894582 - IonMonkey: constant fold arithm operations with double output that fits in int32

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Hannes Verschore [:h4writer]]

Noticed this on kraken-stanford-crypto-ccm. EvaluateConstantOperands uses setNumber what will try to put the value in int32 if possible. Now if the output result needs to be in double, we won't constant fold, since the types don't match. But we can just transform the int32 result to double without precision loss.

Comment 1

[Hannes Verschore [:h4writer]]

Attachment: Patch

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 776659 [details] [diff] [review]
Patch

Review of attachment 776659 [details] [diff] [review]:
-----------------------------------------------------------------

Nice find!

::: js/src/ion/MIR.cpp
@@ +123,5 @@
>      }
>  
> +    // setNumber eagerly transforms a number to int32.
> +    // Transform back to double, if the output type is double.
> +    if (ins->type() == MIRType_Double && MIRTypeFromValue(ret) == MIRType_Int32)

You can use ret.isInt32() instead of MIRTypeFromValue(ret) == MIRType_Int32.

Comment 3

[Hannes Verschore [:h4writer]]

Attachment: Patch

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7c5c7d816fbb

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7c5c7d816fbb