1147353 - Odin: simplify the masked index bounds check test.

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Douglas Crosher [:dougc]]

The test of a masked index against the known minimum heap length is overly complex and while the recent update fixes an issue it is still a little too conservative and misses some opportunities.

Comment 1

[Douglas Crosher [:dougc]]

Attachment: Simplify the masked index bounds check test.

This code was way too complex, sorry. It just needed to compare the mask to the length and avoid negative indexes when the top bit of the mask is set.

Comment 2

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8583043 [details] [diff] [review]
Simplify the masked index bounds check test.

Review of attachment 8583043 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense to me. A slightly different way of stating it is that ANDing the mask with the index can only decrease the mask if it's unsigned, so mask ≤ max => (x & mask) ≤ max since (mask & x) ≤ mask ≤ max. Pretty much the same as what your comment says.

And yet -- I'd rather luke stamp this too, if you don't mind. My paranoia knows no bounds.

::: js/src/asmjs/AsmJSValidate.cpp
@@ +4444,5 @@
>      uint32_t mask2;
>      if (IsLiteralOrConstInt(f, maskNode, &mask2)) {
>          // Flag the access to skip the bounds check if the mask ensures that an 'out of
> +        // bounds' access can not occur based on the current heap length constraint. The
> +        // maxium of a masked index is the mask itself so simply compare the mask to the

*maximum

Comment 3

[Luke Wagner [:luke]]

(In reply to Steve Fink [:sfink, :s:] from comment #2)
> My paranoia knows no bounds.

NO_BOUNDS_CHECK, even?

Comment 4

[Luke Wagner [:luke]]

Comment on attachment 8583043 [details] [diff] [review]
Simplify the masked index bounds check test.

Much simpler.

Comment 5

[Douglas Crosher [:dougc]]

Attachment: Simplify the masked index bounds check test.

Fix the source comment. Carrying forward r+.

Comment 6

[Douglas Crosher [:dougc]]

Requesting checkin. Try build: https://treeherder.mozilla.org/#/jobs?repo=try&revision=0748011b8259

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7e4aab7d129f

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7e4aab7d129f