,fedor@indutny.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1476763006

Cr-Commit-Position: refs/heads/master@{#32310}
2015-11-26 03:52:30 +00:00
fedor
993ba9d252 [compiler] merge binary-operator-reducer
Merge BinaryOperatorReducer into the MachineOperatorReducer class.
It does not need `Revisit()` calls, because the newly inserted nodes are
visited anyway, and there are no other methods that need AdvancedReducer
there.

BUG=
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1473073004

Cr-Commit-Position: refs/heads/master@{#32298}
2015-11-25 19:25:17 +00:00
machenbach
b9d5126930 Revert of Reland "[Interpreter] Add CreateClosure to BytecodeGraphBuilder." (patchset #1 id:1 of https://codereview.chromium.org/1475793003/ )
Reason for revert:
[Sheriff] Breaks cfi:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds/1209

Original issue's description:
> Reland "[Interpreter] Add CreateClosure to BytecodeGraphBuilder."
>
> Original issue's description:
> > [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
> >
> > Adds code and tests to support CreateClosure bytecode when building
> > graphs.
> >
> > Committed: https://crrev.com/4cceb11b0929abcbc82bf0854554a9b66003335d
> > Cr-Commit-Position: refs/heads/master@{#32224}
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/6a8db006e1f0a08a43446b62765bba39fdc6af10
> Cr-Commit-Position: refs/heads/master@{#32257}

TBR=bmeurer@chromium.org,oth@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1469303006

Cr-Commit-Position: refs/heads/master@{#32260}
2015-11-25 11:04:34 +00:00
oth
6a8db006e1 Reland "[Interpreter] Add CreateClosure to BytecodeGraphBuilder."
Original issue's description:
> [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
>
> Adds code and tests to support CreateClosure bytecode when building
> graphs.
>
> Committed: https://crrev.com/4cceb11b0929abcbc82bf0854554a9b66003335d
> Cr-Commit-Position: refs/heads/master@{#32224}

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1475793003

Cr-Commit-Position: refs/heads/master@{#32257}
2015-11-25 09:51:49 +00:00
fedor
64efa2a904 [machine-operator-reducer] fix float truncation
Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
`value`. Generally, `value` may have a range bigger than the one that
could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
instead, and only if the `value` fits into Float64 without precision
loss.

Add missing mjsunit test for 52bit multiplication/division optimization
that has landed in refs/heads/master@{#31899}.

BUG=
R=titzer@google.com

Review URL: https://codereview.chromium.org/1433353006

Cr-Commit-Position: refs/heads/master@{#32227}
2015-11-24 20:25:40 +00:00
oth
daf185b243 Revert of [Interpreter] Add CreateClosure to BytecodeGraphBuilder. (patchset #8 id:140001 of https://codereview.chromium.org/1458603012/ )
Reason for revert:
Build break.

Original issue's description:
> [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
>
> Adds code and tests to support CreateClosure bytecode when building
> graphs.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/4cceb11b0929abcbc82bf0854554a9b66003335d
> Cr-Commit-Position: refs/heads/master@{#32224}

TBR=bmeurer@chromium.org,mythria@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1471913004

Cr-Commit-Position: refs/heads/master@{#32225}
2015-11-24 18:11:00 +00:00
oth
4cceb11b09 [Interpreter] Add CreateClosure to BytecodeGraphBuilder.
Adds code and tests to support CreateClosure bytecode when building
graphs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1458603012

Cr-Commit-Position: refs/heads/master@{#32224}
2015-11-24 17:51:54 +00:00
verwaest
8e28e851ee Install ConstructNonConstructable as construct stub for non-constructables.
BUG=

Review URL: https://codereview.chromium.org/1467473002

Cr-Commit-Position: refs/heads/master@{#32223}
2015-11-24 17:17:00 +00:00
bmeurer
1b1db13549 [runtime] Pass closure to %CreateArrayLiteral and %CreateObjectLiteral.
Change the runtime entries and their associated code stubs for object
and array literal creation to take the closure instead of the raw
literals pointer. This is way easier to deal with (and cleaner) in
TurboFan.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1469833005

Cr-Commit-Position: refs/heads/master@{#32220}
2015-11-24 16:05:49 +00:00
bmeurer
68ce906134 [turbofan] Introduce proper CreateLiteralParameters.
Put the constant parts of the CreateLiteralArray and CreateLiteralObject
operators into CreateLiteralParameters and properly use them everywhere.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1475613002

Cr-Commit-Position: refs/heads/master@{#32207}
2015-11-24 13:42:30 +00:00
danno
c6d310da4d [turbofan]: Implement tail calls with more callee than caller parameters
* Adds a PrepareForTailCall instruction that bumps the stack in the case that
  the number of parameters passed to the callee causes the stack to exceed the
  calleer's frame size.
* Uses the gap resolver to move the saved caller return address and frame
  pointer to the approprate location in the tail-called frame.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1455833004

Cr-Commit-Position: refs/heads/master@{#32151}
2015-11-20 15:04:30 +00:00
dusan.m.milosavljevic
40a501a26a MIPS: [turbofan] Add matching rule to use Nor instruction.
TEST=unittests/InstructionSelectorTest.Word32XorMinusOneWithWord32Or,
     Word64XorMinusOneWithWord64Or
BUG=

Review URL: https://codereview.chromium.org/1459723002

Cr-Commit-Position: refs/heads/master@{#32149}
2015-11-20 14:00:29 +00:00
oth
8cfa73ac38 [Interpreter] Add New, CallRuntime and CallJSRuntime support to BytecodeGraphBuilder.
Adds support for the New, CallRuntime and CallJSRuntime bytecodes in
BytecodeGraphBuilder. Also adds BuildLoadObjectField,
BuildLoadGlobalObject and BuildLoadNativeContextField helpers.

Landed on behalf of rmcilroy.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1456483002

Cr-Commit-Position: refs/heads/master@{#32136}
2015-11-20 09:25:41 +00:00
mythria
4bb6e7c8c0 [Interpreter] Add support for keyed load / store ICs and named store IC to
bytecode graph builder

Adds implementation and tests for KeyedLoadIC, KeyedStoreIC and StoreIC to
bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1448913002

Cr-Commit-Position: refs/heads/master@{#32116}
2015-11-19 14:16:53 +00:00
mstarzinger
0227857d26 [turbofan] Make new.target explicit in JSCallDescriptor.
This adds an explicit parameter to the call descriptor having kind
kJSCallFunction representing the new.target value. Note that for now
this parameter is not yet passed in and hence cannot be used yet. Also
contains some refactoring of how parameter index value are calculated,
establishing Linkage as the central point for such index computations.

This is a preparatory CL to allows us passing new.target in a register
instead of via a side-channel through the construct stub frame.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1461973002

Cr-Commit-Position: refs/heads/master@{#32112}
2015-11-19 12:48:25 +00:00
mythria
a8e86c49ec [Interpreter] Add support for unary operators to bytecode graph builder.
Adds implementation and tests for LogicalNot, TypeOf and Delete operators
to bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1459543003

Cr-Commit-Position: refs/heads/master@{#32104}
2015-11-19 09:39:11 +00:00
mstarzinger
8a57c81b3a [turbofan] Fix CFI failures in BytecodeGraphBuilder unit test.
This fixes undefined behavior with the OpParameter helper in some of our
node matchers. There was a constness mismatch of the template parameter.

R=oth@chromium.org,mythria@chromium.org

Review URL: https://codereview.chromium.org/1453973004

Cr-Commit-Position: refs/heads/master@{#32087}
2015-11-18 14:16:10 +00:00
dusan.m.milosavljevic
74145470dd MIPS: Enable logical shift right and bitwise And matching to Ext, Dext.
TEST=unittests/InstructionSelectorTest/Word32ShrWithWord32AndWithImmediate,
     Word32AndWithImmediateWithWord32Shr, Word64AndWithImmediateWithWord64Shr,
     Word64AndWithImmediateWithWord64Shr
BUG=

Review URL: https://codereview.chromium.org/1457523002

Cr-Commit-Position: refs/heads/master@{#32062}
2015-11-17 23:10:59 +00:00
dusan.m.milosavljevic
5d843f26a9 MIPS64: [turbofan] Combine untagging shifts with Mul, Div and Mod.
TEST=unittests/InstructionSelectorTest.CombineShiftsWithMul,
     InstructionSelectorTest.CombineShiftsWithDivMod
BUG=

Review URL: https://codereview.chromium.org/1444423002

Cr-Commit-Position: refs/heads/master@{#32061}
2015-11-17 22:52:54 +00:00
oth
519df935a3 [Interpreter] Add support for global loads / stores / calls to BytecodeGraphBuilder.
Adds support for the LdaGlobal and StaGlobal bytecodes to the
BytecodeGraphBuilder. Also fixes a bug in the context node's parameter
index and start node inputs.

Landed on behalf of rmcilroy.

TBR=bmeuer@chromium.org,mythria@chromium.org
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1449373002

Cr-Commit-Position: refs/heads/master@{#32049}
2015-11-17 15:07:15 +00:00
oth
e8ae8b34a5 [Interpreter] Add support for Call bytecode to bytecode graph builder.
Adds support for visiting the Call bytecode to the bytecode graph builder.
This change also adds the call type feedback slot to the Call bytecode.
This is not currently used by the interpreter, but is used by the
graph builder.

Also adds a CallWide varient of the Call bytecode, and adds the kCount16
operand type.

