Bug 1104647 - IonMonkey: Implement MathFunction(Floor) recover instruction r=nbp
authorJeff Hemphill <jthemphill@gmail.com>
Wed, 08 Nov 2017 15:42:57 +0000
changeset 444016 6203d3f7c36df8dca1c0a0baf0efbad9137ea7bc
parent 444015 e47ba5950c9ce450b2c5df03cc5ee02dd9815816
child 444017 b69cb7c76bcd141264877059abef4848690d687f
push id1618
push userCallek@gmail.com
push dateThu, 11 Jan 2018 17:45:48 +0000
treeherdermozilla-release@882ca853e05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1104647
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1104647 - IonMonkey: Implement MathFunction(Floor) recover instruction r=nbp
js/src/jit-test/tests/ion/rinstructions-no-sse4.js
js/src/jit/MIR.h
js/src/jit/Recover.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/rinstructions-no-sse4.js
@@ -0,0 +1,37 @@
+// |jit-test| --no-sse4;
+
+// This test is a fork of dce-with-rinstructions.js. It tests recover
+// instructions which are only executed on pre-SSE4 processors.
+
+setJitCompilerOption("baseline.warmup.trigger", 10);
+setJitCompilerOption("ion.warmup.trigger", 20);
+
+const max = 200;
+
+// Check that we are able to remove the operation inside recover test
+// functions (denoted by "rop..."), when we inline the first version
+// of uceFault, and ensure that the bailout is correct when uceFault
+// is replaced (which cause an invalidation bailout)
+let uceFault = function (i) {
+    if (i > 98)
+        uceFault = function (i) { return true; };
+    return false;
+};
+
+let uceFault_floor_double = eval(
+    uneval(uceFault)
+        .replace('uceFault', 'uceFault_floor_double')
+);
+function rfloor_double(i) {
+    const x = Math.floor(i + (-1 >>> 0));
+    if (uceFault_floor_double(i) || uceFault_floor_double(i))
+        assertEq(x, 99 + (-1 >>> 0)); /* = i + 2 ^ 32 - 1 */
+    assertRecoveredOnBailout(x, true);
+    return i;
+}
+
+for (let j = 100 - max; j < 100; j++) {
+    with({}){} // Do not Ion-compile this loop.
+    const i = j < 2 ? (Math.abs(j) % 50) + 2 : j;
+    rfloor_double(i);
+}
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7012,16 +7012,17 @@ class MMathFunction
     void computeRange(TempAllocator& alloc) override;
     MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;
     bool canRecoverOnBailout() const override {
         if (input()->type() == MIRType::SinCosDouble)
             return false;
         switch(function_) {
           case Sin:
           case Log:
+          case Floor:
           case Round:
             return true;
           default:
             return false;
         }
     }
 
     ALLOW_CLONE(MMathFunction)
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -957,16 +957,19 @@ RHypot::recover(JSContext* cx, SnapshotI
     return true;
 }
 
 bool
 MMathFunction::writeRecoverData(CompactBufferWriter& writer) const
 {
     MOZ_ASSERT(canRecoverOnBailout());
     switch (function_) {
+      case Floor:
+        writer.writeUnsigned(uint32_t(RInstruction::Recover_Floor));
+        return true;
       case Round:
         writer.writeUnsigned(uint32_t(RInstruction::Recover_Round));
         return true;
       case Sin:
       case Log:
         writer.writeUnsigned(uint32_t(RInstruction::Recover_MathFunction));
         writer.writeByte(function_);
         return true;