1116807 - IonMonkey: Form unsigned comparisons with array.length

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P5)

Description

[Dan Gohman [:sunfish]]

This code, run with --ion-eager, could be optimized with an unsigned comparison:

function foo(a, i) {
  if ((i>>>0) < a.length) 
      return a[i];
  else
      return 3;
}

x=[34,54,56,65];
print(foo(x, 2));
print(foo(x, 1));
print(foo(x, 0));
print(foo(x, 4));

It's probably just a matter of teaching MustBeUInt32 that MArrayLength and MTypedArrayLength are unsigned.

Comment 1

[Dan Gohman [:sunfish]]

For details about why MArrayLength and friends can be considered unsigned, see the comment in MArrayLength::computeRange. There are several other *Length operators there which could benefit from unsigned comparisons too.