Support large array buffers in the JITs
Categories
(Core :: JavaScript Engine: JIT, task, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox87 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(23 files)
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details | |
(deleted),
text/x-phabricator-request
|
Details |
With the patches in bug 1686936, the remaining places where we don't support large ArrayBuffers are mostly JSAPIs and JIT code.
JIT support isn't trivial because we will need to do 64-bit bounds checks and sign-extend 32-bit indexes for that. I hope this will be acceptable perf-wise, else we could do this in Warp code only in zones that have created large ArrayBuffer views.
Assignee | ||
Comment 1•4 years ago
|
||
I have a working prototype for this that passes all jit-tests. I'm pretty happy with how it all turned out.
Needs more work and testing, but I'm going to start splitting it up and land preliminary pieces.
Assignee | ||
Comment 2•4 years ago
|
||
Based on convertDoubleToInt32.
On 32-bit platforms this is equivalent to convertDoubleToInt32 which will be
sufficient because the length limit doesn't change there. On 64-bit platforms
this will let us support large index values.
Assignee | ||
Comment 3•4 years ago
|
||
Depends on D102426
Assignee | ||
Comment 4•4 years ago
|
||
Based on spectreBoundsCheck32.
Depends on D102427
Assignee | ||
Comment 5•4 years ago
|
||
This matches branchAdd32 and branchSub32.
We will use branchSubPtr with Register and Imm32 in EmitDataViewBoundsCheck.
Depends on D102428
Assignee | ||
Comment 6•4 years ago
|
||
The next patch will add spectreMaskIndexPtr.
Depends on D102429
Assignee | ||
Comment 7•4 years ago
|
||
Baesd on spectreMaskIndex32 and cmp32Move32.
Depends on D102430
Assignee | ||
Updated•4 years ago
|
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/7f2bc0012c45 part 1 - Add convertDoubleToPtr to the MacroAssembler. r=anba https://hg.mozilla.org/integration/autoland/rev/4c037df6bd90 part 2 - Add move32SignExtendToPtr to the MacroAssembler. r=anba https://hg.mozilla.org/integration/autoland/rev/ca92ee4304ac part 3 - Add spectreBoundsCheckPtr to the MacroAssembler. r=anba https://hg.mozilla.org/integration/autoland/rev/d034802fb52f part 4 - Templatize branchAddPtr and branchSubPtr. r=anba https://hg.mozilla.org/integration/autoland/rev/52db39728006 part 5 - Rename spectreMaskIndex to spectreMaskIndex32. r=anba https://hg.mozilla.org/integration/autoland/rev/609249cb8b2c part 6 - Add spectreMaskIndexPtr to the MacroAssembler. r=anba
Comment 9•4 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/7f2bc0012c45
https://hg.mozilla.org/mozilla-central/rev/4c037df6bd90
https://hg.mozilla.org/mozilla-central/rev/ca92ee4304ac
https://hg.mozilla.org/mozilla-central/rev/d034802fb52f
https://hg.mozilla.org/mozilla-central/rev/52db39728006
https://hg.mozilla.org/mozilla-central/rev/609249cb8b2c
Assignee | ||
Comment 10•4 years ago
|
||
Tests based on the Int32 tests, with changes/tests for very large/small values.
Assignee | ||
Comment 11•4 years ago
|
||
This matches what we do for similar cases like MLoadUnboxedScalar.
A later patch will change the operand type to MIRType::IntPtr and that's easier
if there's no type policy to worry about.
Depends on D102724
Assignee | ||
Comment 12•4 years ago
|
||
This is the type that will be used to represent indexes/offsets into TypedArray
and DataView objects.
Depends on D102725
Assignee | ||
Comment 13•4 years ago
|
||
This will be used later for transpiling LoadTypedArrayElementExistsResult.
Depends on D102726
Assignee | ||
Comment 14•4 years ago
|
||
The alternative is to add support for MIRType::IntPtr to MSub and MMinMax which
seemed more complicated.
This also matches the IC code in EmitDataViewBoundsCheck. A later patch will
change codegen to branchSubPtr.
Depends on D102727
Assignee | ||
Comment 15•4 years ago
|
||
This will be useful for folding constant indexes to IntPtr in later patches.
Because we can't have different MConstant constructors with int64_t and intptr_t
arguments, reuse the one that takes int64_t by adding a MIRType argument to it.
Depends on D102728
Assignee | ||
Comment 16•4 years ago
|
||
Depends on D102729
Assignee | ||
Comment 17•4 years ago
|
||
This is similar to ValueTagOperandId. Later patches will use this type.
Depends on D102730
Assignee | ||
Comment 18•4 years ago
|
||
The variants that load an int32 value now take an optional Label that's used if
the index doesn't fit in an int32.
The Label argument is optional at this point so that we don't have to touch all
the callers, but later patches will change that.
