[for-of-performance] Handle Async ArrayIterators and a bug fix [v8/v8 : main]

0 views
Skip to first unread message

Rezvan Mahdavi Hezaveh (Gerrit)

unread,
Sep 3, 2025, 5:18:44 PM (4 days ago) Sep 3
to Leszek Swirski, V8 LUCI CQ, v8-re...@googlegroups.com
Attention needed from Leszek Swirski

Rezvan Mahdavi Hezaveh added 1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4 (Latest): ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . unresolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Open in Gerrit

Related details

Attention is currently required from:
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 4
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Wed, 03 Sep 2025 21:18:40 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Sep 4, 2025, 3:56:17 AM (3 days ago) Sep 4
to Rezvan Mahdavi Hezaveh, V8 LUCI CQ, v8-re...@googlegroups.com
Attention needed from Rezvan Mahdavi Hezaveh

Leszek Swirski voted and added 1 comment

Votes added by Leszek Swirski

Code-Review+1

1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4 (Latest): ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . unresolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Leszek Swirski

Ok, let's take this fix for now and look into why 3323 isn't working separately.

Open in Gerrit

Related details

Attention is currently required from:
  • Rezvan Mahdavi Hezaveh
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 4
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Comment-Date: Thu, 04 Sep 2025 07:56:11 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Sep 4, 2025, 7:41:48 AM (3 days ago) Sep 4
to Rezvan Mahdavi Hezaveh, V8 LUCI CQ, v8-re...@googlegroups.com
Attention needed from Rezvan Mahdavi Hezaveh

Leszek Swirski added 1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4 (Latest): ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . unresolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Leszek Swirski

Ok, let's take this fix for now and look into why 3323 isn't working separately.

Leszek Swirski

I figured it out -- it's because of the way the register optimizer works, it expects that `ForOfNext` will _unconditionally_ write into the `done` register, and therefore that the previous store of `True` into the `done` register is not observable.

You can take advantage of this by actually unconditionally writing `True` into `done` at the start of `ForOfNext`, before doing all the callbacks, and then you can move the `LoadTrue().Store(done)` into the `else` branch here.

Open in Gerrit

Related details

Attention is currently required from:
  • Rezvan Mahdavi Hezaveh
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 4
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Comment-Date: Thu, 04 Sep 2025 11:41:43 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Leszek Swirski <les...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Rezvan Mahdavi Hezaveh (Gerrit)

unread,
Sep 4, 2025, 5:34:53 PM (3 days ago) Sep 4
to AyeAye, Leszek Swirski, V8 LUCI CQ, dmercadi...@chromium.org, v8-re...@googlegroups.com
Attention needed from Leszek Swirski

Rezvan Mahdavi Hezaveh added 1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4: ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . unresolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Leszek Swirski

Ok, let's take this fix for now and look into why 3323 isn't working separately.

Leszek Swirski

I figured it out -- it's because of the way the register optimizer works, it expects that `ForOfNext` will _unconditionally_ write into the `done` register, and therefore that the previous store of `True` into the `done` register is not observable.

You can take advantage of this by actually unconditionally writing `True` into `done` at the start of `ForOfNext`, before doing all the callbacks, and then you can move the `LoadTrue().Store(done)` into the `else` branch here.

Rezvan Mahdavi Hezaveh

That's interesting. I did not know about the register optimizer.
I applied your suggestion but it didn't work. I have uploaded my code so you can see what I have done. I tried loading `True` in bytecode-array-builder.cc and bytecode-graph-builder.cc and none of them worked. I kept both in this CL so you can check them.
(I also tried loading `True` in var_done (TVARIABLE) in `ForOfNextHelper` in code-stub-assembler.cc but that did not look correct to me. We don't have access to the registers there so I did not upload that part in this CL.)

Let me know if I am missing something here, thanks.

Open in Gerrit

Related details

Attention is currently required from:
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 5
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Thu, 04 Sep 2025 21:34:50 +0000
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Sep 5, 2025, 5:53:12 AM (2 days ago) Sep 5
to Rezvan Mahdavi Hezaveh, AyeAye, V8 LUCI CQ, dmercadi...@chromium.org, v8-re...@googlegroups.com
Attention needed from Rezvan Mahdavi Hezaveh

Leszek Swirski added 1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4: ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . unresolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Leszek Swirski

Ok, let's take this fix for now and look into why 3323 isn't working separately.

Leszek Swirski

I figured it out -- it's because of the way the register optimizer works, it expects that `ForOfNext` will _unconditionally_ write into the `done` register, and therefore that the previous store of `True` into the `done` register is not observable.

You can take advantage of this by actually unconditionally writing `True` into `done` at the start of `ForOfNext`, before doing all the callbacks, and then you can move the `LoadTrue().Store(done)` into the `else` branch here.

