772265 - IonMonkey: Redundant movegroups in loop backedge

Status: NEW

(Core :: JavaScript Engine: JIT, defect)

Description

[Sean Stangl [:sstangl]]

Attachment: Generated LIR (Block 26).

Register allocation displays local silliness on a small allocation benchmark from dvander, related to earley-boyer. In the attached PNG image of the LIR after regalloc, Block 26 contains the following instructions:

(%esi is the loop counter)

> movegroup ()[=esi -> =eax]
> addi ([i:62 (=eax)]) (=eax), (c)
> movegroup ()[=eax -> =esi]

This is done in order to preserve the original value in a register in the case of bailout. 
We could trivially save a register move by reversing the logic to instead allocate a register for purposes of preserving the original value:

> movegroup ()[=esi -> =eax]
> addi (i:62 (=esi)]) (=esi), (c)

(Range analysis should also let us know that the add in question is infallible.)

Comment 1

[Sean Stangl [:sstangl]]

Attachment: Benchmark used.