Landed on behalf of rmcilroy.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1456453002

Cr-Commit-Position: refs/heads/master@{#32033}
2015-11-17 12:18:53 +00:00
mythria
2acc2bc2a1 [Interpreter] Adds implementation of bytecode graph builder for LoadICSloppy/Strict.
Adds implementation and tests for following operators in bytecode graph builder:
-VisitLoadICSloppy
-VisitLoadICStrict
-VisitLoadICSloppyWide
-VisitLoadICStrictWide

The current implementation introduces empty frame states for frame state inputs expected by these operations.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1419373007

Cr-Commit-Position: refs/heads/master@{#32026}
2015-11-17 09:06:17 +00:00
danno
ff283f7ded [turbofan] Better and more sane support for tail calls
* Limit triggering of tail calls to explicit use of a new inline runtime
  function %_TailCall. %_TailCall works just like %_Call except for using
  tail-calling mechanics (currently only in TF).
* Remove hack that recognized some specific usages of %_Call and converted them
  into tail calls.
* Support tail calls for all calls where the number of callee stack parameters
  is less than or equal to the number of caller stack parameters.
* Use the gap resolver to swizzle parameters and registers to tail calls.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1439613003

Cr-Commit-Position: refs/heads/master@{#31987}
2015-11-13 16:08:30 +00:00
mstarzinger
83e9ea1e49 [turbofan] Ensure inlined constructor calls still throw.
This makes sure that inlining a constructor call to a function which
cannot be used as a constructor (e.g. strong mode function) still does
throw correctly when the implicit receiver is created.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-inline-strong-as-construct
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1447443002

Cr-Commit-Position: refs/heads/master@{#31982}
2015-11-13 14:05:48 +00:00
jarin
95cb324adb [turbofan] Move simplified alloc, load and store lowering to change lowering.
This is necessary to allow more optimizations to take place between
the representation inference and change lowering. Perhaps we want
to rename SimplifiedLowering -> RepresentationInference and
ChangeLowering -> SimplifiedLowering.

Review URL: https://codereview.chromium.org/1439473003

Cr-Commit-Position: refs/heads/master@{#31976}
2015-11-13 08:12:14 +00:00
bmeurer
c55161bf16 [turbofan] Add support for %_IsSpecObject intrinsic lowering.
Now JSIntrinsicLowering can also lower %_IsSpecObject intrinsics to a
diamond.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1436943005

Cr-Commit-Position: refs/heads/master@{#31960}
2015-11-12 14:05:49 +00:00
bmeurer
c4e19c7d8d [turbofan] Lower JSCreate to an inline allocation in JSTypedLowering.
This adds initial support for fast inline allocations of JSObject
instances. It currently has exactly the same limitations as Crankshaft.

R=mstarzinger@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1441573004

Cr-Commit-Position: refs/heads/master@{#31957}
2015-11-12 12:57:32 +00:00
mstarzinger
bae4492a3e [turbofan] Pass new target to JSCreate nodes.
This passes both, the actual constructor and the original constructor,
to nodes having the {JSCreate} operator. This is required for allocating
properly subclassed implicit receiver objects.

R=verwaest@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1434873004

Cr-Commit-Position: refs/heads/master@{#31955}
2015-11-12 09:33:37 +00:00
mstarzinger
11d5d09ce1 [turbofan] Initial support for constructor call inlining.
This implements a first version of support for constructor call inlining
in the inlining machinery. For now we can only inline calls where the
actual constructor and the original constructor coincide (i.e. no super
constructor calls). Note that the target of a super constructor call is
loaded with a runtime call, so there is no way for it to be constant
promoted at the moment.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1435873002

Cr-Commit-Position: refs/heads/master@{#31954}
2015-11-12 08:51:28 +00:00
sigurds
45787501e5 [turbofan] Pseudo-inline 'instanceof'
This patch extends the typed lowering with a specialized version of 'instanceof' that is used if the "class", i.e. the constructor function, is a known constant.

Unittests check that replacement occurs as intended. Functional correctness is ensured by extensive unit tests covering instanceof already in the testsuite.

TESTS=unittests/JSTypedLoweringTest.{JSInstanceOfSpecializationWithSmiCheck,JSInstanceOfSpecializationWithoutSmiCheck,JSInstanceOfNoSpecialization}

Review URL: https://codereview.chromium.org/1407413014

Cr-Commit-Position: refs/heads/master@{#31916}
2015-11-10 12:20:11 +00:00
fedor
461e5b49d0 binary-operator-reducer: reduce mul+div(shift)
Reduction Input:

    ChangeInt32ToFloat64=>          TruncateFloat64ToInt32
                         Float64Mul=>
    ChangeInt32ToFloat64=>          Float64Div=>TruncateFloat64ToInt32

Output:

         =>  TruncateInt64ToInt32
Int64Mul
         =>  Int64Shr => TruncateInt64ToInt32

Test code:

    function mul(a, b) {
      var l = a & 0x3ffffff;
      var h = b & 0x3ffffff;
      var m = l * h;

      var rl = m & 0x3ffffff;
      var rh = (m / 0x4000000) | 0;

      return rl | rh;
    }

    mul(1, 2);
    var a0 = mul(0x3ffffff, 0x3ffffff);
    mul(0x0, 0x0);
    %OptimizeFunctionOnNextCall(mul);
    var a1 = mul(0x3ffffff, 0x3ffffff);

    print(a0 + ' == ' + a1);

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1350223006

Cr-Commit-Position: refs/heads/master@{#31899}
2015-11-09 20:42:39 +00:00
martyn.capewell
eb991c66e5 [turbofan] Use cmn on ARM64 for negated rhs cmp
Use compare-negate instruction if the right-hand input to a compare is a
negate operation.

BUG=

Review URL: https://codereview.chromium.org/1410123009

Cr-Commit-Position: refs/heads/master@{#31866}
2015-11-07 07:20:17 +00:00
ahaas
39ed694bbd Implemented the Word64Clz TurboFan operator for x64, arm64, and mips64.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1413463009

Cr-Commit-Position: refs/heads/master@{#31858}
2015-11-06 14:51:20 +00:00
bmeurer
9c8f4f91aa [runtime] Remove the unused weird %Likely and %Unlikely intrinsics.
These intrinsics are completely unused and there doesn't seem to an
actual use case for it in the future.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1418663011

Cr-Commit-Position: refs/heads/master@{#31828}
2015-11-05 13:52:31 +00:00
bmeurer
8d780560bd [turbofan] Add support for relevant ES6 type conversion intrinsics.
TurboFan didn't fully support the relevant ES6 type conversion
intrinsics like %_ToNumber, %_ToLength, %_ToName, %_ToString and
%_ToInteger until now, we always went to the runtime instead.  These
intrinsics are now well supported in TurboFan, and we are even able to
generate quite decent code in some cases.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1428243003

Cr-Commit-Position: refs/heads/master@{#31820}
2015-11-05 09:51:28 +00:00
dusan.m.milosavljevic
8ae7c9abc3 MIPS: [turbofan] Properly implement Float64/32 Min/Max instructions.
TEST=cctest/test-run-machops/Float(64|32)MaxP, Float(64|32)MinP,
       unittests/InstructionSelectorTest.Float64Min|Max
BUG=v8:4206
LOG=N

Review URL: https://codereview.chromium.org/1419753008

Cr-Commit-Position: refs/heads/master@{#31806}
2015-11-04 21:03:25 +00:00
mstarzinger
e3f4047814 [turbofan] Deprecate RawMachineAssembler::CallFunctionStub0.
This deprecates the ability of the raw machine assembler to utilize the
CallFunctionStub in preparation of the stub itself being deprecated. We
only used this to test instruction selection of calls to stubs that can
deoptimize, the test has been adapted.

R=verwaest@chromium.org
TEST=unittests/InstructionSelectorTest

Review URL: https://codereview.chromium.org/1408193006

Cr-Commit-Position: refs/heads/master@{#31799}
2015-11-04 17:17:13 +00:00
bmeurer
309c36f5a9 [turbofan] Remove use of CallFunctionStub from TurboFan.
Use the Call builtin instead, which does the right thing(TM)
always, especially since the CallFunctionStub is going away.

R=jarin@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1410853007

Cr-Commit-Position: refs/heads/master@{#31794}
2015-11-04 15:04:53 +00:00
bmeurer
30aca03ad1 [turbofan] Implement the call protocol properly for direct calls.
The callees are expected to properly set the number of actual
arguments passed to the callee, which is now represented correctly
in the TurboFan graphs by a new Parameter right before the context
Parameter.  Currently this is only being used for outgoing calls.

Note that this requires disabling two of the TF code stub tests,
because of the JavaScript graphs are not automagically compatible
with abitrary (incoming) code stub interface descriptors.  If we
want to support JS code stubs at all, then we need to find a sane
way to feed in this information.

Drive-by-fix: Don't insert a direct call to a classConstructor.

R=mstarzinger@chromium.org
BUG=v8:4413, v8:4428
LOG=n

Review URL: https://codereview.chromium.org/1410633006

Cr-Commit-Position: refs/heads/master@{#31789}
2015-11-04 14:08:59 +00:00
rmcilroy
41f3e782d9 [Interpreter] Add support for JS runtime calls.
Adds support for calling JS runtime functions. Also changes the bytecode
array builder to allow calling functions with an invalid argument
register if the call takes no arguments.

Adds the bytecode CallJSRuntime.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1410003003

Cr-Commit-Position: refs/heads/master@{#31774}
2015-11-04 09:21:51 +00:00
mstarzinger
3e73ce4954 [turbofan] Desugar lookup slot optimization in graph builder.
This moves the optimization for variables loads targeting lookup slots
in DYNAMIC_GLOBAL and DYNAMIC_LOCAL mode into the AstGraphBuilder. This
way we implicitly get all optimizations that target global loads and
context loads for free.

R=bmeurer@chromium.org
BUG=v8:4513
LOG=n

Review URL: https://codereview.chromium.org/1424943008

Cr-Commit-Position: refs/heads/master@{#31713}
2015-11-02 13:55:31 +00:00
rmcilroy
6173d504ee [Interpreter] Add wide varients of bytecodes with feedback and constant pool indexes.
Adds wide bytecode varients, which take 16-bit feedback slot and constant
pool entry indexes for the following bytecodes:
  - LoadICSloppyWide
  - LoadICStrictWide
  - KeyedLoadICSloppyWide
  - KeyedLoadICStrictWide
  - StoreICSloppyWide
  - StoreICStrictWide
  - KeyedStoreICSloppyWide
  - KeyedStoreICStrictWide
  - LdaGlobalSloppyWide
  - LdaGlobalStrictWide
  - StaGlobalSloppyWide
  - StaGlobalStrictWide
  - LdaConstantWide

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1413863010

Cr-Commit-Position: refs/heads/master@{#31683}
2015-10-30 11:17:29 +00:00
bmeurer
47c0cb1d14 [turbofan] Optimize inlining and direct function calls.
This adds optimized lowering for JSConvertReceiver (in the general case)
and JSToObject in typed lowering. It also uses JSConvertReceiver for
direct calls in typed lowering.

