536643 - TM: insufficient integer demotion in bitwise-and.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicholas Nethercote [inactive]]

From bug 536630:  this is bitwise-and.js:

    bitwiseAndValue = 4294967296;
    for (var i = 0; i < 600000; i++)
        bitwiseAndValue = bitwiseAndValue & i;

The LIR looks like this (instructions indented to the right are optimised
away by StackFilter or dead-code elimination):

  00: start
  01: ebx = iparam 0 ebx
  02: esi = iparam 1 esi
  03: edi = iparam 2 edi
  04: state = iparam 0 ecx
  05: label1:
  06: sp = ld state[8]
                                  07: rp = ld state[24]
  08: cx = ld state[0]
  09: eos = ld state[12]
                                  10: eor = ld state[28]
  11: ld1 = ld cx[0]
                                  12: 0 = int 0
  13: eq1 = eq ld1, 0
  14: xf1: xf eq1 -> pc=0x30cba6 imacpc=0x0 sp+0 rp+0 (GuardID=001)
                                  15: obj = int 2961408
                                  16: sti sp[0] = obj 
                                  17: ld2 = ld cx[148]
                                  18: ld3 = ld ld2[56]
                                  19: map = ld ld3[0]
  20: ld4 = ld eos[664]
                                  21: $global0 = i2f ld4 
                                  22: sti sp[8] = ld4
  23: ld5 = ld eos[656]
                                  24: $global1 = i2f ld5
                                  25: sti sp[16] = ld5
  26: and1 = and ld4, ld5
                                  27: i2f1 = i2f and1
                                  28: sti sp[8] = and1
                                  29: map = ld obj[0]
  30: sti eos[664] = and1
                                  31: 1 = float 1
                                  32: 1 = int 1
  33: add1 = add ld5, 1
  34: ov1 = ov add1
  35: xt1: xt ov1 -> pc=0x30cbb5 imacpc=0x0 sp+0 rp+0 (GuardID=002)
  36: i2f2 = i2f add1
                                  37: sti sp[0] = ld5
  38: sti eos[656] = add1
  39: sti sp[0] = add1
  40: 600000 = float 600000
                                  41: 600000 = int 600000
  42: sti sp[8] = 600000
  43: flt1 = flt i2f2, 600000
  44: xf2: xf flt1 -> pc=0x30cbc0 imacpc=0x0 sp+16 rp+0 (GuardID=003)
  45: sti eos[664] = and1
  46: sti eos[656] = add1
  47: j -> label1
  48: live state
  49: x1: x  -> pc=0x30cba6 imacpc=0x0 sp+0 rp+0 (GuardID=004)

Using a FP comparison (instruction 44) is bad, we should use integer comparison.

I tried a simpler piece of code:

  sum = 0;
  for (var i = 0; i < 600000; i++)
      sum = sum + i;

and it successful used an integer comparison, so maybe there is something about 'i' being used in a bitwise-and that's causing problems.

Comment 1

[Nicholas Nethercote [inactive]]

This appears to have been fixed, though I don't know how or when.  The code now looks like this:

    start
    ebx = parami 0 ebx
    esi = parami 1 esi
    edi = parami 2 edi
    state = parami 0 ecx
    label1:
    sp = ldi.o state[8]
                                    rp = ldi.o state[24]
    cx = ldi.o state[0]
    eos = ldi.o state[12]
                                    eor = ldi.o state[28]
    ldi1 = ldi.csro cx[0]
    immi1 = immi 0                
    eqi1 = eqi ldi1, immi1/*0*/
    xf1: xf eqi1 -> pc=0x9c127a6 imacpc=(nil) sp+0 rp+0 (GuardID=001)
                                  
                                    obj = immi -152035328
                                    sti.s sp[0] = obj/*-152035328*/
    ldi2 = ldi.o eos[1376]        
                                    $global0 = i2d ldi2
                                    sti.s sp[8] = ldi2
    ldi3 = ldi.o eos[1368]        
                                    $global1 = i2d ldi3
                                    sti.s sp[16] = ldi3
    andi1 = andi ldi2, ldi3       
                                    i2d1 = i2d andi1
                                    sti.s sp[8] = andi1
    sti.o eos[1376] = andi1       
                                    immd1 = immd 1
    immi2 = immi 1                
    addxovi1 = addxovi ldi3, immi2/*1*/ -> pc=0x9c127b5 imacpc=(nil) sp+0 rp+0 (GuardID=002)
                                  
                                    i2d2 = i2d addxovi1
                                    sti.s sp[0] = ldi3
    sti.o eos[1368] = addxovi1      
    sti.s sp[0] = addxovi1
                                    immd2 = immd 600000
    immi3 = immi 600000           
    sti.s sp[8] = immi3/*600000*/   
    lti1 = lti addxovi1, immi3/*600000*/
    xf2: xf lti1 -> pc=0x9c127c0 imacpc=(nil) sp+16 rp+0 (GuardID=003)
                                  
    j -> label1 
    livei state
    x1: x  -> pc=0x9c127a6 imacpc=(nil) sp+0 rp+0 (GuardID=004)