891534 - IonMonkey: Use asm.js ops for truncated unsigned div or mod

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

asm.js uses specialized patterns on divisions or modulus ops like (x>>>0) / (y>>>0).  It would be good to use these for vanilla Ion compilation on these patterns, to avoid extra code and bailouts from the shifts.  The attached patch does this, and also allows division ops to be marked as truncated, which wasn't happening before (fixing bug 891055).  This improves vanilla x86 performance on asmjs-ubench-corrections from 65% slower than with asm.js to 9% slower.  A couple notes:

- The relevant division is of the form ((x>>>0) / (y>>>0)) >>> 0.  Changing the latter bit from >>> 0 to | 0 improves things so that performance is at parity between asm.js and vanilla compilation.  This change is valid to make and is consistent with how other integer operations behave in asm.js.

- This and many other range analysis truncation optimizations only work if the division or shifts have never overflowed while running in baseline.  Such operations will cause the div/shifts to use double arithmetic and go really slow.  This doesn't affect the corrections benchmark but will I think need to be fixed, probably by improving the range analysis so that it can respecialize arithmetic ops on int32s.

Comment 1

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/05bfd456e558

Comment 2

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/05bfd456e558