Closed Bug 1657552 Opened 6 months ago Closed 5 months ago

Replace branchTestObject + unboxObject sequences with fallibleUnboxObject

Categories

(Core :: JavaScript Engine: JIT, enhancement, P1)

enhancement

Tracking

()

RESOLVED FIXED
81 Branch
Tracking Status
firefox81 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(2 files)

Seeing fallibleUnboxObject over in https://phabricator.services.mozilla.com/D85991 reminded me that we have some branchTestObject followed by unboxObject sequences which can be optimised to use fallibleUnboxObject instead.

fallibleUnboxObject generates better code on x64 systems.

[[Codegen] # instruction ValueToObject
[Codegen] movq       %rcx, %r11
[Codegen] shrq       $47, %r11
[Codegen] cmpl       $0x1fffc, %r11d
[Codegen] jne        .Lfrom141
[Codegen] movabsq    $0xfffe000000000000, %rax
[Codegen] xorq       %rcx, %rax

with fallibleUnboxObject:

[Codegen] # instruction ValueToObject
[Codegen] movabsq    $0xfffe000000000000, %r11
[Codegen] xorq       %rcx, %r11
[Codegen] movq       %r11, %rax
[Codegen] shrq       $47, %r11
[Codegen] jne        .Lfrom147

Replace sequences of branchTestObject followed by unboxObject with a
single call to fallibleUnboxObject.

fallibleUnboxObject(src, dst, fail) clobbers dst on failure, so for each
updated call site we need to make sure dst isn't used when we jump to fail.

Severity: -- → N/A
Priority: -- → P1
Pushed by abutkovits@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/608d51ea71e7
Part 1: Use fallibleUnboxObject to test + unbox objects. r=jandem
https://hg.mozilla.org/integration/autoland/rev/7cb94a7bb583
Part 2: Use fallibleUnbox(Boolean|Int32) to unbox boolean/int32. r=jandem
Status: ASSIGNED → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
You need to log in before you can comment on or make changes to this bug.