Comment #3 on issue 4273 by [email protected]: Unsound TurboFan OSR
https://code.google.com/p/v8/issues/detail?id=4273#c3
The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8.git/+/ef661b080426d88be188342b4d8b9df3edd49026
commit ef661b080426d88be188342b4d8b9df3edd49026
Author: bmeurer <[email protected]>
Date: Mon Jul 06 11:11:15 2015
[turbofan] Reland "Add new JSFrameSpecialization reducer." and "Perform OSR
deconstruction early and remove type propagation.".
We have to reland these two commits at once, because the first breaks
some asm.js benchmarks without the second. The change was reverted
because of bogus checks in the verifier, which will not work in the
presence of OSR (and where hidden because of the type back propagation
hack in OSR so far). Original messages are below:
[turbofan] Add new JSFrameSpecialization reducer.
The JSFrameSpecialization specializes an OSR graph to the current
unoptimized frame on which we will perform the on-stack replacement.
This is used for asm.js functions, where we cannot reuse the OSR
code object anyway because of context specialization, and so we could as
well specialize to the max instead.
It works by replacing all OsrValues in the graph with their values
in the JavaScriptFrame.
The idea is that using this trick we get better performance without
doing the unsound backpropagation of types to OsrValues later. This
is the first step towards fixing OSR for TurboFan.
[turbofan] Perform OSR deconstruction early and remove type propagation.
This way we don't have to deal with dead pre-OSR code in the graph
and risk optimizing the wrong code, especially we don't make
optimistic assumptions in the dead code that leaks into the OSR code
(i.e. deopt guards are in dead code, but the types propagate to OSR
code via the OsrValue type back propagation).
BUG=v8:4273
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/1226673005
Cr-Commit-Position: refs/heads/master@{#29486}
[modify] http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/BUILD.gn
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler.h
[add]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/js-frame-specialization.cc
[add]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/js-frame-specialization.h
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/osr.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/pipeline.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/typer.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/compiler/verifier.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/src/runtime/runtime-compiler.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/test/cctest/compiler/test-osr.cc
[modify]
http://crrev.com/ef661b080426d88be188342b4d8b9df3edd49026/tools/gyp/v8.gyp
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
