Store base of data directly in typed arrays

RESOLVED FIXED in mozilla8

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: bhackett, Assigned: bhackett)

Tracking

Trunk
mozilla8
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
Per bug 664249 comment 34, handling of byte offsets in JM typed array ICs is incorrect, and slower than it needs to be.  Here is a testcase exposing the problem:

function f(x, y) {
  for (var i = 0; i < 100; i++)
    assertEq(x[0], y);
}
var a = ArrayBuffer(20);
var b = Int32Array(a, 12, 2);
var c = Int32Array(a, 0, 2);
b[0] = 10;
f(b, 10);
c[0] = 20;
f(c, 20);

> js test.js
> js -m test.js
test.js:3: Error: Assertion failed: got 10, expected 20

The base of the data in a typed array is split across two Values because it may be unaligned, and unaligned private pointers cannot be stored in Values on x64.  The .privateData of typed array JSObjects is unused, however, and can store unaligned pointers.  Using this instead allows fixing the ICs and faster accesses on the typed arrays.
(Assignee)

Comment 1

6 years ago
Created attachment 551928 [details] [diff] [review]
patch
Attachment #551928 - Flags: review?(mrbkap)
(Assignee)

Comment 2

6 years ago
Landing to JM for some post-merge greenification.

http://hg.mozilla.org/projects/jaegermonkey/rev/7f3e8f6ba47a

Updated

6 years ago
Attachment #551928 - Flags: review?(mrbkap) → review+

Updated

6 years ago
Blocks: 677854

Updated

6 years ago
No longer blocks: 677854
(Assignee)

Comment 3

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/d8838be30903
Whiteboard: inbound
Merged:
http://hg.mozilla.org/mozilla-central/rev/d8838be30903
Assignee: general → bhackett1024
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
OS: Mac OS X → All
Hardware: x86 → All
Resolution: --- → FIXED
Whiteboard: inbound
Target Milestone: --- → mozilla8
Version: unspecified → Trunk
Duplicate of this bug: 677854
You need to log in before you can comment on or make changes to this bug.