Bug 192073 – [JSC] FTL should not load arguments twice for type check and use for non-full-64bit values

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

We end up loading the arguments twice just to have the second loads be 32-bit loads. We shouldn't have to do this.

a & b are ints:
```
function foo(a, b) {
    return a + b;
}
```

Generates:
```
0x4c04f0c024ed: mov 0x38(%rbp), %rcx
0x4c04f0c024f1: mov $0xffff000000000000, %rax
0x4c04f0c024fb: cmp %rax, %rcx
0x4c04f0c024fe: jb 0x4c04f0c02595
0x4c04f0c02504: mov 0x30(%rbp), %rcx
0x4c04f0c02508: cmp %rax, %rcx
0x4c04f0c0250b: jb 0x4c04f0c0259f
0x4c04f0c02511: mov 0x30(%rbp), %ecx
0x4c04f0c02514: mov 0x38(%rbp), %edx
0x4c04f0c02517: add %ecx, %edx
0x4c04f0c02519: jo 0x4c04f0c025b3
0x4c04f0c0251f: add %rdx, %rax
0x4c04f0c02526: ret 
```

[Filip Pizlo]

And the FTL is emitting the loads twice?

This could be restated as an FTL lowering bug. But I agree that CSE should be smart enough to manufacture a Trunc on the originally loaded value.

[Saam Barati]

(In reply to Filip Pizlo from comment #1)
> And the FTL is emitting the loads twice?
Yeah it could, but it'd be awkward to do this in the FTL since the first loads are for proving argument types. I think it'd be nicer if B3 were just smart enough to do this.\

> 
> This could be restated as an FTL lowering bug. But I agree that CSE should
> be smart enough to manufacture a Trunc on the originally loaded value.

[Radar WebKit Bug Importer]

<rdar://problem/110121633>

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/14592

[EWS]

Committed 264846@main (4b922ed02257): <https://commits.webkit.org/264846@main>

Reviewed commits have been landed. Closing PR #14592 and removing active labels.