866670 - IonMonkey: Fold unnecessary bitops after analyzing truncated instructions

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

Right now, unnecessary bitops like (x | 0) on an integer input are folded away during GVN.  This happens before range analysis though, and as a result information about the truncation is lost and operations like ((x + y) | 0) will usually require unnecessary overflow checks.

Folding unnecessary bitops seems to fit a different role than constant folding / CSE; this patch makes this step part of range analysis, done after instructions are marked as truncated.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 743036 [details] [diff] [review]
patch

Review of attachment 743036 [details] [diff] [review]:
-----------------------------------------------------------------

A similar pattern is ~~x; maybe BitNot should have the same treatment?

Does this have any effect on Octane-mandreel?

::: js/src/ion/MIR.cpp
@@ +878,5 @@
>  
>      if (IsConstant(rhs, -1))
>          return foldIfNegOne(1);
>  
> +    if (EqualValues(false, lhs, rhs))

Can we move this call to foldsTo, and s/false/useValueNumbers?

Comment 2

[Brian Hackett [Laid off!]]

I kept the EqualValues in foldUnnecessaryBitop(), as an (x | x) is doing conceptually the same thing as an (x | 0) and removing it in foldsTo() will cause the same problem that this bug is fixing.

https://hg.mozilla.org/integration/mozilla-inbound/rev/d53be0e3442d

Comment 3

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/mozilla-central/rev/d53be0e3442d