Issue 5267 in v8: TurboFan compiler tracking bug

[bmeu… via monorail]

Status: Started
Owner: bmeu...@chromium.org
CC: mvstan...@chromium.org, bge...@google.com, ja...@chromium.org, hab...@chromium.org, eper...@chromium.org, mstar...@chromium.org
Labels: Performance HelpWanted TurboFan Hotlist-TurboFan
Components: Compiler

New issue 5267 by bmeu...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267

This is the tracking bug for the implementation of the TurboFan compiler for JavaScript. We especially want to track the open issues that we need to resolve to reach the initial milestone where we can ship the "Hundertwasserpipeline" (as described in this document here: https://docs.google.com/document/d/1o7XEFhJ9qCDngm6KL7npXVF3ky0U1hGwM1IhN96xzCM/edit), and the following steps required to reach the final goal of having an Ignition+TurboFan architecture only (with an additional baseline compiler to avoid the expensive tier up to TurboFan in the common case).

--
You received this message because:
1. The project was configured to send all issue notifications to this address

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

[bmeu… via monorail]

Updates:
Blockedon: 5265

Comment #22 on issue 5267 by bmeu...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c22

(No comment was entered for this change.)

[rmcil… via monorail]

Updates:
Cc: rmci...@chromium.org

Comment #23 on issue 5267 by rmci...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c23

[bugdro… via monorail]

Comment #31 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c31

The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8.git/+/3909250a6c7ae0003a1d54a3d47ec32260e4ede4

commit 3909250a6c7ae0003a1d54a3d47ec32260e4ede4
Author: bmeurer
Date: Wed Aug 10 04:33:18 2016

[turbofan] Add support for keyed access to strings.

This introduces initial support to handle keyed load access to
String primitives. This is accomplished via the existing operators
StringCharCodeAt and StringFromCharCode, which we already use to
optimize String.prototype.charCodeAt and String.fromCharCode.

R=yan...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2232483002
Cr-Commit-Position: refs/heads/master@{#38512}

[modify] https://crrev.com/3909250a6c7ae0003a1d54a3d47ec32260e4ede4/src/compiler/js-native-context-specialization.cc

[bugdro… via monorail]

Comment #32 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c32

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b8f475045c27536e2666a55d826c556ce4cdbb3e

commit b8f475045c27536e2666a55d826c556ce4cdbb3e
Author: bmeurer
Date: Thu Aug 11 13:13:05 2016

[turbofan] Add inlined Array.prototype.pop support.

This adds a very first version of inlined Array.prototype.pop into
TurboFan optimized code. We currently limit the inlining to fast
object or smi elements, until the unclear situation around hole NaNs
is resolved and we have a clear semantics inside the compiler.

It's also probably overly defensive in when it's safe to inline
the call to Array.prototype.pop, but we can always extend that
later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229,v8:3952,v8:5267
R=eper...@chromium.org

Review-Url: https://codereview.chromium.org/2239703002
Cr-Commit-Position: refs/heads/master@{#38578}

[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/compiler/access-builder.cc
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/compiler/access-builder.h
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/compiler/js-builtin-reducer.h
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/compiler/pipeline.cc
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/src/type-cache.h
[add] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/test/mjsunit/compiler/inlined-array-pop-getter1.js
[add] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/test/mjsunit/compiler/inlined-array-pop-getter2.js
[add] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/test/mjsunit/compiler/inlined-array-pop-opt.js
[modify] https://crrev.com/b8f475045c27536e2666a55d826c556ce4cdbb3e/test/unittests/compiler/js-builtin-reducer-unittest.cc

[bugdro… via monorail]

Comment #33 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c33

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/50f223e47eafdf4fccc0108b03affca9e3d892b1

commit 50f223e47eafdf4fccc0108b03affca9e3d892b1
Author: bmeurer
Date: Fri Aug 12 08:59:20 2016

[turbofan] Add inlined Array.prototype.push support.

This adds a very first version of inlined Array.prototype.push into
TurboFan optimized code. The current inlined version has a potential
deopt loop, but it's unlikely that we hit it currently (Crankshaft
suffers from an even worse problem). Once we have a way to learn from
deopts we can fix this deopt loops.

It's also probably overly defensive in when it's safe to inline

the call to Array.prototype.push, but we can always extend that

later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229,v8:3952,v8:5267

R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2245533003
Cr-Commit-Position: refs/heads/master@{#38603}

[modify] https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1/src/compiler/access-builder.cc
[modify] https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1/src/compiler/js-builtin-reducer.h

[bugdro… via monorail]

Comment #40 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c40

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/052ba98d14fae5d6d0595f0272fa922df3025e10

commit 052ba98d14fae5d6d0595f0272fa922df3025e10
Author: bmeurer
Date: Thu Aug 25 05:42:58 2016

[compiler] Properly canonicalize handles even with concurrent recompilation.

For concurrent recompilation we created the CompilationHandleScope after
the CanonicalHandleScope, which basically disabled the canonicalization
because the deferred handle creation doesn't pay attention to the
canonicalization mode then. This meant that we did not canonicalize
handles properly as soon as concurrent recompilation was enabled.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2276953004
Cr-Commit-Position: refs/heads/master@{#38882}

[modify] https://crrev.com/052ba98d14fae5d6d0595f0272fa922df3025e10/src/compiler.cc

[bugdro… via monorail]

Comment #42 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c42

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0da5b8222b623e5c975e4552ce7cd42cbe56ec1a

commit 0da5b8222b623e5c975e4552ce7cd42cbe56ec1a
Author: bmeurer
Date: Thu Aug 25 09:36:10 2016

[turbofan] Narrow type of Phis during JSTypedLowering.

Try to narrow types of Phis further during JSTypedLowering, because
lowering based on types might create further opportunities for improving
the types.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2278903002
Cr-Commit-Position: refs/heads/master@{#38895}

[modify] https://crrev.com/0da5b8222b623e5c975e4552ce7cd42cbe56ec1a/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/0da5b8222b623e5c975e4552ce7cd42cbe56ec1a/src/compiler/js-typed-lowering.h

[bugdro… via monorail]

Comment #44 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c44

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f154c75a39308be6253de351bd4422033ba528fe

commit f154c75a39308be6253de351bd4422033ba528fe
Author: bmeurer
Date: Fri Aug 26 07:57:57 2016

[turbofan] Separate typed optimizations from JSTypedLowering.

Introduce a new TypedOptimization reducer that contains the type
based optimization reduction steps, which are not (directly)
related to lowering JavaScript operators based on types (which is
what JSTypedLowering is supposed to do).

This also addresses a chicken-and-egg problem that we see in the
Octane/Mandreel benchmark where type based constant folding isn't
applied to the numeric comparison operators introduced by the
JSTypedLowering itself, and thus gives up to 10% speedup for the
benchmark.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2280673003
Cr-Commit-Position: refs/heads/master@{#38928}

[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/BUILD.gn
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/compiler/pipeline.cc
[add] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/compiler/typed-optimization.cc
[add] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/compiler/typed-optimization.h
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/src/v8.gyp
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/test/unittests/compiler/js-typed-lowering-unittest.cc
[add] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/test/unittests/compiler/typed-optimization-unittest.cc
[modify] https://crrev.com/f154c75a39308be6253de351bd4422033ba528fe/test/unittests/unittests.gyp

[bugdro… via monorail]

Comment #45 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c45

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/76f740b2642032d449832b727e1fc3d70734c086

commit 76f740b2642032d449832b727e1fc3d70734c086
Author: bmeurer
Date: Fri Aug 26 08:34:38 2016

[turbofan] Introduce a dedicated ArrayBufferWasNeutered operator.

Using the dedicated simplified operator we are able to eliminate
redundant neuterung checks as long as there is no call in the
effect chain. This yields a nice speed up for the Octane Mandreel
benchmark (and TypedArray-heavy workloads in general).

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2279213002
Cr-Commit-Position: refs/heads/master@{#38932}

[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/load-elimination.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/load-elimination.h
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/opcodes.h
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/simplified-operator.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/simplified-operator.h
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/typer.cc
[modify] https://crrev.com/76f740b2642032d449832b727e1fc3d70734c086/src/compiler/verifier.cc

[bugdro… via monorail]

Comment #46 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c46

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f676db4655ea8d87e5f6a8172341dbf0cb09923b

commit f676db4655ea8d87e5f6a8172341dbf0cb09923b
Author: bmeurer
Date: Mon Aug 29 05:16:05 2016

[turbofan] Lazy bailout for calls doesn't need callee.

There's no need to preserve the exact callee for lazy bailouts
from JSCallFunction in the AstGraphBuilder, as fullcodegen code
will never look at that value after the callee returns. So we
just push optimized_out instead.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2285183002
Cr-Commit-Position: refs/heads/master@{#38963}

[modify] https://crrev.com/f676db4655ea8d87e5f6a8172341dbf0cb09923b/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/f676db4655ea8d87e5f6a8172341dbf0cb09923b/test/cctest/cctest.status

[bugdro… via monorail]

Comment #47 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c47

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f5a37d13bcee05875f675cb07535e8ac87266807

commit f5a37d13bcee05875f675cb07535e8ac87266807
Author: bmeurer
Date: Mon Aug 29 06:12:20 2016

[turbofan] Remove the unused asm.js types from TypeCache.

For asm.js we now have a dedicated AsmTyper, that uses it's own type
system (which is tailored towards asm.js), and so we don't need the
special asm.js types anymore in the TypeCache. This also moves the
TypeCache into the src/compiler directory, because it doesn't make
sense to use outside anyways.

TBR=ah...@chromium.org
R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2289573002
Cr-Commit-Position: refs/heads/master@{#38964}

[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/BUILD.gn
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/asmjs/asm-typer.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/access-builder.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/access-info.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/access-info.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/escape-analysis.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-builtin-reducer.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-global-object-specialization.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-global-object-specialization.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-native-context-specialization.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/operation-typer.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/operation-typer.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/simplified-lowering.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/simplified-operator-reducer.cc
[rename] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/type-cache.cc
[rename] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/type-cache.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/typed-optimization.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/typed-optimization.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/typer.cc
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/compiler/typer.h
[modify] https://crrev.com/f5a37d13bcee05875f675cb07535e8ac87266807/src/v8.gyp

[bugdro… via monorail]

Comment #48 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c48

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/ead8f658cdf7784852b288a29f47947766472110

commit ead8f658cdf7784852b288a29f47947766472110
Author: bmeurer
Date: Mon Aug 29 07:09:34 2016

[turbofan] Nuke the funny typing rule for JSTypedArray constants.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2291433003
Cr-Commit-Position: refs/heads/master@{#38966}

[modify] https://crrev.com/ead8f658cdf7784852b288a29f47947766472110/src/compiler/typer.cc

[bugdro… via monorail]

Comment #49 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c49

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/1915762cc8caea42727daebfe738bfcdca8ac859

commit 1915762cc8caea42727daebfe738bfcdca8ac859
Author: bmeurer
Date: Mon Aug 29 08:47:12 2016

[turbofan] Remove special JSForInStep and JSForInDone.

These JavaScript operators were special hacks to ensure that we always
operate on Smis for the magic for-in index variable, but this never
really worked in the OSR case, because the OsrValue for the index
variable didn't have the proper information (that we have for the
JSForInPrepare in the non-OSR case).

Now that we have loop induction variable analysis and binary operation
hints, we can just use JSLessThan and JSAdd instead with appropriate
Smi hints, which handle the OSR case by inserting Smi checks (that are
always true). Thanks to OSR deconstruction and loop peeling these Smi
checks will be hoisted so they don't hurt the OSR case too much.

Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
we have to lower it to JSLessThan to get the loop induction variable
goodness.

R=eper...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2289613002
Cr-Commit-Position: refs/heads/master@{#38968}

[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/ast/ast.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/js-operator.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/js-operator.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/linkage.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/opcodes.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/typer.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/compiler/verifier.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/bytecode-array-builder.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/bytecodes.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/bytecodes.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/interpreter/interpreter.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/runtime/runtime-forin.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/src/runtime/runtime.h
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/test/cctest/interpreter/bytecode_expectations/ForIn.golden
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/test/cctest/interpreter/bytecode_expectations/WideRegisters.golden
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/test/unittests/interpreter/bytecode-array-builder-unittest.cc
[modify] https://crrev.com/1915762cc8caea42727daebfe738bfcdca8ac859/test/unittests/interpreter/bytecode-array-writer-unittest.cc

[bugdro… via monorail]

Comment #50 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c50

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/285e1e157a63c929cfb9d9466333c9798df6bb57

commit 285e1e157a63c929cfb9d9466333c9798df6bb57
Author: bmeurer
Date: Mon Aug 29 09:19:59 2016

[turbofan] Remove invalid typing rules.

Drop the typing rules for the machine operators and replace them
with UNREACHABLE. These typing rules were never correct and there's
also no need to have those rules at all.

