This is a reland of commit 86bc438834
Fix: we don't have a map for the rest parameter, so we only
allow to forward the arguments object if the map is a JSArray
and elements array is ArgumentsElements.
Original change's description:
> [maglev] Fix VirtualObject refactoring
>
> - VirtualObject::slot_count does not include the Map. We need to add +1
> when the map count should be included.
>
> - We forgot to patch the nested allocations back to the object
> graph.
>
> Fixed: 346042378
> Change-Id: I54e06a82a9324a55902b720e8188b6b8ec2c22bd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614730
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#94341}
Change-Id: Iaf6cd204c73ae6bd0b495af5196d1232b7d72ef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621050
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94366}
The {string} input and the result could register, which make the
StringLength calculation buggy.
If we are calculating the CodePointAt of a two byte string, we need
a second temporary (or we would need to support adding constrains
like input cannot alias with result in the register allocator).
Drive-by: Make BuiltinStringPrototypeCharCodeOrCodePointAt
arch-agnostic.
Fixed: 345547970
Change-Id: Id42fc7f244a0307699ee39707e7a5b892a4cedf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614410
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94343}
- VirtualObject::slot_count does not include the Map. We need to add +1
when the map count should be included.
- We forgot to patch the nested allocations back to the object
graph.
Fixed: 346042378
Change-Id: I54e06a82a9324a55902b720e8188b6b8ec2c22bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614730
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94341}
This reverts commit aabb0de7fe.
Reason for revert: https://crbug.com/343069824
Original change's description:
> [maglev] Avoid call to ObjectPrototypeHasOwnProperty builtin if possible.
>
> If the input "key" of the "object.prototype.hasownproperty" JSCall
> comes from enum cache and the receiver is a heap constant, then we
> can replace the ObjectPrototypeHasOwnProperty builtin call with some
> compare and jump instructions.
>
> This CL can bring ~50% improvement on this micro case below:
> (just run maglev code with "--no-turbofan" flag)
> -----------------------------------
> const RESERVED_PROPS = {
> key: true,
> ref: true,
> __self: true,
> __source: true,
> };
>
> function foo(config) {
> let i = 0;
> let propName;
> const props = {};
> for (propName in config) {
> if (!RESERVED_PROPS.hasOwnProperty(propName)) {
> i = i + 1;
> }
> }
> return i;
> }
> -----------------------------------
>
> Change-Id: I6023532ed839c348e5646adc7809719870b24375
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5517735
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Jialu Zhang <jialu.zhang@intel.com>
> Cr-Commit-Position: refs/heads/main@{#94109}
Change-Id: Iff77aa5b485eacc91fcdc7b2251d0342cbad6c8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5577676
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#94144}
This reverts commit aadbcd5a98.
Reason for revert: static_assert about the alignment is
now incorrect.
Original change's description:
> [base] Change PointerWithPayload to accept incomplete types
>
> Currently PointerWithPayload is templatize by using a complete type,
> which means that we cannot define a PointerWithPayload of a not yet
> defined type, eg:
>
> class MyType;
> PointerWithPayload<MyType>; // Fails compilation
>
> However PointerWithPayload is essentially a pointer, so if we
> pass the pointer type instead, we can allow incomplete types.
>
> Change-Id: I3a273419599bdfbd2f21060d1fa749d82ce3adea
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5553986
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#94025}
Change-Id: If82d69284c2f59410e9525d7f452d6c6f8bed86b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5573728
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94141}
Currently PointerWithPayload is templatize by using a complete type,
which means that we cannot define a PointerWithPayload of a not yet
defined type, eg:
class MyType;
PointerWithPayload<MyType>; // Fails compilation
However PointerWithPayload is essentially a pointer, so if we
pass the pointer type instead, we can allow incomplete types.
Change-Id: I3a273419599bdfbd2f21060d1fa749d82ce3adea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5553986
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94025}
Non-tagged values (and numbers) should always return false when
comparing to a root constant, except HoleyFloat64, which can be
undefined.
Drive-by: if iterator_method is untagged, then just throw an
exception in GetIterator.
Fixed: 341167196
Change-Id: Id6a20c3d6e3d40e7c03e0a8e877464ab29ac1fcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5553851
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94006}
This is a reland of commit 2098e649b4
Fix: LazyContinuationFrameScope should be only considered for
lazy deopts. We can skip when emitting an eager frame.
Before this CL we would checkpoint the eager deopt frame, so that
it wouldn't be recreated with the lazy continuation frame on top.
However, this CL wraps a lazy deopt continuation to a call to
TryBuildLoadNamedProperty, which can split in multiple blocks
in case of polymorphic feedback and need to reconstruct the
deopt frame.
I also added the regression test.
Original change's description:
> [maglev] Inline GetIterator
>
> Bug: v8:7700
> Change-Id: I8bc9ac2bc884e4f02e159aaf1a9b04b91fc4be4e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5531447
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#93856}
Bug: v8:7700
Change-Id: I90fe9ac7fe6be7ffb64c35aa02f1c4c63c853c92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5537911
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93906}
Undetectable objects should return false in ToBoolean, whereas any
other JSReceiver returns true. Since there is only one possible
JSReceiver and undetectable object (aka document.all), we track its
type separately.
Fixed: 340167165
Change-Id: I950f6390a3e42abe68e0de76106bae1fb0d0fb57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5535008
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93877}
DependOnInitialMapInstanceSizePrediction uses the default initial
map for the array_function to calculate the slack size.
Later we update the initial map depending on the elements kind.
We assume that the slack calculated by this updated initial map
is the same.
So in the CL we add a check in CapturedObject::set to be sure
we don't overflow the CapturedObject.
Drive-by: We refactor ReduceArrayConstructor to make the
initial map logic more explicit.
Fixed: 339517309
Change-Id: Ib7de77738895c1ff2ccfced2d4bc5499c18a5ca2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5534744
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93860}
2 errors in the previous CL:
- Checking for is_inline() is not enough to check if the arguments
object were built in inlined function.
- We cannot reconstruct the arguments object elements from
the inlined_arguments_ array, we should read its captured
elements offset, since it could have been created by a different
function.
This CL adds tags to CapturedObject to identify its provenance.
It also adds support to RestParameters.
Fixed: 336833467
Bug: 326091155
Change-Id: I48763a817428952d7178bd1ec3bde76af5f1be82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5487519
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93574}
Inline calls to the array constructor like:
`new Array()` or `new Array(size)`
This does not consider argument count > 1 and calls to the
constructor without the keyword `new`.
Bug: v8:7700
Change-Id: I30aead1032f88a516823e2d6ca39eee8e0a72290
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5481578
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93572}
This is a reland of commit 38d8751be2
- Fixed Goto in SelectioReduction to use GotoOrTrim in case of abort
- Fixed to use tagged version of arg_list
- Added a test.
Original change's description:
> [maglev] Re-enable ReduceFunctionPrototypeApplyCallWithReceiver
>
> The reason this reduction was disabled is that we did not
> support the case when the second argument could be null or
> undefined.
>
> With the SubGraphBuilder, this is trivial to implement.
>
> Bug: v8:7700
> Change-Id: I8d880935c8bf7383c0307127c3f72b1b5cea168f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5458171
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#93401}
Bug: v8:7700
Change-Id: I313a5db68958901631005ac294186f54920ff36d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5458397
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93527}
The reason this reduction was disabled is that we did not
support the case when the second argument could be null or
undefined.
With the SubGraphBuilder, this is trivial to implement.
Bug: v8:7700
Change-Id: I8d880935c8bf7383c0307127c3f72b1b5cea168f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5458171
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93401}
... to indicate that the argument was not passed to the function.
This is a regression from the previous refactoring, we were
doing the same thing before.
https://crrev.com/c/5435076
Note this does not need to be done for inlined functions, since
we know exactly the correct mapped count.
Fixed: 334974242
Bug: 326091155
Change-Id: I004a7e6a7aea678147f3e0d4e2172ff2318bfe79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5453873
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93383}
This shows off how to create a new inlined allocation in Maglev.
The allocation automatically participates in the escape analysis.
Bug: v8:7700
Change-Id: Idff4738186a38a958a4325315a85039f4c7933f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5443264
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93372}
... and allow the arguments object to participate in the
escape analysis.
This CL:
Creates CapturedObject, which is simply an array of CapturedValues.
CapturedObject abstracts the previous FastObject, FastContext,
FastFixedArray, FastArguments... Instead it provides functions
static creation functions. All objects automatically
participate in the escape analysis.
This avoids code duplication. For instance, allocation and
translate state creation is very similar for all these objects.
This also creates a single allocation function (which creates
InlinedAllocation node) and wrap all nested objects in
runtime values variant of CapturedValues.
This decouples the "escapeness" of the nested allocations.
This will allow the simplification of dependencies in a
follow up CL.
CaptureObject also deals with extra input locations
automatically.
InputLocations are also simplified: we walk the same input
locations in the same order if we escape or not the allocation.
We also always dedicate an input location to the InlinedAllocation
node even if it was captured.
This currently disables property load / element load caches.
These optimizations were not very useful for these kind of objects
anyways. However, a follow up CL will recreate these optimizations
by manipulating the CapturedObject directly.
