810375 - BaselineCompiler: Support local/arg inc/dec ops

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Part 1: Ignore decomposed ops

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Part 2: Implement JSOP_POS

Uses an inline path for int32 and double. We can test for both with a single compare and in these cases POS is a no-op.

Comment 3

[Jan de Mooij [:jandem]]

Attachment: Part 3: Implement JSOP_DUP

i++ is decomposed as

getlocal 0
pos
dup
one
add
setlocal 0

The patch doesn't attempt to DUP unsynced constants etc directly. There are probably other uses of DUP but here it doesn't matter.

Comment 4

[Kannan Vijayan [:djvj]]

There's something I don't understand about decomposed ops.  JSOP_LOCALINC has the decompose flag set on it, but in the emitted bytecode it doesn't actually seem to be decomposed.

The couple of other inc ops I checked actually had the surrogate ops emitted, but not LOCALINC.  Is there something I'm missing?

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Kannan Vijayan [:djvj] from comment #4)
> There's something I don't understand about decomposed ops.  JSOP_LOCALINC
> has the decompose flag set on it, but in the emitted bytecode it doesn't
> actually seem to be decomposed.

Are you using a recent build? Local/arg ops were decomposed in bug 804636.

js> dis(function() { var i; i++; });
flags: LAMBDA
loc     op
-----   --
main:
00000:  getlocal 0
00003:  pop
00004:  localinc 11
00007:  getlocal 0
00010:  pos
00011:  dup
00012:  one
00013:  add
00014:  setlocal 0
00017:  pop
00018:  pop
00019:  stop

Comment 6

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/6942d3709009
https://hg.mozilla.org/projects/ionmonkey/rev/79b5f9e429d0
https://hg.mozilla.org/projects/ionmonkey/rev/281c54efd991