Commit Graph

778 Commits

Author SHA1 Message Date
Z Duong Nguyen-Huu
9ccad33c97 Optimize spread call for sealed, frozen objects
Also add mjsunit test for spread call with non-extensible objects

Micro-benchmark JSTests/ObjectFreeze shows ~7x improvement

Before:
SpreadCall
SpreadCall-Numbers(Score): 239

After:
SpreadCall
SpreadCall-Numbers(Score): 1461

Bug: v8:6831
Change-Id: Icefd89ad790ac159b7f0617d0a012eefd90d3b1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1614296
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61669}
2019-05-20 20:36:32 +00:00
Jaroslav Sevcik
5504068f49 Revert "[cleanup] Remove the now-unused deopt_count from feedback vector."
This reverts commit ad1fcd4343.

Reason for revert: Breaks waterfall.

Original change's description:
> [cleanup] Remove the now-unused deopt_count from feedback vector.
> 
> Bug: v8:9183
> Change-Id: Iceeccc8ab1e4e77b428e7e2feec39bff3317f241
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617675
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61665}

TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: Iea0e6a329f55a3a941f0b976925b2abdf7eece38
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9183
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619867
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61666}
2019-05-20 17:29:54 +00:00
Jaroslav Sevcik
ad1fcd4343 [cleanup] Remove the now-unused deopt_count from feedback vector.
Bug: v8:9183
Change-Id: Iceeccc8ab1e4e77b428e7e2feec39bff3317f241
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617675
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61665}
2019-05-20 15:48:33 +00:00
Ujjwal Sharma
094435b6b6 Reland "[turbofan] Add fast path for single-character String#startsWith()"
This is a reland of e7e512da66

Original change's description:
> [turbofan] Add fast path for single-character String#startsWith()
> 
> This CL adds a fast path to String#startsWith(s) if s is a
> single character string.
> 
> Bug: v8:8400
> Change-Id: Ibd6a9d1e46d98f41c198d2b579208e25003eedb0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525362
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61504}

Bug: v8:8400
Change-Id: Ic2d60ccb8fdeb51373fcd025a7e970fda0c14d79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1618342
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61637}
2019-05-20 08:42:57 +00:00
Ujjwal Sharma
fbe70b386b Revert "[turbofan] Add fast path for single-character String#startsWith()"
This reverts commit e7e512da66.

Reason for revert: chromium:963687, chromium:963731

Original change's description:
> [turbofan] Add fast path for single-character String#startsWith()
>
> This CL adds a fast path to String#startsWith(s) if s is a
> single character string.
>
> Bug: v8:8400
> Change-Id: Ibd6a9d1e46d98f41c198d2b579208e25003eedb0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525362
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61504}

TBR=sigurds@chromium.org,bmeurer@chromium.org,usharma1998@gmail.com

Change-Id: Ie09a96557102063ab15c3900563cf16ec57a47e3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8400
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1614605
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61562}
2019-05-16 06:27:34 +00:00
Georg Schmid
376d242fbf Make LoadElimination aware of const fields
Change-Id: I28f2c87ffae32d16bcfb7cb17ec6e607e7fa2285
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1599172
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61506}
2019-05-15 08:46:16 +00:00
Ujjwal Sharma
e7e512da66 [turbofan] Add fast path for single-character String#startsWith()
This CL adds a fast path to String#startsWith(s) if s is a
single character string.

Bug: v8:8400
Change-Id: Ibd6a9d1e46d98f41c198d2b579208e25003eedb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525362
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61504}
2019-05-15 07:33:54 +00:00
Georg Schmid
37ab663ae5 Improve SameValue folding in TypedOptimization to ignore renames
R=jarin@google.com, tebbi@google.com

Change-Id: I23b92df275ce294d62c906a0b94dcb9b15f6be39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609803
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61472}
2019-05-14 11:29:42 +00:00
Georg Neis
b1e7cd9661 [turbofan] Handle insufficient feedback in ComputeElementAccessInfos
Bug: chromium:961986, v8:7790
Change-Id: I4c5fbd8eafb96ffe7e54be28eb5c5462b49ed015
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607648
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61439}
2019-05-13 10:39:01 +00:00
Benedikt Meurer
585d822a84 [test] Fix test case for GC Stress testing.
We need to keep strong references to the final map, otherwise the test
may start failing randomly depending on GC timing, because the optimized
code will get deoptimized when the map disappears.