Bug: 326091155
Change-Id: I245803d2a9a1a86fd085160c995d4efa5640652f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5435076
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93371}
The function passed as parameter to DeepForDeoptObject tree walker needs
to consider nested escaped objects. We use a recursive lambda for that.
In the test case, for instance, we should not try to apply argument `f`
(the node marker) to a captured context (InlinedAllocation) that is
the extension value of another captured context that will be
materialized when/if we deopt.
Fixed: 332947120
Bug: 326091155
Change-Id: Ibab8bb758cc7ce704cfeee4200f6fcab0eaf4728
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5431937
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93229}
We don't need to use the input_locations for duplicated object, we
should skip them.
The input location size for an InlinedAllocation is either 1 when
escaped, or GetInputLocationsArraySize when captured.
Fixed: 332392668
Bug: 326091155
Change-Id: I3b8a1c8559a7feaef3bbf813dbdb27bcb081051e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5419174
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93144}
We want FastObjects to continue to be constants, ie. they don't
depend on generic ValueNodes.
This removes FastField and wire inlined arguments elements
differently.
Bug: 326091155
Change-Id: I91ca451d1a0c61ee11c94cab58325f5f44b0d938
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401861
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93116}
ScopeInfo is assumed to be corrupted, we then create a FastContext
object that is smaller than Context::MIN_CONTEXT_SLOTS.
Since we always assume that a context has at least the mandatory slots,
we corrupt memory later.
Fixed: 331837303
Change-Id: I0b6e32b7457778777ade8257e907fe9d71bea206
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5412131
Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93108}
That is, it allows the allocation of contexts to be elided if
it does not escape.
This CL:
- simplifies FastContext, since most fields are just undefined. This
allows to easily identify runtime values. FastContext also does not
use FastField(ValueNode*) anymore, which makes it possible to
delete this constructor in a follow up CL.
- updates DeepForEachInputImpl to also visit DeoptObjects.
- adds InputLocations in DeoptInfos for value nodes in a DeoptObject
- extends the lifetime of value nodes that are fields in a DeoptObject
- allocates inputs for these value nodes during regalloc
- create a CAPTURE_OBJECT for non escaping contexts to materialize
them during deoptimization.
Bug: 326091155
Change-Id: I58a446bb17b702cb3dd90564c6793d16bcb7d43e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5392586
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93105}
We assume that if we strict compare an untagged value to a constant,
then the comparison is false.
This is not true with HoleyFloat64, since they can compare
equal to the undefined value.
This adds HoleyFloat64IsHole node and the optimization to use
BranchIfFloat64IsHole.
Fixed: 331711028
Change-Id: I9e2ccbdeda1f12795406a1256b5a76e526453d27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401864
Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93102}
Finish basic block with a Goto to label done only if
TryBuildPropertyLoad finishes with a result.
Otherwise, if it fails, the basic block would be empty,
since we have Goto to the generic case.
Fixed: 330427711
Change-Id: I07078f52c0693fb954b2018e4380d0cec8012bf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5387762
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93007}
Previously, inputs to initialization stores were often constants,
so optimizing them away had little impact. However, the escape
analysis of the arguments object introduces runtime values
(ArgumentsLength and ArgumentsElements) that can't be eliminated.
This change saves stores during the AnyUseMarkingProcessor phase,
allowing us to process their inputs after identifying allocations
that did not escaped.
The inputs to the store would then be eliminated in
DeadNodeSweepingProcessor if their use reaches zero.
Bug: 326091155
Change-Id: I8aeca146c03008fab285b4fc52f3ed74c2cf09a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5383474
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92948}
... where equivalence doesn't imply same NodeType.
For instance, we cannot assume that a TypeCombine with a HeapNumber
and a generic tagged value yields another HeapNumber.
In particular, the node Float64ToTagged may return a Smi instead of
a HeapNumber.
Fixed: 329476993
Change-Id: I3f1c06e0b870ba3c84a1f3ea19f8d2a7b03cdd8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5383097
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92943}
This is a reland of commit 12c69e482d
This fixes the index of mapped parameters in the function context:
For the top function, mapped_count = parameter_count_without_receiver,
but this is not the case for inlined functions.
Original change's description:
> Reland "[maglev] Support arguments object in inlined function"
>
> This is a reland of commit 38554cc99f
>
> Original change's description:
> > [maglev] Support arguments object in inlined function
> >
> > We actually already support them via runtime function calls
> > We only need to enable them.
> >
> > Drive-by: if the number of rest parameters is zero (empty
> > fixed array), we could fail GetWriteBarrierMode.
> > So instead, we return the rest object earlier.
