1315218 - Optimize Uint32 corner case of Atomics.store

Status: NEW

(Core :: JavaScript Engine: JIT, defect, P5)

Description

[Lars T Hansen [:lth]]

There is a corner case of JIT implementation of Atomics.store that will prevent inlining when the input type is not Int32 *and* the result value of Atomics.store is captured by the program, see bug 1246140.

Even though the result value of Atomics.store is rarely captured, there is a risk that this can effect some users of Uint32Array on shared memory since with Uint32Array the value will frequently be represented as double.

Hannes writes:

"MIRs that have no uses (and aren't guarded or effectfull) get removed during DCE if they have no uses.  And if you have a MIR that is partly guard, you can split this function into effectfull MIR part and a second MIR, which has no guards and will get removed if there are no uses? Though this off course depends on the specifics.

This looks like this is one of those cases the split MIR would work.  I.e. get the Atomics.store to return MIRType::Value and add MConvertToInt32 after it?

(note: MConvertToInt32 doesn't exist yet)"