Closed Bug 1536699 Opened 2 years ago Closed 10 months ago

Enable TypedArray JIT optimizations for Big(U)Int64Array


(Core :: JavaScript Engine: JIT, enhancement, P2)




Tracking Status
firefox68 --- wontfix
firefox78 --- fixed


(Reporter: terpri, Assigned: anba)




(6 files)

ElementAccessIsTypedArray should return true for BigInt scalar types. Currently it returns false in order to bypass TypedArray-specific JIT optimizations that aren't yet implemented for BigInt.

Blocks: 1456569
Priority: -- → P2

v. review comments from bug 1456569 for optimization ideas from :wingo and :Waldo

Required for bug 1631920.

Running with --no-threads --warp

var ta = new BigInt64Array(2);
var q = 0;
for (var i = 0; i < 10000; ++i) {
  if (ta[i&1]) q++;

asserts with Assertion failure: IsNumberType(ins->type()) || ins->type() == MIRType::Boolean, at /home/andre/hg/mozilla-inbound/js/src/jit/Lowering.cpp:3486.

Assignee: nobody → andrebargull
Blocks: 1631920

These functions are needed for the next parts.

There are too few registers available on x86, therefore LLoadTypedArrayElementHoleBigInt
is reusing the ValueOperand's type register, similar to CacheIRCompiler::emitLoadTypedElementResult.

LLoadUnboxedBigInt and LLoadTypedArrayElementHoleBigInt are both using an OOL vm-call
if the result BigInt can't be allocated inline, similar to CodeGenerator::visitInt64ToBigInt.

Depends on D72639

The next part needs ToBigIntPolicy when storing BigInts into a typed array.

MToBigInt is currently only used as part of ToBigIntPolicy, therefore we
have to bailout for effectful operations, like ToBigInt(object). Only strings
and booleans can be handled without a bailout.

Depends on D72640

Also adds Register64::scratchReg() to make sure we don't run out of registers on x86.

Depends on D72641

LLoadTypedArrayElementHole used to need to a safepoint for a vm-call (bug 737783),
but this vm-call was later removed in bug 829896.

Depends on D72642

Thanks for catching and fixing this issue! Can you also land the testcase?

Depends on D72643

Pushed by
Part 1: Add missing helpers for Register64. r=jandem
Part 2: Support BigInts in MLoadUnboxedScalar and MLoadTypedArrayElementHole. r=jandem
Part 3: Add MToBigInt and ToBigIntPolicy. r=jandem
Part 4: Support BigInts in MStoreUnboxedScalar and MStoreTypedArrayElementHole. r=jandem
Part 5: Remove unnecessary safepoint for LLoadTypedArrayElementHole. r=jandem
Part 6: Add test case. r=jandem
You need to log in before you can comment on or make changes to this bug.