Bug 2035741 - Part 6: Fold to comparison against zero if possible. r=jandem

To avoid repeating the same optimisations across all architectures, handle these
comparisons at the MIR level.

1. `i >= 1`

Before:

x86
```asm
cmpl       $0x1, %eax
jl
```

arm64
```asm
cmp     w0, #0x1
b.lt
```

riscv64
```asm
li        t4, 1
bge       t0, t4, 0
nop
auipc     t4, 0x0
jr        t4
```

Now:

x86
```asm
testl      %eax, %eax
jle
```

arm64 (no optimisation!):
```asm
cmp     w0, #0x0
b.le
```

riscv64:
```asm
blt       zero, t0, 0
nop
auipc     t4, 0x0
jr        t4
```

2. Changes for `i < 1` are similar to `i >= 1`.

3. `i <= -1`

Before:

x86
```asm
cmpl       $0xffffffff, %eax
jg
```

arm64
```asm
cmn     w0, #0x1
b.gt
```

riscv64
```asm
li        t4, -1
bge       t4, t0, 0
nop
auipc     t4, 0x0
jr        t4
```

Now:

x86
```asm
testl      %eax, %eax
jge
```

arm64
```asm
tbz     w0, #31
```

riscv64
```asm
blt       t0, zero, 0
nop
auipc     t4, 0x0
jr        t4
```

4. Changes for `i > -1` are similar to `i <= -1`.

Differential Revision: https://phabricator.services.mozilla.com/D297325

Author: anba

js/src/jit/MIR.cpp

@@ -4,6 +4,7 @@
 
 #include "jit/MIR.h"
 
+#include "mozilla/Casting.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/Maybe.h"
@@ -5700,6 +5701,80 @@ MDefinition* MCompare::tryFoldStringIndexOf(TempAllocator& alloc) {
   return MNot::New(alloc, startsWith);
 }
 
+/**
+ * Most architectures can generate smaller code for comparison against zero, so
+ * the macro-assemblers special-case a zero immediate when emitting
+ * compare-and-branch instructions.
+ *
+ * Some comparisons against one resp. negative one can instead be written as a
+ * comparison against zero. Handle these cases here to avoid duplicating the
+ * same code across all architectures.
+ */
+static bool CanCompareAgainstZero(int64_t value, JSOp op, bool isSigned) {
+  switch (op) {
+    case JSOp::Lt:
+    case JSOp::Ge:
+      // Can rewrite |operand < 1| as |operand <= 0|.
+      // Can rewrite |operand >= 1| as |operand > 0|.
+      return value == 1;
+
+    case JSOp::Le:
+    case JSOp::Gt:
+      // Can rewrite |operand <= -1| as |operand < 0|.
+      // Can rewrite |operand > -1| as |operand >= 0|.
+      return isSigned && value == -1;
+
+    default:
+      return false;
+  }
+}
+
+MCompare* MCompare::newCompareInt(TempAllocator& alloc, MDefinition* operand,
+                                  int64_t value, JSOp op, bool isSigned) {
+  MOZ_ASSERT(IsIntType(operand->type()) || operand->type() == MIRType::BigInt);
+  MOZ_ASSERT_IF(operand->type() == MIRType::BigInt, isSigned);
+
+  // Prefer comparison against zero if possible.
+  if (CanCompareAgainstZero(value, op, isSigned)) {
+    value = 0;
+
+    // Update operator: (Lt -> Le), (Le -> Lt), (Gt -> Ge), (Ge -> Gt).
+    op = ReverseCompareOp(NegateCompareOp(op));
+  }
+
+  MConstant* cst;
+  CompareType compareType;
+  switch (operand->type()) {
+    case MIRType::Int32:
+      cst = MConstant::NewInt32(alloc, mozilla::AssertedCast<int32_t>(value));
+      compareType = isSigned ? Compare_Int32 : Compare_UInt32;
+      break;
+
+    case MIRType::Int64:
+      cst = MConstant::NewInt64(alloc, value);
+      compareType = isSigned ? Compare_Int64 : Compare_UInt64;
+      break;
+
+    case MIRType::IntPtr:
+      cst = MConstant::NewIntPtr(alloc, mozilla::AssertedCast<intptr_t>(value));
+      compareType = isSigned ? Compare_IntPtr : Compare_UIntPtr;
+      break;
+
+    case MIRType::BigInt:
+      cst = MConstant::NewInt32(alloc, mozilla::AssertedCast<int32_t>(value));
+      compareType = Compare_BigInt_Int32;
+      break;
+
+    default:
+      MOZ_CRASH("unexpected operand type");
+  }
+  block()->insertBefore(this, cst);
+
+  auto* ins = MCompare::New(alloc, operand, cst, op, compareType);
+  ins->setResultType(type());
+  return ins;
+}
+
 MDefinition* MCompare::tryFoldBigInt64(TempAllocator& alloc) {
   if (compareType() == Compare_BigInt) {
     auto* left = lhs();
@@ -5797,17 +5872,11 @@ MDefinition* MCompare::tryFoldBigInt64(TempAllocator& alloc) {
       return MConstant::NewBoolean(alloc, result);
     }
 