Bug: v8:9236
Change-Id: I3c18cba96546020b4d70b95993e1531e787ed253
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607652
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61438}
2019-05-13 09:56:30 +00:00
Z Duong Nguyen-Huu
e69460e649 Sealed array should handle store out of bounds in optimized code
Bug: chromium:959747
Change-Id: I2518a35508b97ae1c2df7f30c1c2b9755ba6f495
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1597116
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61348}
2019-05-08 17:19:02 +00:00
Mythri A
f820041aba Reland "[Test] Update tests to work with lazy feedback allocation."
This is a reland of 289b25765a.
The fix for failures landed here:
https://chromium-review.googlesource.com/c/v8/v8/+/1599388

Original change's description:
> [Test] Update tests to work with lazy feedback allocation.
>
> This adds either %EnsureFeedbackVectorForFunction or
> %PrepareFunctionForOptimization to allocate feedback vectors when testing
> optimization, allocation sites, IC transitions etc.,
>
> Bug: v8:8394
> Change-Id: I6ad1b6d460e4abda693b326cddb87754e080a0a1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593303
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Auto-Submit: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61212}

Bug: v8:8394
Change-Id: Idb5bba221d138e6fd73155f959b9e16fc948c709
TBR: rmcilroy@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1599607
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61332}
2019-05-08 12:51:13 +00:00
Georg Schmid
a542b735b4 Add StaticAssert node and corresponding intrinsic that allows explicit static asserts in tests
R=tebbi@chromium.org

Change-Id: I1003a4f4a0e9227618e685a2fb56ead2083709a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594731
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61251}
2019-05-06 16:32:47 +00:00
Clemens Hammacher
ef97aa7cc2 Revert "[Test] Update tests to work with lazy feedback allocation."
This reverts commit 289b25765a.

Reason for revert: Fails gc-stress: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/7143

Original change's description:
> [Test] Update tests to work with lazy feedback allocation.
> 
> This adds either %EnsureFeedbackVectorForFunction or
> %PrepareFunctionForOptimization to allocate feedback vectors when testing
> optimization, allocation sites, IC transitions etc.,
> 
> Bug: v8:8394
> Change-Id: I6ad1b6d460e4abda693b326cddb87754e080a0a1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593303
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Auto-Submit: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61212}

TBR=rmcilroy@chromium.org,mythria@chromium.org

Change-Id: I2a78bfd3ee6102c1d2062957970f425308050d3d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8394
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594565
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61213}
2019-05-03 15:54:53 +00:00
Mythri A
289b25765a [Test] Update tests to work with lazy feedback allocation.
This adds either %EnsureFeedbackVectorForFunction or
%PrepareFunctionForOptimization to allocate feedback vectors when testing
optimization, allocation sites, IC transitions etc.,

Bug: v8:8394
Change-Id: I6ad1b6d460e4abda693b326cddb87754e080a0a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593303
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61212}
2019-05-03 15:21:22 +00:00
Seth Brenith
df8548cd5b Touch guard pages when allocating stack frames
On Windows, expanding the stack by more than 4 KB at a time can cause
access violations. This change fixes a few known cases (and includes
unit tests for those), and attempts to make stack expansion more
consistent overall by using the AllocateStackSpace helper method
everywhere we can, even when the offset is a small constant.

On arm64, there was already a consistent method for stack pointer
manipulation using the Claim and Drop methods, so Claim is updated to
touch every page.

Bug: v8:9017
Change-Id: I2dbbceeebbdefaf45803e9b621fe83f52234a395
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1570666
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61186}
2019-05-02 17:46:18 +00:00
Georg Neis
87b3416a87 [turbofan] Fix a bug in DepenOnStablePrototypeChains
When asked to start at the receiver and the receiver is a primitive, the
dependency should be taken on the primitive map (which is a no-op)
rather than the wrapper object's map.

Bug: chromium:958716
Change-Id: I9c8b2b56436d134b2f79dbe458c0c527fe6d17a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593086
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61174}
2019-05-02 14:25:03 +00:00
Georg Neis
d83f023e2c [turbofan] Fix monotonicity of ComparisonOutcome-related typings
Bug: chromium:958021
Change-Id: I6cc6ff2666750b508786db010e202b1e8e1e9536
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593293
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61171}
2019-05-02 14:14:54 +00:00
Georg Neis
053393d9fd [turbofan] Fix two bugs in ReduceArrayIteratorPrototypeNext
- Add missing uses of MapInference::NoChange.
- Insert map checks even if inferred maps were reliable, because
  they were inferred for an earlier effect input.