Depends on D102731
Assignee | ||
Comment 19•4 years ago
|
||
Eventually we should optimize the result-is-double case too.
Depends on D102732
Assignee | ||
Comment 20•4 years ago
|
||
Depends on D102733
Assignee | ||
Comment 21•4 years ago
|
||
This also adds the IntPtr implementation that will later be used for bounds checks.
Depends on D102734
Assignee | ||
Comment 22•4 years ago
|
||
Depends on D102735
Assignee | ||
Comment 23•4 years ago
|
||
Depends on D102736
Assignee | ||
Comment 24•4 years ago
|
||
Depends on D102737
Assignee | ||
Comment 25•4 years ago
|
||
This switches all CacheIR and MIR instructions that use a TypedArray or DataView
index from Int32 to IntPtr.
The int32-index and non-int32-index cases in the GetElem/SetElem/In CacheIR generators
are now unified into a single method. This way it's easy to see that in-bounds Int32
and Double indexes are handled exactly the same way.
The IRGenerators call IRGenerator::guardToIntPtrIndex to convert key values to an
IntPtrOperandId. All TypedArray/DataView accesses optimized by CacheIR go through
there now.
The GuardToTypedArrayIndex CacheIR and MIR instruction is replaced with a similar
GuardNumberToIntPtrIndex instruction. It accepts a Number instead of a Value.
Depends on D102738
Updated•4 years ago
|
Assignee | ||
Comment 26•4 years ago
|
||
Adds useRegisterOrIndexConstant to check this during lowering, and also uses
ArrayOffsetFitsInInt32 in codegen to assert no overflow.
Comment 27•4 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/f48f084d1b07 part 7 - Add NumberEqualsInt64 and NumberIsInt64 to MFBT. r=sg https://hg.mozilla.org/integration/autoland/rev/55faa30d1d32 part 8 - Don't use a type policy for the index argument for atomics. r=anba https://hg.mozilla.org/integration/autoland/rev/cdd1a0427206 part 9 - Add MIRType::IntPtr. r=anba https://hg.mozilla.org/integration/autoland/rev/242a6e9d5466 part 10 - Add MCompare::Compare_UIntPtr. r=anba https://hg.mozilla.org/integration/autoland/rev/c8f373bd71a5 part 11 - Add MAdjustDataViewLength. r=anba https://hg.mozilla.org/integration/autoland/rev/9dbff11bb583 part 12 - Add support for IntPtr MConstants. r=anba https://hg.mozilla.org/integration/autoland/rev/11f74ecada8f part 13 - Add MInt32ToIntPtr. r=anba
Comment 28•4 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/165c5f46f3b6 part 14 - Add IntPtrOperandId. r=anba https://hg.mozilla.org/integration/autoland/rev/7a28b297920d part 15 - MacroAssembler changes for loading buffer lengths/offsets. r=anba https://hg.mozilla.org/integration/autoland/rev/10359c97a16d part 16 - Guard ArrayBuffer byteLength fits in int32 for JIT fast paths. r=anba https://hg.mozilla.org/integration/autoland/rev/4feb15e5cb8c part 17 - Guard ArrayBufferView byteOffset fits in int32 for JIT fast paths. r=anba https://hg.mozilla.org/integration/autoland/rev/32f439b0662a part 18 - Guard ArrayBufferView length fits in int32 for JIT fast paths. r=anba
Comment 29•4 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/f48f084d1b07
https://hg.mozilla.org/mozilla-central/rev/55faa30d1d32
https://hg.mozilla.org/mozilla-central/rev/cdd1a0427206
https://hg.mozilla.org/mozilla-central/rev/242a6e9d5466
https://hg.mozilla.org/mozilla-central/rev/c8f373bd71a5
https://hg.mozilla.org/mozilla-central/rev/9dbff11bb583
https://hg.mozilla.org/mozilla-central/rev/11f74ecada8f
Comment 30•4 years ago
|
||
bugherder |
Comment 31•4 years ago
|
||
Pushed by jdemooij@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/9263fbf533e0 part 19 - Add IntPtr support to MBoundsCheck and MSpectreMaskIndex. r=anba https://hg.mozilla.org/integration/autoland/rev/ed004d2c8864 part 20 - Support bounds check optimizations when the index is MInt32ToIntPtr. r=anba,iain https://hg.mozilla.org/integration/autoland/rev/44be7a953533 part 21 - Change Atomics VM functions to take index as size_t instead of int32_t. r=anba https://hg.mozilla.org/integration/autoland/rev/29c981446c38 part 22 - Guard against int32 overflow in offset computations. r=anba https://hg.mozilla.org/integration/autoland/rev/2610d2d33a73 part 23 - Add JIT support for large buffers. r=anba
Comment 32•4 years ago
|
||
bugherder |
Assignee | ||
Updated•4 years ago
|
Description
•