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1431543002

Cr-Commit-Position: refs/heads/master@{#31676}
2015-10-30 10:25:12 +00:00
bmeurer
6040d5c0db [turbofan] Fix missing bailout point before calls.
In order to properly (lazy) bailout when converting the receiver for
sloppy mode functions (using the newly added JSConvertReceiver
operator), we need to have a bailout location right before every call
(also right before every %_Call and %_CallFunction), otherwise if the
JSConvertReceiver just reuses the lazy bailout frame state from the
JSCallFunction node, it will skip the whole function in case of lazy
bailout.

Note it should be impossible to trigger this currently because we do not
yet support AllocationSite code dependencies in TurboFan, which can
trigger this kind of lazy bailout; therefore it's not possible to write
a regression test (yet).

R=yangguo@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1425883004

Cr-Commit-Position: refs/heads/master@{#31668}
2015-10-30 06:59:07 +00:00
mtrofin
46878c1da1 When we split above an instruction (for example because of splintering),
we may introduce moves that are redundant in the context of
moves on subsequent instructions. Currently, we only detect such
redundancies by allowing moves to skip over Nop instructions (true
nops, with no input/output). We can also skip over other cases, for
example over constant definitions (nop with an output), since whatever
moves happen above it do not influence the instruction's outcome.

We may be able to handle other cases, too - in subsequent CLs.

BUG=

Review URL: https://codereview.chromium.org/1422333003

Cr-Commit-Position: refs/heads/master@{#31662}
2015-10-29 16:12:54 +00:00
mstarzinger
747ff0ebf8 [turbofan] Add unit tests for ReduceJSCreateArguments.
R=jarin@chromium.org
TEST=unittests/JSTypedLoweringTest.JSCreateArguments

Review URL: https://codereview.chromium.org/1417983004

Cr-Commit-Position: refs/heads/master@{#31653}
2015-10-29 13:37:49 +00:00
oth
dcf757a16f [Interpreter] Add support for for..in.
For..in introduces 3 new bytecodes ForInPrepare, ForInNext, and
ForInDone to start a for..in loop, get the next element, and check if
the loop is done.

For..in builds upon new LoopBuilder constructs for conditionally
breaking and continuing during iteration: BreakIf{Null|Undefined}
and ContinueIf{Null|Undefined}. New conditional jump bytecodes
support this succinctly: JumpIfNull and JumpIfUndefined.

Add missing check to BytecodeLabel that could allow multiple
forward referencess to the same label which is not supported.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1422033002

Cr-Commit-Position: refs/heads/master@{#31651}
2015-10-29 12:06:24 +00:00
mstarzinger
26fc85aae3 [turbofan] Cleanup RawMachineAssembler::Store interface.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1424983003

Cr-Commit-Position: refs/heads/master@{#31646}
2015-10-29 09:22:25 +00:00
bmeurer
23ac686ff8 [types] Use the TypeCache consistently for common types.
Rename ZoneTypeCache to TypeCache and use a single shared (immutable)
instance consistently to cache the most commonly used types. Also serves
as a chokepoint for defining those types, so we don't repeat the
definition (and possible bugs) in various places.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1409763004

Cr-Commit-Position: refs/heads/master@{#31631}
2015-10-28 13:31:22 +00:00
akos.palfi
8eabcb3fb6 Fix debug mode test failures on MIPS and PPC after f1aa5562.
TEST=cctest/test-gap-resolver/FuzzResolver,unittests/MoveOptimizerTest.RemovesRedundantExplicit
BUG=

Review URL: https://codereview.chromium.org/1403373016

Cr-Commit-Position: refs/heads/master@{#31629}
2015-10-28 13:04:43 +00:00
jacob.bramley
2f80165f22 [arm64] Implement Float(32|64)(Min|Max) using fcsel.
Float(32|64)Min:
  // (a < b) ? a : b
  fcmp da, db
  fcsel dd, da, db, lo

Float(32|64)Max:
  // (b < a) ? a : b
  fcmp db, da
  fcsel dd, da, db, lo

BUG=

Review URL: https://codereview.chromium.org/1360603003

Cr-Commit-Position: refs/heads/master@{#31621}
2015-10-28 09:55:12 +00:00
bmeurer
7709e41aec [turbofan] Try hard(er) to use smi representation for float64 values.
Previously ChangeLowering would always box float64 values when going to
tagged representation, but that introduces a lot of deoptimizer loops
and polymorphism into TurboFan, which is unfortunate and unnecessary.

This adds some logic to ChangeFloat64ToTagged to try harder to create a
Smi when going from Float64 to Tagged, instead of always allocating a
HeapNumber.  This might need some additional tweaking, but at least it
makes it possible to start comparing TurboFan and Crankshaft for some
regular JavaScript.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1420913003

Cr-Commit-Position: refs/heads/master@{#31609}
2015-10-27 16:18:15 +00:00
danno
f1aa556278 [turbofan] Create ExplicitOperands to specify operands without virtual registers
Up until now, if one wanted to specify an explicit stack location                                                                                                                                                                                                or register as an operand for an instruction, it had to also be
explicitly associated with a virtual register as a so-called
FixedRegister or FixedStackSlot.

For the implementation of tail calls, the plan is to use the gap
resolver needs to shuffle stack locations from the caller to the
tail-called callee. In order to do this, it must be possible to
explicitly address operand locations on the stack that are not
associated with virtual registers.

This CL introduces ExplictOperands, which can specify a specific
register or stack location that is not associated with virtual
register. This will allow tail calls to specify the target
locations for the necessary stack moves in the gap for the tail
call without the core register allocation having to know about
the target of the stack moves at all.

In the process this CL:
* creates a new Operand kind, ExplicitOperand, with which
  instructions can specify register and stack slots without an
  associated virtual register.
* creates a LocationOperand class from which AllocatedOperand and
  ExplicitOperand are derived and provides a common interface to
  get Register, DoubleRegister and spill slot information.
* removes RegisterOperand, DoubleRegisterOperand,
  StackSlotOperand and DoubleStackSlotOperand, they are subsumed
  by LocationOperand.
* addresses a cleanup TODO in AllocatedOperand to reduce the
  redundancy of AllocatedOperand::Kind by using machine_type() to
  determine if an operand corresponds to a general purpose or
  double register.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1389373002

Cr-Commit-Position: refs/heads/master@{#31603}
2015-10-27 13:27:00 +00:00
bmeurer
d08f9045a1 [turbofan] Introduce simplified NumberBitwise{Or,Xor,And} operators.
Currently we still (mis)used some machine operators in typed lowering
(namely Word32Or, Word32Xor and Word32And). But these operators are
"polymorphic" in the signedness of their inputs and output, hence the
representation selection (and thereby simplified lowering) was unable to
figure out whether a bitwise operation that was seen would produce an
unsigned or a signed result. If such nodes also have frame state uses,
the only safe choice was float64, which was not only a lot less ideal,
but also the main cause of the for-in related deoptimizer loops.

Adding dedicated NumberBitwiseOr, NumberBitwiseAnd and NumberBitwiseXor
simplified operators not only gives us precise (and correct) typing for
the bitwise operations, but also allows us to actually verify the graph
properly after typed lowering.

Drive-by-fix: Remove the double-to-smi magic from the Deoptimizer, which
is responsible for various deopt-loops in TurboFan, and is no longer
needed with the addition of the NumberBitwise operators.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1422213002

Cr-Commit-Position: refs/heads/master@{#31594}
2015-10-27 09:08:19 +00:00
rmcilroy
c0c214daa8 [Interpreter] Add support for loading from / storing to outer context variables.
Adds support for loading from and storing to outer context
variables. Also adds support for declaring functions on contexts and
locals. Finally, fixes a couple of issues with StaContextSlot where
we weren't emitting the write barrier and therefore would crash in the
GC.

Also added code so that --print-bytecode will output the
function name before the bytecodes, and replaces MachineType with StoreRepresentation in RawMachineAssembler::Store and updates tests.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1425633002

Cr-Commit-Position: refs/heads/master@{#31584}
2015-10-26 18:11:35 +00:00
mstarzinger
d8ceb9cb58 [unittests] Fix build/namespaces style guide violation.
From the Google C++ style guide: "You may not use a using-directive to
make all names from a namespace available". This would be covered by
presubmit linter checks if build/namespaces were not blacklisted.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410073004

Cr-Commit-Position: refs/heads/master@{#31565}
2015-10-26 13:47:16 +00:00
chunyang.dai
5978b926c6 For some platform such as X87, Crankshaft and Turbofan needs to use different
register configurations currently. This CL provides a mechanism so that
    optimizing compilers can select different Register Configuration.

BUG=

Review URL: https://codereview.chromium.org/1405673003

Cr-Commit-Position: refs/heads/master@{#31476}
2015-10-22 13:24:49 +00:00
ishell
14b31970e7 Remove support for "loads and stores to global vars through property cell shortcuts installed into parent script context" from all compilers.
The plan is to implement the same idea using vector IC machinery.
Stubs implementations and scopes modifications are left untouched for now.

Review URL: https://codereview.chromium.org/1419823003

Cr-Commit-Position: refs/heads/master@{#31458}
2015-10-22 09:17:24 +00:00
bmeurer
bb20d7aea0 [turbofan] Unify NamedAccess and PropertyAccess operator parameters.
Use a unified NamedAccess operator parameter for both JSLoadNamed and
JSStoreNamed, and similar use PropertyAccess for both JSLoadProperty and
JSStoreProperty.

Review URL: https://codereview.chromium.org/1418993002

Cr-Commit-Position: refs/heads/master@{#31456}
2015-10-22 08:48:09 +00:00
mtrofin
3e2e2062e7 [Turbofan] Re-enable single splinter.
Revert "Revert of [turbofan] Splinter into one range.
(patchset #2 id:80001 of https://codereview.chromium.org/1391023007/ )"

This reverts commit 23a8837fcc.

Also added a CHECK in Merge to validate that splitting yields a different
range and thus advances the algorithm. Ran stress bots successfully. Likely my earlier change in Splintering addressed the stress test scenario
that was looping infinitely.

BUG=

Review URL: https://codereview.chromium.org/1406983004

Cr-Commit-Position: refs/heads/master@{#31430}
2015-10-21 08:09:43 +00:00
mstarzinger
dbae315a10 [turbofan] Remove locally constructed simplified builders.
This removes all locally constructed SimplifiedOperatorBuilder instances
and uses the one passed along the JSGraph. It ensures that the correct
zone is used to allocate operators, no matter where the reducer is used.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1410003002

Cr-Commit-Position: refs/heads/master@{#31355}
2015-10-19 08:05:27 +00:00
jarin
106aecf262 [turbofan] Redundant branch elimination.
Removes a branch that checks for a condition that has been checked on dominators of the branch.

