2090328 - [riscv64] Fold the low twelve bits of an absolute address into the access

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task)

Description

[Andrew Gaul]

load32, loadPtr, store32 and storePtr of an AbsoluteAddress on riscv64, and inc64, load the whole address into a scratch register and then access offset 0 through it. ma_li ends the address with an addi of its low twelve bits, which the access's own 12-bit offset can take instead. For example the stack limit check in an Ion prologue

  lui   t5, 0xfe4
  addiw t5, t5, 0x58f
  slli  t5, t5, 0xe
  addi  t5, t5, 0x218
  ld    t4, 0x0(t5)
  bgeu  t4, sp, <ool>

becomes

  lui   t5, 0xfe4
  addiw t5, t5, 0x58f
  slli  t5, t5, 0xe
  ld    t4, 0x218(t5)
  bgeu  t4, sp, <ool>

The branch32, branchPtr and branchTest32 overloads that take an AbsoluteAddress go through load32 and loadPtr, so this also covers the interrupt checks at Ion and Baseline loop heads and the stack checks in Baseline code and regexps.

In a JetStream 3 run on a SpacemiT K3 this removes one instruction from about 226,000 accesses: 118,000 in Ion code, 86,000 in Baseline code and 21,000 in regexps. Code that loads such an address with movePtr and then accesses it, like the nursery's bump allocation, is unchanged. The JetStream 3 score shows no measurable change (+0.25% over five alternating pairs, within noise).

Found with riscvlint.

Comment 1

[Andrew Gaul]

Attachment: Bug 2090328 - [riscv64] Fold the low twelve bits of an absolute address into the access. r?csmantle

load32, loadPtr, store32 and storePtr of an AbsoluteAddress, and inc64,
loaded the whole address into a scratch register and then accessed
offset 0 through it. ma_li ends the address with an addi of its low
twelve bits, which the access's own 12-bit offset can take instead, so
load the address without them and use them as the offset. The branch32,
branchPtr and branchTest32 overloads that take an AbsoluteAddress go
through load32 and loadPtr.

The stack limit check in an Ion prologue:

lui t5, 0xfe4
addiw t5, t5, 0x58f
slli t5, t5, 0xe
addi t5, t5, 0x218
ld t4, 0x0(t5)
bgeu t4, sp, <ool>

becomes

lui t5, 0xfe4
addiw t5, t5, 0x58f
slli t5, t5, 0xe
ld t4, 0x218(t5)
bgeu t4, sp, <ool>

In a JetStream 3 run on a SpacemiT K3 this shortens about 226,000
accesses by an instruction each: 118,000 in Ion code, 86,000 in Baseline
code and 21,000 in regexps. Code that loads such an address with movePtr
and then accesses it, like the nursery's bump allocation, is unchanged.

Found with riscvlint.

Co-Authored-By: Claude Opus 5.5 <[e-mail]>

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/143ecaa96637
https://hg.mozilla.org/integration/autoland/rev/ada87d71d164
[riscv64] Fold the low twelve bits of an absolute address into the access. r=csmantle

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/ada87d71d164