643037 - JM: OOL path to truncate small doubles

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

About 85% of the slow paths we take when converting doubles to ints in the kraken pbkdf2 benchmark (or at least the version posted in bug 642412) are due to truncating the result of adding several int32s together, such that the value is within 2^32 of an int32.  These can be truncated by adding/subtracting 2^32 to get the value in range, then converting to an int32 (exact conversion is required, as truncation behaves incorrectly if the value changes sign).

Comment 1

[Brian Hackett [Laid off!]]

Patch landed on the TI branch. This could also be added to the TM branch.

http://hg.mozilla.org/projects/jaegermonkey/rev/f1dff744b6c8

On the pbkdf2 test in bug 642412, this improves JM+TI time from 438ms to 361ms.  On this microbenchmark:

function foo(x) {
  var a = x;
  for (var i = 0; i < 3000000; i++) {
    a += x | 0;
    x++;
  }
  return a + x;
}
foo(0xffffffff);

JM+TI (old): 108
JM+TI (new): 20
JM+TM: 56
V8: 95

This is a little gamey but I think that doing bitwise ops on nearly-int32 values (especially uint32s) is pretty common in crypto code.