677045 - IonMonkey: Type analyzer inefficiency with phis

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

In the following code:

var f = function (y) {
    var x = y;
    for (var i = 1; i; i = i + 1) {
        x = x & i;
    }
    return x;
}

The type analyzer does not recognize that the argument |y| is only ever used as an int32, and places an unbox instruction inside the loop which generates really inefficient code:

=> 0xf73ed179:  cmpl   $0xffffff81,0x7c(%esp)
=> 0xf73ed17e:  jne    0xf73ed004
=> 0xf73ed184:  test   %ebp,%ebp
=> 0xf73ed186:  jne    0xf73ed198
=> 0xf73ed198:  and    %ebp,%esi
=> 0xf73ed19a:  add    $0x1,%ebp
=> 0xf73ed1a2:  mov    %edi,0x7c(%esp)
=> 0xf73ed1a6:  jmp    0xf73ed179

The reason is that the only use |y| is a phi and phis are not propagating observed types.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

This patch propagates observed types from phis, and also makes Unbox idempotent. Now we get, for this loop:

=> 0xf73ed17e:  test   %esi,%esi
=> 0xf73ed180:  jne    0xf73ed192
=> 0xf73ed192:  and    %esi,%edi
=> 0xf73ed194:  add    $0x1,%esi
=> 0xf73ed197:  jmp    0xf73ed17e

Comment 2

[Tom S. (please needinfo tschuster)]

http://hg.mozilla.org/projects/ionmonkey/rev/c88d2ecb2472