Bug 925586 - IonMonkey: Simplify MLoadTypedArrayElement and MLoadTypedArrayElementStatic range computation. r=nbp
authorDan Gohman <sunfish@google.com>
Tue, 15 Oct 2013 20:49:43 -0700
changeset 150869 0e58a7a4c393bdd27545c08a19985a95f344a1de
parent 150868 ea7391a5932319227cafe292122a99e6ae08206a
child 150870 d2a8732eeaef87577751be5a4e41e7761a39ed8a
push id25469
push usercbook@mozilla.com
push dateWed, 16 Oct 2013 10:46:01 +0000
treeherderautoland@afae5911a1e0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs925586
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 925586 - IonMonkey: Simplify MLoadTypedArrayElement and MLoadTypedArrayElementStatic range computation. r=nbp
js/src/jit/IonMacroAssembler.cpp
js/src/jit/RangeAnalysis.cpp
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -473,16 +473,20 @@ MacroAssembler::loadFromTypedArray(int a
         load32(src, dest.gpr());
         break;
       case ScalarTypeRepresentation::TYPE_UINT32:
         if (dest.isFloat()) {
             load32(src, temp);
             convertUInt32ToDouble(temp, dest.fpu());
         } else {
             load32(src, dest.gpr());
+
+            // Bail out if the value doesn't fit into a signed int32 value. This
+            // is what allows MLoadTypedArrayElement to have a type() of
+            // MIRType_Int32 for UInt32 array loads.
             test32(dest.gpr(), dest.gpr());
             j(Assembler::Signed, fail);
         }
         break;
       case ScalarTypeRepresentation::TYPE_FLOAT32:
         if (LIRGenerator::allowFloat32Optimizations()) {
             loadFloat(src, dest.fpu());
             canonicalizeFloat(dest.fpu());
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -1260,28 +1260,29 @@ static Range *GetTypedArrayRange(int typ
     }
 
   return nullptr;
 }
 
 void
 MLoadTypedArrayElement::computeRange()
 {
-    if (Range *range = GetTypedArrayRange(arrayType())) {
-        if (type() == MIRType_Int32 && !range->hasInt32UpperBound())
-            range->extendUInt32ToInt32Min();
-        setRange(range);
-    }
+    // We have an Int32 type and if this is a UInt32 load it may produce a value
+    // outside of our range, but we have a bailout to handle those cases.
+    setRange(GetTypedArrayRange(arrayType()));
 }
 
 void
 MLoadTypedArrayElementStatic::computeRange()
 {
-    if (Range *range = GetTypedArrayRange(typedArray_->type()))
-        setRange(range);
+    // We don't currently use MLoadTypedArrayElementStatic for uint32, so we
+    // don't have to worry about it returning a value outside our type.
+    JS_ASSERT(typedArray_->type() != ScalarTypeRepresentation::TYPE_UINT32);
+
+    setRange(GetTypedArrayRange(typedArray_->type()));
 }
 
 void
 MArrayLength::computeRange()
 {
     // Array lengths can go up to UINT32_MAX, but we only create MArrayLength
     // nodes when the value is known to be int32 (see the
     // OBJECT_FLAG_LENGTH_OVERFLOW flag).