1657552 - Replace branchTestObject + unboxObject sequences with fallibleUnboxObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P1)

Description

[André Bargull [:anba]]

Seeing fallibleUnboxObject over in https://phabricator.services.mozilla.com/D85991 reminded me that we have some branchTestObject followed by unboxObject sequences which can be optimised to use fallibleUnboxObject instead.

fallibleUnboxObject generates better code on x64 systems.

[[Codegen] # instruction ValueToObject
[Codegen] movq       %rcx, %r11
[Codegen] shrq       $47, %r11
[Codegen] cmpl       $0x1fffc, %r11d
[Codegen] jne        .Lfrom141
[Codegen] movabsq    $0xfffe000000000000, %rax
[Codegen] xorq       %rcx, %rax

with fallibleUnboxObject:

[Codegen] # instruction ValueToObject
[Codegen] movabsq    $0xfffe000000000000, %r11
[Codegen] xorq       %rcx, %r11
[Codegen] movq       %r11, %rax
[Codegen] shrq       $47, %r11
[Codegen] jne        .Lfrom147

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1657552 - Part 1: Use fallibleUnboxObject to test + unbox objects. r=jandem!

Replace sequences of branchTestObject followed by unboxObject with a
single call to fallibleUnboxObject.

fallibleUnboxObject(src, dst, fail) clobbers dst on failure, so for each
updated call site we need to make sure dst isn't used when we jump to fail.

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1657552 - Part 2: Use fallibleUnbox(Boolean|Int32) to unbox boolean/int32. r=jandem!

Depends on D86158

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/608d51ea71e7
Part 1: Use fallibleUnboxObject to test + unbox objects. r=jandem
https://hg.mozilla.org/integration/autoland/rev/7cb94a7bb583
Part 2: Use fallibleUnbox(Boolean|Int32) to unbox boolean/int32. r=jandem

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/608d51ea71e7
https://hg.mozilla.org/mozilla-central/rev/7cb94a7bb583