Bug: chromium:958420, chromium:958350, v8:9197
Change-Id: Id7677b1fc6f1e09dc12ae178f1155e4245b4e3e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593077
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61157}
2019-05-02 11:31:30 +00:00
Georg Neis
7c1ed0b8f8 Reland "[turbofan] Avoid raw InferReceiverMaps in JSCallReducer"
This is a reland of 9284ad5731, after
adding a missing speculation mode check in ReduceCallApiFunction.

Original change's description:
> [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
>
> Instead provide an abstraction that makes it hard to forget
> dealing with unreliable maps.
>
> This also fixes a deopt loop in Function.prototype.bind and
> one in Array.prototype.reduce.
>
> Bug: v8:9137
> Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61106}

Tbr: jarin@chromium.org
Bug: v8:9137, v8:9197
Change-Id: I0db68d267055969553c0c1b85fad7b909075c062
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1589976
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61140}
2019-05-01 09:34:01 +00:00
Sigurd Schneider
f0a4b252c8 Revert "[turbofan] Avoid raw InferReceiverMaps in JSCallReducer"
This reverts commit 9284ad5731.

Reason for revert: breaks blink tests:
https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Win/16839

Original change's description:
> [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
> 
> Instead provide an abstraction that makes it hard to forget
> dealing with unreliable maps.
> 
> This also fixes a deopt loop in Function.prototype.bind and
> one in Array.prototype.reduce.
> 
> Bug: v8:9137
> Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61106}

TBR=jarin@chromium.org,neis@chromium.org

Change-Id: I97e0f47fb82eda76656905a3f7cc494babd92be6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588433
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61118}
2019-04-30 13:46:06 +00:00
Jaroslav Sevcik
da6ebfafad [turbofan] Handle -0 truncation in word32->float64 rep change.
This just adds the same case we already added in
https://chromium-review.googlesource.com/c/v8/v8/+/1478192
for conversions to tagged representation.

Bug: chromium:957559
Change-Id: I62a388ba47bd72d65fa07d0141362d7f1383c96e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588428
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61115}
2019-04-30 13:21:21 +00:00
Georg Neis
9284ad5731 [turbofan] Avoid raw InferReceiverMaps in JSCallReducer
Instead provide an abstraction that makes it hard to forget
dealing with unreliable maps.

This also fixes a deopt loop in Function.prototype.bind and
one in Array.prototype.reduce.

Bug: v8:9137
Change-Id: If6a51182c8693a62e9fb6d302cec19b4d48e25cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578501
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61106}
2019-04-30 09:19:56 +00:00
Jaroslav Sevcik
cb451fe59d Remove FLAG_track_constant_fields
This enables constant field tracking unconditionally.

TBR=jgruber@chromium.org

Bug: v8:8361
Change-Id: I02f35827d860c3e0f18a3d55cb156c088d48bc94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585730
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61055}
2019-04-27 10:47:19 +00:00
Z Duong Nguyen-Huu
e4669a9c32 Reland of Improve test coverage for non-extensible holey array in optimized code
This is reland of https://chromium-review.googlesource.com/c/v8/v8/+/1575036 which the flaky test is fixed by moving '%PrepareFunctionForOptimization' around

Bug: v8:6831
Change-Id: I0e8c3d2452b14c86e8ff0851e1840294734435e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1582481
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61050}
2019-04-26 15:49:02 +00:00
Clemens Hammacher
4ab4bbd828 Revert "Improve test coverage for non-extensible holey array in optimized code"
This reverts commit 81dd67db09.

Reason for revert: Breaks gc-stress: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/22111

Original change's description:
> Improve test coverage for non-extensible holey array in optimized code
> 
> Bug: v8:6831
> Change-Id: Icb4b504771e623b3c9503c6daffd7b771fbef3a6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1575036
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#60990}

TBR=verwaest@chromium.org,duongn@microsoft.com

Change-Id: I0a581c1e47d9883a2727000843ad4e9ede2e411d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6831
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581648
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60991}
2019-04-24 17:43:23 +00:00
Z Duong Nguyen-Huu
81dd67db09 Improve test coverage for non-extensible holey array in optimized code
Bug: v8:6831
Change-Id: Icb4b504771e623b3c9503c6daffd7b771fbef3a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1575036
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60990}
2019-04-24 16:46:18 +00:00
Jaroslav Sevcik
d2bfdafe20 [turbofan] Fix bounds check for the 'in' operator on typed arrays.
This fixes the bounds check for the 'in' operator to handle the negative
index case properly (by using the same machinery as the potentially
out-of-bounds loads/stores use).