Rezvan Mahdavi Hezaveh

That's interesting. I did not know about the register optimizer.
I applied your suggestion but it didn't work. I have uploaded my code so you can see what I have done. I tried loading `True` in bytecode-array-builder.cc and bytecode-graph-builder.cc and none of them worked. I kept both in this CL so you can check them.
(I also tried loading `True` in var_done (TVARIABLE) in `ForOfNextHelper` in code-stub-assembler.cc but that did not look correct to me. We don't have access to the registers there so I did not upload that part in this CL.)

Let me know if I am missing something here, thanks.

Leszek Swirski

What I meant was in the ForOfNext bytecode handler itself, before it calls the ForOfNextHelper. OTOH, this might be tricky with lazy deopts...

Another option you have is to add ForOfNext to the list of bytecodes in the register optimizer which flush the optimizer state. Since you're at the top of a loop, this won't have a huge impact, since loops already flush the registers.

Open in Gerrit

Related details

Attention is currently required from:
  • Rezvan Mahdavi Hezaveh
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 5
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Comment-Date: Fri, 05 Sep 2025 09:53:06 +0000
unsatisfied_requirement
open
diffy

Rezvan Mahdavi Hezaveh (Gerrit)

unread,
Sep 5, 2025, 7:13:57 PM (2 days ago) Sep 5
to AyeAye, Leszek Swirski, V8 LUCI CQ, dmercadi...@chromium.org, v8-re...@googlegroups.com
Attention needed from Leszek Swirski

Rezvan Mahdavi Hezaveh added 1 comment

File src/interpreter/bytecode-generator.cc
Line 3336, Patchset 4: ->LoadTrue()
.StoreAccumulatorInRegister(done)
Rezvan Mahdavi Hezaveh . resolved

using `--trace_ignition`, I realized that `done` set to `false` in the second iteration of the loop at this point. The code in line 3323 should set it to `true` at the start of each iteration but it does not. Loading `true` here fixes the bug but I still am not sure why this happens.

Leszek Swirski

Ok, let's take this fix for now and look into why 3323 isn't working separately.

Leszek Swirski

I figured it out -- it's because of the way the register optimizer works, it expects that `ForOfNext` will _unconditionally_ write into the `done` register, and therefore that the previous store of `True` into the `done` register is not observable.

You can take advantage of this by actually unconditionally writing `True` into `done` at the start of `ForOfNext`, before doing all the callbacks, and then you can move the `LoadTrue().Store(done)` into the `else` branch here.

Rezvan Mahdavi Hezaveh

That's interesting. I did not know about the register optimizer.
I applied your suggestion but it didn't work. I have uploaded my code so you can see what I have done. I tried loading `True` in bytecode-array-builder.cc and bytecode-graph-builder.cc and none of them worked. I kept both in this CL so you can check them.
(I also tried loading `True` in var_done (TVARIABLE) in `ForOfNextHelper` in code-stub-assembler.cc but that did not look correct to me. We don't have access to the registers there so I did not upload that part in this CL.)

Let me know if I am missing something here, thanks.

Leszek Swirski

What I meant was in the ForOfNext bytecode handler itself, before it calls the ForOfNextHelper. OTOH, this might be tricky with lazy deopts...

Another option you have is to add ForOfNext to the list of bytecodes in the register optimizer which flush the optimizer state. Since you're at the top of a loop, this won't have a huge impact, since loops already flush the registers.

Rezvan Mahdavi Hezaveh

Okay, I applied your suggestion and add the ForOfNext to the list of bytecodes that needs flushing the optimizer state. Thanks for the suggestion.

Open in Gerrit

Related details

Attention is currently required from:
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 7
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Fri, 05 Sep 2025 23:13:53 +0000
unsatisfied_requirement
open
diffy

Rezvan Mahdavi Hezaveh (Gerrit)

unread,
Sep 5, 2025, 7:17:29 PM (2 days ago) Sep 5
to AyeAye, Leszek Swirski, V8 LUCI CQ, dmercadi...@chromium.org, v8-re...@googlegroups.com
Attention needed from Leszek Swirski

Rezvan Mahdavi Hezaveh added 1 comment

Rezvan Mahdavi Hezaveh . resolved

Thanks for the review. PTAL, thanks

Open in Gerrit

Related details

Attention is currently required from:
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ibc65f170de98325a7411473fc752f9247885f8bc
Gerrit-Change-Number: 6907269
Gerrit-PatchSet: 7
Gerrit-Owner: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Rezvan Mahdavi Hezaveh <rez...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Fri, 05 Sep 2025 23:17:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy
Reply all
Reply to author
Forward
0 new messages