1640829 - Generate more efficient code for fallible unbox

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P2)

Description

[Jan de Mooij [:jandem]]

Now that we use XOR to unbox Values (since Spectre), we can optimize fallible unboxing a bit more. To unbox a Value in rax to an object in rbx on x64, instead of generating this:

movq       %rax, %r11
shrq       $47, %r11
cmpl       $0x1fffc, %r11d
jne        <bail>
movabsq    $0xfffe000000000000, %rbx
xorq       %rax, %rbx

We can do this:

movabsq    $0xfffe000000000000, %r11
xorq       %rax, %r11
movq       %r11, %rbx
shrq       $47, %r11
jnz        <bail>

The new version on ARM64:

eor       x2, x1, #0xfffe000000000000
cmp       xzr, x2, lsr 47
bne       <bail>

This is a measurable win on some benchmarks with Warp enabled.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Bug 1640829 part 1 - Add some missing branchTestSymbol and unboxInt32/unboxBoolean overloads. r?iain!

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1640829 part 2 - Add fallibleUnbox* methods to the MacroAssembler. r?iain!

On 64-bit platforms we can generate better code for a fallible unbox by first
doing a XOR to unbox and then doing the type check with a right-shift + check-non-zero.

For int32 and boolean we still use a separate branch + unbox: these types can be
unboxed more efficiently because they only use 32 payload bits.

Depends on D76827

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Bug 1640829 part 3 - Use fallibleUnbox* for LUnbox on 64-bit platforms. r?iain!

Depends on D76828

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 1640829 part 4 - Use fallibleUnbox* in EmitLoadAndUnbox. r?iain!

Also adds support for object/string/symbol/bigint to the FoldLoadsWithUnbox
optimization pass: with the old unboxing scheme this would have been inefficient
on 64-bit platforms (loading the Value twice, for type guard and unbox) but
fallibleUnboxPtr now does a single load on x64 and ARM64.

Depends on D76829

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e0c0917c6826
part 1 - Add some missing branchTestSymbol and unboxInt32/unboxBoolean overloads. r=iain
https://hg.mozilla.org/integration/autoland/rev/b53f40d2b305
part 2 - Add fallibleUnbox* methods to the MacroAssembler. r=iain
https://hg.mozilla.org/integration/autoland/rev/abc180c57420
part 3 - Use fallibleUnbox* for LUnbox on 64-bit platforms. r=iain
https://hg.mozilla.org/integration/autoland/rev/abab86b25b5f
part 4 - Use fallibleUnbox* in EmitLoadAndUnbox. r=iain

Comment 6

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/e0c0917c6826
https://hg.mozilla.org/mozilla-central/rev/b53f40d2b305
https://hg.mozilla.org/mozilla-central/rev/abc180c57420
https://hg.mozilla.org/mozilla-central/rev/abab86b25b5f