Drive-by-fix: Remove the extremely annoying test-simplified-lowering.cc
file, which is not very useful, but consumes a large amount of time to
keep it compiling and passing. Instead we should introduce appropriate
tests for the SimplifiedLowering that also test something meaningful
w/o just cementing the implementation.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2292463002
Cr-Commit-Position: refs/heads/master@{#38970}

[modify] https://crrev.com/285e1e157a63c929cfb9d9466333c9798df6bb57/src/compiler/typer.cc
[modify] https://crrev.com/285e1e157a63c929cfb9d9466333c9798df6bb57/test/cctest/cctest.gyp
[modify] https://crrev.com/285e1e157a63c929cfb9d9466333c9798df6bb57/test/cctest/compiler/test-machine-operator-reducer.cc
[delete] https://crrev.com/98a79c9412accd4fc9b806b2e52870230cf24094/test/cctest/compiler/test-simplified-lowering.cc
[modify] https://crrev.com/285e1e157a63c929cfb9d9466333c9798df6bb57/test/unittests/compiler/branch-elimination-unittest.cc
[modify] https://crrev.com/285e1e157a63c929cfb9d9466333c9798df6bb57/test/unittests/compiler/machine-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #51 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c51

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/24ef71d96b6e7f9c94af8bbc288624f9f06a34e5

commit 24ef71d96b6e7f9c94af8bbc288624f9f06a34e5
Author: bmeurer
Date: Mon Aug 29 11:22:18 2016

[turbofan] More efficient code generation for unsigned modulus.

If we know statically that x and y are both in Unsigned32 or NaN or -0,
and we have SignedSmall or Signed32 feedback for x % y, then we can take
the feedback on the inputs and lower to Uint32Mod.

Drive-by-fix: Refactor this logic into a separate method.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2287303002
Cr-Commit-Position: refs/heads/master@{#38975}

[modify] https://crrev.com/24ef71d96b6e7f9c94af8bbc288624f9f06a34e5/src/compiler/simplified-lowering.cc

[bugdro… via monorail]

Comment #52 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c52

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/9bdce030df73681e5f5fc28b4b2b2b349d283c57

commit 9bdce030df73681e5f5fc28b4b2b2b349d283c57
Author: bmeurer
Date: Tue Aug 30 10:05:40 2016

[turbofan] Sanitize typing of Date builtins.

Put the types for the Date builtins into the TypeCache, and add
support for Date.prototype.getDay and Date.prototype.getMinutes.

R=eper...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2296593002
Cr-Commit-Position: refs/heads/master@{#39005}

[modify] https://crrev.com/9bdce030df73681e5f5fc28b4b2b2b349d283c57/src/compiler/type-cache.h
[modify] https://crrev.com/9bdce030df73681e5f5fc28b4b2b2b349d283c57/src/compiler/typer.cc
[modify] https://crrev.com/9bdce030df73681e5f5fc28b4b2b2b349d283c57/src/objects.h

[bugdro… via monorail]

Comment #53 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c53

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/a35934a67347169e4c711751f212b90beb119cba

commit a35934a67347169e4c711751f212b90beb119cba
Author: bmeurer
Date: Tue Aug 30 18:35:50 2016

[turbofan] Don't mark likely conversion as deferred.

When changing from Tagged to Float64 representation, it's not unlikely
to see a HeapNumber (or if feedback says so, an Oddball), so we
shouldn't penalize the code that deals with this case by marking it as
deferred.

R=mvst...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295933003
Cr-Commit-Position: refs/heads/master@{#39025}

[modify] https://crrev.com/a35934a67347169e4c711751f212b90beb119cba/src/compiler/effect-control-linearizer.cc

[bugdro… via monorail]

Comment #54 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c54

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/2b93899057a4c52cf523114b582bbca48b035cb2

commit 2b93899057a4c52cf523114b582bbca48b035cb2
Author: bmeurer
Date: Wed Aug 31 05:44:20 2016

[turbofan] Remove remaining uses of Class type from the compiler.

We (mis)used Type::Class to track stable field maps in the past. But
that always more or less unsupport and wrong for various reasons, mostly
because the class types do not really present static information and
thus it is possible to violate fundamental assumptions of the type
system (i.e. intersecting class types and other types produces
"interesting" results).

Now it is possible to finally nuke the class types completely and thus
simplify (and ideally correctify) the type system further.

Note to performance sheriff: We do expect to see some performance
regressions from this change. This is because we do not yet have a sane
replacement mechanism to track known field maps and utilize them during
LoadElimination. This will be accomplished in a follow up CL.

BUG=v8:5270,v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2293343002
Cr-Commit-Position: refs/heads/master@{#39031}

[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/access-info.cc
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/access-info.h
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/js-global-object-specialization.cc
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/typed-optimization.cc
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/compiler/typer.cc
[modify] https://crrev.com/2b93899057a4c52cf523114b582bbca48b035cb2/src/types.h

[bugdro… via monorail]

Comment #55 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c55

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac

commit b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac
Author: bmeurer
Date: Wed Aug 31 05:48:05 2016

[turbofan] Extend LoadElimination to introduce TypeGuards.

If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}

[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/src/compiler/load-elimination.cc
[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/src/compiler/load-elimination.h
[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/test/unittests/compiler/load-elimination-unittest.cc
[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/test/unittests/compiler/node-test-utils.cc
[modify] https://crrev.com/b98d64f909db4ae2eda9fabcbab9cf0f81cb76ac/test/unittests/compiler/node-test-utils.h

[bugdro… via monorail]

Comment #57 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c57

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/83e14103203f581b9b741d2b0612374e88855625

commit 83e14103203f581b9b741d2b0612374e88855625
Author: bmeurer
Date: Thu Sep 01 06:26:41 2016

[turbofan] Float32Constant/Float64Constant cannot occur in JS level graph.

Now that the hole NaN is no longer represented as Float64Constant early
on, we should never see such a constant node in any JS-level graph, but
we will only see them after representation selection. Change Typer and
SimplifiedLowering appropriately (and fix the invalid tests).

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2299883003
Cr-Commit-Position: refs/heads/master@{#39063}

[modify] https://crrev.com/83e14103203f581b9b741d2b0612374e88855625/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/83e14103203f581b9b741d2b0612374e88855625/src/compiler/typer.cc
[modify] https://crrev.com/83e14103203f581b9b741d2b0612374e88855625/test/cctest/compiler/test-js-constant-cache.cc
[modify] https://crrev.com/83e14103203f581b9b741d2b0612374e88855625/test/cctest/compiler/test-js-typed-lowering.cc
[modify] https://crrev.com/83e14103203f581b9b741d2b0612374e88855625/test/unittests/compiler/effect-control-linearizer-unittest.cc

[bugdro… via monorail]

Comment #59 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c59

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/9f37e303c3fab8146826a01ae442ef27c3cec4aa

commit 9f37e303c3fab8146826a01ae442ef27c3cec4aa
Author: bmeurer
Date: Thu Sep 01 10:50:08 2016

[turbofan] Properly look through FinishRegion in alias analysis.

For two FinishRegion nodes, the alias analysis returned "may alias" even
without properly looking through them.

Drive-by-fix: Add meaningful output for --trace-turbo-load-elimination.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2301903002
Cr-Commit-Position: refs/heads/master@{#39075}

[modify] https://crrev.com/9f37e303c3fab8146826a01ae442ef27c3cec4aa/src/compiler/load-elimination.cc
[modify] https://crrev.com/9f37e303c3fab8146826a01ae442ef27c3cec4aa/src/compiler/load-elimination.h
[modify] https://crrev.com/9f37e303c3fab8146826a01ae442ef27c3cec4aa/test/unittests/compiler/load-elimination-unittest.cc

[epert… via monorail]

Issue 5267: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267

This issue is now blocking issue 5341.
See https://bugs.chromium.org/p/v8/issues/detail?id=5341

[bugdro… via monorail]

Comment #62 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c62

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/99e91aaeacf7ed12570530b4f48b8f93b023f876

commit 99e91aaeacf7ed12570530b4f48b8f93b023f876
Author: bmeurer
Date: Mon Sep 05 07:02:00 2016

[turbofan] Fold "boolean not"-like Selects into branches.

Fold a Select that negates a boolean value, i.e. returning true in the
false case and vice versa, into Branch users, similar to what we already
do for Branch nodes with BooleanNot inputs.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2308303003
Cr-Commit-Position: refs/heads/master@{#39149}

[modify] https://crrev.com/99e91aaeacf7ed12570530b4f48b8f93b023f876/src/compiler/common-operator-reducer.cc
[modify] https://crrev.com/99e91aaeacf7ed12570530b4f48b8f93b023f876/test/unittests/compiler/common-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #63 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c63

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/776a5c100873cd59f32565ba8482417c8b749e7a

commit 776a5c100873cd59f32565ba8482417c8b749e7a
Author: bmeurer
Date: Mon Sep 05 08:43:17 2016

[turbofan] Improve graph for JumpIfTrue/False and JumpIfToBooleanTrue/False.

Avoid the useless strict equality comparisons with true/false being
generated for the JumpIfTrue, JumpIfFalse, JumpIfToBooleanTrue and
JumpIfToBooleanFalse bytecodes. Instead feed the accumulator (or the
outcome of ToBoolean) directly to the Branch node and do the negation
as part of the control flow.

The previous subraphs would render the loop variable analysis useless,
and would cause a lot of unnecessary bit materialization, because many
of our optimizations don't kick in.

Note: This is only part of the problem, there are more subtle differences
in the bytecode pipeline that prevent several important optimizations to
kick in.

R=mstar...@chromium.org
BUG=v8:5267,v8:5348

Review-Url: https://codereview.chromium.org/2309733002
Cr-Commit-Position: refs/heads/master@{#39151}

[modify] https://crrev.com/776a5c100873cd59f32565ba8482417c8b749e7a/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/776a5c100873cd59f32565ba8482417c8b749e7a/src/compiler/bytecode-graph-builder.h

[bugdro… via monorail]

Comment #64 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c64

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/7e95e2064ab5387838a05fc20ece9a1e04c93056

commit 7e95e2064ab5387838a05fc20ece9a1e04c93056
Author: bmeurer
Date: Mon Sep 05 09:18:39 2016

[turbofan] Nuke class types.

There are no users of class types left inside TurboFan, so we can nuke
them and thereby simplify the type system quite a bit.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309753002
Cr-Commit-Position: refs/heads/master@{#39152}

[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/src/types.cc
[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/src/types.h
[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/test/cctest/ast-types-fuzz.h
[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/test/cctest/test-ast-types.cc
[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/test/cctest/test-types.cc
[modify] https://crrev.com/7e95e2064ab5387838a05fc20ece9a1e04c93056/test/cctest/types-fuzz.h

[bugdro… via monorail]

Comment #65 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c65

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/75d4db728b67395954bf85e531924f7e4e3a115e

commit 75d4db728b67395954bf85e531924f7e4e3a115e
Author: bmeurer
Date: Mon Sep 05 11:55:06 2016

[turbofan] Math.random never produces -0.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2312693002
Cr-Commit-Position: refs/heads/master@{#39162}

[modify] https://crrev.com/75d4db728b67395954bf85e531924f7e4e3a115e/src/compiler/typer.cc

[bugdro… via monorail]

Comment #66 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c66

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b5f60820acc51075ac139037788d52951a20ff84

commit b5f60820acc51075ac139037788d52951a20ff84
Author: bmeurer
Date: Mon Sep 05 12:40:37 2016

[turbofan] Nuke the context types.

Those have been effectively unused for quite a while now, and we
don't see any use in having them around. Actually it'd be way more
consistent and simpler to just use OtherInternal as type for contexts
instead.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2305383002
Cr-Commit-Position: refs/heads/master@{#39166}

[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/src/compiler/typer.cc
[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/src/compiler/verifier.cc
[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/src/types.cc
[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/src/types.h
[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/test/cctest/test-types.cc
[modify] https://crrev.com/b5f60820acc51075ac139037788d52951a20ff84/test/cctest/types-fuzz.h

[bugdro… via monorail]

Comment #67 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c67

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/68b47f5e0f02a736ddd3ae3e210957d947f7516c

commit 68b47f5e0f02a736ddd3ae3e210957d947f7516c
Author: bmeurer
Date: Mon Sep 05 13:03:30 2016

[turbofan] Also nuke Array and Function types.

We used to have Array types for typed arrays in asm.js at some point,
but had to change that quite some time ago already. And Function types
were mostly used for the CallInterfaceDescriptor (and the code-stub.js
experiment), but are also unusedn nowadays.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2310923002
Cr-Commit-Position: refs/heads/master@{#39168}

[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/src/compiler/type-cache.h
[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/src/compiler/typer.cc
[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/src/types.cc
[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/src/types.h
[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/test/cctest/test-types.cc
[modify] https://crrev.com/68b47f5e0f02a736ddd3ae3e210957d947f7516c/test/cctest/types-fuzz.h

[bugdro… via monorail]

Comment #68 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c68

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff

commit c071a8f0ca096c28a1c6bf7a5d1304f121d027ff
Author: bmeurer
Date: Tue Sep 06 08:54:19 2016

[turbofan] Introduce dedicated NumberToBoolean operator.

Previously we always lowered JSToBoolean(x:Number) to the subgraph
NumberLessThan(0.0, NumberAbs(x)), which deals with both 0, -0 and
NaNs appropriately. However this doesn't always generate the best,
especially when we can later derive from feedback that x is always
an Integral32 value, where the ideal code would be just a single
comparison to 0 w/o the absolute value computation.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309953002
Cr-Commit-Position: refs/heads/master@{#39194}

[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/opcodes.h
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/operation-typer.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/simplified-lowering.h
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/simplified-operator.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/simplified-operator.h
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/typer.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/src/compiler/verifier.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/test/unittests/compiler/js-typed-lowering-unittest.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/test/unittests/compiler/node-test-utils.cc
[modify] https://crrev.com/c071a8f0ca096c28a1c6bf7a5d1304f121d027ff/test/unittests/compiler/node-test-utils.h

[bugdro… via monorail]

Comment #69 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c69

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/17dbaff9c77c3a3d5a7248fe302a43ca0b51ec26

commit 17dbaff9c77c3a3d5a7248fe302a43ca0b51ec26
Author: bmeurer
Date: Tue Sep 06 09:08:32 2016

[turbofan] Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply.

