[turbolev] Range value analysis [v8/v8 : main]

0 views
Skip to first unread message

Victor Gomes (Gerrit)

unread,
Sep 25, 2025, 6:47:29 AM (yesterday) Sep 25
to Darius Mercadier, dmercadi...@chromium.org, leszek...@chromium.org, v8-flag...@chromium.org, v8-re...@googlegroups.com, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Darius Mercadier

Victor Gomes added 1 comment

Patchset-level comments
File-level comment, Patchset 6 (Latest):
Victor Gomes . resolved

PTAL!

Open in Gerrit

Related details

Attention is currently required from:
  • Darius Mercadier
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I88c52792a741d35f811057d3792cea0ced196ddd
Gerrit-Change-Number: 6973485
Gerrit-PatchSet: 6
Gerrit-Owner: Victor Gomes <victo...@chromium.org>
Gerrit-Reviewer: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Attention: Darius Mercadier <dmerc...@chromium.org>
Gerrit-Comment-Date: Thu, 25 Sep 2025 10:47:24 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Darius Mercadier (Gerrit)

unread,
4:57 AM (11 hours ago) 4:57 AM
to Victor Gomes, dmercadi...@chromium.org, leszek...@chromium.org, v8-flag...@chromium.org, v8-re...@googlegroups.com, verwaes...@chromium.org, victorgo...@chromium.org
Attention needed from Victor Gomes

Darius Mercadier added 23 comments

Patchset-level comments
Darius Mercadier . resolved

Overall looks good; cool stuff! :)

File src/flags/flag-definitions.h
Line 631, Patchset 6 (Latest):DEFINE_BOOL(maglev_range_analysis, false,
Darius Mercadier . unresolved

Make experimental before landing.

File src/maglev/maglev-graph-optimizer.cc
Line 314, Patchset 6 (Latest): auto r1 = GetRange(GetInputAt(0));
Darius Mercadier . resolved

Now that the Visit methods take the `node` as input, I think that you should remove those `GetInputAt` helpers and just use `node->input_node()` instead.
(not in this CL though)

Line 316, Patchset 6 (Latest): if (r1 && r2 && Range::Uint32().contains(*r1) && *r1 < *r2) {
Darius Mercadier . unresolved

`r1->IsUint32()` would feel less awkward imo

Line 1217, Patchset 6 (Latest): return ReplaceWith(
reducer_.AddNewNodeNoInputConversion<UnsafeSmiTagInt32>(
{GetInputAt(0)}));
Darius Mercadier . unresolved

What about overwriting the node in place instead of creating a new node?

File src/maglev/maglev-kna-processor.h
Line 61, Patchset 6 (Latest): } else if (block->is_edge_split_block()) {
BasicBlock* next_block = block;
while (next_block->is_edge_split_block()) {
next_block = next_block->control_node()->Cast<Jump>()->target();
}
known_node_aspects_ = next_block->state()->CloneKnownNodeAspects(zone());
}
DCHECK_NOT_NULL(known_node_aspects_);
Darius Mercadier . unresolved

Consider doing this in a separate CL.

Line 62, Patchset 6 (Latest): BasicBlock* next_block = block;
while (next_block->is_edge_split_block()) {
next_block = next_block->control_node()->Cast<Jump>()->target();
}
known_node_aspects_ = next_block->state()->CloneKnownNodeAspects(zone());
Darius Mercadier . unresolved
```suggestion
while (block->is_edge_split_block()) {
block = block->control_node()->Cast<Jump>()->target();
}
known_node_aspects_ = block->state()->CloneKnownNodeAspects(zone());
```
File src/maglev/maglev-range-analysis.h
Line 502, Patchset 6 (Latest): if (range != widened && !(range.is_empty() && widened.is_empty())) {
Darius Mercadier . unresolved

What's the idea of this check exactly? Can't this be true in some cases where the loop is unreachable?

Line 494, Patchset 6 (Latest): auto range = ranges_.Get(block, phi);
auto backedge = ranges_.Get(backedge_pred, phi->input_node(backedge_id));
auto widened = Range::Widen(range, backedge);
Darius Mercadier . unresolved
```suggestion
Range range = ranges_.Get(block, phi);
Range backedge = ranges_.Get(backedge_pred, phi->input_node(backedge_id));
Range widened = Range::Widen(range, backedge);
```
Line 491, Patchset 6 (Latest): DCHECK_EQ(backedge_pred, block->backedge_predecessor());
Darius Mercadier . unresolved

move up

Line 476, Patchset 6 (Latest): predecessor_id = i;
Darius Mercadier . unresolved

Add a `break` after

Line 474, Patchset 6 (Latest): for (int i = block->predecessor_count() - 1; i >= 0; i--) {
Darius Mercadier . unresolved

Why is this iterating backwards?

