585915 - JM: remove stores for loop condition values

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Consider a loop like this:
for(var j=0; j<100

Comment 1

[Jan de Mooij [:jandem]]

Argh, second part was not submitted.
But for this loop:

for(var j=0; j<100000; j++) {} we generate this code:

   0xf7fc831b:	mov    0x78(%ebx),%edx
   0xf7fc831e:	mov    %edx,%esi
   0xf7fc8320:	add    $0x1,%esi
   0xf7fc8323:	jo     0xf7fc86e2
   0xf7fc8329:	mov    %esi,0x78(%ebx)
   0xf7fc832c:	mov    0x7c(%ebx),%edi
   0xf7fc832f:	mov    0x78(%ebx),%esi
   0xf7fc8332:	cmp    $0xffff0001,%edi
   0xf7fc8338:	jne    0xf7fc8714
-> 0xf7fc833e:	movl   $0xffff0001,0x8c(%ebx)
-> 0xf7fc8348:	movl   $0xf4240,0x88(%ebx)
-> 0xf7fc8352:	mov    %esi,0x80(%ebx)
-> 0xf7fc8358:	mov    %edi,0x84(%ebx)
   0xf7fc835e:	cmp    $0xf4240,%esi
   0xf7fc8364:	jl     0xf7fc82f8

The marked lines should be removed.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Patch

This patch reduces the loop to:

   0xf7fc831b:	mov    0x78(%ebx),%edx
   0xf7fc831e:	mov    %edx,%esi
   0xf7fc8320:	add    $0x1,%esi
   0xf7fc8323:	jo     0xf7fc86a2
   0xf7fc8329:	mov    %esi,0x78(%ebx)
   0xf7fc832c:	mov    0x7c(%ebx),%edi
   0xf7fc832f:	mov    0x78(%ebx),%esi
   0xf7fc8332:	cmp    $0xffff0001,%edi
   0xf7fc8338:	jne    0xf7fc86d4
   0xf7fc833e:	cmp    $0xf4240,%esi
   0xf7fc8344:	jl     0xf7fc82f8

This passes trace-tests. Reduces time for an empty-loop microbenchmark from 390ms. to 300ms. Probably a few ms. on SS/V8 on awfy.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 464373 [details] [diff] [review]
Patch

Nice! The sub-optimal ordering looks like a regression from bug 579225.

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/1fa8cdc8b328

Comment 4

[Jan de Mooij [:jandem]]

Thanks, marking fixed then.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

Looks like this was about 6ms on regress-x86 (2ms on main, might be noisy).