Keep the unrestricted feedback type around during retyping and use that
to check whether an overflow check is actually necessary when doing the
lowering of SpeculativeNumberAdd/Subtract/Multiply. If based on feedback
that is taken for the inputs we already know that the result of the
operation fits into Signed32 or Unsigned32 range, then we don't need to
perform any overflow checks.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309193003
Cr-Commit-Position: refs/heads/master@{#39198}

[modify] https://crrev.com/17dbaff9c77c3a3d5a7248fe302a43ca0b51ec26/src/compiler/representation-change.cc
[modify] https://crrev.com/17dbaff9c77c3a3d5a7248fe302a43ca0b51ec26/src/compiler/representation-change.h
[modify] https://crrev.com/17dbaff9c77c3a3d5a7248fe302a43ca0b51ec26/src/compiler/simplified-lowering.cc

[bugdro… via monorail]

Comment #71 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c71

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/7ac19fe59823c82a8cf484d50a26767e1c828572

commit 7ac19fe59823c82a8cf484d50a26767e1c828572
Author: bmeurer
Date: Wed Sep 07 10:14:19 2016

[builtins] Migrate Number predicates and make them optimizable.

Migrate the isNaN, isFinite, Number.isFinite, Number.isInteger,
Number.isSafeInteger and Number.isNaN predicates to TurboFan
builtins and make them optimizable (for certain input types) in
JavaScript callees being optimized by TurboFan. That means both
the baseline and the optimized version is now always at maximum,
consistent performance. Especially TurboFan suffered from poor
baseline (and optimized) performance because it cannot play the
same weird tricks that Crankshaft plays for %_IsSmi.

This also adds a bunch of new tests to properly cover the use
of the Harmony predicates in optimized code.

R=fra...@chromium.org
BUG=v8:5049,v8:5267

Review-Url: https://codereview.chromium.org/2313073002
Cr-Commit-Position: refs/heads/master@{#39242}

[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/bootstrapper.cc
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/builtins/builtins-global.cc
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/builtins/builtins-number.cc
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/builtins/builtins.h
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/compiler/js-builtin-reducer.h
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/compiler/typer.cc
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/js/collection.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/js/i18n.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/js/prologue.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/js/typedarray.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/js/v8natives.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/src/objects.h
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/cctest/test-serialize.cc
[add] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/mjsunit/compiler/number-isfinite.js
[add] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/mjsunit/compiler/number-isinteger.js
[add] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/mjsunit/compiler/number-isnan.js
[add] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/mjsunit/compiler/number-issafeinteger.js
[modify] https://crrev.com/7ac19fe59823c82a8cf484d50a26767e1c828572/test/unittests/compiler/js-builtin-reducer-unittest.cc

[bugdro… via monorail]

Comment #72 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c72

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/91ed540ee662e15a9a33a420848f2e171f2999d1

commit 91ed540ee662e15a9a33a420848f2e171f2999d1
Author: bmeurer
Date: Thu Sep 08 04:20:09 2016

[turbofan] Revert "Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply."

The optimization is not correct for unsigned output types, and we the
overall complexity seems too high. We need to find a better way to
take into account the input/output type restrictions.

Also added a regression test for the unsigned output bug.

BUG=v8:5267,v8:5270,v8:5357
TBR=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2320013002
Cr-Commit-Position: refs/heads/master@{#39262}

[modify] https://crrev.com/91ed540ee662e15a9a33a420848f2e171f2999d1/src/compiler/representation-change.cc
[modify] https://crrev.com/91ed540ee662e15a9a33a420848f2e171f2999d1/src/compiler/representation-change.h
[modify] https://crrev.com/91ed540ee662e15a9a33a420848f2e171f2999d1/src/compiler/simplified-lowering.cc
[add] https://crrev.com/91ed540ee662e15a9a33a420848f2e171f2999d1/test/mjsunit/regress/regress-5357.js

[bugdro… via monorail]

Comment #75 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c75

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/7d4ab7d43e335f36b0f91eb36e231dc7bea048ea

commit 7d4ab7d43e335f36b0f91eb36e231dc7bea048ea
Author: bmeurer
Date: Fri Sep 09 08:44:01 2016

[turbofan] Initial support for polymorphic inlining.

For call sites where the target is not a known constant, but potentially
a list of known constants (i.e. a Phi with all HeapConstant inputs), we
still record the call site as a potential candidate for inlining.
In case the heuristic picks that candidate for inlining, we
expand the call site to a dispatched call site and invoke the
actual inlining logic for all the nested call sites.

Like Crankshaft, we currently allow up to 4 targets for polymorphic inlining,
although we might want to refine that later.

This approach is different from what Crankshaft does in
that we don't duplicate the evaluation of the parameters per polymorphic
case. Instead we first perform the load of the target (which usually
dispatches based on the receiver map), then we evaluate all the
parameters, and then we dispatch again based on the known targets. This
might generate better or worse code compared to what Crankshaft does,
and for the cases where we generate worse code (i.e. because we have
only trivial parameters or no parameters at all), we might want to
investigate optimizing away the double dispatch in the
future.

R=mvst...@chromium.org
BUG=v8:5267,v8:5365

Review-Url: https://codereview.chromium.org/2325943002
Cr-Commit-Position: refs/heads/master@{#39302}

[modify] https://crrev.com/7d4ab7d43e335f36b0f91eb36e231dc7bea048ea/src/compilation-info.cc
[modify] https://crrev.com/7d4ab7d43e335f36b0f91eb36e231dc7bea048ea/src/compiler/js-inlining-heuristic.cc
[modify] https://crrev.com/7d4ab7d43e335f36b0f91eb36e231dc7bea048ea/src/compiler/js-inlining-heuristic.h
[modify] https://crrev.com/7d4ab7d43e335f36b0f91eb36e231dc7bea048ea/src/compiler/pipeline.cc

[bugdro… via monorail]

Comment #77 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c77

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f0a0c432a5d048d39f250a7bb20d662d14e1cd17

commit f0a0c432a5d048d39f250a7bb20d662d14e1cd17
Author: bmeurer
Date: Mon Sep 12 09:40:51 2016

[turbofan] Ship eval.

No longer disable TurboFan for functions with eval, but only disable
Crankshaft in those cases.

R=mstar...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2334633002
Cr-Commit-Position: refs/heads/master@{#39338}

[modify] https://crrev.com/f0a0c432a5d048d39f250a7bb20d662d14e1cd17/src/ast/ast-numbering.cc

[bugdro… via monorail]

Comment #78 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c78

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/dfc4b47f661d7cde5fa23112c19e3f146526d0d3

commit dfc4b47f661d7cde5fa23112c19e3f146526d0d3
Author: bmeurer
Date: Tue Sep 13 06:31:50 2016

[turbofan] Strength reduce CheckTaggedSigned/Pointer with checked inputs.

Add strength reduction rules to optimize

CheckTaggedSigned(CheckTaggedSigned(x)) -> CheckTaggedSigned(x)

and

CheckTaggedPointer(CheckTaggedPointer(x)) -> CheckTaggedPointer(x)

where we do some cleanup optimizations after loop peeling and redundancy
elimination, which can generate these constructs.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2336093002
Cr-Commit-Position: refs/heads/master@{#39366}

[modify] https://crrev.com/dfc4b47f661d7cde5fa23112c19e3f146526d0d3/src/compiler/simplified-operator-reducer.cc
[modify] https://crrev.com/dfc4b47f661d7cde5fa23112c19e3f146526d0d3/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #79 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c79

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/ae9a39b010ff74759439d3084e99a6b809085151

commit ae9a39b010ff74759439d3084e99a6b809085151
Author: bmeurer
Date: Tue Sep 13 08:19:22 2016

[turbofan] Make the inlining heuristic deterministic.

Don't sort inline candidates by comparing Node pointers, where the order
depends on the allocation order and the concrete Zone memory layout at
runtime. Instead sort based on NodeId, which is deterministic.

R=mvst...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2336113002
Cr-Commit-Position: refs/heads/master@{#39371}

[modify] https://crrev.com/ae9a39b010ff74759439d3084e99a6b809085151/src/compiler/js-inlining-heuristic.cc

[bugdro… via monorail]

Comment #80 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c80

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/97b330ada5c58db66cf64b8124ef5349e269cded

commit 97b330ada5c58db66cf64b8124ef5349e269cded
Author: bmeurer
Date: Tue Sep 13 11:44:54 2016

[turbofan] Avoid unnecessary JSConvertReceiver nodes.

When inlining sloppy functions try to find some witness in the effect
chain that the receiver is already a JSReceiver and thereby avoid
inserting the JSConvertReceiver node, which we currently cannot really
optimize away most of the time.

Middle-term we may want to change the way CheckMaps works and have some
unified mechanism to deal with effect chain walks to find witnesses for
various map related facts. Also we may want to consider doing this
optimization later, although that requires some more refactorings since
we already promised that JSConvertReceiver gives a Type::Receiver.

R=mstar...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2333213002
Cr-Commit-Position: refs/heads/master@{#39379}

[modify] https://crrev.com/97b330ada5c58db66cf64b8124ef5349e269cded/src/compiler/js-inlining.cc

[bugdro… via monorail]

Comment #82 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c82

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0fb92f273526f105adabd63dda92ebc44192dc27

commit 0fb92f273526f105adabd63dda92ebc44192dc27
Author: bmeurer
Date: Tue Sep 13 12:24:17 2016

[turbofan] Properly use MachineRepresentation for field access.

When lowering DataField accesses, we should pay attention to the
MachineRepresentation reported by the AccessInfo. This doesn't
yet change the rest of the pipeline to take full advantage of
the representations.

Drive-by-fix: Make the code more robust, especially the part that
deals with mutable heap number access.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2334193002
Cr-Commit-Position: refs/heads/master@{#39381}

[modify] https://crrev.com/0fb92f273526f105adabd63dda92ebc44192dc27/src/compiler/js-native-context-specialization.cc

[bugdro… via monorail]

Comment #84 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c84

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0b8a69458ea25314f83d83fbe7f6ced4f903daf1

commit 0b8a69458ea25314f83d83fbe7f6ced4f903daf1
Author: bmeurer
Date: Wed Sep 14 04:12:26 2016

[turbofan] Call frequencies for JSCallFunction and JSCallConstruct.

Extract the call counts from the type feedback vector during graph
building (either via the AstGraphBuilder or the BytecodeGraphBuilder),
and put them onto the JSCallFunction and JSCallConstruct operators,
so that they work even across inlinine through .apply and .call (which
was previously hacked by creating a temporary type feedback vector
for those).

The next logic step will be to make those call counts into real
relative call frequencies (also during graph building), so that we
can make inlining decisions that make sense for the function being
optimized (where absolute values are misleading).

R=ja...@chromium.org
BUG=v8:5267,v8:5372

Review-Url: https://codereview.chromium.org/2330883002
Cr-Commit-Position: refs/heads/master@{#39400}

[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/ast-graph-builder.h
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/bytecode-graph-builder.h
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-inlining-heuristic.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-inlining-heuristic.h
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-intrinsic-lowering.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-operator.cc
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-operator.h
[modify] https://crrev.com/0b8a69458ea25314f83d83fbe7f6ced4f903daf1/src/compiler/js-typed-lowering.cc

[bugdro… via monorail]

Comment #85 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c85

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870

commit c7d7ca361dd1ba399becd54ce0d9c6e53f76c870
Author: bmeurer
Date: Wed Sep 14 10:20:08 2016

[turbofan] Collect invocation counts and compute relative call frequencies.

Add a notion of "invocation count" to the baseline compilers, which
increment a special slot in the TypeFeedbackVector for each invocation
of a given function (the optimized code doesn't currently collect this
information).

Use this invocation count to relativize the call counts on the call
sites within the function, so that the inlining heuristic has a view
of relative importance of a call site rather than some absolute numbers
with unclear meaning for the current function. Also apply the call site
frequency as a factor to all frequencies in the inlinee by passing this
to the graph builders so that the importance of a call site in an
inlinee is relative to the topmost optimized function.

Note that all functions that neither have literals nor need type
feedback slots will share a single invocation count cell in the
canonical empty type feedback vector, so their invocation count is
meaningless, but that doesn't matter since we only use the invocation
count to relativize call counts within the function, which we only have
if we have at least one type feedback vector (the CallIC slot).