Bug: chromium:952586
Change-Id: I2225acae8be7dcedbcde745e8ef202e789085041
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581179
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60978}
2019-04-24 11:52:17 +00:00
Jaroslav Sevcik
2c5f11fba2 [turbofan] Use the right comparison for constant field store.
This uses the same comparison as the ICs to make sure that ICs learn
after deoptimization (see
https://chromium-review.googlesource.com/c/v8/v8/+/1561319 for the IC
fix).

Bug: v8:9139
Change-Id: I67a361d85ee0c8a4ad4a6abc2d33ac4ca5fa22bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1569438
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60917}
2019-04-18 11:29:22 +00:00
Benedikt Meurer
f11ba854e5 [map] Support in-place field representation changes.
This adds a new flag --modify-field-representation-inplace (enabled by
default), which lets the runtime perform field representation changes
for Smi to Tagged or for HeapObject to Tagged in-place instead of
creating new maps and marking the previous map tree as deprecated.

That means we create (a lot) fewer Maps and DescriptorArrays in the
beginning and also need to self-heal fewer objects later (migrating
off the deprecated maps). In TurboFan we just take the "field owner
dependency" whenever we use the field representation, which is very
similar to what we already do for the field types. That means if we
change the representation of a field that we used in optimized code,
we will simply deoptimize that code and have TurboFan potentially
later optimize it again with the new field representation.

On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
time from around 415ms to around 352ms, which corresponds to a **15%**
improvement. The overall Speedometer2 score improves from around 74.1
to around 78.3 (on local runs with content_shell), corresponding to a
**5.6%** improvement here. 🎉

On the CNN desktop browsing story, it seems that we reduce map space
utilization/fragmentation by about 4-5%. But since we allocate a lot
less (fewer Maps and DescriptorArrays) we also significantly change
the GC timing, which heavily influences the results here. So take this
with a grain of salt. 🤷

Note: For Double fields, this doesn't change anything, meaning they
still create new maps and deprecate the previous map trees.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: Ibd70efcb59be982863905663dbfaa89aa5b31e14
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Doc: http://bit.ly/v8-in-place-field-representation-changes
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565891
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60822}
2019-04-12 14:37:07 +00:00
Georg Neis
45df2e8a10 [turbofan] Teach the serializer about many more bytecodes
... all of the kind that modifies the accumulator but no other
registers. Also move a few of that kind out of the IGNORED_BYTECODES
list, where they didn't belong.

R=mslekova@chromium.org

Bug: v8:7790
Change-Id: I67189750e5e01fc8a3b6b5117b61a0d21837693a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561320
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60817}
2019-04-12 12:56:14 +00:00
Georg Neis
9f37b2f74b [turbofan] Lift incorrect restriction in serializer
Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}
2019-04-12 12:43:54 +00:00
Michael Hablich
48efe388d8 Revert "[map] Support in-place field representation changes."
This reverts commit 1416d5a565.

Reason for revert: blocks roll https://chromium-review.googlesource.com/c/chromium/src/+/1564550

Original change's description:
> [map] Support in-place field representation changes.
> 
> This adds a new flag --modify-field-representation-inplace (enabled by
> default), which lets the runtime perform field representation changes
> for Smi to Tagged or for HeapObject to Tagged in-place instead of
> creating new maps and marking the previous map tree as deprecated.
> 
> That means we create (a lot) fewer Maps and DescriptorArrays in the
> beginning and also need to self-heal fewer objects later (migrating
> off the deprecated maps). In TurboFan we just take the "field owner
> dependency" whenever we use the field representation, which is very
> similar to what we already do for the field types. That means if we
> change the representation of a field that we used in optimized code,
> we will simply deoptimize that code and have TurboFan potentially
> later optimize it again with the new field representation.
> 
> On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
> time from around 415ms to around 352ms, which corresponds to a **15%**
> improvement. The overall Speedometer2 score improves from around 74.1
> to around 78.3 (on local runs with content_shell), corresponding to a
> **5.6%** improvement here. 🎉
> 
> On the CNN desktop browsing story, it seems that we reduce map space
> utilization/fragmentation by about 4-5%. But since we allocate a lot
> less (fewer Maps and DescriptorArrays) we also significantly change
> the GC timing, which heavily influences the results here. So take this
> with a grain of salt. 🤷‍♂️
> 
> Note: For Double fields, this doesn't change anything, meaning they
> still create new maps and deprecate the previous map trees.
> 
> Bug: v8:8749, v8:8865, v8:9114
> Change-Id: I694a53f87ae5caeb868fd98a21809b66d4297d35
> Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
> Doc: http://bit.ly/v8-in-place-field-representation-changes
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561132
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60764}

