771835 - IonMonkey: handle x[v + i] during bounds check hoisting

Status: NEW

(Core :: JavaScript Engine, defect, P5)

Description

[Brian Hackett [Laid off!]]

Bounds check hoisting currently fails for accesses of the form x[v + i], when x and v are loop invariant.  Array traversals in autoranslated code will look like this, rather than the usual x[i], as x is a big typed array and v is the base address of some allocated subarray of x.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 639994 [details] [diff] [review]
patch

Review of attachment 639994 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/LICM.cpp
@@ +465,5 @@
>  
> +    // Check if lhs in the conditional matches the bounds check index, in
> +    // either the form (lhs + indexN) or (lhs + extra + indexN) for loop
> +    // invariant extra. The latter pattern is important for JS translated from
> +    // C/C++, where the accessed array is a giant typed array and y indicates

What does "y" refer to in this comment?

@@ +504,2 @@
>          return;
> +    } while (0);

Please separate out the above block into a separate function, since tryHoistBoundsCheck is getting pretty long.

Comment 3

[Iain Ireland [:iain]]

This was motivated by asm.js and its predecessors, which have all been superseded by wasm. Unless we see other real-world examples of this pattern, it's not a high priority.