See the design document for additional details on this change:
https://docs.google.com/document/d/1VoYBhpDhJC4VlqMXCKvae-8IGuheBGxy32EOgC2LnT8

BUG=v8:5267,v8:5372
R=mvst...@chromium.org,rmci...@chromium.org,mstar...@chromium.org

Review-Url: https://codereview.chromium.org/2337123003
Cr-Commit-Position: refs/heads/master@{#39410}

[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/arm/builtins-arm.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/arm64/builtins-arm64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/ia32/builtins-ia32.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/mips/builtins-mips.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/mips64/builtins-mips64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/builtins/x64/builtins-x64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/ast-graph-builder.h
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/bytecode-graph-builder.h
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/js-inlining.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/compiler/pipeline.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/heap/heap.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/heap/heap.h
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/profiler/heap-snapshot-generator.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/type-feedback-vector-inl.h
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/type-feedback-vector.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/src/type-feedback-vector.h
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ArrayLiterals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/AssignmentsInBinaryExpression.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/BasicBlockToBoolean.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/BasicLoops.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/BreakableBlocks.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CallGlobal.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CallNew.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ClassDeclarations.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CompoundExpressions.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/Conditional.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CreateArguments.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/CreateRestParameter.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/DeclareGlobals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/DoExpression.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ForIn.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ForOf.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/FunctionLiterals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/Generators.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/GlobalCompoundExpressions.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/GlobalCountOperators.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/GlobalDelete.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/IfConditions.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/JumpsRequiringConstantWideOperands.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/LoadGlobal.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/LogicalExpressions.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/ObjectLiterals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/OuterContextVariables.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/PrimitiveExpressions.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/PropertyCall.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/PropertyLoads.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/PropertyStores.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/RegExpLiterals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/RemoveRedundantLdar.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/StoreGlobal.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/Switch.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/TopLevelObjectLiterals.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/Typeof.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/UnaryOperators.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/bytecode_expectations/WideRegisters.golden
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/interpreter/test-interpreter.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/test-compiler.cc
[modify] https://crrev.com/c7d7ca361dd1ba399becd54ce0d9c6e53f76c870/test/cctest/test-feedback-vector.cc

[bugdro… via monorail]

Comment #86 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c86

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/7954b3f8fa6a9fc6c884953d2615dea3018f52be

commit 7954b3f8fa6a9fc6c884953d2615dea3018f52be
Author: bmeurer
Date: Wed Sep 14 13:12:11 2016

[turbofan] Introduce TruncateTaggedToBit operator for ToBoolean truncation.

Add a dedicated simplified operator to inline the general case for the
ToBoolean conversion. In a follow up CL we will also use the ToBoolean
hints gathered by the baseline compiler.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_arm64_gc_stress_dbg
R=ja...@chromium.org
BUG=v8:5267

Committed: https://crrev.com/8c50b51ab3d21efcd2f6900d83962159f21e1590
Review-Url: https://codereview.chromium.org/2167593002
Cr-Original-Commit-Position: refs/heads/master@{#37882}
Cr-Commit-Position: refs/heads/master@{#39420}

[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/opcodes.h
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/representation-change.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/representation-change.h
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/simplified-operator.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/simplified-operator.h
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/src/compiler/verifier.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/test/cctest/compiler/test-representation-change.cc
[modify] https://crrev.com/7954b3f8fa6a9fc6c884953d2615dea3018f52be/test/unittests/compiler/simplified-operator-unittest.cc

[bugdro… via monorail]

Comment #88 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c88

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/3f0c8819800baca0d994c0dffafcb528bdcc060f

commit 3f0c8819800baca0d994c0dffafcb528bdcc060f
Author: bjaideep
Date: Thu Sep 15 13:11:14 2016

PPC/s390: [turbofan] Collect invocation counts and compute relative call frequencies.

Port c7d7ca361dd1ba399becd54ce0d9c6e53f76c870

Original commit message:

Add a notion of "invocation count" to the baseline compilers, which
increment a special slot in the TypeFeedbackVector for each invocation
of a given function (the optimized code doesn't currently collect this
information).

Use this invocation count to relativize the call counts on the call
sites within the function, so that the inlining heuristic has a view
of relative importance of a call site rather than some absolute numbers
with unclear meaning for the current function. Also apply the call site
frequency as a factor to all frequencies in the inlinee by passing this
to the graph builders so that the importance of a call site in an
inlinee is relative to the topmost optimized function.

Note that all functions that neither have literals nor need type
feedback slots will share a single invocation count cell in the
canonical empty type feedback vector, so their invocation count is
meaningless, but that doesn't matter since we only use the invocation
count to relativize call counts within the function, which we only have
if we have at least one type feedback vector (the CallIC slot).

See the design document for additional details on this change:
https://docs.google.com/document/d/1VoYBhpDhJC4VlqMXCKvae-8IGuheBGxy32EOgC2LnT8

R=bme...@chromium.org, jora...@ca.ibm.com, jy...@ca.ibm.com, michael...@ca.ibm.com, mbr...@us.ibm.com

BUG=v8:5267,v8:5372
LOG=N

Review-Url: https://codereview.chromium.org/2338413002
Cr-Commit-Position: refs/heads/master@{#39446}

[modify] https://crrev.com/3f0c8819800baca0d994c0dffafcb528bdcc060f/src/builtins/ppc/builtins-ppc.cc
[modify] https://crrev.com/3f0c8819800baca0d994c0dffafcb528bdcc060f/src/builtins/s390/builtins-s390.cc
[modify] https://crrev.com/3f0c8819800baca0d994c0dffafcb528bdcc060f/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/3f0c8819800baca0d994c0dffafcb528bdcc060f/src/full-codegen/s390/full-codegen-s390.cc

[bugdro… via monorail]

Comment #89 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c89

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/347931e6273484c97c7b6e065f6b0e500ed089f6

commit 347931e6273484c97c7b6e065f6b0e500ed089f6
Author: bmeurer
Date: Fri Sep 16 09:20:11 2016

[turbofan] Constant-fold some ObjectIs checks based on feedback type.

During feedback typing (in SimplifiedLowering) we might be able to
constant-fold a bunch of ObjectIs<Type> predicates, i.e. because we
took type feedback on the input or we narrowed the type of a Phi
because of type feedback.

R=mvst...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2342283002
Cr-Commit-Position: refs/heads/master@{#39468}

[modify] https://crrev.com/347931e6273484c97c7b6e065f6b0e500ed089f6/src/compiler/simplified-lowering.cc

[bugdro… via monorail]

Comment #92 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c92

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc

commit 29dd7fc5ed2490947bd951efa7d49e54c41dfbdc
Author: bmeurer
Date: Tue Sep 20 11:00:11 2016

[turbofan] Lower ConsString creation in JSTypedLowering.

Extract String feedback on Add operation and utilize to lower ConsString
creation in JSTypedLowering when we know that a String addition will
definitely result in the creation of a ConsString.

Note that Crankshaft has to guard the potential length overflow of the
resulting string with an eager deoptimization exit, while we can safely
throw an exception in that case.

Also note that the bytecode pipeline does not currently provide the
String feedback for the addition, which has to be added.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2354853002
Cr-Commit-Position: refs/heads/master@{#39540}

[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/js-operator.cc
[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/type-hint-analyzer.cc
[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/type-hints.cc
[modify] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/src/compiler/type-hints.h
[add] https://crrev.com/29dd7fc5ed2490947bd951efa7d49e54c41dfbdc/test/mjsunit/compiler/string-add-try-catch.js

[bugdro… via monorail]

Comment #93 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c93

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b0b97bfc0f3043058a479f62d3f4f0ea9995e6e5

commit b0b97bfc0f3043058a479f62d3f4f0ea9995e6e5
Author: bmeurer
Date: Wed Sep 21 07:14:29 2016

[turbofan] Also allow TaggedSigned/Pointer memory operand.

When we added the new MachineRepresentation::kTaggedSigned and
MachineRepresentation::kTaggedPointer, we didn't extend the logic
for memory operand covering, and so for map checks and other
comparisons with fields we'd always need an additional register.
This fixes that and does reduce register pressure in some cases.

R=ja...@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2354863003
Cr-Commit-Position: refs/heads/master@{#39575}

[modify] https://crrev.com/b0b97bfc0f3043058a479f62d3f4f0ea9995e6e5/src/compiler/x64/instruction-selector-x64.cc

[bugdro… via monorail]

Comment #95 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c95

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b63de989dbd7236b9b7750d2edb4dd85eecb9036

commit b63de989dbd7236b9b7750d2edb4dd85eecb9036
Author: bmeurer
Date: Thu Sep 22 10:01:08 2016

[turbofan] Bailout for call sites w/o feedback.

If a JSCallFunction node doesn't have any callee information, either
from feedback taken on input nodes, i.e. on property loads, or from
the CallIC, we insert a soft deoptimization exit instead.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2361773002
Cr-Commit-Position: refs/heads/master@{#39619}

[modify] https://crrev.com/b63de989dbd7236b9b7750d2edb4dd85eecb9036/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/b63de989dbd7236b9b7750d2edb4dd85eecb9036/src/compiler/js-call-reducer.h
[modify] https://crrev.com/b63de989dbd7236b9b7750d2edb4dd85eecb9036/src/compiler/pipeline.cc
[modify] https://crrev.com/b63de989dbd7236b9b7750d2edb4dd85eecb9036/src/deoptimize-reason.h

[bugdro… via monorail]

Comment #96 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c96

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/dfbb3db5ef3401248177829eff4f36b9e0cc2324

commit dfbb3db5ef3401248177829eff4f36b9e0cc2324
Author: Benedikt Meurer
Date: Fri Sep 23 10:32:13 2016

[turbofan] Improve representation selection for Smi checking.

Rename the high-level operators CheckTaggedSigned to CheckSmi and
CheckTaggedPointer to CheckHeapObject, to better match the naming
convention (i.e. ObjectIsSmi and CheckSmi, ObjectIsString and
CheckString, etc.).

For lowering CheckSmi, always report TaggedSigned representation
and let the RepresentationChanger come up with a reasonable conversion
from whatever input representation to TaggedSigned. This way we no
longer insert the useless ChangeSomethingToTagged and then Smi check
the result sequences, i.e. mostly reduces the amount of useless code
being generated. But we also observe a few performance improvements
on some crypto benchmarks.

This would enable us to avoid the Smi canonicalization when going from
Float64 to Tagged completely and thus match the representation selection
of Crankshaft in many areas (which might reduce the amount of
polymorphism until we fix our object model).

A follow-up CL will do the same for CheckHeapObject.

BUG=v8:5267
R=ja...@chromium.org

Review URL: https://codereview.chromium.org/2362173003 .

Cr-Commit-Position: refs/heads/master@{#39654}

[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/code-generator.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/js-global-object-specialization.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/js-native-context-specialization.h
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/opcodes.h
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/redundancy-elimination.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/representation-change.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/representation-change.h
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/simplified-operator-reducer.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/simplified-operator.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/simplified-operator.h
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/typer.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/src/compiler/verifier.cc
[modify] https://crrev.com/dfbb3db5ef3401248177829eff4f36b9e0cc2324/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #97 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c97

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/6a939714e991ebf10d56ddbd2869325cca99c0ef

commit 6a939714e991ebf10d56ddbd2869325cca99c0ef
Author: Benedikt Meurer
Date: Fri Sep 23 10:36:58 2016

[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=ja...@chromium.org
BUG=v8:5267

Review URL: https://codereview.chromium.org/2367593003 .

Cr-Commit-Position: refs/heads/master@{#39655}

[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/src/compiler/representation-change.cc
[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/src/compiler/simplified-operator.cc
[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/src/compiler/simplified-operator.h
[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/src/runtime/runtime-test.cc
[modify] https://crrev.com/6a939714e991ebf10d56ddbd2869325cca99c0ef/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #99 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c99

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/c80ca79715b4e03c4513d4e4893789eeb3aba0af

commit c80ca79715b4e03c4513d4e4893789eeb3aba0af
Author: bmeurer
Date: Fri Sep 23 11:24:00 2016

Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #3 id:40001 of https://codereview.chromium.org/2367593003/ )

Reason for revert:
Causes tree breakage:

https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/12916/steps/Check/logs/typedarray

Original issue's description:

> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=ja...@chromium.org
> BUG=v8:5267
>

> Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef

TBR=ja...@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2358123007
Cr-Commit-Position: refs/heads/master@{#39657}

[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/src/compiler/representation-change.cc
[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/src/compiler/simplified-operator.cc
[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/src/compiler/simplified-operator.h
[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/src/runtime/runtime-test.cc
[modify] https://crrev.com/c80ca79715b4e03c4513d4e4893789eeb3aba0af/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bmeu… via monorail]

Comment #100 on issue 5267 by bmeu...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c100

This is the tracking bug for the implementation of the TurboFan compiler for JavaScript. We especially want to track the open issues that we need to resolve to reach the initial milestone where we can ship the "Hundertwasserpipeline", and the following steps required to reach the final goal of having an Ignition+TurboFan architecture only (with an additional baseline compiler to avoid the expensive tier up to TurboFan in the common case).

[bugdro… via monorail]

Comment #101 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c101

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/1b33028607637ba8cb2d60433811f825b00a0cc1

commit 1b33028607637ba8cb2d60433811f825b00a0cc1
Author: Benedikt Meurer
Date: Fri Sep 23 11:47:07 2016

[turbofan] Don't take into account source size for inlining heuristics.

The source size is not a real indicator for whether or not to inline a
certain function.

R=ish...@chromium.org, ja...@chromium.org
BUG=v8:3354,v8:5267

Review URL: https://codereview.chromium.org/2361813002 .