This introduces a new reducer that propagates the list of checked conditions (and their boolean values) through the control flow graph. If it encounters a branch checking a condition with a known value, the branch is eliminated.

The analysis relies on loops being reducible: if a condition has been checked on all paths to loop entry, then it is checked in the loop (regardless what of the conditions checked inside the loop).

The implementation is fairly naive and could be improved:

- all the operation on the condition lists could be made allocation-free when revisited.

- we could try to use a map structure rather than a linked list (to make
lookups faster).

- the merging of control flow could be changed to take into account
  conditions from non-dominating paths (as long as all paths check
  the condition).

Review URL: https://codereview.chromium.org/1376293005

Cr-Commit-Position: refs/heads/master@{#31347}
2015-10-17 17:50:26 +00:00
rmcilroy
2c8340dac4 [Interpreter] Add support for local context loads and stores.
Adds support for local context loads and stores. Also adds support for
creation of new block contexts (e.g., for let variables) and initializing
const / let variables with the hole appropriately.

Also adds some checks to ensure BytecodeArrayBuilder::context_count is set
appropriately and fixes tests to do so.

Adds the bytecode StaContextSlot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1403943004

Cr-Commit-Position: refs/heads/master@{#31343}
2015-10-16 15:29:16 +00:00
mstarzinger
b7990793cf [turbofan] Move SimplifiedOperatorBuilder into JSGraph.
This fixes the lifetime of nodes created by JSGlobalSpecialization that
contain a simplified operator. In the case where this reducer runs as
part of the inliner, the SimplifiedOperatorBuilder was instantiated with
the wrong zone. This led to use-after-free of simplified operators.

To avoid such situations in the future, we decided to move this operator
builder into the JSGraph and make the situation uniform with all other
operator builders.

R=bmeurer@chromium.org
BUG=chromium:543528
LOG=n

Review URL: https://codereview.chromium.org/1409993002

Cr-Commit-Position: refs/heads/master@{#31334}
2015-10-16 12:38:52 +00:00
jarin
87aab49a42 [turbofan] Remove the --turbo-allocate flag.
The CL also fixes various small bugs in context allocation.

Review URL: https://codereview.chromium.org/1404293002

Cr-Commit-Position: refs/heads/master@{#31311}
2015-10-15 16:11:20 +00:00
bmeurer
23a8837fcc Revert of [turbofan] Splinter into one range. (patchset #2 id:80001 of https://codereview.chromium.org/1391023007/ )
Reason for revert:
Weird endless loop in TopLevelLiveRange::Merge() due to always splitting first and not making progress. See comments, unfortunately no useable repro.

Original issue's description:
> [turbofan] Splinter into one range.
>
> Before this CL, we created one live range per successive set of
> deferred blocks. For scenarios with many such blocks, this creates
> an upfront pressure for the register allocator to deal with many ranges.
> Linear sorts ranges, which is a super-linear operation.
>
> The change places all deferred intervals into one range, meaning that,
> at most, there will be twice as many live ranges as the original set. In
> pathological cases (benchmarks/Compile/slow_nbody1.js), this change
> halves the compilation time. We see some improvements elsewhere,
> notably SQLite at ~4-5%.
>
> We may be able to avoid the subsequent merge. Its cost is the
> additional ranges it may need to create. The sole reason for the merge
> phase is to provide an unchanged view of the world to the subsequent
> phases. With the at-most-one splinter model, we may be able to teach
> the other phases about splintering - should we find perf hindrances
> due to merging.
>
> Committed: https://crrev.com/efdcd20267870276c5824f1ccf4e171ac378f7ae
> Cr-Commit-Position: refs/heads/master@{#31224}

TBR=jarin@chromium.org,mtrofin@google.com,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1403163003

Cr-Commit-Position: refs/heads/master@{#31300}
2015-10-15 13:28:20 +00:00
jarin
59c616ccd7 [turbofan] Introduce node regions for protection from scheduling.
This CL re-purposes ValueEffect and Finish as delimiters for regions
that are scheduled atomically (renamed to BeginRegion, FinishRegion).

The BeginRegion node takes and produces an effect. For the uses that do
not care about the placement in the effect chain, it is ok to feed
graph->start() as an effect input.

The FinishRegion takes a value and an effect and produces a value and
an effect. It is important that any value or effect produced inside the
region is not used outside the region. The FinishRegion node is the only
way to smuggle an effect and a value out.

At the moment, this does not support control flow inside the region. Control flow would be hard.

During scheduling we do some sanity check, but the checks are not exhaustive. Here is what we check:
- the effect chain between begin and finish is linear (no splitting,
  single effect input and output).
- any value produced is consumed by the FinishRegion node.
- no control flow outputs.

Review URL: https://codereview.chromium.org/1399423002

Cr-Commit-Position: refs/heads/master@{#31265}
2015-10-14 14:53:12 +00:00
martyn.capewell
a456134b8b [turbofan] Negate with shifted input for ARM64
Support negate with shifted input on ARM64 by supporting lhs zero registers for
binary operations, and removing explicit Neg instruction support.

Review URL: https://codereview.chromium.org/1404093003

Cr-Commit-Position: refs/heads/master@{#31263}
2015-10-14 14:51:06 +00:00
mtrofin
efdcd20267 [turbofan] Splinter into one range.
Before this CL, we created one live range per successive set of
deferred blocks. For scenarios with many such blocks, this creates
an upfront pressure for the register allocator to deal with many ranges.
Linear sorts ranges, which is a super-linear operation.

The change places all deferred intervals into one range, meaning that,
at most, there will be twice as many live ranges as the original set. In
pathological cases (benchmarks/Compile/slow_nbody1.js), this change
halves the compilation time. We see some improvements elsewhere,
notably SQLite at ~4-5%.

We may be able to avoid the subsequent merge. Its cost is the
additional ranges it may need to create. The sole reason for the merge
phase is to provide an unchanged view of the world to the subsequent
phases. With the at-most-one splinter model, we may be able to teach
the other phases about splintering - should we find perf hindrances
due to merging.

Review URL: https://codereview.chromium.org/1391023007

Cr-Commit-Position: refs/heads/master@{#31224}
2015-10-13 03:58:19 +00:00
paul.lind
9d66c8813a Fix another gcc 4.9.2 signed-compare error.
BUG=

Review URL: https://codereview.chromium.org/1397003002

Cr-Commit-Position: refs/heads/master@{#31199}
2015-10-09 20:04:09 +00:00
jarin
4f64af2fa6 [turbofan] Fix scheduler test for Loop/Terminate nodes.
The test had an effect phi with one effect input connected to a loop with two control inputs. Also, the Terminate node was used by the effect phi.

Review URL: https://codereview.chromium.org/1398763002

Cr-Commit-Position: refs/heads/master@{#31193}
2015-10-09 10:52:59 +00:00
bradnelson
2e3c36fb1c Adding support for multiple returns in compiled functions.
This will allow exploration of possibilities like passing around buffer base and length.

BUG=None
TEST=test-multiple-return
LOG=N
R=mtrofin@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/1391333003

Cr-Commit-Position: refs/heads/master@{#31184}
2015-10-08 18:27:46 +00:00
rmcilroy
688eacdae9 [Interpreter] Add support for global declarations and load/store of global variables
Implements support for declaring global variables. Also adds support for loading
from and storing to both global and unallocated global variables.  Adds the
following bytecodes:
 - StoreGlobal
 - LoadContextSlot

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1378523005

Cr-Commit-Position: refs/heads/master@{#31166}
2015-10-07 21:20:02 +00:00
bmeurer
74ae226b94 [turbofan] Move global constant optimization to AstGraphBuilder.
Optimizing global constants such as "NaN", "Infinity" and "undefined" is
best performed during graph building. Then the optimization and lowering
passes only need to deal with real loads in case of JSLoadGlobal.

R=mstarzinger@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1384953002

Cr-Commit-Position: refs/heads/master@{#31135}
2015-10-07 08:19:43 +00:00
rmcilroy
785516821d [Interpreter]: Add support for strict mode load / store ICs.
Adds support for strict mode load / store ICs and cleans up BinaryOp and
CompareOp to only trigger an UNIMPLEMENTED abort if called with STRONG
mode (which is the only language mode which has different compare/binary ops.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1385623002

Cr-Commit-Position: refs/heads/master@{#31134}
2015-10-07 07:54:27 +00:00
mbrandy
4ddc9f1cc8 [test] Protect against infinite loops in LiveRange logic.
A subset of the LiveRangeUnitTests (SplitInvalidPreStart,
InvalidSplitEnd, SplitInvalidPostEnd) fail or hang on AIX in release
mode.

These tests fork a child which is expected to crash in
register-allocator code after feeding in bad inputs.

In debug mode, they behave as expected due to hitting a debug assert.

In release mode, however, the tests rely only on the fact that
dereferencing a null pointer will cause a SEGFAULT.  This is true on
most platforms, but not AIX.  An AIX process has valid low memory
pages mapped for reading and will not fault.  Thus, these tests fail
or hang because the child process survives the load from address zero
and either completes (with undefined results) or goes into an infinite
loop.

R=bmeurer@chromium.org, danno@chromium.org, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1384733002

Cr-Commit-Position: refs/heads/master@{#31090}
2015-10-02 18:45:00 +00:00
rmcilroy
75f6ad74b2 [Interpreter] Add CallRuntime support to the interpreter.
Adds support for calling runtime functions from the interpreter. Adds the
CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
and the arguments in sequential registers. Adds a InterpreterCEntry builtin
to enable the interpreter to enter C++ code based on the functionId.

Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
and groups all the interpreter builtins together.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1362383002

Cr-Commit-Position: refs/heads/master@{#31089}
2015-10-02 18:13:57 +00:00
danno
5cf1c0bcf6 Re-reland: Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
Cr-Commit-Position: refs/heads/master@{#30913}

Committed: https://crrev.com/7b7a8205d9a00c678fb7a6e032a55fecbc1509cf
Cr-Commit-Position: refs/heads/master@{#31075}

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#31087}
2015-10-02 16:55:22 +00:00
danno
00e07b0057 Revert of Reland: Remove register index/code indirection (patchset #20 id:380001 of https://codereview.chromium.org/1287383003/ )
Reason for revert:
Failures on MIPS

Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
>   so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
>   different platforms is now shared.
> * The list of allocatable registers on each platform is declared
>   as a list rather than implicitly via the register index <->
>   code mapping.
>
> Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}
>
> Committed: https://crrev.com/7b7a8205d9a00c678fb7a6e032a55fecbc1509cf
> Cr-Commit-Position: refs/heads/master@{#31075}

TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1380863004

Cr-Commit-Position: refs/heads/master@{#31083}
2015-10-02 15:37:06 +00:00
rmcilroy
b4a2f65624 Revert of [Interpreter] Add CallRuntime support to the interpreter. (patchset #8 id:220001 of https://codereview.chromium.org/1362383002/ )
Reason for revert:
Now breaking arm32 debug bot (worked locally even with --debug-code, so I'll need to figure out what's different on the bot)

Original issue's description:
> [Interpreter] Add CallRuntime support to the interpreter.
>
> Adds support for calling runtime functions from the interpreter. Adds the
> CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
> and the arguments in sequential registers. Adds a InterpreterCEntry builtin
> to enable the interpreter to enter C++ code based on the functionId.
>
> Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
> and groups all the interpreter builtins together.
>
> BUG=v8:4280
> LOG=N
>

TBR=bmeurer@chromium.org,oth@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1379933003

Cr-Commit-Position: refs/heads/master@{#31078}
2015-10-02 15:12:17 +00:00
rmcilroy
c991d8f384 [Interpreter] Add CallRuntime support to the interpreter.
Adds support for calling runtime functions from the interpreter. Adds the
CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
and the arguments in sequential registers. Adds a InterpreterCEntry builtin
to enable the interpreter to enter C++ code based on the functionId.

Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
and groups all the interpreter builtins together.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/40e8424b744f8b6e3e1d93e20f23487419911dfc
Cr-Commit-Position: refs/heads/master@{#31064}

Review URL: https://codereview.chromium.org/1362383002

Cr-Commit-Position: refs/heads/master@{#31076}
2015-10-02 14:12:09 +00:00
danno
7b7a8205d9 Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
Cr-Commit-Position: refs/heads/master@{#30913}

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#31075}
2015-10-02 13:59:06 +00:00
mstarzinger
ea26401266 [turbofan] Call FastNewContextStub for function context.
This lowers JSCreateFunctionContext nodes to call the above stub for
help with allocating function contexts when possible. It also contains
an implementation for inlined allocations of such contexts, which is
still behind a flag until inlined allocations are ready for prime time.

TEST=unittests/JSTypedLoweringTest.JSCreateFunctionContext
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1380113002

Cr-Commit-Position: refs/heads/master@{#31068}
2015-10-02 09:30:21 +00:00
rmcilroy
90f69d1610 Revert of [Interpreter] Add CallRuntime support to the interpreter. (patchset #6 id:180001 of https://codereview.chromium.org/1362383002/ )
Reason for revert:
Broke Arm64 bot (CEntry stub is trying to pop arguments off stack when argv_in_reg, so I need to fix this).

Original issue's description:
> [Interpreter] Add CallRuntime support to the interpreter.
>
> Adds support for calling runtime functions from the interpreter. Adds the
> CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
> and the arguments in sequential registers. Adds a InterpreterCEntry builtin
> to enable the interpreter to enter C++ code based on the functionId.
>
> Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
> and groups all the interpreter builtins together.
>
> BUG=v8:4280
> LOG=N
>
> Committed: https://crrev.com/40e8424b744f8b6e3e1d93e20f23487419911dfc
> Cr-Commit-Position: refs/heads/master@{#31064}

TBR=bmeurer@chromium.org,oth@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review URL: https://codereview.chromium.org/1387543002

Cr-Commit-Position: refs/heads/master@{#31066}
2015-10-02 09:21:59 +00:00
rmcilroy
40e8424b74 [Interpreter] Add CallRuntime support to the interpreter.
Adds support for calling runtime functions from the interpreter. Adds the
CallRuntime bytecode which takes a Runtime::FunctionId of the function to call
and the arguments in sequential registers. Adds a InterpreterCEntry builtin
to enable the interpreter to enter C++ code based on the functionId.

Also renames Builtin::PushArgsAndCall to Builtin::InterpreterPushArgsAndCall
and groups all the interpreter builtins together.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1362383002

Cr-Commit-Position: refs/heads/master@{#31064}
2015-10-02 07:25:56 +00:00
rmcilroy
03369ed2cb [Interpreter] Add support for short (16 bit) operands.
Adds support for short operands, starting with kIdx16. Introduces
BytecodeTraits to enable compile time determination of various traits for a
bytecode, such as size, operands, etc. Reworks BytecodeIterator,
BytecodeArrayBuilder and Bytecodes::Decode to support 16 bit operands. Adds
support to Interpreter to load 16 bit operands.

Also fixes a bug with ToBoolean where it wouldn't get emitted at the start
of a block, and added a test.

BytecodeTraits template magic inspired by oth@chromium.org.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1370893002

Cr-Commit-Position: refs/heads/master@{#31058}
2015-10-01 17:23:14 +00:00
mstarzinger
6a769ac1df [presubmit] Enable readability/namespace linter checking.
This enables linter checking for "readability/namespace" violations
during presubmit and instead marks the few known exceptions that we
allow explicitly.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1371083003

Cr-Commit-Position: refs/heads/master@{#31019}
2015-09-30 13:47:11 +00:00
mstarzinger
8dfe18559c [turbofan] Pass scope infos as static operator parameters.
This changes the operators for JSCreate[Block|Script]Context to take
their ScopeInfo as a static parameter as opposed to a value input and
in turn allows for easier access to that parameter during lowerings.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1379593002

Cr-Commit-Position: refs/heads/master@{#31009}
2015-09-29 15:53:28 +00:00
jarin
904ac0ae2c [turbofan] Make string comparisons effectful.
BUG=v8:4446
LOG=n

Review URL: https://codereview.chromium.org/1369313004

Cr-Commit-Position: refs/heads/master@{#31006}
2015-09-29 14:39:01 +00:00
jarin
d06930fc4b [turbofan] Make Strict(Not)Equal, TypeOf, ToBoolean, UnaryNot effectful.
This is necessary because these operators can read heap (equality can actually write heap when flattening strings).

BUG=v8:4446
LOG=n

Review URL: https://codereview.chromium.org/1374683002

Cr-Commit-Position: refs/heads/master@{#31005}
2015-09-29 13:51:33 +00:00
mstarzinger
6a20034d24 [presubmit] Fix whitespace/semicolon linter violations.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1365803004

Cr-Commit-Position: refs/heads/master@{#30963}
2015-09-28 08:18:49 +00:00
jarin
1c2867c0da [turbofan] Check node input/use consistency for changed operators and new nodes.
Verifies consistency of node inputs and uses:
- node inputs should agree with the input count computed from the node's operator.
- effect inputs should have effect outputs (or be a sentinel).
- control inputs should have control outputs (or be a sentinel).
- frame state inputs should be frame states (or be a sentinel).
- if the node has control uses, it should produce control.
- if the node has effect uses, it should produce effect.
- if the node has frame state uses, it must be a frame state.

I also removed some tests, either because they did not seem to be useful (scheduler) or they tested dead functionality (diamond effect phi).

Review URL: https://codereview.chromium.org/1368913002

Cr-Commit-Position: refs/heads/master@{#30927}
2015-09-25 08:43:11 +00:00
oth
347fa90626 [Interpreter] Basic flow control.
+ Add bytecodes for conditional and unconditional jumps.
+ Add bytecodes for test/compare operations.
+ Expose jumps in bytecode-array-builder and add BytecodeLabel class for
  identifying jump targets.
+ Add support for if..then...else in the bytecode-generator.
+ Implement jump bytecodes in the interpreter. Test/compare operations
  dependent on runtime call for comparisons.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1343363002

Cr-Commit-Position: refs/heads/master@{#30918}
2015-09-24 15:21:04 +00:00
mstarzinger
da9c42dd45 [turbofan] Make Node::set_op safer via wrapper.
This introduces the NodeProperties::ChangeOp helper which guards node
operator changes so that additional checking can be done without any
additional dependencies being pulled into the Node class. For now only
the input count is checked, but additional checking might follow.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1366753003

Cr-Commit-Position: refs/heads/master@{#30916}
2015-09-24 14:46:37 +00:00
danno
3ac27431a9 Revert of Remove register index/code indirection (patchset #17 id:320001 of https://codereview.chromium.org/1287383003/ )
Reason for revert:
Failures on greedy RegAlloc, Fuzzer

Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
>   so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
>   different platforms is now shared.
> * The list of allocatable registers on each platform is declared
>   as a list rather than implicitly via the register index <->
>   code mapping.
>
> Committed: https://crrev.com/80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}

TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1365073002

Cr-Commit-Position: refs/heads/master@{#30914}
2015-09-24 13:39:03 +00:00
danno
80bc6f6e11 Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.

Some highlights of changes:

* TurboFan's RegisterConfiguration class moved to V8's top level
  so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
  different platforms is now shared.
* The list of allocatable registers on each platform is declared
  as a list rather than implicitly via the register index <->
  code mapping.

Review URL: https://codereview.chromium.org/1287383003

Cr-Commit-Position: refs/heads/master@{#30913}
2015-09-24 12:53:13 +00:00
pierre.langlois
d1472d65dd [arm] Optimize vcmp when lhs operand is #0.0
This patch checks the type of the lhs operand of a floating point
comparison for ARM, and commutes the operands if it is #0.0.  It allows
us to optimize a comparison with zero, as the vcmp instruction
accepts #0.0 as rhs operand.

Code before for "0.0 < 0.123":
------------------------------
movw ip, #29360
movt ip, #37224
movw r9, #31981
movt r9, #16319
vmov d0, ip, r9
mov ip, #0
vmov d1, ip, ip
vcmp.f64 d1, d0
vmrs APSR, FPSCR
bcc +12

Code after:
-----------
movw ip, #29360
movt ip, #37224
movw r9, #31981
movt r9, #16319
vmov d0, ip, r9
vcmp.f64 d0, #0.0
vmrs APSR, FPSCR
bgt +12

BUG=

Review URL: https://codereview.chromium.org/1361913003

Cr-Commit-Position: refs/heads/master@{#30911}
2015-09-24 12:04:16 +00:00
martyn.capewell
809f6b15be [turbofan] Elide fp32 convert for const compares
Reduce operations of the form f64cmp(fp32to64(x), k) to f32cmp(x, k) when k
can be encoded as a 32-bit float.

