[maglev] Optimize dictionary loads using cached index [v8/v8 : main]

0 views
Skip to first unread message

Marco Vitale (Gerrit)

unread,
Apr 24, 2026, 4:38:34 AM (5 days ago) Apr 24
to Leszek Swirski, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, jgrube...@chromium.org, leszek...@chromium.org, pthier...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Leszek Swirski

Marco Vitale added 1 comment

File test/mjsunit/maglev/swiss-dict-load.js
Line 6, Patchset 16:
Marco Vitale . unresolved

Not sure if this test make sense. IMO would be nice to see directly we break the optimization, but not sure exactly how to test it.

Open in Gerrit

Related details

Attention is currently required from:
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I106eece0f7de17f2d45540ac83303c4d0bcf096b
Gerrit-Change-Number: 7764526
Gerrit-PatchSet: 20
Gerrit-Owner: Marco Vitale <mrc...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Marco Vitale <mrc...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Fri, 24 Apr 2026 08:38:30 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Apr 24, 2026, 7:55:29 AM (4 days ago) Apr 24
to Marco Vitale, Igor Sheludko, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Igor Sheludko and Marco Vitale

Leszek Swirski added 1 comment

Patchset-level comments
File-level comment, Patchset 20 (Latest):
Leszek Swirski . resolved

+igor for a second opinion (maybe a first one if he beats me to it)

Open in Gerrit

Related details

Attention is currently required from:
  • Igor Sheludko
  • Marco Vitale
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I106eece0f7de17f2d45540ac83303c4d0bcf096b
Gerrit-Change-Number: 7764526
Gerrit-PatchSet: 20
Gerrit-Owner: Marco Vitale <mrc...@chromium.org>
Gerrit-Reviewer: Igor Sheludko <ish...@chromium.org>
Gerrit-Attention: Igor Sheludko <ish...@chromium.org>
Gerrit-Attention: Marco Vitale <mrc...@chromium.org>
Gerrit-Comment-Date: Fri, 24 Apr 2026 11:55:24 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Apr 24, 2026, 8:29:11 AM (4 days ago) Apr 24
to Marco Vitale, Igor Sheludko, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Igor Sheludko and Marco Vitale

Leszek Swirski added 4 comments

File src/compiler/js-heap-broker.h
Line 71, Patchset 20 (Latest): base::hash_combine(base::hash_combine(pair.map.object().address(),
Leszek Swirski . unresolved

I think we have a base::Hasher helper which can help make this a bit more readable.

File src/compiler/js-heap-broker.cc
Line 993, Patchset 20 (Latest): factory.ComputePropertyAccessInfo(map, name, access_mode, cache_handler);
Leszek Swirski . unresolved

pass the real handler in here, not the cache handler, in case we want to use the handler for other things (like speeding up the compile-time descriptor lookup in non-dictionary maps).

File src/compiler/turboshaft/turbolev-graph-builder.cc
Line 2163, Patchset 20 (Latest): maglev::ProcessResult Process(maglev::LoadDictionaryField* node,
Leszek Swirski . unresolved

This needs to implement the cached index use to make the turbolev numbers valid, since right now it unconditionally calls LoadIC

File src/objects/feedback-vector-inl.h
Line 551, Patchset 20 (Latest): Tagged<MaybeObject> handler_obj = it.handler();
if (!handler_obj.IsCleared()) {
MaybeObjectDirectHandle handler = config()->NewHandle(handler_obj);
function(map, handler);
}
Leszek Swirski . unresolved

maybe worth doing this only for Smi handlers, since that's the only kind we actually process? Then you could operate on Smis directly throughout, without needing to allocate a handle that you later discard.

Gerrit-Comment-Date: Fri, 24 Apr 2026 12:29:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Marco Vitale (Gerrit)

unread,
Apr 27, 2026, 10:15:06 AM (yesterday) Apr 27
to Igor Sheludko, Leszek Swirski, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Igor Sheludko and Leszek Swirski

Marco Vitale added 4 comments

File src/compiler/js-heap-broker.h
Line 71, Patchset 20: base::hash_combine(base::hash_combine(pair.map.object().address(),
Leszek Swirski . resolved

I think we have a base::Hasher helper which can help make this a bit more readable.