Cr-Commit-Position: refs/heads/master@{#39659}

[modify] https://crrev.com/1b33028607637ba8cb2d60433811f825b00a0cc1/src/compiler/js-inlining-heuristic.cc
[modify] https://crrev.com/1b33028607637ba8cb2d60433811f825b00a0cc1/test/cctest/test-heap-profiler.cc
[modify] https://crrev.com/1b33028607637ba8cb2d60433811f825b00a0cc1/test/mjsunit/es6/tail-call-megatest.js

[bugdro… via monorail]

Comment #102 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c102

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/99160dc1c124d39c5d9e1eeb14bb363ab554ce6c

commit 99160dc1c124d39c5d9e1eeb14bb363ab554ce6c
Author: machenbach
Date: Fri Sep 23 12:43:23 2016

Revert of [turbofan] Don't take into account source size for inlining heuristics. (patchset #4 id:60001 of https://codereview.chromium.org/2361813002/ )

Reason for revert:
timeouts on windows:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/12504

Original issue's description:

> [turbofan] Don't take into account source size for inlining heuristics.
>
> The source size is not a real indicator for whether or not to inline a
> certain function.
>
> R=ish...@chromium.org, ja...@chromium.org
> BUG=v8:3354,v8:5267
>

> Committed: https://chromium.googlesource.com/v8/v8/+/1b33028607637ba8cb2d60433811f825b00a0cc1

TBR=ish...@chromium.org,ja...@chromium.org,bme...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

BUG=v8:3354,v8:5267

Review-Url: https://codereview.chromium.org/2362853003
Cr-Commit-Position: refs/heads/master@{#39661}

[modify] https://crrev.com/99160dc1c124d39c5d9e1eeb14bb363ab554ce6c/src/compiler/js-inlining-heuristic.cc
[modify] https://crrev.com/99160dc1c124d39c5d9e1eeb14bb363ab554ce6c/test/cctest/test-heap-profiler.cc
[modify] https://crrev.com/99160dc1c124d39c5d9e1eeb14bb363ab554ce6c/test/mjsunit/es6/tail-call-megatest.js

[bugdro… via monorail]

Comment #103 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c103

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0702ea3000df8235c8bfcf1e99a948ba38964ee3

commit 0702ea3000df8235c8bfcf1e99a948ba38964ee3
Author: bmeurer
Date: Fri Sep 23 16:23:17 2016

[turbofan] Don't take into account source size for inlining heuristics.

The source size is not a real indicator for whether or not to inline a
certain function.

R=ish...@chromium.org, ja...@chromium.org
BUG=v8:3354,v8:5267

Committed: https://chromium.googlesource.com/v8/v8/+/1b33028607637ba8cb2d60433811f825b00a0cc1

Review-Url: https://codereview.chromium.org/2361813002
Cr-Commit-Position: refs/heads/master@{#39681}

[modify] https://crrev.com/0702ea3000df8235c8bfcf1e99a948ba38964ee3/src/compiler/js-inlining-heuristic.cc
[modify] https://crrev.com/0702ea3000df8235c8bfcf1e99a948ba38964ee3/test/cctest/test-heap-profiler.cc
[modify] https://crrev.com/0702ea3000df8235c8bfcf1e99a948ba38964ee3/test/mjsunit/es6/tail-call-megatest.js
[modify] https://crrev.com/0702ea3000df8235c8bfcf1e99a948ba38964ee3/test/mozilla/mozilla.status

[bugdro… via monorail]

Comment #104 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c104

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/ee158e6c4cc896479a32245432a3c2fdd31bcb73

commit ee158e6c4cc896479a32245432a3c2fdd31bcb73
Author: bmeurer
Date: Fri Sep 23 19:26:53 2016

[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=ja...@chromium.org
BUG=v8:5267

Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef

Review-Url: https://codereview.chromium.org/2367593003
Cr-Commit-Position: refs/heads/master@{#39692}

[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/compiler/representation-change.cc
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/compiler/simplified-operator.cc
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/compiler/simplified-operator.h
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/js/regexp.js
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/src/runtime/runtime-test.cc
[modify] https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #105 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c105

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/72b01e4a41e3df784fce161a1928d9a7a3021aba

commit 72b01e4a41e3df784fce161a1928d9a7a3021aba
Author: bmeurer
Date: Fri Sep 23 20:16:42 2016

Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #5 id:80001 of https://codereview.chromium.org/2367593003/ )

Reason for revert:
Failing on the main waterfall again (again for typedarray, even tho it passed trybots?):

https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11515/steps/Check/logs/typedarray

Original issue's description:

> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=ja...@chromium.org
> BUG=v8:5267
>
> Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef

> Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
> Cr-Commit-Position: refs/heads/master@{#39692}

TBR=ja...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2367963002
Cr-Commit-Position: refs/heads/master@{#39694}

[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/compiler/representation-change.cc
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/compiler/simplified-operator.cc
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/compiler/simplified-operator.h
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/js/regexp.js
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/src/runtime/runtime-test.cc
[modify] https://crrev.com/72b01e4a41e3df784fce161a1928d9a7a3021aba/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #107 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c107

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/a0484bc6116ebc2b855de87d862945e2ae07169b

commit a0484bc6116ebc2b855de87d862945e2ae07169b
Author: bmeurer
Date: Mon Sep 26 12:32:23 2016

[compiler] Properly guard the speculative optimizations for instanceof.

Add a general feedback slot for instanceof similar to what we already have
for for-in, which basically has a fast (indicated by the uninitialized
sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
we can only take the fast path when the feedback slot says it hasn't
seen any funky inputs and nothing funky appeared in the prototype chain.
In the TurboFan code we also deoptimize whenever we see a funky object
(i.e. a proxy or an object that requires access checks) in the prototype
chain (similar to what Crankshaft already did).

Drive-by-fix: Also make Crankshaft respect the mode and therefore
address the deopt loop in Crankshaft around instanceof.

We might want to introduce an InstanceOfIC mechanism at some point and
track the map of the right-hand side.

BUG=v8:5267
R=mvst...@chromium.org

Review-Url: https://codereview.chromium.org/2370693002
Cr-Commit-Position: refs/heads/master@{#39718}

[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/ast/ast.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/code-stub-assembler.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/code-stub-assembler.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/code-stubs.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/code-stubs.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/js-operator.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/js-operator.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/opcodes.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/simplified-operator.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/simplified-operator.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/typer.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/compiler/verifier.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/crankshaft/hydrogen.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/full-codegen.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/interpreter/bytecodes.h
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/src/interpreter/interpreter.cc
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/test/cctest/interpreter/bytecode_expectations/IfConditions.golden
[add] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/test/mjsunit/compiler/deopt-instanceof-proxy.js
[modify] https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b/test/unittests/compiler/js-typed-lowering-unittest.cc

[bugdro… via monorail]

Comment #110 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c110

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b9cdb630dd86d5e4d6acafdb77e61684213c2a82

commit b9cdb630dd86d5e4d6acafdb77e61684213c2a82
Author: bmeurer
Date: Mon Sep 26 17:40:20 2016

Revert of [compiler] Properly guard the speculative optimizations for instanceof. (patchset #3 id:40001 of https://codereview.chromium.org/2370693002/ )

Reason for revert:
Tanks EarleyBoyer.

Original issue's description:

> [compiler] Properly guard the speculative optimizations for instanceof.
>
> Add a general feedback slot for instanceof similar to what we already have
> for for-in, which basically has a fast (indicated by the uninitialized
> sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
> we can only take the fast path when the feedback slot says it hasn't
> seen any funky inputs and nothing funky appeared in the prototype chain.
> In the TurboFan code we also deoptimize whenever we see a funky object
> (i.e. a proxy or an object that requires access checks) in the prototype
> chain (similar to what Crankshaft already did).
>
> Drive-by-fix: Also make Crankshaft respect the mode and therefore
> address the deopt loop in Crankshaft around instanceof.
>
> We might want to introduce an InstanceOfIC mechanism at some point and
> track the map of the right-hand side.
>
> BUG=v8:5267
> R=mvst...@chromium.org
>

> Committed: https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b
> Cr-Commit-Position: refs/heads/master@{#39718}

TBR=mvst...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2365223003
Cr-Commit-Position: refs/heads/master@{#39736}

[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/ast/ast.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/code-stub-assembler.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/code-stub-assembler.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/code-stubs.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/code-stubs.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/js-operator.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/js-operator.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/opcodes.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/simplified-operator.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/simplified-operator.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/typer.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/compiler/verifier.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/crankshaft/hydrogen.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/full-codegen.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/interpreter/bytecodes.h
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/src/interpreter/interpreter.cc
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/test/cctest/interpreter/bytecode_expectations/IfConditions.golden
[delete] https://crrev.com/b1b47aaea73e744f6f4a3709a90f08397399f71a/test/mjsunit/compiler/deopt-instanceof-proxy.js
[modify] https://crrev.com/b9cdb630dd86d5e4d6acafdb77e61684213c2a82/test/unittests/compiler/js-typed-lowering-unittest.cc

[bugdro… via monorail]

Comment #111 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c111

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd

commit ddf792beb3a72f6dba83e94fc8ada03ebf1630bd
Author: bmeurer
Date: Tue Sep 27 04:47:28 2016

[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

R=ja...@chromium.org
BUG=v8:5267

Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef
Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73

Review-Url: https://codereview.chromium.org/2367593003
Cr-Original-Commit-Position: refs/heads/master@{#39692}
Cr-Commit-Position: refs/heads/master@{#39748}

[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/compiler/representation-change.cc
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/compiler/simplified-operator.cc
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/compiler/simplified-operator.h
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/js/regexp.js
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/src/runtime/runtime-test.cc
[modify] https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #112 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c112

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/76b68915b3b87ac6da9408a4d5d756cfe0440d8b

commit 76b68915b3b87ac6da9408a4d5d756cfe0440d8b
Author: bmeurer
Date: Tue Sep 27 05:10:41 2016

Revert of [turbofan] ChangeFloat64ToTagged shouldn't canonicalize. (patchset #6 id:100001 of https://codereview.chromium.org/2367593003/ )

Reason for revert:
Still blows up on the main waterfall even after Jakob's fix:

https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11557/steps/Check/logs/typedarray-indexing
https://build.chromium.org/p/client.v8/builders/V8%20Mac64/builds/11557/steps/Check/logs/typedarray
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/12982/steps/Check/logs/typedarray

Original issue's description:

> [turbofan] ChangeFloat64ToTagged shouldn't canonicalize.
>
> This matches current Crankshaft/fullcodegen behavior more closely and
> thus reduces the chances that we run into unnecessary polymorphism due
> to the field representation tracking in our object model.
>
> R=ja...@chromium.org
> BUG=v8:5267
>
> Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef
> Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73

> Committed: https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd

> Cr-Original-Commit-Position: refs/heads/master@{#39692}
> Cr-Commit-Position: refs/heads/master@{#39748}

TBR=ja...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2365353006
Cr-Commit-Position: refs/heads/master@{#39749}

[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/compiler/representation-change.cc
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/compiler/simplified-operator.cc
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/compiler/simplified-operator.h
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/js/regexp.js
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/src/runtime/runtime-test.cc
[modify] https://crrev.com/76b68915b3b87ac6da9408a4d5d756cfe0440d8b/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #115 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c115

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/19b3943607521f63fe44774ef36becf747cb818e

commit 19b3943607521f63fe44774ef36becf747cb818e
Author: bmeurer
Date: Wed Sep 28 06:07:40 2016

[turbofan] ChangeFloat64ToTagged shouldn't canonicalize.

This matches current Crankshaft/fullcodegen behavior more closely and
thus reduces the chances that we run into unnecessary polymorphism due
to the field representation tracking in our object model.

Drive-by-fixes: Make sure the JSRegExp::lastIndex field stays Smi
if possible (otherwise we tank the regexp benchmark in Octane).

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_mac64_rel,v8_mac64_dbg

R=ja...@chromium.org
BUG=v8:5267

Committed: https://chromium.googlesource.com/v8/v8/+/6a939714e991ebf10d56ddbd2869325cca99c0ef
Committed: https://crrev.com/ee158e6c4cc896479a32245432a3c2fdd31bcb73
Committed: https://crrev.com/ddf792beb3a72f6dba83e94fc8ada03ebf1630bd

Review-Url: https://codereview.chromium.org/2367593003
Cr-Original-Original-Commit-Position: refs/heads/master@{#39692}
Cr-Original-Commit-Position: refs/heads/master@{#39748}
Cr-Commit-Position: refs/heads/master@{#39803}

[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/compiler/representation-change.cc
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/compiler/simplified-operator.cc
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/compiler/simplified-operator.h
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/js/regexp.js
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/src/runtime/runtime-test.cc
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/test/cctest/test-api.cc
[modify] https://crrev.com/19b3943607521f63fe44774ef36becf747cb818e/test/unittests/compiler/simplified-operator-reducer-unittest.cc

[bugdro… via monorail]

Comment #116 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c116

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/def77f4f420f7459d748ba487d739d74a78eb221

commit def77f4f420f7459d748ba487d739d74a78eb221
Author: bmeurer
Date: Thu Sep 29 06:56:32 2016

[turbofan] Properly optimize immutable property loads.

When lowering a JSLoadNamed with an immutable own property of a
known constant JSObject, we can just constant fold the load during
native context specialization, similar to what Crankshaft does in
HOptimizedGraphBuilder::BuildLoadNamedField. This way we can also
constant-fold stuff like Math.LN2 and friends.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2376033002
Cr-Commit-Position: refs/heads/master@{#39849}

[modify] https://crrev.com/def77f4f420f7459d748ba487d739d74a78eb221/src/compiler/js-native-context-specialization.cc

[bugdro… via monorail]

Comment #118 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c118

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/cb0de11d800ffb0aa6ca26b54e97fd0f8b93d558

commit cb0de11d800ffb0aa6ca26b54e97fd0f8b93d558
Author: bmeurer
Date: Thu Sep 29 12:51:48 2016

[turbofan] Eliminate unnecessary hole to undefined conversion.

Add simplified operator reduction rule that reduces

CheckedTaggedSignedToInt32(ConvertTaggedHoleToUndefined(x))

to

CheckedTaggedSignedToInt32(x)

which avoids the unnecessary hole to undefined conversion, as the check
operation will fail equally on either hole or undefined.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2384453002
Cr-Commit-Position: refs/heads/master@{#39863}

[modify] https://crrev.com/cb0de11d800ffb0aa6ca26b54e97fd0f8b93d558/src/compiler/simplified-operator-reducer.cc

[bugdro… via monorail]

Comment #122 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c122

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/78f16b39ca5462f5a58bd10d751508b3d22e8864

commit 78f16b39ca5462f5a58bd10d751508b3d22e8864
Author: bmeurer
Date: Fri Oct 07 09:10:22 2016

[turbofan] CheckedTaggedToInt32 doesn't distinguish undefined and hole.