Review URL: https://codereview.chromium.org/1365623002

Cr-Commit-Position: refs/heads/master@{#30909}
2015-09-24 11:24:33 +00:00
pierre.langlois
cf38725d0b [arm64] Explicit commuted conditions in unittests
This patch explicitly names commuted conditions for floating point
comparisons, instead of relying on CommuteFlagsCondition.  Otherwise, a
bug in this function would not be caught.

BUG=

Review URL: https://codereview.chromium.org/1364773002

Cr-Commit-Position: refs/heads/master@{#30905}
2015-09-24 09:27:30 +00:00
pierre.langlois
e28ae8ca8a [arm64] Optimize fcmp when lhs operand is #0.0
This patch checks the type of the lhs operand of a floating point
comparison, and commutes the operands if it is #0.0.  It allows us to
optimize a comparison with zero, as the fcmp instruction accepts #0.0 as
rhs operand.

Code before for "0.0 < 0.123":
------------------------------
fmov d1, xzr
ldr d0, pc+96
fcmp d1, d0
b.lo #+0xc

Code after:
-----------
ldr d0, pc+92
fcmp d0, #0.0
b.gt #+0xc

Before this patch, we used unsigned condition codes for floating point
comparisons, but the unordered case was not correctly commuted.

Review URL: https://codereview.chromium.org/1356283003

Cr-Commit-Position: refs/heads/master@{#30881}
2015-09-23 09:33:35 +00:00
jarin
205d85affc Reland "[turbofan] Checking of input counts on node creation"
(Original CL: https://codereview.chromium.org/1347353003/)

Unfortunately, the mips gcc gets confused by arraysize on
variadic templated arguments, so we use sizeof... instead.

Review URL: https://codereview.chromium.org/1366543003

Cr-Commit-Position: refs/heads/master@{#30880}
2015-09-23 09:08:34 +00:00
machenbach
c602a91c1d Revert of [turbofan] Checking of input counts on node creation (patchset #4 id:60001 of https://codereview.chromium.org/1347353003/ )
Reason for revert:
[Sheriff] Breaks mips cross-compile:
http://build.chromium.org/p/client.v8/builders/V8%20Mips%20-%20builder/builds/4315

Original issue's description:
> [turbofan] Checking of input counts on node creation
>
> This required fixing bunch of tests with wrong input counts.
>
> Committed: https://crrev.com/260ec46efd74c45cdc4b156d95086b7de06621ad
> Cr-Commit-Position: refs/heads/master@{#30877}

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1362783004

Cr-Commit-Position: refs/heads/master@{#30878}
2015-09-23 08:02:41 +00:00
jarin
260ec46efd [turbofan] Checking of input counts on node creation
This required fixing bunch of tests with wrong input counts.

Review URL: https://codereview.chromium.org/1347353003

Cr-Commit-Position: refs/heads/master@{#30877}
2015-09-23 07:53:53 +00:00
jarin
92903d0a19 [turbofan] Get rid of type lower bounds.
Review URL: https://codereview.chromium.org/1348073002

Cr-Commit-Position: refs/heads/master@{#30764}
2015-09-16 11:55:43 +00:00
paul.lind
b4f9a95e6c MIPS64: Fix unittests (to not use invalid load representation).
Same as https://codereview.chromium.org/1340303002/

BUG=

Review URL: https://codereview.chromium.org/1339763005

Cr-Commit-Position: refs/heads/master@{#30756}
2015-09-15 21:28:30 +00:00
jarin
edf6d2adbd [mips] Fix mips unittests (to not use invalid load representation).
Review URL: https://codereview.chromium.org/1340303002

Cr-Commit-Position: refs/heads/master@{#30753}
2015-09-15 15:50:44 +00:00
jarin
a86db19e0a [turbofan] Limit the load/store machine types to the ones we actually use.
Review URL: https://codereview.chromium.org/1333353005

Cr-Commit-Position: refs/heads/master@{#30725}
2015-09-15 05:45:30 +00:00
rmcilroy
e7fb233946 [Interpreter] Add support for JS calls.
Adds support for JS calls to the interpreter. In order to support
calls from the interpreter, the PushArgsAndCall builtin is added
which pushes a sequence of arguments onto the stack and calls
builtin::Call.

Adds the Call bytecode.

MIPS port contributed by akos.palfi@imgtec.com in https://codereview.chromium.org/1334873002/

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1323463005

Cr-Commit-Position: refs/heads/master@{#30710}
2015-09-14 10:05:35 +00:00
oth
8df7b4f6b5 [Interpreter] Skeleton bytecode graph builder
Add skeleton version bytecode-graph-builder.{h,cc} for existing
bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1291693004

Cr-Commit-Position: refs/heads/master@{#30687}
2015-09-10 16:21:40 +00:00
bmeurer
a1b2ec60b0 [runtime] Move binary operator fallbacks into the runtime.
Replace the ADD, SUB, etc. builtins with proper runtime implementations,
and expose them as runtime calls that can be used by the code stubs and
the interpreter (for now).

Also remove all the support runtime functions for ADD, SUB and friends,
namely %NumberAdd, %NumberSub, and so on.

R=mstarzinger@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg

Review URL: https://codereview.chromium.org/1333843002

Cr-Commit-Position: refs/heads/master@{#30680}
2015-09-10 13:04:33 +00:00
bmeurer
6b3c070db6 [runtime] Sanitize %NewClosure runtime entries.
There are now two runtime entries %NewClosure and %NewClosure_Tenured,
with the same signature (one parameter, the SharedFunctionInfo, and the
context of the caller).

Also remove the HFunctionLiteral special case instruction from Crankshaft,
as HCallWithDescriptor with FastNewClosureStub or HCallRuntime with
either %NewClosure or %NewClosure_Tenured can easily do that for you.

Also remove the redundant context parameter from the JSCreateClosure
operator, because every JS operator already takes a context input.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_dbg

Review URL: https://codereview.chromium.org/1329293003

Cr-Commit-Position: refs/heads/master@{#30671}
2015-09-10 08:36:15 +00:00
mtrofin
96c0e6f96b [turbofan] relative_id of splinters and their children.
A LiveRange is identified by 2 integers: the vreg() of its TopLevel,
which is the virtual register (operand) ID; and a relative_id(), which has
no meaning in the program, but is valuable in debugging or tracing
scenarios.

This change ensures that relative_id is unique even in cases of splinter
ranges and their children.

Review URL: https://codereview.chromium.org/1318493005

Cr-Commit-Position: refs/heads/master@{#30665}
2015-09-09 19:34:11 +00:00
dusan.m.milosavljevic
4329a7c2cf MIPS64: [turbofan] Improve changes from and to Smi.
The instruction selection for following sequences is
improved:

  113: Word64Sar(107, 91) : Internal/Any
  114: TruncateInt64ToInt32(113) : Signed32/UntaggedSigned32
  115: ChangeInt32ToFloat64(114) : Signed32/UntaggedFloat64

TEST=unittests/InstructionSelectorTest.ChangesFromToSmi
BUG=

Review URL: https://codereview.chromium.org/1318153006

Cr-Commit-Position: refs/heads/master@{#30645}
2015-09-08 21:55:00 +00:00
bmeurer
3dc9b122fa [runtime] Remove useless IN builtin.
Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
and %HasProperty anyway, and cannot be optimized, plus it had a weird
special fast case (which also involved at least one LOAD_IC plus some
intrinsic magic).

R=yangguo@chromium.org,jarin@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_win_nosnap_shared_rel

Committed: https://crrev.com/72d60a1e80e81e2e68ca402665e2acbc46c5e471
Cr-Commit-Position: refs/heads/master@{#30154}

Review URL: https://codereview.chromium.org/1295433002

Cr-Commit-Position: refs/heads/master@{#30582}
2015-09-04 08:44:38 +00:00
mtrofin
db646fb2f8 [turbofan] Greedy: split around calls heuristic.
Once  a range is found to have a conflict, split around all the calls it
crosses over, since it will anyway have conflicts there, too.

Incrementally, from the last change to greedy, this change brings
overall improvement in benchmarks. In fact, except for 2 regressions
in Jetstream (splay-latency and date-format-xparb, at 6 and 7%
respectivelly), everything else is in the green or noise. Quite a few
benchmarks are over 3%, with a few (zlib, for example) in the double
digits.

Review URL: https://codereview.chromium.org/1328783002

Cr-Commit-Position: refs/heads/master@{#30579}
2015-09-04 06:50:30 +00:00
rmcilroy
d8df7468b4 [Interpreter] Add support for property load operations.
Adds support for property load operations via Load/KeyedLoad ICs. Adds the
following bytecodes:
 - LoadIC
 - KeyedLoadIC
Also adds support to the interpreter assembler for loading the type feedback
vector from the function on the stack, and calling ICs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1309843007

Cr-Commit-Position: refs/heads/master@{#30543}
2015-09-02 13:03:22 +00:00
pcc
e70f23f959 Fix type errors in unit test utilities.
Fixes all bad casts associated with operands of call and select operators
in the test suite.

Cleanup for cfi_vptr=1; see https://www.chromium.org/developers/testing/control-flow-integrity

BUG=chromium:457523
R=bmeurer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1329643002

Cr-Commit-Position: refs/heads/master@{#30531}
2015-09-02 04:55:27 +00:00
mstarzinger
c87bd340af [turbofan] Remove obsolete unique.h includes in TurboFan.
Now that it is no longer needed, this also removes the invalid inclusion
of "object-inl.h" within the "unique.h" header file.

Note that this change still leaves 2 violations of that rule in the
code, checked with the "tools/check-inline-includes.sh" tool.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1321223002

Cr-Commit-Position: refs/heads/master@{#30503}
2015-09-01 10:30:57 +00:00
mstarzinger
5f57ebe222 Make isolate.h usable without objects-inl.h header.
This CL us a pure refactoring that makes an empty compilation unit
including just "isolate.h" or "contexts.h" but not "objects-inl.h"
compile without warnings or errors. This is needed to further reduce
the header dependency tangle.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1322883002

Cr-Commit-Position: refs/heads/master@{#30500}
2015-09-01 09:25:27 +00:00
mtrofin
d940690bb5 [turbofan] Live Range unit tests.
Unit tests for split/splinter/merge.