Marco Vitale

Done

File src/compiler/js-heap-broker.cc
Line 993, Patchset 20: factory.ComputePropertyAccessInfo(map, name, access_mode, cache_handler);
Leszek Swirski . resolved

pass the real handler in here, not the cache handler, in case we want to use the handler for other things (like speeding up the compile-time descriptor lookup in non-dictionary maps).

Marco Vitale

Done

File src/compiler/turboshaft/turbolev-graph-builder.cc
Line 2163, Patchset 20: maglev::ProcessResult Process(maglev::LoadDictionaryField* node,
Leszek Swirski . resolved

This needs to implement the cached index use to make the turbolev numbers valid, since right now it unconditionally calls LoadIC

Marco Vitale

good point ty!

File src/objects/feedback-vector-inl.h
Line 551, Patchset 20: Tagged<MaybeObject> handler_obj = it.handler();

if (!handler_obj.IsCleared()) {
MaybeObjectDirectHandle handler = config()->NewHandle(handler_obj);
function(map, handler);
}
Leszek Swirski . unresolved

maybe worth doing this only for Smi handlers, since that's the only kind we actually process? Then you could operate on Smis directly throughout, without needing to allocate a handle that you later discard.

Marco Vitale

I think we still need to record all maps in the NamedAccessFeedback. Tried to do that just for SMI headers and got a 80% regression. Maybe i did something wrong tho...

Open in Gerrit

Related details

Attention is currently required from:
  • Igor Sheludko
  • Leszek Swirski
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I106eece0f7de17f2d45540ac83303c4d0bcf096b
Gerrit-Change-Number: 7764526
Gerrit-PatchSet: 21
Gerrit-Owner: Marco Vitale <mrc...@chromium.org>
Gerrit-Reviewer: Igor Sheludko <ish...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Marco Vitale <mrc...@chromium.org>
Gerrit-Attention: Igor Sheludko <ish...@chromium.org>
Gerrit-Attention: Leszek Swirski <les...@chromium.org>
Gerrit-Comment-Date: Mon, 27 Apr 2026 14:15:01 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Leszek Swirski <les...@chromium.org>
unsatisfied_requirement
open
diffy

Leszek Swirski (Gerrit)

unread,
Apr 27, 2026, 10:16:46 AM (yesterday) Apr 27
to Marco Vitale, Igor Sheludko, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Igor Sheludko and Marco Vitale

Leszek Swirski added 1 comment

File src/objects/feedback-vector-inl.h
Line 551, Patchset 20: Tagged<MaybeObject> handler_obj = it.handler();
if (!handler_obj.IsCleared()) {
MaybeObjectDirectHandle handler = config()->NewHandle(handler_obj);
function(map, handler);
}
Leszek Swirski . unresolved

maybe worth doing this only for Smi handlers, since that's the only kind we actually process? Then you could operate on Smis directly throughout, without needing to allocate a handle that you later discard.

Marco Vitale

I think we still need to record all maps in the NamedAccessFeedback. Tried to do that just for SMI headers and got a 80% regression. Maybe i did something wrong tho...

Leszek Swirski

yeah sounds like something went wrong because afaict you also later discard non-Smi handlers

Open in Gerrit

Related details

Attention is currently required from:
  • Igor Sheludko
  • Marco Vitale
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I106eece0f7de17f2d45540ac83303c4d0bcf096b
Gerrit-Change-Number: 7764526
Gerrit-PatchSet: 21
Gerrit-Owner: Marco Vitale <mrc...@chromium.org>
Gerrit-Reviewer: Igor Sheludko <ish...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Marco Vitale <mrc...@chromium.org>
Gerrit-Attention: Igor Sheludko <ish...@chromium.org>
Gerrit-Attention: Marco Vitale <mrc...@chromium.org>
Gerrit-Comment-Date: Mon, 27 Apr 2026 14:16:42 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Marco Vitale <mrc...@chromium.org>
Comment-In-Reply-To: Leszek Swirski <les...@chromium.org>
unsatisfied_requirement
open
diffy