R=mvst...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2397253002
Cr-Commit-Position: refs/heads/master@{#40073}

[modify] https://crrev.com/78f16b39ca5462f5a58bd10d751508b3d22e8864/src/compiler/simplified-operator-reducer.cc

[bugdro… via monorail]

Comment #127 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c127

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/308788b3069703117a9004e64c06c26137c84263

commit 308788b3069703117a9004e64c06c26137c84263
Author: bmeurer
Date: Tue Oct 18 12:01:05 2016

[ic] Unify CallIC feedback collection and handling.

Consistently collect CallIC feedback in fullcodegen and Ignition, even
for possibly direct eval calls, that were treated specially so far, for
no apparent reason. With the upcoming SharedFunctionInfo based CallIC
feedback, we might be able to even inline certain direct eval calls, if
they manage to hit the eval cache. More importantly, this patch
simplifies the collection and dealing with CallIC feedback (and as a
side effect fixes an inconsistency with feedback for super constructor
calls).

R=mvst...@chromium.org, myt...@chromium.org
BUG=v8:2206,v8:4280,v8:5267

Review-Url: https://codereview.chromium.org/2426693002
Cr-Commit-Position: refs/heads/master@{#40397}

[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/ast/ast.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/ast/ast.h
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/crankshaft/hydrogen.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/crankshaft/typing.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/src/interpreter/interpreter-assembler.cc
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/test/cctest/interpreter/bytecode_expectations/CallLookupSlot.golden
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/test/cctest/interpreter/bytecode_expectations/ClassAndSuperClass.golden
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/test/cctest/interpreter/bytecode_expectations/ContextVariables.golden
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/test/cctest/interpreter/bytecode_expectations/Eval.golden
[modify] https://crrev.com/308788b3069703117a9004e64c06c26137c84263/test/cctest/interpreter/bytecode_expectations/LookupSlot.golden

[bugdro… via monorail]

Comment #133 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c133

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/639abf4fd4d1c9113824975d679e4982081a1309

commit 639abf4fd4d1c9113824975d679e4982081a1309
Author: bmeurer
Date: Mon Oct 31 10:21:44 2016

[turbofan] Ship inlining into try blocks.

R=mstar...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2460333002
Cr-Commit-Position: refs/heads/master@{#40665}

[modify] https://crrev.com/639abf4fd4d1c9113824975d679e4982081a1309/src/flag-definitions.h

[bugdro… via monorail]

Comment #136 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c136

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/6322bf41613fd0df785ae4341e674fa9ee09c9d4

commit 6322bf41613fd0df785ae4341e674fa9ee09c9d4
Author: bmeurer
Date: Thu Nov 03 12:52:11 2016

[turbofan] Improve representation selection for HeapObject checking.

For lowering CheckHeapObject, always report TaggedPointer representation

and let the RepresentationChanger come up with a reasonable conversion from

whatever input representation to TaggedPointer. This way we no longer insert
the useless ChangeSomethingToTagged and then check the result for HeapObject,

i.e. mostly reduces the amount of useless code being generated.

Note there are now two operators ChangeFloat64ToTaggedPointer and the old
ChangeFloat64ToTagged, because their semantics different wrt. the strength
reduction in the SimplifiedOperatorReducer.

Also set the output MachineRepresentation::kTaggedPointer properly in
SimplifiedLowering whenever we know that we produce a HeapObject.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2476593002
Cr-Commit-Position: refs/heads/master@{#40725}

[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/opcodes.h
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/representation-change.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/representation-change.h
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/simplified-operator-reducer.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/simplified-operator.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/simplified-operator.h
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/compiler/verifier.cc
[modify] https://crrev.com/6322bf41613fd0df785ae4341e674fa9ee09c9d4/src/machine-type.h

[bugdro… via monorail]

Comment #137 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c137

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/cdf9a4062ec6aa8f7c180e3f3e9f5c7130eb199a

commit cdf9a4062ec6aa8f7c180e3f3e9f5c7130eb199a
Author: bmeurer
Date: Thu Nov 03 18:47:20 2016

[turbofan][x64] Improve code generation for Float64LessThan with Float64Abs.

During instruction selection, match the pattern

Float64LessThan(#0.0, Float64Abs(x))

which TurboFan generates for NumberToBoolean in the general case,
and which evaluates to false if x is 0, -0 or NaN, and compile this
to a simple (v)ucomisd using not_equal flags condition, which avoids
the costly Float64Abs.

Also consistently generate this pattern in TurboFan and the code
stubs/interpreter for ToBoolean.

R=mstar...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2473923003
Cr-Commit-Position: refs/heads/master@{#40740}

[modify] https://crrev.com/cdf9a4062ec6aa8f7c180e3f3e9f5c7130eb199a/src/code-stub-assembler.cc
[modify] https://crrev.com/cdf9a4062ec6aa8f7c180e3f3e9f5c7130eb199a/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/cdf9a4062ec6aa8f7c180e3f3e9f5c7130eb199a/src/compiler/x64/instruction-selector-x64.cc

[bugdro… via monorail]

Comment #138 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c138

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7

commit 0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7
Author: franzih
Date: Thu Nov 03 21:24:18 2016

[compiler] Delete extra map check.

Use HeapConstant for string_iterator_map rather than loading it
manually. This avoids unnecessary map checks.

BUG= v8:3822,v8:5267

Review-Url: https://codereview.chromium.org/2479563003
Cr-Commit-Position: refs/heads/master@{#40741}

[modify] https://crrev.com/0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7/src/compiler/js-builtin-reducer.h
[modify] https://crrev.com/0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7/src/compiler/pipeline.cc
[modify] https://crrev.com/0f7ea219f0e3927fa1d00a8ffdc38dbd74d7dbd7/test/unittests/compiler/js-builtin-reducer-unittest.cc

[bugdro… via monorail]

Comment #210 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c210

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/fc3312255f44eefac0677a9c0267095858c7c799

commit fc3312255f44eefac0677a9c0267095858c7c799
Author: bmeurer <bme...@chromium.org>
Date: Mon Feb 20 12:54:03 2017

[turbofan] Unify NodeProperties::InferReceiverMaps.

Unify the three different implementations of InferReceiverMaps, which
were basically copy&paste with slightly different optimizations applied
later into a single NodeProperties::InferReceiverMaps helper, which also
returns a ZoneHandleSet of maps, rather than only a single map.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2703133003
Cr-Commit-Position: refs/heads/master@{#43318}

[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/js-inlining.cc
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/js-native-context-specialization.h
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/node-properties.cc
[modify] https://crrev.com/fc3312255f44eefac0677a9c0267095858c7c799/src/compiler/node-properties.h

[bugdro… via monorail]

Comment #211 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c211

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/eb5f06dec8802b1376e7f86c1d56a825db0e9435

commit eb5f06dec8802b1376e7f86c1d56a825db0e9435
Author: bmeurer <bme...@chromium.org>
Date: Mon Feb 27 10:27:51 2017

[turbofan] Make sure that CallIC feedback actually helps.

Don't just blindly bake in CallIC feedback in the JSCallReducer,
but instead try to estimate first whether it makes sense to bake
it in (and risk potential eager deoptimization exits). We already
didn't use the CallIC feedback when the call target is a known
constant, but we should also not use it if the target is a
JSCreateClosure node or a Phi of known constants / JSCreateClosure
nodes.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2721483003
Cr-Commit-Position: refs/heads/master@{#43443}

[modify] https://crrev.com/eb5f06dec8802b1376e7f86c1d56a825db0e9435/src/compiler/js-call-reducer.cc

[bugdro… via monorail]

Comment #212 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c212

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/c45da1b47b39a93f12258b2ac427ff83de4f942f

commit c45da1b47b39a93f12258b2ac427ff83de4f942f
Author: bmeurer <bme...@chromium.org>
Date: Mon Feb 27 14:11:11 2017

[turbofan] Inline Array.isArray in JSBuiltinReducer.

Inline the Array.isArray builtin during typed lowering, which generates
ideal code for the common case (non-JSProxy arg), and use the existing
%ArrayIsArray runtime function for the JSProxy case just like in baseline.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2719023002
Cr-Commit-Position: refs/heads/master@{#43453}

[modify] https://crrev.com/c45da1b47b39a93f12258b2ac427ff83de4f942f/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/c45da1b47b39a93f12258b2ac427ff83de4f942f/src/compiler/js-builtin-reducer.h

[bugdro… via monorail]

Comment #213 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c213

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/de52562d8e6fec7949cafd39bb7aa58d3269ac8e

commit de52562d8e6fec7949cafd39bb7aa58d3269ac8e
Author: bmeurer <bme...@chromium.org>
Date: Fri Mar 03 09:08:14 2017

[turbofan] Introduce dedicated ObjectIsNaN operator.

We can compile a !== a and Number.isNaN(a) to ObjectIsNaN. The former is
commonly used to check for NaN, i.e. in case of equals in AngularJS.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2722483003
Cr-Commit-Position: refs/heads/master@{#43572}

[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/opcodes.h
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/simplified-operator.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/simplified-operator.h
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/typer.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/src/compiler/verifier.cc
[add] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/test/mjsunit/number-isnan-opt.js
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/test/unittests/compiler/js-builtin-reducer-unittest.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/test/unittests/compiler/node-test-utils.cc
[modify] https://crrev.com/de52562d8e6fec7949cafd39bb7aa58d3269ac8e/test/unittests/compiler/node-test-utils.h

[bugdro… via monorail]

Comment #214 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c214

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3

commit 9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3
Author: bmeurer <bme...@chromium.org>
Date: Fri Mar 03 17:59:21 2017

[turbofan] Drop obsolete unused JSStrictNotEqual operator.

We don't need the JSStrictNotEqual operator in the compiler, because
this is never generated by the BytecodeGraphBuilder, and the code in
the AstGraphBuilder was dead code. Also remove the backing builtin
StrictNotEqual.

R=mstar...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2727003006
Cr-Commit-Position: refs/heads/master@{#43594}

[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/builtins/builtins-number.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/builtins/builtins.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/code-factory.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/code-factory.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/code-stub-assembler.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/code-stub-assembler.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-operator.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-operator.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-type-hint-lowering.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/opcodes.h
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/operator-properties.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/typer.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/compiler/verifier.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/src/interpreter/interpreter.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/test/cctest/compiler/test-js-typed-lowering.cc
[modify] https://crrev.com/9ef1e35bc6c6ef2ddb55211563f169bbc3eaecb3/test/unittests/compiler/typer-unittest.cc

[bugdro… via monorail]

Comment #215 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c215

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/95d808670e37d660f9eb8d76546587c8fe52167d

commit 95d808670e37d660f9eb8d76546587c8fe52167d
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 07 10:11:16 2017

[turbofan] Introduce TruncateTaggedPointerToBit operator.

Oftentimes we can avoid the Smi check for ToBoolean truncations, since
we already know that the input is always going to be a HeapObject. So
introduce a dedicated TruncateTaggedPointerToBit operator, which uses
the fact that the input is known to be a HeapObject.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2738483002
Cr-Commit-Position: refs/heads/master@{#43629}

[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/opcodes.h
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/representation-change.cc
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/simplified-operator.cc
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/simplified-operator.h
[modify] https://crrev.com/95d808670e37d660f9eb8d76546587c8fe52167d/src/compiler/verifier.cc

[bugdro… via monorail]

Comment #217 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c217

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/8150cb2c3ca3cf968d2b12b6625bc73733bd40cf

commit 8150cb2c3ca3cf968d2b12b6625bc73733bd40cf
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 07 10:39:00 2017

[macros] Implement NUMBER_IS_NAN in terms of strict equality.

This slighty improves the Map/Set implementations in the new pipeline,
which makes heavy use of NUMBER_IS_NAN.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2740433003
Cr-Commit-Position: refs/heads/master@{#43632}

[modify] https://crrev.com/8150cb2c3ca3cf968d2b12b6625bc73733bd40cf/src/js/macros.py

[bugdro… via monorail]

Comment #218 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c218

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/15bed19495e240db5f72a6ec6845ad5692950e80

commit 15bed19495e240db5f72a6ec6845ad5692950e80
Author: mvstanton <mvst...@chromium.org>
Date: Tue Mar 07 13:27:55 2017

Adjust some tests to prepare enabling Ignition+TurboFan

BUG=v8:5267, chromium:692409

Review-Url: https://codereview.chromium.org/2720713003
Cr-Commit-Position: refs/heads/master@{#43638}

[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/cctest/cctest.status
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/inspector/debugger/get-possible-breakpoints-master-expected.txt
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/inspector/debugger/get-possible-breakpoints-master.js
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/inspector/debugger/step-into-expected.txt
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/inspector/debugger/step-into.js
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/mjsunit/mjsunit.status
[modify] https://crrev.com/15bed19495e240db5f72a6ec6845ad5692950e80/test/mjsunit/string-externalize.js

[bugdro… via monorail]

Comment #219 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c219

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f0e7a3174e4470d04c923db577c6b238b2d20f09

commit f0e7a3174e4470d04c923db577c6b238b2d20f09
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 07 14:46:10 2017

[turbofan] Extend optimization of flooring integer division.