> >
> > Bug: v8:7700
> > Change-Id: Ib07c8b91cf9c0bc668358de47b1b9b74adb715ad
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5366455
> > Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> > Reviewed-by: Patrick Thier <pthier@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#92819}
>
> Bug: v8:7700
> Change-Id: I7812c8da58ede3b66af4b5202587d070cd0b332b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5382159
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#92924}
Fixed: 330578127
Bug: v8:7700
Change-Id: Ic9be959cf3a16acb9cc8b1c7ec2adf5326849056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5383081
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92934}
This is a reland of commit 38554cc99f
Original change's description:
> [maglev] Support arguments object in inlined function
>
> We actually already support them via runtime function calls
> We only need to enable them.
>
> Drive-by: if the number of rest parameters is zero (empty
> fixed array), we could fail GetWriteBarrierMode.
> So instead, we return the rest object earlier.
>
> Bug: v8:7700
> Change-Id: Ib07c8b91cf9c0bc668358de47b1b9b74adb715ad
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5366455
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#92819}
Bug: v8:7700
Change-Id: I7812c8da58ede3b66af4b5202587d070cd0b332b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5382159
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92924}
... and analyse them after AnyUseMarkingProcessor, which will
delete most of unused nodes.
The non escaped allocations and its stores are them removed from the
graph in DeadNodeSweepingProcessor.
If the store makes nodes unused, it is then too late to remove them.
This fixes the issue when we have 3 allocations (A, B, C)
and the dependencies (A, C) and (B, C).
Assuming A and C are not escaping, but B is.
If we process A first, we will remove the node, since it
is non-escaping.
But later, we process B, which forces C to escape.
Therefore, A needs to escape as well!
This CL also allows multiple dependencies.
This CL also simplifies the HasEscaped predicate:
After EscapeDependentAllocationsIfNeeded, we use a simple boolean
flag to denote escaped objects.
Bug: 329474361, 326091155
Change-Id: I4682c0b78f9514a2aef804d55a81ba9954209f79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5374908
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92902}
This reverts commit 38554cc99f.
Reason for revert: Performance regressions.
Original change's description:
> [maglev] Support arguments object in inlined function
>
> We actually already support them via runtime function calls
> We only need to enable them.
>
> Drive-by: if the number of rest parameters is zero (empty
> fixed array), we could fail GetWriteBarrierMode.
> So instead, we return the rest object earlier.
>
> Bug: v8:7700
> Change-Id: Ib07c8b91cf9c0bc668358de47b1b9b74adb715ad
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5366455
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#92819}
Bug: 330096622, v8:7700
Change-Id: Idd52f310c26e2476b372eced4a5da86a5bf6ddb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5374912
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92883}
We actually already support them via runtime function calls
We only need to enable them.
Drive-by: if the number of rest parameters is zero (empty
fixed array), we could fail GetWriteBarrierMode.
So instead, we return the rest object earlier.
Bug: v8:7700
Change-Id: Ib07c8b91cf9c0bc668358de47b1b9b74adb715ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5366455
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92819}
Object ids should be unique. In particular, object allocated
inside inlined functions should have different ids than the
ones allocated in the parent function. Otherwise we will
materialize the wrong object in the deoptimizer.
Fixed: 328868985
Bug: v8:7700, 326091155
Change-Id: Icfb803a38fd94520d5b4dae6d90cb72f67e119bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5361455
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92766}
Caveats:
- We do not inline the allocation for inlined functions.
- We do not support aliased/mapped arguments.
- Allocation currently always escape (we do not add the non escape uses).
Bug: v8:8800, 326091155
Change-Id: Ia4dc2d248169bef08fc25caf16f9d8f79d8c7e9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5344756
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92748}
This is a reland of commit 576176291b
Fix 3 issues:
- Fix hole issue in Float64
- Always escape constructors that have any use in the inlined function
- Always escape if object is allocated inside a try-block, since
we do not currently support materialization of the object in the catch
block.
Original change's description:
> [maglev] Simple escape analysis for inlined allocated objects
>
> Only escape objects that have no use, other than its initializing
> stores.
>
> Bug: v8:8800, 326091155,
> Change-Id: I8c25fdd7da12058cf33501f03d43d4f357c2bc46
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5306934
> Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#92667}
Fixed: 328280144, 328096360, 328134548
Bug: v8:8800, 326091155
Change-Id: Ia1e18df1d5d807184cd3f05c0b9b1be5fbd0c4de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5348997
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92701}
When alllowing OOB access, we rely on no elements protector to
invalidate the optimization. But since negative index is not
consider an element access, it is transformed to a name and
loaded as a property, it does not invalidate the protector.
Here (as in TF) we force a deoptimization if index is negative.
Bug: v8:7700, chromium:41496337
Change-Id: I1eb7287f7a26e97e44df32cc63cc7aa633608532
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5286015
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92277}
Victor Gomes