BUG=

Review URL: https://codereview.chromium.org/1315113003

Cr-Commit-Position: refs/heads/master@{#30475}
2015-08-31 13:27:12 +00:00
machenbach
4abfa4e43f [test] Remove unused code.
BUG=

Review URL: https://codereview.chromium.org/1313213007

Cr-Commit-Position: refs/heads/master@{#30469}
2015-08-31 11:52:33 +00:00
mtrofin
9987734fe5 [turbofan] Factored out the test live range builder.
I plan to reuse this for live range splitting/splintering/merging tests.

BUG=

Review URL: https://codereview.chromium.org/1305313008

Cr-Commit-Position: refs/heads/master@{#30461}
2015-08-31 09:57:48 +00:00
mstarzinger
6e65e6db6c [turbofan] Remove usage of Unique<T> from graph.
The usage of Unique<T> throughout the TurboFan IR does not have any
advantage. There is no single point in time when they are initialized
and most use-sites looked through to the underlying Handle<T> anyways.
Also there already was a mixture of Handle<T> versus Unique<T> in the
graph and this unifies the situation to use Handle<T> everywhere.

R=bmeurer@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/1314473007

Cr-Commit-Position: refs/heads/master@{#30458}
2015-08-31 08:25:05 +00:00
rmcilroy
b416475435 [Interpreter] Add support for loading literals from the constant pool.
Adds support to the interpreter for loading literals from the constant pool.
Adds the LoadConstant bytecode and makes use of it for loading large Smis and
HeapObject literals.

Also removes unused HandleVector from utils.h.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1321663003

Cr-Commit-Position: refs/heads/master@{#30450}
2015-08-28 15:41:07 +00:00
yangguo
b42c4459e6 Move (uppercase) JS builtins from js builtins object to native context.
R=bmeurer@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1316943002

Cr-Commit-Position: refs/heads/master@{#30402}
2015-08-27 10:18:42 +00:00
mstarzinger
aca4a411e7 Move runtime helper for JSArrayBuffer onto objects.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1305383003

Cr-Commit-Position: refs/heads/master@{#30387}
2015-08-26 13:59:50 +00:00
mtrofin
0ee4b47368 [turbofan] Separate LiveRange and TopLevelLiveRange concepts
A TopLevelLiveRange is the live range of a virtual register. Through
register allocation, it may end up being split in a succession of child
live ranges, where data flow is handled through moves from
predecessor to successor child.

Today, the concepts of "top level" and "child" live ranges are conflated
under the LiveRange class. However, a good few APIs pertain solely
to TopLevelLiveRanges. This was communicated through comments or
DCHECKs - but this makes for poor code comprehensibility and maintainability.

For example, the worklist of the register allocator (live_ranges()) needs
to only contain TopLevelLiveRanges; spill range concerns are associated
only with the top range; phi-ness; certain phases in the allocation pipeline;
APIs on LiveRange used for initial construction - before splitting;
splintering - these are all responsibilities associated to TopLevelLiveRanges,
and not child live ranges.

This change separates the concepts.

An effect of this change is that child live range allocation need not involve
RegisterAllocationData. That's "a good thing" (lower coupling), but it has
the side-effect of not having a good way to construct unique identifiers for
child live ranges, relative to a given InstructionSequence.

LiveRange Id are used primarily for tracing/output-ing, and debugging.

I propose a 2-component identifier: a virtual register (vreg) number,
uniquely identifying TopLevelLiveRanges; and a relative identifier, which
uniquely identifies children of a given TopLevelLiveRange. "0" is reserved
for the TopLevel range. The relative identifier does not necessarily
indicate order in the child chain, which is no worse than the current state
of affairs.

I believe this change should make it easier to understand a trace output
(because the virtual register number is readily available). I plan to formalize
with a small structure the notion of live range id, and consolidate tracing
around that, as part of a separate CL. (there are seemingly disparate ways
to trace - printf or stream-based APIs - so this seems like an opportune
change to consolidate that)

Review URL: https://codereview.chromium.org/1311983002

Cr-Commit-Position: refs/heads/master@{#30370}
2015-08-26 05:22:36 +00:00
mtrofin
5d954d6506 [turbofan] Deferred blocks splintering.
This change encompasses what is necessary to enable stack checks in loops without suffering large regressions.

Primarily, it consists of a new mechanism for dealing with deferred blocks by "splintering", rather than splitting, inside deferred blocks.

My initial change was splitting along deferred block boundaries, but the regression introduced by stackchecks wasn't resolved conclusively. After investigation, it appears that just splitting ranges along cold block boundaries leads to a greater opportunity for moves on the hot path, hence the suboptimal outcome.

The alternative "splinters" ranges rather than splitting them. While splitting creates 2 ranges and links them (parent-child), in contrast, splintering creates a new independent range with no parent-child relation to the original. The original range appears as if it has a liveness hole in the place of the splintered one. All thus obtained ranges are then register allocated with no change to the register allocator.

The splinters (cold blocks) do not conflict with the hot path ranges, by construction. The hot path ones have less pressure to split, because we remove a source of conflicts. After allocation, we merge the splinters back to their original ranges and continue the pipeline. We leverage the previous changes made for deferred blocks (determining where to spill, for example).

Review URL: https://codereview.chromium.org/1305393003

Cr-Commit-Position: refs/heads/master@{#30357}
2015-08-25 14:47:38 +00:00
rmcilroy
b5502099b7 [Interpreter] Add implementations of arithmetic binary op bytecodes.
Adds implementations and tests for the following bytecodes:
  - Add
  - Sub
  - Mul
  - Div
  - Mod

Also adds the Mod bytecode and adds support to BytecodeGenerator and
BytecodeArrayBuilder to enable it's use.

The current bytecodes always call through to the JS builtins. This also adds
LoadObjectField and CallJSBuiltin operators to the InterpreterAssembler.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1300813005

Cr-Commit-Position: refs/heads/master@{#30352}
2015-08-25 11:31:20 +00:00
rmcilroy
bfdc22d7fc [Interpreter] Pass context to interpreter bytecode handlers and add LoadConstextSlot
Passes the current context to bytecode interpreter handlers. This is held in the
context register on all architectures except for ia32 where there are too few
registers and it is instead spilled to the stack.

Also changes Load/StoreRegister to use kMachAnyTagged representation since they
should only ever hold tagged values.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1294133004

Cr-Commit-Position: refs/heads/master@{#30325}
2015-08-24 10:25:50 +00:00
rmcilroy
f36cc258ff [Interpreter] Add implementations for load immediate bytecodes.
Adds implementations and tests for the following bytecodes:
  - LdaZero
  - LdaSmi8
  - LdaUndefined
  - LdaNull
  - LdaTheHole
  - LdaTrue
  - LdaFalse
  - LdaLdar
  - LdaStar

Also adds  Smi tagging / untagging and OperandType typed
BytecodeOperand operations to InterpreterAssembler.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1294793002

Cr-Commit-Position: refs/heads/master@{#30226}
2015-08-18 15:29:39 +00:00
rmcilroy
00df60d1c6 [interpreter]: Changes to interpreter builtins for accumulator and register file registers.
Makes the following modifications to the interpreter builtins and
InterpreterAssembler:
 - Adds an accumulator register and initializes it to undefined()
 - Adds a register file pointer register and use it instead of FramePointer to
   access registers
 - Modifies builtin to support functions with 0 regiters in the register file
 - Modifies builtin to Call rather than TailCall to first bytecode handler.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1289863003

Cr-Commit-Position: refs/heads/master@{#30219}
2015-08-18 12:41:58 +00:00
bmeurer
96e331e2f2 Revert of [runtime] Remove useless IN builtin. (patchset #2 id:20001 of https://codereview.chromium.org/1295433002/ )
Reason for revert:
Breaks win32 nosnap

Original issue's description:
> [runtime] Remove useless IN builtin.
>
> Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
> and %HasProperty anyway, and cannot be optimized, plus it had a weird
> special fast case (which also involved at least one LOAD_IC plus some
> intrinsic magic).
>
> R=yangguo@chromium.org,jarin@chromium.org
>
> Committed: https://crrev.com/72d60a1e80e81e2e68ca402665e2acbc46c5e471
> Cr-Commit-Position: refs/heads/master@{#30154}

TBR=yangguo@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1288923002

Cr-Commit-Position: refs/heads/master@{#30155}
2015-08-13 13:06:58 +00:00
bmeurer
72d60a1e80 [runtime] Remove useless IN builtin.
Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
and %HasProperty anyway, and cannot be optimized, plus it had a weird
special fast case (which also involved at least one LOAD_IC plus some
intrinsic magic).

R=yangguo@chromium.org,jarin@chromium.org

Review URL: https://codereview.chromium.org/1295433002

Cr-Commit-Position: refs/heads/master@{#30154}
2015-08-13 12:39:21 +00:00
bmeurer
6db78c8065 [turbofan] Drop V8_TURBOFAN_BACKEND and V8_TURBOFAN_TARGET defines.
TurboFan is now a requirement and supported by all backends, so we don't
need those macros (plus all the machinery on top) anymore.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1282763002

Cr-Commit-Position: refs/heads/master@{#30082}
2015-08-10 07:17:34 +00:00
titzer
8b56ec9ccc [turbofan] Remove kInterpreterDispatch CallDescriptor kind in favor of flag.
Rationale: The {kind} of a call descriptor describes what the {target} being
called is--i.e. a JSFunction, code object, or address. That kind materially
dictates the instruction(s) generated for an outgoing call.

The other flags on a call descriptor should describe specific properties
(like whether a roots register is valid or not) so that backend logic doesn't
have to switch over the kind, but is informed directly of what it wants to
know.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1268273003

Cr-Commit-Position: refs/heads/master@{#30065}
2015-08-07 11:46:19 +00:00
mtrofin
5202facf9e Stand-alone deferred block splitting. This continues 1256313003.
BUG=

Review URL: https://codereview.chromium.org/1271703002

Cr-Commit-Position: refs/heads/master@{#30050}
2015-08-06 16:21:38 +00:00
martyn.capewell
9bf532350f [turbofan] Merge dependent Word32Equal on ARM64
Improve code generated for flag materialization.

