tor-browser

commit b5cc60f342c3b19d70d299bc03f619120e59d873
parent 66d5a654c006126949e5a92be042d3b1179785d9
Author: André Bargull <andre.bargull@gmail.com>
Date:   Thu, 23 Oct 2025 09:56:07 +0000

Bug 1995491 - Part 2: Use standard unboxing methods in loadInt32OrDouble. r=spidermonkey-reviewers,iain

`LoadFixedSlotT` was compiled to:
```asm
ld        t4, 24(t0)
srli      t4, t4, 47
lui       t5, 0x20
addiw     t5, t5, -15
beq       t4, t5, 0 -> notInt32
auipc     t5, 0x0
jr        t5
ld        t4, 24(t0)
fcvt.d.w  ft0, t4
j         0 -> end
fld       ft0, 24(t0)
```

It's now compiled to:
```asm
ld        t4, 24(t0)
srli      t4, t4, 47
lui       t5, 0x20
addiw     t5, t5, -15
bne       t4, t5, 0 -> notInt32
lw        t4, 24(t0)
fcvt.d.w  ft0, t4
j         0 -> end
fld       ft0, 24(t0)
```

Also perform the same changes for mips64.

Differential Revision: https://phabricator.services.mozilla.com/D269359

Diffstat:
M
js/src/jit/mips64/MacroAssembler-mips64.cpp
 | 
29
++++++++++++++++-------------
M
js/src/jit/riscv64/MacroAssembler-riscv64.cpp
 | 
27
+++++++++++++++++----------

2 files changed, 33 insertions(+), 23 deletions(-)
diff --git a/js/src/jit/mips64/MacroAssembler-mips64.cpp b/js/src/jit/mips64/MacroAssembler-mips64.cpp
@@ -2008,23 +2008,26 @@ void MacroAssemblerMIPS64Compat::loadConstantFloat32(float f,
 void MacroAssemblerMIPS64Compat::loadInt32OrDouble(const Address& src,
                                                    FloatRegister dest) {
   UseScratchRegisterScope temps(*this);
-  Register scratch2 = temps.Acquire();
+  Register scratch = temps.Acquire();
+
   Label notInt32, end;
-  // If it's an int, convert it to double.
   {
-    UseScratchRegisterScope temps(*this);
-    Register scratch = temps.Acquire();
-    loadPtr(Address(src.base, src.offset), scratch);
-    ma_dsrl(scratch2, scratch, Imm32(JSVAL_TAG_SHIFT));
+    // Inlined |branchTestInt32| to use a short-jump.
+    Register tag = extractTag(src, scratch);
+    ma_b(tag, ImmTag(JSVAL_TAG_INT32), &notInt32, Assembler::NotEqual,
+         ShortJump);
+  }
+  {
+    // If it's an int, convert it to double.
+    unboxInt32(src, scratch);
+    convertInt32ToDouble(scratch, dest);
+    ma_b(&end, ShortJump);
   }
-  asMasm().branchTestInt32(Assembler::NotEqual, scratch2, &notInt32);
-  loadPtr(Address(src.base, src.offset), scratch2);
-  convertInt32ToDouble(scratch2, dest);
-  ma_b(&end, ShortJump);
-
-  // Not an int, just load as double.
   bind(&notInt32);
-  unboxDouble(src, dest);
+  {
+    // Not an int, just load as double.
+    unboxDouble(src, dest);
+  }
   bind(&end);
 }
 
diff --git a/js/src/jit/riscv64/MacroAssembler-riscv64.cpp b/js/src/jit/riscv64/MacroAssembler-riscv64.cpp
@@ -2021,20 +2021,27 @@ void MacroAssemblerRiscv64Compat::loadConstantFloat32(float f,
 
 void MacroAssemblerRiscv64Compat::loadInt32OrDouble(const Address& src,
                                                     FloatRegister dest) {
-  Label notInt32, end;
-  // If it's an int, convert it to double.
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
-  loadPtr(Address(src.base, src.offset), scratch);
-  srli(scratch, scratch, JSVAL_TAG_SHIFT);
-  asMasm().branchTestInt32(Assembler::NotEqual, scratch, &notInt32);
-  loadPtr(Address(src.base, src.offset), scratch);
-  convertInt32ToDouble(scratch, dest);
-  ma_branch(&end);
 
-  // Not an int, just load as double.
+  Label notInt32, end;
+  {
+    // Inlined |branchTestInt32| to use a short-jump.
+    Register tag = extractTag(src, scratch);
+    ma_b(tag, ImmTag(JSVAL_TAG_INT32), &notInt32, Assembler::NotEqual,
+         ShortJump);
+  }
+  {
+    // If it's an int, convert it to double.
+    unboxInt32(src, scratch);
+    convertInt32ToDouble(scratch, dest);
+    ma_branch(&end);
+  }
   bind(&notInt32);
-  unboxDouble(src, dest);
+  {
+    // Not an int, just load as double.
+    unboxDouble(src, dest);
+  }
   bind(&end);
 }