Igor Sheludko (Gerrit)

unread,
11:55 AM (8 hours ago) 11:55 AM
to Marco Vitale, Leszek Swirski, chrom...@appspot.gserviceaccount.com, v8-s...@luci-project-accounts.iam.gserviceaccount.com, dmercadi...@chromium.org, leszek...@chromium.org, v8-mip...@googlegroups.com, v8-ppc...@googlegroups.com, v8-re...@googlegroups.com, v8-risc...@chromium.org, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Marco Vitale

Igor Sheludko added 11 comments

Patchset-level comments
File-level comment, Patchset 21 (Latest):
Igor Sheludko . resolved

some comments

File src/compiler/turboshaft/turbolev-graph-builder.cc
Line 2220, Patchset 21 (Latest): __ LoadTaggedField<Smi>(properties, FixedArrayBase::kLengthOffset);
Igor Sheludko . unresolved

This requires updating, the length is `uint32_t` as of https://crrev.com/c/7594595.

Line 2224, Patchset 21 (Latest): int key_offset = NameDictionary::OffsetOfElementAt(entry_index);
Igor Sheludko . unresolved

`static_assert(NameDictionary::kEntryKeyIndex == 0);` or just add `NameDictionary::kEntryKeyIndex` here.

Line 2232, Patchset 21 (Latest): IF (LIKELY(__ IsSmi(details))) {
Igor Sheludko . unresolved

I don't think we need this, matching name already guarantees that the correct entry exists.

File src/ic/handler-configuration.h
Line 142, Patchset 21 (Latest): bool is_data_property = false);
Igor Sheludko . unresolved

Please remove the default value, it's confusing.

File src/maglev/arm64/maglev-ir-arm64.cc
Line 1273, Patchset 21 (Latest): __ LoadTaggedField(length, properties, FixedArrayBase::kLengthOffset);
Igor Sheludko . unresolved

Ditto: uint32_t.

Line 1286, Patchset 21 (Latest): __ JumpIfNotSmi(scratch, deferred_fallback);
Igor Sheludko . unresolved

Ditto: not necessary.

File src/maglev/x64/maglev-ir-x64.cc
Line 1302, Patchset 21 (Latest): __ LoadTaggedField(length, properties, FixedArrayBase::kLengthOffset);
Igor Sheludko . unresolved

Ditto: uint32_t.

Line 1307, Patchset 21 (Latest): int key_offset = NameDictionary::OffsetOfElementAt(entry_index);
Igor Sheludko . unresolved

Ditto: + kEntryKeyIndex.

Line 1315, Patchset 21 (Latest): __ JumpIfNotSmi(scratch, deferred_fallback);
Igor Sheludko . unresolved

Ditto: not necessary.

File test/mjsunit/maglev/swiss-dict-load.js
Marco Vitale . unresolved

Not sure if this test make sense. IMO would be nice to see directly we break the optimization, but not sure exactly how to test it.

Igor Sheludko

We haven't been testing swiss dictionary stuff for quite a while, most likely it's already broken in many ways, so you could have skipped implementing the optimization for swiss dictionaries at all.

In general, swiss dictionaries shouldn't require super-special case, regular dictionary mode object behavior should apply there automatically. Maybe rename the test to just dict-load.js or something.

Open in Gerrit

Related details

Attention is currently required from:
  • Marco Vitale
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I106eece0f7de17f2d45540ac83303c4d0bcf096b
Gerrit-Change-Number: 7764526
Gerrit-PatchSet: 21
Gerrit-Owner: Marco Vitale <mrc...@chromium.org>
Gerrit-Reviewer: Igor Sheludko <ish...@chromium.org>
Gerrit-Reviewer: Leszek Swirski <les...@chromium.org>
Gerrit-Reviewer: Marco Vitale <mrc...@chromium.org>
Gerrit-Attention: Marco Vitale <mrc...@chromium.org>
Gerrit-Comment-Date: Tue, 28 Apr 2026 15:55:50 +0000
unsatisfied_requirement
open
diffy
Reply all
Reply to author
Forward
0 new messages