Open
Bug 1691919
Opened 4 years ago
Updated 2 years ago
Figure out what to do with the AnalyzeLoadUnboxedScalar optimization
Categories
(Core :: JavaScript Engine: JIT, task, P3)
Core
JavaScript Engine: JIT
Tracking
()
NEW
People
(Reporter: jandem, Unassigned)
Details
Attachments
(1 file)
(deleted),
text/x-phabricator-request
|
Details |
This optimization has no effect if Spectre mitigations are enabled, due to MSpectreMaskIndex
.
Furthermore, it doesn't know about MInt32ToIntPtr
. I tried to fix this and it works on a local test case, but I couldn't get it to trigger on any jit-tests (tested with MOZ_CRASH
+ running jit-tests with various shell flags) or Octane. All of this with Spectre mitigations off.
It's possible this optimization was more valuable with IonBuilder/TI because it was able to bake in the array length for asm.js style workloads.
Reporter | ||
Comment 1•4 years ago
|
||
Reporter | ||
Comment 2•4 years ago
|
||
The WIP patch works for this test case, with --spectre-mitigations=off
:
function f(ta) {
var res = 0;
for (var i = 0; i < 3000; i++) {
res += ta[i + 1] + ta[i + 2] + ta[i + 3];
}
return res;
}
var ta = new Int16Array(4 * 1024);
f(ta);
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•