Review URL: https://codereview.chromium.org/1260733003

Cr-Commit-Position: refs/heads/master@{#29954}
2015-07-31 12:46:09 +00:00
danno
3c9f69d399 [turbofan]: Add better encapsulation to LinkageLocation
Add factory methods for different types of LinkageLocations, and ensure that
accesses to the underlying data in the location are classified by type and
funneled through explicit accessors.

Also change the representation of LinkageLocation to use a BitField rather
than using a reserved section of the integer range.

Review URL: https://codereview.chromium.org/1262343002

Cr-Commit-Position: refs/heads/master@{#29938}
2015-07-30 14:52:30 +00:00
oth
4da6cbd9ee [Interpreter] Add more bytecode definitions and add operand types.
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1257543003

Cr-Commit-Position: refs/heads/master@{#29934}
2015-07-30 13:57:03 +00:00
rmcilroy
c5dd553cf3 [interpreter] Add Interpreter{Entry,Exit}Trampoline builtins.
Adds interpreter entry and exit trampoline builtins. Also implements the
Return bytecode handler and fixes a few bugs in InterpreterAssembler
highlighted by running on other architectures.

MIPS and MIPS64 port contributed by Paul Lind (paul.lind@imgtec.com)

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1245133002

Cr-Commit-Position: refs/heads/master@{#29929}
2015-07-30 11:36:43 +00:00
rmcilroy
597da50322 [interpreter] Change interpreter to use an BytecodeArray pointer and and offset.
Changes the interpreter to use a BytecodeArray pointer and an offset to avoid
having an inner pointer to a BytecodeArray object in registers during dispatch.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1254293006

Cr-Commit-Position: refs/heads/master@{#29910}
2015-07-30 08:18:28 +00:00
mbrandy
270dd554b7 Update PPC OWNERS
R=michael_dawson@ca.ibm.com, danno@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1255953003

Cr-Commit-Position: refs/heads/master@{#29884}
2015-07-27 21:37:55 +00:00
rmcilroy
7877c4e0c7 [interpreter] Add basic framework for bytecode handler code generation.
Adds basic support for generation of interpreter bytecode handler code
snippets. The InterpreterAssembler class exposes a set of low level,
interpreter specific operations which can be used to build a Turbofan
graph. The Interpreter class generates a bytecode handler snippet for
each bytecode by assembling operations using an InterpreterAssembler.

Currently only two simple bytecodes are supported: LoadLiteral0 and Return.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1239793002

Cr-Commit-Position: refs/heads/master@{#29814}
2015-07-23 14:21:39 +00:00
danno
d1a6dfaf4d [turbofan]: Fix tail calls edge cases and add tests
Review URL: https://codereview.chromium.org/1245523002

Cr-Commit-Position: refs/heads/master@{#29791}
2015-07-22 18:27:35 +00:00
mtrofin
3e3608cdd5 Unit tests for the live range conflict detection mechanism (CoalescedLiveRanges) in the Greedy Allocator.
Consolidated conflict detection and traversal logic in CoalescedLiveRanges to avoid duplication in both code and testing. In addition, this change achieves better separation between CoalescedLiveRanges and other register allocator components, improving testability and maintainability.

BUG=

Review URL: https://codereview.chromium.org/1219063017

Cr-Commit-Position: refs/heads/master@{#29783}
2015-07-22 04:50:22 +00:00
rmcilroy
fbe085fd75 [turbofan] Change RawMachineAssembler to take a CallDescriptor instead of a MachineSignature.
The InterpreterAssembler needs to specify a specific CallDescriptor type
instead of using the SimplifiedCDescriptor type. This CL makes it possible
to specify the CallDescriptor used by the RawMachineAssembler instead of
specifying a MachineSignature.

Also removes instruction-selector-tester.h which was erroneously resurrected
at some point.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1235313002

Cr-Commit-Position: refs/heads/master@{#29777}
2015-07-21 15:54:27 +00:00
danno
cca5e74a58 [turbofan]: Add a context relaxation Reducer
In many cases, the context that TurboFan's ASTGraphBuilder or subsequent
reduction operations attaches to nodes does not need to be that exact
context, but rather only needs to be one with the same native context,
because it is used internally only to fetch the native context, e.g. for
creating and throwing exceptions.

This reducer recognizes common cases where the context that is specified
for a node can be relaxed to a canonical, less specific one. This
relaxed context can either be the enclosing function's context or a specific
Module or Script context that is explicitly created within the function.

This optimization is especially important for TurboFan-generated code stubs
which use context specialization and inlining to generate optimal code.
Without context relaxation, many extraneous moves are generated to pass
exactly the right context to internal functions like ToNumber and
AllocateHeapNumber, which only need the native context. By turning context
relaxation on, these moves disappear because all these common internal
context uses are unified to the context passed into the stub function, which
is typically already in the correct context register and remains there for
short stubs. It also eliminates the explicit use of a specialized context
constant in the code stub in these cases, which could cause memory leaks.

Review URL: https://codereview.chromium.org/1244583003

Cr-Commit-Position: refs/heads/master@{#29763}
2015-07-20 17:16:14 +00:00
ishell
fec3c9cba6 TypeofMode replaces TypeofState and ContextualMode.
NON_CONTEXTUAL ~> INSIDE_TYPEOF
CONTEXTUAL ~> NOT_INSIDE_TYPEOF

Review URL: https://codereview.chromium.org/1227893005

Cr-Commit-Position: refs/heads/master@{#29611}
2015-07-13 13:39:43 +00:00
rmcilroy
d02f62484e Move SmartPointer to base.
Review URL: https://codereview.chromium.org/1221433021

Cr-Commit-Position: refs/heads/master@{#29604}
2015-07-13 12:38:17 +00:00
ishell
f87286e2db Loads and stores to global vars are now made via property cell shortcuts installed into parent script context.
This CL also adds hydrogen stubs for global loads and global stores, full-codegen and TurboFan now uses this machinery.

Review URL: https://codereview.chromium.org/1224793002

Cr-Commit-Position: refs/heads/master@{#29592}
2015-07-13 09:18:57 +00:00
bmeurer
b19f118c16 [turbofan] Optimize string "length" property access based on types.
Optimize string "length" property access based on static type
information if possible, but also optimistically optimize the access
based on type feedback from the LoadIC.

R=jarin@chromium.org

Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40
Cr-Commit-Position: refs/heads/master@{#29543}

Review URL: https://codereview.chromium.org/1216593003

Cr-Commit-Position: refs/heads/master@{#29588}
2015-07-13 06:02:22 +00:00
martyn.capewell
ad7f35c49a [turbofan] Reduce Float64 comparison to Float32.
Reduce Float64 comparison to Float32 when both inputs are conversions from
Float32.

Review URL: https://codereview.chromium.org/1235663002

Cr-Commit-Position: refs/heads/master@{#29586}
2015-07-13 05:23:53 +00:00
adamk
54572281e9 Revert of [turbofan] Optimize string "length" property access based on types. (patchset #2 id:20001 of https://codereview.chromium.org/1216593003/)
Reason for revert:
Causes crash when running benchmarks/octane/regexp.js on ARM:
http://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/2492/steps/Benchmarks/logs/regexp

Original issue's description:
> [turbofan] Optimize string "length" property access based on types.
>
> Optimize string "length" property access based on static type
> information if possible, but also optimistically optimize the access
> based on type feedback from the LoadIC.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/17add22ff4b9c5ca638502e7708f0d9d99baca40
> Cr-Commit-Position: refs/heads/master@{#29543}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1224083002

Cr-Commit-Position: refs/heads/master@{#29544}
2015-07-08 21:30:14 +00:00
bmeurer
17add22ff4 [turbofan] Optimize string "length" property access based on types.
Optimize string "length" property access based on static type
information if possible, but also optimistically optimize the access
based on type feedback from the LoadIC.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1216593003

Cr-Commit-Position: refs/heads/master@{#29543}
2015-07-08 19:12:58 +00:00
bmeurer
4b38c15817 [turbofan] Add TruncationMode for TruncateFloat64ToInt32.
We actually need round to zero truncation to implement the counterpart
of LDoubleToI in TurboFan, which tries to convert a double to an integer
as required for keyed load/store optimizations.

Drive-by-cleanup: Reduce some code duplication in the InstructionSelector
implementations.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1225993002

Cr-Commit-Position: refs/heads/master@{#29527}
2015-07-08 06:49:00 +00:00
rmcilroy
ea560a9be9 [turbofan] Move RawMachineAssembler back to src/compiler.
The RawMachineAssembler will be used to build the interpreter, so it needs
to move back to src/compiler.

This reverts commit b5b00cc031.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1221303014

Cr-Commit-Position: refs/heads/master@{#29519}
2015-07-07 15:02:51 +00:00
bmeurer
5f288c201c [turbofan] Right hand side of shifts needs ToUint32.
Currently we lower shifts directly to machine operators, and add an
appropriate Word32And to implement the & 0x1F operation on the right
hand side required by the specification. However for Word32And we assume
Int32 in simplified lowering, which is basically changes the right hand
side bit interpretation for the shifts from Uint32 to Int32, which is
obviously wrong. So now we represent that explicitly by proper
simplified operators for the shifts, which are lowered to machine in
simplified lowering.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1213803008

Cr-Commit-Position: refs/heads/master@{#29465}
2015-07-03 11:42:00 +00:00
titzer
0a5b6ad755 [turbofan] Add Uint64LessThanOrEqual to 64-bit TurboFan backends.
Also add control inputs to 64-bit integer divide and modulus operations.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1223613002

Cr-Commit-Position: refs/heads/master@{#29460}
2015-07-03 05:14:13 +00:00
martyn.capewell
1297a51e30 [turbofan] Support cmp with shift/extend on ARM64.
Support 32-bit cmp with shift/extend by reusing the existing add/sub shift and
extend code.

Review URL: https://codereview.chromium.org/1218103005

Cr-Commit-Position: refs/heads/master@{#29435}
2015-07-02 04:32:15 +00:00
conradw
7281f80151 [strong] Implement strong property access semantics
Revert "Revert relanded strong property access CL"

Regression issues should be solved. Initial patchset is the original, subsequent patchsets are the fixing modifications.

This reverts commit 4ac7be5656.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1199983002

Cr-Commit-Position: refs/heads/master@{#29384}
2015-06-30 15:24:43 +00:00