1679121 - Warp: Make Number.is{Safe}Integer inlinable again

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[André Bargull [:anba]]

Ion used to be able to inline Number.is{Safe}Integer() and also inline away most of its instructions.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1679121 - Part 1: Use Math.trunc() in Number.is{Safe}Integer. r=iain!

Instead of Math.abs() and Math.floor(), directly use Math.trunc() in
both Number.isInteger() and Number.isSafeInteger(). Also replace the last
if-statement in Number.isSafeInteger() with a return statement to avoid
exceeding the small, inlinable function size limit. And add a test to ensure we
don't regress that size limit.

Drive-by change:

• Remove the function declaration for OptimizationInfo::isSmallFunction().

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1679121 - Part 2: Optimise Math.{ceil, floor, round, trunc} with int32 inputs in CacheIR and Warp. r=iain!

MCallOptimize optimised away int32 inputs to Math.{ceil, floor, round, trunc}.
Add the same optimisation to CacheIR, so Warp can also optimise these calls
away.

Depends on D97910

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1679121 - Part 3: Change GuardIsNumber to use MToDouble for Int32 inputs. r=iain!

MUnbox was previously using BoxInputsPolicy and BoxInputsPolicy has an
optimisation to reuse the input of MUnbox operands, see BoxAt(). This
prevented to use the MToDouble optimisation in MUnbox::foldsTo(), which
in turn disabled the MToDouble optimisation in
MCompare::evaluateConstantOperands().

This issue prevented to optimise away the integer <= (2 ** 53) - 1 check
in Number.isSafeInteger when it is called with int32 inputs:

When Number.isSafeInteger(number) was called with number being an int32,
the call to Math.trunc(number) was correctly optimised away. But then CacheIR
was using CompareDoubleResult for integer <= (2 ** 53) - 1, which applies
GuardIsNumber on both inputs. GuardIsNumber is transpiled to MUnbox, so
we ended up with unbox input to Double. But when input is already another
MUnbox, we get unbox (unbox value to Int32) to Double and BoxAt() was
then reusing the previous MUnbox and returned unbox value to Double. This
prevented applying the MToDouble optimisation in MUnbox::foldsTo(), which
then prevented the other MToDouble optimisation in
MCompare::evaluateConstantOperands(). Therefore we couldn't successfully
optimise away the whole integer <= (2 ** 53) - 1 comparison, even though we
knew that integer was an int32 and therefore is always lower than the safe
integer limit.

Depends on D97911

Comment 4

[André Bargull [:anba]]

Attachment: Bug 1679121 - Part 4: Fold same operands in MSub when returning int32. r=iain!

This change allows to optimise away the number - integer === 0 comparison
in Number.is{Safe}Integer() for int32 inputs.

Depends on D97912

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5dcf6e5a3f6f
Part 1: Use Math.trunc() in Number.is{Safe}Integer. r=iain
https://hg.mozilla.org/integration/autoland/rev/1f893388f957
Part 2: Optimise Math.{ceil, floor, round, trunc} with int32 inputs in CacheIR and Warp. r=iain
https://hg.mozilla.org/integration/autoland/rev/940b0d3275f3
Part 3: Change GuardIsNumber to use MToDouble for Int32 inputs. r=iain
https://hg.mozilla.org/integration/autoland/rev/7c9098ae666d
Part 4: Fold same operands in MSub when returning int32. r=iain

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/5dcf6e5a3f6f
https://hg.mozilla.org/mozilla-central/rev/1f893388f957
https://hg.mozilla.org/mozilla-central/rev/940b0d3275f3
https://hg.mozilla.org/mozilla-central/rev/7c9098ae666d