866137 - IonMonkey: Teach range analysis about LoadTypedArrayElement

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

On the testcase below the "arr[3] + arr[4]" expression has an overflow check. We should add range information to LoadTypedArrayElement so that we can eliminate these.

function f(arr) {
    var res = 0;
    for (var i=0; i<2000; i++) {
	res = arr[3] + arr[4];
	arr[3] = 3;
    }
    return res;
}
var a = new Uint8Array(100);
f(a);

Comment 1

[Dan Gohman [:sunfish]]

Attachment: a proposed fix

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 770027 [details] [diff] [review]
a proposed fix

Review of attachment 770027 [details] [diff] [review]:
-----------------------------------------------------------------

Nice, thanks for stealing this. r=me with nits addressed.

::: js/src/ion/RangeAnalysis.cpp
@@ +768,5 @@
>      Range input(getOperand(0));
>      setRange(new Range(input.lower(), input.upper()));
>  }
>  
> +static Range *GetTypedArrayRange(int type) {

Nit: format like this:

static Range *
GetTypedArrayRange(int type)
{
    ...

@@ +770,5 @@
>  }
>  
> +static Range *GetTypedArrayRange(int type) {
> +  switch (type) {
> +  case TypedArray::TYPE_UINT8_CLAMPED:

Nit: indent the switch with 4 spaces, and every case with 2 more spaces.

Comment 3

[Dan Gohman [:sunfish]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/49c410370ad6

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/49c410370ad6