Enable TypedArray JIT optimizations for Big(U)Int64Array
Categories
(Core :: JavaScript Engine: JIT, enhancement, P2)
Tracking
()
People
(Reporter: terpri, Assigned: anba)
References
Details
Attachments
(6 files)
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review | |
47 bytes,
text/x-phabricator-request
|
Details | Review |
ElementAccessIsTypedArray should return true for BigInt scalar types. Currently it returns false in order to bypass TypedArray-specific JIT optimizations that aren't yet implemented for BigInt.
Updated•2 years ago
|
Reporter | ||
Comment 1•2 years ago
|
||
v. review comments from bug 1456569 for optimization ideas from :wingo and :Waldo
Assignee | ||
Comment 2•10 months ago
|
||
Required for bug 1631920.
Running with --no-threads --warp
var ta = new BigInt64Array(2);
var q = 0;
for (var i = 0; i < 10000; ++i) {
if (ta[i&1]) q++;
}
asserts with Assertion failure: IsNumberType(ins->type()) || ins->type() == MIRType::Boolean, at /home/andre/hg/mozilla-inbound/js/src/jit/Lowering.cpp:3486
.
Assignee | ||
Comment 3•10 months ago
|
||
These functions are needed for the next parts.
Assignee | ||
Comment 4•10 months ago
|
||
There are too few registers available on x86, therefore LLoadTypedArrayElementHoleBigInt
is reusing the ValueOperand's type register, similar to CacheIRCompiler::emitLoadTypedElementResult
.
LLoadUnboxedBigInt
and LLoadTypedArrayElementHoleBigInt
are both using an OOL vm-call
if the result BigInt can't be allocated inline, similar to CodeGenerator::visitInt64ToBigInt
.
Depends on D72639
Assignee | ||
Comment 5•10 months ago
|
||
The next part needs ToBigIntPolicy
when storing BigInts into a typed array.
MToBigInt
is currently only used as part of ToBigIntPolicy
, therefore we
have to bailout for effectful operations, like ToBigInt(object)
. Only strings
and booleans can be handled without a bailout.
Depends on D72640
Assignee | ||
Comment 6•10 months ago
|
||
Also adds Register64::scratchReg()
to make sure we don't run out of registers on x86.
Depends on D72641
Assignee | ||
Comment 7•10 months ago
|
||
LLoadTypedArrayElementHole
used to need to a safepoint for a vm-call (bug 737783),
but this vm-call was later removed in bug 829896.
Depends on D72642
Comment 8•10 months ago
|
||
Thanks for catching and fixing this issue! Can you also land the testcase?
Assignee | ||
Comment 9•10 months ago
|
||
Depends on D72643
Comment 10•10 months ago
|
||
Pushed by nbeleuzu@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/329a180ed9a0 Part 1: Add missing helpers for Register64. r=jandem https://hg.mozilla.org/integration/autoland/rev/778475971875 Part 2: Support BigInts in MLoadUnboxedScalar and MLoadTypedArrayElementHole. r=jandem https://hg.mozilla.org/integration/autoland/rev/984382fdbcd9 Part 3: Add MToBigInt and ToBigIntPolicy. r=jandem https://hg.mozilla.org/integration/autoland/rev/a5f9b78cf7ba Part 4: Support BigInts in MStoreUnboxedScalar and MStoreTypedArrayElementHole. r=jandem https://hg.mozilla.org/integration/autoland/rev/031dee539212 Part 5: Remove unnecessary safepoint for LLoadTypedArrayElementHole. r=jandem https://hg.mozilla.org/integration/autoland/rev/c43819fbce22 Part 6: Add test case. r=jandem
Comment 11•10 months ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/329a180ed9a0
https://hg.mozilla.org/mozilla-central/rev/778475971875
https://hg.mozilla.org/mozilla-central/rev/984382fdbcd9
https://hg.mozilla.org/mozilla-central/rev/a5f9b78cf7ba
https://hg.mozilla.org/mozilla-central/rev/031dee539212
https://hg.mozilla.org/mozilla-central/rev/c43819fbce22
Updated•10 months ago
|
Description
•