TBR=jarin@chromium.org,neis@chromium.org,ishell@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: I666975d08d51bbe7ab4faec9428b9a1f88e9b322
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564208
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60807}
2019-04-12 10:37:04 +00:00
Jaroslav Sevcik
cdc7bd6189 [turbofan] Inline SameValue for numbers
Bug: v8:9113
Change-Id: I413d9df34f0bdea9c30db33ad79891218e229341
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564053
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60776}
2019-04-11 13:35:24 +00:00
Jaroslav Sevcik
42b90afe69 [turbofan] Switch equality check for constant fields to SameValue.
The current NumberEqual check ignores -0 when it is stored to
a constant unboxed double field containing 0.

Bug: v8:9113
Change-Id: I7eb59ca8af09ab7317da3c6ce9c9cedad81f6cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561317
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60771}
2019-04-11 11:59:24 +00:00
Benedikt Meurer
1416d5a565 [map] Support in-place field representation changes.
This adds a new flag --modify-field-representation-inplace (enabled by
default), which lets the runtime perform field representation changes
for Smi to Tagged or for HeapObject to Tagged in-place instead of
creating new maps and marking the previous map tree as deprecated.

That means we create (a lot) fewer Maps and DescriptorArrays in the
beginning and also need to self-heal fewer objects later (migrating
off the deprecated maps). In TurboFan we just take the "field owner
dependency" whenever we use the field representation, which is very
similar to what we already do for the field types. That means if we
change the representation of a field that we used in optimized code,
we will simply deoptimize that code and have TurboFan potentially
later optimize it again with the new field representation.

On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
time from around 415ms to around 352ms, which corresponds to a **15%**
improvement. The overall Speedometer2 score improves from around 74.1
to around 78.3 (on local runs with content_shell), corresponding to a
**5.6%** improvement here. 🎉

On the CNN desktop browsing story, it seems that we reduce map space
utilization/fragmentation by about 4-5%. But since we allocate a lot
less (fewer Maps and DescriptorArrays) we also significantly change
the GC timing, which heavily influences the results here. So take this
with a grain of salt. 🤷‍♂️

Note: For Double fields, this doesn't change anything, meaning they
still create new maps and deprecate the previous map trees.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: I694a53f87ae5caeb868fd98a21809b66d4297d35
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Doc: http://bit.ly/v8-in-place-field-representation-changes
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561132
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60764}
2019-04-11 08:59:33 +00:00
Georg Neis
fc36dfb7f5 [turbofan] Serialize for ReduceKeyedLoadFromHeapConstant
Drive-by fix: In ProcessFeedbackForGlobalAccess, we had forgotten to
return the feedback when it already existed.

Bug: v8:7790, v8:9094
Change-Id: Ie4be6cef5755bbdd9d8ed472caaa2e32d243893d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554680
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60705}
2019-04-09 12:08:41 +00:00
Georg Neis
d97bc8db79 [turbofan] Add a regression test
Bug: v8:9087
Change-Id: Ibc21d7e5619e4e6a0edc98cb0bd12e67ab2f6643
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554690
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60657}
2019-04-05 13:57:56 +00:00
Jaroslav Sevcik
4a68b29c1c Fix Map::TryUpdate assertion.
This makes the DCHECK consistent with the map updater.
See https://cs.chromium.org/chromium/src/v8/src/map-updater.cc?l=330&rcl=5671f8b940b0fcdb550e318e449ded0f866e935a

Bug: chromium:949435
Change-Id: Id4fef60cdca094e638a1db38878953ecb2422c4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552797
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60640}
2019-04-04 19:27:29 +00:00
Z Duong Nguyen-Huu
9d2f267f42 Improve test coverage for non-extensible array when possible
Bug: v8:6831
Change-Id: I7d51a49dfbf2e5a1fa2675fe0d70bb4091a4db78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1544274
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60611}
2019-04-03 16:32:01 +00:00
Georg Neis
4c35194d91 [turbofan] Fix bug in InferHasInPrototypeChain
- We didn't take stability dependencies on the inferred maps
  in case of kUnreliableReceiverMaps.
- We didn't take stability dependencies on the prototype chains.

