897470 - Support asm.js using intel MPX instructions

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

From my quick read of the specification (http://software.intel.com/sites/default/files/319433-015.pdf), these instructions seem reasonably well suited to the bounds checking needs of asm.js. They allow specifying a lower and upper bound such that all memory accesses outside of that bound will throw a bound range exception.

Emulation of these instructions is supported with the Intel Software Development Emulator.

Comment 1

[lwagner]

This looks interesting.  On a quick first reading, I'm a little disappointed that MPX seems to require explicit bounds-check instructions instead of adding a prefix on load/store instructions (which is what I hoped).  Since we don't require any explicit bounds checking on x64, I expect this would only benefit x86.  By the time these instructions roll out in new processors, though, I wonder if we wouldn't be shipping FF 64-bit, though ;)