Line 430, Patchset 6 (Latest): if (node->if_true() == succ) {
ranges_.NarrowUpdate(succ, lhs, lhs_range.ConstrainLessEqual(rhs_range));
ranges_.NarrowUpdate(succ, rhs, rhs_range.ConstraintGreater(lhs_range));
} else {
DCHECK_EQ(node->if_false(), succ);
ranges_.NarrowUpdate(succ, lhs, lhs_range.ConstraintGreater(rhs_range));
ranges_.NarrowUpdate(succ, rhs, rhs_range.ConstrainLessEqual(lhs_range));
}
Darius Mercadier . unresolved

This should depend on `node->operation()`

Line 384, Patchset 6 (Latest): } else {
Darius Mercadier . unresolved

I would distinguish between Conditional and Unconditional control nodes to make things clearer. Thanks to edge splitting, you are guaranteed that Conditional control node go to blocks with a single predecessor. And only unconditional control nodes are allowed to go to Merges.

Line 257, Patchset 6 (Latest): TRACE_RANGE("[range]: Narrow update: "
Darius Mercadier . unresolved
```suggestion
TRACE_RANGE("[range]: update: "
```
Line 249, Patchset 6 (Latest): void Update(BasicBlock* block, ValueNode* node, Range range) {
Darius Mercadier . unresolved

`Union` would be a more descriptive name.

Line 195, Patchset 6 (Latest): if (!IsSafeInteger(new_min)) new_min = kInfMin;
Darius Mercadier . unresolved

Is that possible?

Line 188, Patchset 6 (Latest): if (!IsSafeInteger(new_max)) new_max = kInfMax;
Darius Mercadier . unresolved

Is that possible?

Line 171, Patchset 6 (Latest): int64_t min = kInfMin;
if (r1.min_ != kInfMin) {
min = r1.min_ & r2.max_;
}
int64_t max = kInfMax;
if (r1.max_ != kInfMax) {
max = r1.max_ & r2.max_;
}
if (max < min) return Range::Empty();
return Range(min, max);
Darius Mercadier . unresolved

This is wrong. A simple example for the maxes for instance: if r1.max_ is `2**31` and r2.max_ is `2**31-1`, then the bitwise and of the 2 will be `0` instead of `2**31-1`.

Cf OperationTyper::NumberBitwiseAnd in Turbofan for an implementation that should be more correct.

Line 170, Patchset 6 (Latest): if (r2.is_constant()) {
Darius Mercadier . unresolved

`if (r1.is_constant() && !r2.is_constant()) { std::swap(r1, r2); }`

Line 126, Patchset 6 (Latest): if (!IsSafeInteger(min)) min = kInfMin;
if (!IsSafeInteger(max)) max = kInfMax;
Darius Mercadier . unresolved

Is that possible?

Line 117, Patchset 6 (Latest): if (!IsSafeInteger(min)) min = kInfMin;
if (!IsSafeInteger(max)) max = kInfMax;
Darius Mercadier . unresolved

Is that possible?

Line 30, Patchset 6 (Latest):void DestructivelyIntersect(ZoneMap<Key, Value>& lhs_map,
Darius Mercadier . unresolved

Add a comment stating which input will be updated by the intersection (lhs_map here).

Open in Gerrit

Related details

Attention is currently required from:
  • Victor Gomes
Submit Requirements:
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: v8/v8
    Gerrit-Branch: main
    Gerrit-Change-Id: I88c52792a741d35f811057d3792cea0ced196ddd
    Gerrit-Change-Number: 6973485
    Gerrit-PatchSet: 6
    Gerrit-Owner: Victor Gomes <victo...@chromium.org>
    Gerrit-Reviewer: Darius Mercadier <dmerc...@chromium.org>
    Gerrit-Attention: Victor Gomes <victo...@chromium.org>
    Gerrit-Comment-Date: Fri, 26 Sep 2025 08:56:56 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages