1519113 - Avoid generating unnecessary Box -> Unbox sequences

Status: RESOLVED DUPLICATE of bug 1632757

(Core :: JavaScript Engine: JIT, enhancement, P2)

Description

[André Bargull [:anba]]

We're sometimes generating unnecessary MBox directly followed by MUnbox sequences. This happens when a MUnbox definition has a MPhi as its input and the MPhi is later simplified in GVN, so only one of the MPhi's inputs is still present.

Excerpt after Alias Analysis:

79  newiterator constant78              Object
133 box newiterator79                   Value

117 constant undefined                  Undefined
125 box constant117                     Value

135 phi box125 box133                   Value
144 unbox phi135 to Object (fallible)   Object

Excerpt after GVN:

47  newiterator constant46              Object
69  box newiterator47                   Value
72  unbox box69 to Object (fallible)    Object

Handling this case in MUnbox::foldsTo should help us to avoid the extra box -> unbox sequence.

Test case:

function f() {
    Array.from(new Int32Array(10));
    var r = 0;
    for (var i = 0; i < 100000; ++i) {
        for (var x of [1,2,3,4,5]) {
            r += x;
        }
    }
    return r;
}
for (var i = 0; i < 4; ++i) print(f());

Comment 1

[Nicolas B. Pierron [:nbp]]

I guess we could add a GVN pass to fold "MUnbox (MPhi x y z)" to "MPhi (MUnbox x) (MUnbox y) (MUnbox z)".
And we should do that if at least one of the input of MPhi is a MBox.

Comment 2

[André Bargull [:anba]]

bug 1632757 will probably fix this issue (https://phabricator.services.mozilla.com/D72335).