So far we only recognize the special

NumberFloor(NumberDivide(lhs, rhs))

subgraph when both lhs and rhs are in the Unsigned32 range, and the
result is a PlainNumber. Extend this pattern matching to also cover

NumberFloor(SpeculativeNumberDivide(lhs, rhs))

and to replace the NumberFloor with NumberToInt32 truncation if the
lhs value is in Signed32 range and the rhs is in Unsigned32 range.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2739573004
Cr-Commit-Position: refs/heads/master@{#43642}

[modify] https://crrev.com/f0e7a3174e4470d04c923db577c6b238b2d20f09/src/compiler/operation-typer.cc
[modify] https://crrev.com/f0e7a3174e4470d04c923db577c6b238b2d20f09/src/compiler/typed-optimization.cc
[modify] https://crrev.com/f0e7a3174e4470d04c923db577c6b238b2d20f09/test/unittests/compiler/typer-unittest.cc

[bugdro… via monorail]

Comment #220 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c220

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/99aaa69b29c64bb05b6cf318b01bfac6214de340

commit 99aaa69b29c64bb05b6cf318b01bfac6214de340
Author: bmeurer <bme...@chromium.org>
Date: Wed Mar 08 06:05:41 2017

[turbofan] Consume feedback types for NumberMax and NumberMin.

For nodes

NumberMin(lhs, rhs)
NumberMax(lhs, rhs)

we might have feedback types for lhs and rhs that would allow us to
generate unsigned32 or signed32 versions of this operator, which is way
more efficient that going to the full Float64Min/Float64Max operator.
However we cannot promise word32 truncations in this case, since we
based this decision on the feedback types.

This allows us to generate better code for Math.min and Math.max when
one of the inputs is a speculative number operator that provides better
typing during representation selection. We've seen such code in the
hottest function on Google Maps for example.

BUG=v8:5267
R=ja...@chromium.org,mvst...@chromium.org

Review-Url: https://codereview.chromium.org/2734193003
Cr-Commit-Position: refs/heads/master@{#43660}

[modify] https://crrev.com/99aaa69b29c64bb05b6cf318b01bfac6214de340/src/compiler/simplified-lowering.cc

[bugdro… via monorail]

Comment #221 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c221

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/e7f8575851a0a56ffe6772d98fd8d90602e6876b

commit e7f8575851a0a56ffe6772d98fd8d90602e6876b
Author: mvstanton <mvst...@chromium.org>
Date: Wed Mar 08 08:10:59 2017

Turn on Ignition + TurboFan.

_____ _ _ _
|_ _| (_) | (_)
| | __ _ _ __ _| |_ _ ___ _ __
| | / _` | '_ \| | __| |/ _ \| '_ \
_| || (_| | | | | | |_| | (_) | | | |
\___/\__, |_| |_|_|\__|_|\___/|_| |_|
__/ |
|___/

_
_| |_
|_ _|
|_|

_____ _ ______
|_ _| | | | ___|
| |_ _ _ __| |__ ___ | |_ __ _ _ __
| | | | | '__| '_ \ / _ \| _/ _` | '_ \
| | |_| | | | |_) | (_) | || (_| | | | |
\_/\__,_|_| |_.__/ \___/\_| \__,_|_| |_|

BUG=v8:5267, v8:4280, chromium:692409
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2736723006
Cr-Commit-Position: refs/heads/master@{#43663}

[modify] https://crrev.com/e7f8575851a0a56ffe6772d98fd8d90602e6876b/src/flag-definitions.h

[bugdro… via monorail]

Comment #222 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c222

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/938e06f68fe9d055ee5af36e0c722856b2b60b36

commit 938e06f68fe9d055ee5af36e0c722856b2b60b36
Author: machenbach <mache...@chromium.org>
Date: Wed Mar 08 11:47:14 2017

Revert of Turn on Ignition + TurboFan. (patchset #2 id:20001 of https://codereview.chromium.org/2736723006/ )

Reason for revert:
Collected enough test failures: http://crbug.com/698746

Original issue's description:

> Turn on Ignition + TurboFan.
>
> _____ _ _ _
> |_ _| (_) | (_)
> | | __ _ _ __ _| |_ _ ___ _ __
> | | / _` | '_ \| | __| |/ _ \| '_ \
> _| || (_| | | | | | |_| | (_) | | | |
> \___/\__, |_| |_|_|\__|_|\___/|_| |_|
> __/ |
> |___/
>
> _
> _| |_
> |_ _|
> |_|
>
>
>
> _____ _ ______
> |_ _| | | | ___|
> | |_ _ _ __| |__ ___ | |_ __ _ _ __
> | | | | | '__| '_ \ / _ \| _/ _` | '_ \
> | | |_| | | | |_) | (_) | || (_| | | | |
> \_/\__,_|_| |_.__/ \___/\_| \__,_|_| |_|
>
>
> BUG=v8:5267, v8:4280, chromium:692409
> NOTREECHECKS=true
>
> Review-Url: https://codereview.chromium.org/2736723006
> Cr-Commit-Position: refs/heads/master@{#43663}

> Committed: https://chromium.googlesource.com/v8/v8/+/e7f8575851a0a56ffe6772d98fd8d90602e6876b

TBR=mstar...@chromium.org,da...@chromium.org,bme...@chromium.org,rmci...@chromium.org,mvst...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

BUG=v8:5267, v8:4280, chromium:692409

Review-Url: https://codereview.chromium.org/2732113005
Cr-Commit-Position: refs/heads/master@{#43664}

[modify] https://crrev.com/938e06f68fe9d055ee5af36e0c722856b2b60b36/src/flag-definitions.h

[bugdro… via monorail]

Comment #223 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c223

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0f716acadaed1d9e194593543dbe1340d600d6fc

commit 0f716acadaed1d9e194593543dbe1340d600d6fc
Author: mvstanton <mvst...@chromium.org>
Date: Thu Mar 09 07:47:19 2017

Turn on Ignition + TurboFan.

_____ _ _ _
|_ _| (_) | (_)
| | __ _ _ __ _| |_ _ ___ _ __
| | / _` | '_ \| | __| |/ _ \| '_ \
_| || (_| | | | | | |_| | (_) | | | |
\___/\__, |_| |_|_|\__|_|\___/|_| |_|
__/ |
|___/

_
_| |_
|_ _|
|_|

_____ _ ______
|_ _| | | | ___|
| |_ _ _ __| |__ ___ | |_ __ _ _ __
| | | | | '__| '_ \ / _ \| _/ _` | '_ \
| | |_| | | | |_) | (_) | || (_| | | | |
\_/\__,_|_| |_.__/ \___/\_| \__,_|_| |_|

BUG=v8:5267, v8:4280, chromium:692409
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2736723006

Cr-Original-Commit-Position: refs/heads/master@{#43663}

Committed: https://chromium.googlesource.com/v8/v8/+/e7f8575851a0a56ffe6772d98fd8d90602e6876b
Review-Url: https://codereview.chromium.org/2736723006

Cr-Commit-Position: refs/heads/master@{#43684}

[modify] https://crrev.com/0f716acadaed1d9e194593543dbe1340d600d6fc/src/flag-definitions.h

[bugdro… via monorail]

Comment #225 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c225

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/b8453628c94ddf71e05d70471355c7c924bbcf31

commit b8453628c94ddf71e05d70471355c7c924bbcf31
Author: bmeurer <bme...@chromium.org>
Date: Mon Mar 13 07:23:44 2017

[turbofan] Less aggressively insert SOFT deopts for property access.

Sometimes TurboFan is able to extract receiver maps from the surrounding
graph and thus is able to generate reasonable code for property accesses,
even if those haven't been executed in the baseline tier yet. So, only
stick in an SOFT deoptimization exit, if ExtractReceiverMaps failed to
infer proper receiver maps.

R=yan...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2746013002
Cr-Commit-Position: refs/heads/master@{#43736}

[modify] https://crrev.com/b8453628c94ddf71e05d70471355c7c924bbcf31/src/compiler/js-native-context-specialization.cc

[bugdro… via monorail]

Comment #226 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c226

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/098f939d1448e92b715fed45870a16923dfcfef7

commit 098f939d1448e92b715fed45870a16923dfcfef7
Author: bmeurer <bme...@chromium.org>
Date: Mon Mar 13 11:46:57 2017

Revert of [turbofan] Less aggressively insert SOFT deopts for property access. (patchset #2 id:20001 of https://codereview.chromium.org/2746013002/ )

Reason for revert:
Tanks Octane/Mandreel and Octane/MandreelLatency.

Original issue's description:

> [turbofan] Less aggressively insert SOFT deopts for property access.
>
> Sometimes TurboFan is able to extract receiver maps from the surrounding
> graph and thus is able to generate reasonable code for property accesses,
> even if those haven't been executed in the baseline tier yet. So, only
> stick in an SOFT deoptimization exit, if ExtractReceiverMaps failed to
> infer proper receiver maps.
>
> R=yan...@chromium.org
> BUG=v8:5267
>
> Review-Url: https://codereview.chromium.org/2746013002
> Cr-Commit-Position: refs/heads/master@{#43736}

> Committed: https://chromium.googlesource.com/v8/v8/+/b8453628c94ddf71e05d70471355c7c924bbcf31

TBR=yan...@chromium.org

# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2748663002
Cr-Commit-Position: refs/heads/master@{#43743}

[modify] https://crrev.com/098f939d1448e92b715fed45870a16923dfcfef7/src/compiler/js-native-context-specialization.cc

[bugdro… via monorail]

Comment #227 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c227

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/39db77c6ec87dfd69c39488537dd2b2f743f8b17

commit 39db77c6ec87dfd69c39488537dd2b2f743f8b17
Author: Ross McIlroy <rmci...@chromium.org>
Date: Tue Mar 14 18:04:52 2017

[TurboFan] Add ObjectIsSymbol simplified operator.

Used by ReduceJSEqualTypeOf, and will also be used to lower a new
TestTypeof bytecode in a followup CL.

BUG=v8:5267

Change-Id: I990aa6ac8ac0b9bd01080dda1764c5bfe3a4d7cf
Reviewed-on: https://chromium-review.googlesource.com/454797
Reviewed-by: Benedikt Meurer <bme...@chromium.org>
Commit-Queue: Ross McIlroy <rmci...@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43802}
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/effect-control-linearizer.h
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/escape-analysis.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/opcodes.h
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/simplified-operator.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/simplified-operator.h
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/typer.cc
[modify] https://crrev.com/39db77c6ec87dfd69c39488537dd2b2f743f8b17/src/compiler/verifier.cc

[bugdro… via monorail]

Comment #228 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c228

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/94b33165ce662a7596b3f599a62091a554faa83c

commit 94b33165ce662a7596b3f599a62091a554faa83c
Author: bmeurer <bme...@chromium.org>
Date: Wed Mar 15 09:06:52 2017

[turbofan] Skip JSCallReducer and JSNativeContextSpecialization on asm.js.

For the old asm.js pipeline, there's no point in running either the
JSCallReducer or the JSNativeContextSpecialization, as both will not
kick in for any asm.js relevant code.

So remove the kDeoptimizationEnabled flag from both of them and just
run them on regular JavaScript only.

Drive-by-fix: Slightly rearrange keyed access to String receivers in the
JSNativeContextSpecialization::ReduceKeyedAccess method to access constant
characters independent of the IC mode (as long as the constant index is
within the range of the receiver).

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2743253002
Cr-Commit-Position: refs/heads/master@{#43813}

[modify] https://crrev.com/94b33165ce662a7596b3f599a62091a554faa83c/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/94b33165ce662a7596b3f599a62091a554faa83c/src/compiler/js-call-reducer.h
[modify] https://crrev.com/94b33165ce662a7596b3f599a62091a554faa83c/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/94b33165ce662a7596b3f599a62091a554faa83c/src/compiler/js-native-context-specialization.h
[modify] https://crrev.com/94b33165ce662a7596b3f599a62091a554faa83c/src/compiler/pipeline.cc

[bugdro… via monorail]

Comment #229 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c229

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/3db32e064f229c516538064e4aef650386549be7

commit 3db32e064f229c516538064e4aef650386549be7
Author: Ross McIlroy <rmci...@chromium.org>
Date: Wed Mar 15 14:05:51 2017

[Interpreter / TurboFan] Add TestTypeof bytecode.

Adds a TestTypeof bytecode to deal with comparisons of the form:
typeof(object) === 'string';

Also adds support to Turbofan to perform these comparisons without
inserting checkpoints.

BUG=v8:4280,v8:5267

Change-Id: Ib5cc1c6816dfe70a4120838d8eada2fc0267750f
Reviewed-on: https://chromium-review.googlesource.com/454837
Reviewed-by: Mythri Alle <myt...@chromium.org>

Reviewed-by: Benedikt Meurer <bme...@chromium.org>
Commit-Queue: Ross McIlroy <rmci...@chromium.org>

Cr-Commit-Position: refs/heads/master@{#43832}
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/ast/ast-value-factory.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/ast/ast.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/ast/ast.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/bailout-reason.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/crankshaft/hydrogen.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/full-codegen/full-codegen.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-array-builder.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-flags.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-flags.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecode-generator.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/bytecodes.h
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/src/interpreter/interpreter.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/compiler/test-run-bytecode-graph-builder.cc
[add] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/bytecode_expectations/CompareTypeOf.golden
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/bytecode_expectations/ForAwaitOf.golden
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/bytecode_expectations/ForOf.golden
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/bytecode_expectations/Generators.golden
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/test-bytecode-generator.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/cctest/interpreter/test-interpreter.cc
[modify] https://crrev.com/3db32e064f229c516538064e4aef650386549be7/test/unittests/interpreter/bytecode-array-builder-unittest.cc

[bugdro… via monorail]

Comment #231 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c231

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/f08c3fd324c8cd5d1305a5a3de3b2ce0e242ff67

commit f08c3fd324c8cd5d1305a5a3de3b2ce0e242ff67
Author: bmeurer <bme...@chromium.org>
Date: Mon Mar 20 20:37:08 2017

[turbofan] Inline String.prototype.concat with PlainPrimitive parameter.