Bug: v8:9041
Change-Id: I85418dbed219f51e7fb46c59a0cb9cbb9b499bc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1541107
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60550}
2019-04-01 12:13:48 +00:00
Georg Neis
8d6da70857 [turbofan] Fix bug in JSStoreInArrayLiteral
It was missing a control output.

Bug: chromium:946889
Change-Id: I85f203fc6e27a60f0b86e0e2999dd798a5416dfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1547655
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60549}
2019-04-01 11:58:27 +00:00
Jaroslav Sevcik
1ec7ffedc8 [turbofan] Make sure nodes are killed on replacement
In reducers, we should avoid reductions of the form

  ReduceWithValue(node, replacement)
  return Replace(node)

because such reduction does not kill the original node, so it may
become subject to resurrection from some side table (in the bug
referenced below it was load elimination's side table). Instead,
we should use

  ReduceWithValue(node, replacement)
  return Replace(replacement)

Bug: chromium:945644
Change-Id: Id210efe0d214a53241392d30b7f0eee8e7515e2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545229
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60517}
2019-03-29 08:52:20 +00:00
Z Duong Nguyen-Huu
34e1c07110 Improve test coverage for non-extensible array in optimized code
This cover all test files under mjsunit/compiler/array-*

Bug: v8:6831
Change-Id: I7a5632ccb3895a6e23ebfb92598dd1939de133b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1531030
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60484}
2019-03-27 11:08:36 +00:00
Jaroslav Sevcik
149b82230e [turbofan] Only lower constant load if feedback agrees with receiver map.
Bug: chromium:945187
Change-Id: I564a4495f13651ea9fdf1b95c25658b92ff9de49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1538125
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60437}
2019-03-25 13:06:04 +00:00
Georg Neis
95b09e3e98 [turbofan] Support named access on global proxy in serializer
Process feedback and hints for Lda/StaNamed bytecodes w.r.t. access on
the global proxy. This stores the property cells (or their absence) on
the JSGlobalProxyData.

Bug: v8:7790
Change-Id: Iadedea5494611c1b2ed38b6ce75687e084cc27f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1499499
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60411}
2019-03-22 14:23:53 +00:00
Georg Neis
e80082bf54 [turbofan] Add missing map checks in a reducer
ReduceArrayIndexOfIncludes didn't account for kUnreliableReceiverMaps.
Will think about a more robust mechanism for this.

Bug: chromium:944062
Change-Id: Ib2bdaf4399225de4413e12c5684f58dfe524a2cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1532331
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60400}
2019-03-21 21:25:01 +00:00
Georg Neis
d922171717 [turbofan] Unify code that determines a JSCreate's map
There were four places where we did essentially the same steps in
order to extract the initial map for inlining a JSCreate operation.
This CL creates a function on NodeProperties for this task.

As a side effect, this fixes a bug in ReduceJSCreateArray, where
has_initial_map could get called when it wasn't permissible to do so.

Notes: For simplicity, in one or two places where we used to get the
target/newtarget constants from the types we now get them from
HeapConstant nodes.

Cosmetic change: rename "receiver_map" to the more accurate
"root_map" in JSNativeContextSpecialization::ExtractReceiverMaps.

Bug: chromium:939316
Change-Id: I8fd9eb50993be3d839ab9b18eeea28184c53eabf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1528435
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60301}
2019-03-18 15:26:26 +00:00
Jaroslav Sevcik
d62cd2f745 [turbofan] Do not call JSFunction::has_initial_map without has_prototype_slot
Bug: chromium:939316
Change-Id: I2a132b6cce208e110fe30de8d75743ac7534fc94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1525942
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60291}
2019-03-18 13:00:06 +00:00
Sigurd Schneider
790acd7cb0 Revert "[turbofan] add fast path for String.p.startsWith"
This reverts commit acadb20271.

Reason for revert: chromium:941952

Original change's description:
> [turbofan] add fast path for String.p.startsWith
> 
> Add a fast path for String.p.startsWith(str) when length of str is 1.
> 
> Bug: v8:8400
> Change-Id: I65e657549902dc3ad064a213d815dd098ce6455f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1491872
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60091}

TBR=sigurds@chromium.org,bmeurer@chromium.org,usharma1998@gmail.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8400
Change-Id: Iabd66b8db0d6958686ea15a042d8567955700c9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1524205
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60279}
2019-03-18 10:57:03 +00:00