1225025 - Type inference for TypedArray mapping SharedArrayBuffer

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Lars T Hansen [:lth]]

In plain JS code, the jit now (bug 1176214) emits a guard before atomic operations to check that the TypedArray argument maps shared memory.  It will be nice to optimize that guard away when we can.

When a TypedArray is created that maps a SAB the TA's ObjectGroup will reflect that fact (a new flag).  Type inference can then pick up that flag and MCallOptimize can use the information to omit the guard when the TA argument is known always to map shared memory.  The higher-level parts of that logic are already in bug 1176214, but the ObjectGroup/TI parts are not.

Another reason for TI here is for us to be able to tell the difference between when a TA operation is definitely not mapping shared memory, and when it might be.  There are some optimizations that may be legal only in the former case (re-loading a value from memory for example), this is TBD and depends on the final memory model spec.