When we hit a call to String.prototype.concat builtin, where we can
infer that the receiver is a String and there's exactly one parameter,
which is of type PlainPrimitive, then we can reduce that to a call to
the StringAddStub instead, optionally converting the non-String - but
PlainPrimitive - parameter to a String.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2758383002
Cr-Commit-Position: refs/heads/master@{#43957}

[modify] https://crrev.com/f08c3fd324c8cd5d1305a5a3de3b2ce0e242ff67/src/compiler/js-builtin-reducer.cc
[modify] https://crrev.com/f08c3fd324c8cd5d1305a5a3de3b2ce0e242ff67/src/compiler/js-builtin-reducer.h

[bugdro… via monorail]

Comment #232 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c232

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/17d932c06b40d1e6617ebbd6cc8d1e8f411f9750

commit 17d932c06b40d1e6617ebbd6cc8d1e8f411f9750
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 21 10:11:51 2017

[turbofan] Slightly improve truncations for CheckBounds.

For CheckBounds(index,length) we know that the length must be in
Unsigned31 range. Thus there's no observable difference for index
values in the range [-2^31,-1] and the range [2^31,2^32-1], both
are considered out-of-bounds; also it's safe to truncate -0 to 0
wrt. CheckBounds. Thus we can safely pass Word32 truncation if the
index is in Integral32 \/ MinusZero. Usually this generates the same
code, but some index computations can benefit from the Word32 truncation
and avoid going to double because the result would be outside the valid
Signed32 or Unsigned32 ranges.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2760213003
Cr-Commit-Position: refs/heads/master@{#43969}

[modify] https://crrev.com/17d932c06b40d1e6617ebbd6cc8d1e8f411f9750/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/17d932c06b40d1e6617ebbd6cc8d1e8f411f9750/src/compiler/types.h

[bugdro… via monorail]

Comment #233 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c233

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/64ffea8509ebf3e3a004a25ab3fbfbb8c106700b

commit 64ffea8509ebf3e3a004a25ab3fbfbb8c106700b
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 21 15:56:11 2017

[turbofan] Remove leftover Type artifacts from OSR.

BUG=v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2762143002
Cr-Commit-Position: refs/heads/master@{#43986}

[modify] https://crrev.com/64ffea8509ebf3e3a004a25ab3fbfbb8c106700b/src/compiler/osr.cc
[modify] https://crrev.com/64ffea8509ebf3e3a004a25ab3fbfbb8c106700b/src/compiler/pipeline.cc

[bugdro… via monorail]

Comment #235 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c235

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/88a7061a53ad200121f7ee2b2bdcc05d793de806

commit 88a7061a53ad200121f7ee2b2bdcc05d793de806
Author: bmeurer <bme...@chromium.org>
Date: Tue Mar 28 09:24:33 2017

[turbofan] Add support for extending properties backing store.

TurboFan didn't support transitioning stores that also need to grow the
properties backing store so far. This CL adds support for re-allocating
the properties backing store in-place, so these stores can participate
properly in various optimizations like escape analysis and allocation
folding.

R=ish...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2778133003
Cr-Commit-Position: refs/heads/master@{#44183}

[modify] https://crrev.com/88a7061a53ad200121f7ee2b2bdcc05d793de806/src/compiler/access-info.cc
[modify] https://crrev.com/88a7061a53ad200121f7ee2b2bdcc05d793de806/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/88a7061a53ad200121f7ee2b2bdcc05d793de806/src/compiler/js-native-context-specialization.h

[bugdro… via monorail]

Comment #236 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c236

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/9df5674bd53b4a262e72f45263df9e886842c269

commit 9df5674bd53b4a262e72f45263df9e886842c269
Author: bmeurer <bme...@chromium.org>
Date: Wed Mar 29 07:41:17 2017

[turbofan] Avoid going through ArgumentsAdaptorTrampoline for CSA/C++ builtins.

When we call from TurboFan to a CSA or C++ builtin, we can avoid the
ArgumentsAdaptorFrame in case of a parameter arity mismatch by just
filling up missing arguments with undefined or removing additional
arguments on the call site already. This is safe for CSA/C++ builtins,
since those that care about variable arguments are marked with the
kDontAdaptArgumentsSentinel.

R=da...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2684963002
Cr-Commit-Position: refs/heads/master@{#44218}

[modify] https://crrev.com/9df5674bd53b4a262e72f45263df9e886842c269/src/compiler/js-call-reducer.cc

[bugdro… via monorail]

Comment #237 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c237

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/0554e36be0a5406627370606b9791f1f9ec7abd3

commit 0554e36be0a5406627370606b9791f1f9ec7abd3
Author: bmeurer <bme...@chromium.org>
Date: Wed Mar 29 09:07:29 2017

[turbofan] Remove typeof optimization from typed lowering.

Now that Ignition has the dedicated TestTypeOf operator, there's not
really a point in doing the typeof with abstract/strict equal combining
in TurboFan anymore. In fact it's counter-productive to do so, as it
might try to cover typeof comparisons in cases where it's better to just
compute the typeof once, i.e.:

let x = typeof a, y = typeof b;
if (x === y) {
if (x === 'string') {
...
}
}

Here we would combine the second comparison into an ObjectIsString, and
still compute the typeof a.

R=ja...@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2780953003
Cr-Commit-Position: refs/heads/master@{#44220}

[modify] https://crrev.com/0554e36be0a5406627370606b9791f1f9ec7abd3/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/0554e36be0a5406627370606b9791f1f9ec7abd3/src/compiler/js-typed-lowering.h

[bugdro… via monorail]

Comment #238 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c238

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/98c0f6b1c6825c507fb4a51ff2a8011a9bf78957

commit 98c0f6b1c6825c507fb4a51ff2a8011a9bf78957
Author: bmeurer <bme...@chromium.org>
Date: Wed Mar 29 13:03:01 2017

[turbofan] Use the property access IC trampolines when possible.

Even in optimized code we can utilize the various load and store IC
trampolines to save code space when it's an IC in the outermost
function, as in that case the trampoline can just take the vector
from the parent's frame.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2776073005
Cr-Commit-Position: refs/heads/master@{#44226}

[modify] https://crrev.com/98c0f6b1c6825c507fb4a51ff2a8011a9bf78957/src/compiler/js-generic-lowering.cc

[bugdro… via monorail]

Comment #239 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c239

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/36d4ba623346b370c5470da74d4d0db49f4635c0

commit 36d4ba623346b370c5470da74d4d0db49f4635c0
Author: bmeurer <bme...@chromium.org>
Date: Thu Mar 30 03:59:18 2017

[turbofan] Inline calls to the Boolean constructor.

Recognize the Boolean constructor calls in JSCallReducer and replace
them with simple JSToBoolean nodes.

R=yan...@chromium.org
BUG=v8:5267,v8:6169

Review-Url: https://codereview.chromium.org/2782143003
Cr-Commit-Position: refs/heads/master@{#44259}

[modify] https://crrev.com/36d4ba623346b370c5470da74d4d0db49f4635c0/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/36d4ba623346b370c5470da74d4d0db49f4635c0/src/compiler/js-call-reducer.h

[bugdro… via monorail]

Comment #240 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c240

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/04f48a76c87c464a88f049fe64fb2251c6108fb6

commit 04f48a76c87c464a88f049fe64fb2251c6108fb6
Author: bmeurer <bme...@chromium.org>
Date: Fri Mar 31 11:22:20 2017

[turbofan] Specialize to closure with function context specialization.

R=ja...@chromium.org
BUG=v8:5267,v8:6181

Review-Url: https://codereview.chromium.org/2792553002
Cr-Commit-Position: refs/heads/master@{#44305}

[modify] https://crrev.com/04f48a76c87c464a88f049fe64fb2251c6108fb6/src/compiler/js-context-specialization.cc
[modify] https://crrev.com/04f48a76c87c464a88f049fe64fb2251c6108fb6/src/compiler/js-context-specialization.h
[modify] https://crrev.com/04f48a76c87c464a88f049fe64fb2251c6108fb6/src/compiler/pipeline.cc
[modify] https://crrev.com/04f48a76c87c464a88f049fe64fb2251c6108fb6/test/cctest/compiler/test-js-context-specialization.cc

[bugdro… via monorail]

Comment #243 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c243

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/e8c109e2788b59e2b96243131fc17554ca53de32

commit e8c109e2788b59e2b96243131fc17554ca53de32
Author: bmeurer <bme...@chromium.org>
Date: Tue Apr 04 08:04:37 2017

[turbofan] Relax constraints on apply with arguments optimization.

For sloppy arguments in functions with declared formal parameters, the
apply with arguments optimization in TurboFan wouldn't kick in
currently, because so far there was no guard to see if using the
arguments from the stack or the frame state is safe. One easy to check
guard here is to just check that there's no observable side-effect
between the actual arguments creation and the call to apply.

BUG=v8:5267,v8:6200
R=da...@chromium.org

Review-Url: https://codereview.chromium.org/2789113004
Cr-Commit-Position: refs/heads/master@{#44363}

[modify] https://crrev.com/e8c109e2788b59e2b96243131fc17554ca53de32/src/compiler/js-call-reducer.cc

[bugdro… via monorail]

Comment #244 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c244

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/dd7ce93ce0262fff292edeb6fb58d9aed2c29554

commit dd7ce93ce0262fff292edeb6fb58d9aed2c29554
Author: bmeurer <bme...@chromium.org>
Date: Thu Apr 06 11:54:44 2017

[turbofan] Collect and use type feedback on ToNumber.

Make Ignition collect BinaryOperationFeedback on ToNumber, using the
shared type feedback slot with the following Inc/Dec bytecode, and use
this feedback in TurboFan to turn the ToNumber(x) operation into a
SpeculativeNumberMultiply(x,1) with the feedback hint.

R=ja...@chromium.org, mstar...@chromium.org, rmci...@chromium.org
BUG=v8:6214,v8:5267

Review-Url: https://codereview.chromium.org/2804813003
Cr-Commit-Position: refs/heads/master@{#44440}

[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/interpreter/bytecode-array-builder.h
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/interpreter/bytecodes.h
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/src/interpreter/interpreter-generator.cc
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/test/cctest/interpreter/bytecode_expectations/AssignmentsInBinaryExpression.golden
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/test/cctest/interpreter/bytecode_expectations/CountOperators.golden
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/test/cctest/interpreter/bytecode_expectations/GlobalCountOperators.golden
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/test/cctest/interpreter/bytecode_expectations/Modules.golden
[modify] https://crrev.com/dd7ce93ce0262fff292edeb6fb58d9aed2c29554/test/unittests/interpreter/bytecode-array-builder-unittest.cc

[bugdro… via monorail]

Comment #245 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c245

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/e6ca01463de333bd4069d23c616c26647897e749

commit e6ca01463de333bd4069d23c616c26647897e749
Author: bmeurer <bme...@chromium.org>
Date: Fri Apr 07 12:12:23 2017

[turbofan] Introduce a SpeculativeToNumber operator.

Add a dedicated operator for ToNumber(x) with feedback instead of
translating to SpeculativeNumberMultiply(x,1), which allows us to
treat the case where x is already a Number specially, ignoring the
feedback on the operator. This recovers most of the regression in
the crypto benchmark.

BUG=chromium:709398,v8:6214,v8:5267
R=ja...@chromium.org

Review-Url: https://codereview.chromium.org/2802113003
Cr-Commit-Position: refs/heads/master@{#44484}

[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/bytecode-graph-builder.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/js-type-hint-lowering.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/js-type-hint-lowering.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/js-typed-lowering.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/loop-variable-optimizer.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/opcodes.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/operation-typer.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/operation-typer.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/simplified-operator.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/simplified-operator.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/typed-optimization.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/typed-optimization.h
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/typer.cc
[modify] https://crrev.com/e6ca01463de333bd4069d23c616c26647897e749/src/compiler/verifier.cc

[bugdro… via monorail]

Comment #246 on issue 5267 by bugd...@chromium.org: TurboFan compiler tracking bug
https://bugs.chromium.org/p/v8/issues/detail?id=5267#c246

The following revision refers to this bug:

https://chromium.googlesource.com/v8/v8.git/+/c8ae359750a9e9fabbfa25a5e6b10091e401eaad

commit c8ae359750a9e9fabbfa25a5e6b10091e401eaad
Author: Adam Klein <ad...@chromium.org>
Date: Fri Apr 07 20:07:19 2017

Revert "[turbofan] Add support for extending properties backing store."

This reverts commit 88a7061a53ad200121f7ee2b2bdcc05d793de806 (with
one manually-resolved merge conflict).

It caused a spike of GC crashes on Canary.

TBR=bme...@chromium.org

Bug: chromium:708339, v8:5267
Change-Id: I8a5683bbdfb61c95d81a2ee7cdb913f39e553093
Reviewed-on: https://chromium-review.googlesource.com/471928
Commit-Queue: Adam Klein <ad...@chromium.org>
Reviewed-by: Ulan Degenbaev <ul...@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44496}
[modify] https://crrev.com/c8ae359750a9e9fabbfa25a5e6b10091e401eaad/src/compiler/access-info.cc
[modify] https://crrev.com/c8ae359750a9e9fabbfa25a5e6b10091e401eaad/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/c8ae359750a9e9fabbfa25a5e6b10091e401eaad/src/compiler/js-native-context-specialization.h