-    auto* cst = MConstant::NewInt64(alloc, *value);
-    block()->insertBefore(this, cst);
-
-    auto compareType =
-        isSigned ? MCompare::Compare_Int64 : MCompare::Compare_UInt64;
-    if (left == int64ToBigInt) {
-      return MCompare::New(alloc, int64ToBigInt->input(), cst, jsop_,
-                           compareType);
+    JSOp op = jsop();
+    if (right == int64ToBigInt) {
+      op = ReverseCompareOp(op);
     }
-    return MCompare::New(alloc, cst, int64ToBigInt->input(), jsop_,
-                         compareType);
+    return newCompareInt(alloc, int64ToBigInt->input(), *value, op, isSigned);
   }
 
   if (compareType() == Compare_BigInt_Int32) {
@@ -5833,13 +5902,8 @@ MDefinition* MCompare::tryFoldBigInt64(TempAllocator& alloc) {
       return MConstant::NewBoolean(alloc, result);
     }
 
-    auto* cst = MConstant::NewInt64(alloc, int64_t(constInt32));
-    block()->insertBefore(this, cst);
-
-    auto compareType =
-        isSigned ? MCompare::Compare_Int64 : MCompare::Compare_UInt64;
-    return MCompare::New(alloc, int64ToBigInt->input(), cst, jsop_,
-                         compareType);
+    return newCompareInt(alloc, int64ToBigInt->input(), constInt32, jsop(),
+                         isSigned);
   }
 
   return this;
@@ -5894,17 +5958,11 @@ MDefinition* MCompare::tryFoldBigIntPtr(TempAllocator& alloc) {
       return MConstant::NewBoolean(alloc, result);
     }
 
-    auto* cst = MConstant::NewIntPtr(alloc, value);
-    block()->insertBefore(this, cst);
-
-    if (left == intPtrToBigInt) {
-      left = intPtrToBigInt->input();
-      right = cst;
-    } else {
-      left = cst;
-      right = intPtrToBigInt->input();
+    JSOp op = jsop();
+    if (right == intPtrToBigInt) {
+      op = ReverseCompareOp(op);
     }
-    return MCompare::New(alloc, left, right, jsop_, MCompare::Compare_IntPtr);
+    return newCompareInt(alloc, intPtrToBigInt->input(), value, op);
   }
 
   if (compareType() == Compare_BigInt_Int32) {
@@ -5919,12 +5977,8 @@ MDefinition* MCompare::tryFoldBigIntPtr(TempAllocator& alloc) {
       return this;
     }
 
-    auto* cst =
-        MConstant::NewIntPtr(alloc, intptr_t(right->toConstant()->toInt32()));
-    block()->insertBefore(this, cst);
-
-    return MCompare::New(alloc, left->toIntPtrToBigInt()->input(), cst, jsop_,
-                         MCompare::Compare_IntPtr);
+    return newCompareInt(alloc, left->toIntPtrToBigInt()->input(),
+                         right->toConstant()->toInt32(), jsop());
   }
 
   return this;
@@ -5956,9 +6010,6 @@ MDefinition* MCompare::tryFoldBigInt(TempAllocator& alloc) {
     return this;
   }
 
-  MConstant* int32Const = MConstant::NewInt32(alloc, x);
-  block()->insertBefore(this, int32Const);
-
   auto op = jsop();
   if (IsStrictEqualityOp(op)) {
     // Compare_BigInt_Int32 is only valid for loose comparison.
@@ -5967,9 +6018,87 @@ MDefinition* MCompare::tryFoldBigInt(TempAllocator& alloc) {
     // Reverse the comparison operator if the operands were reordered.
     op = ReverseCompareOp(op);
   }
+  return newCompareInt(alloc, operand, x, op);
+}
+
+MDefinition* MCompare::tryFoldIntZero(TempAllocator& alloc) {
+  // Expect signed or unsigned integer relational comparison.
+  if (!IsRelationalOp(jsop())) {
+    return this;
+  }
 
-  return MCompare::New(alloc, operand, int32Const, op,
-                       MCompare::Compare_BigInt_Int32);
+  bool isSigned;
+  switch (compareType()) {
+    case Compare_Int32:
+    case Compare_Int64:
+    case Compare_IntPtr:
+      isSigned = true;
+      break;
+
+    case Compare_UInt32:
+    case Compare_UInt64:
+    case Compare_UIntPtr:
+      isSigned = false;
+      break;
+
+    case Compare_Undefined:
+    case Compare_Null:
+    case Compare_Double:
+    case Compare_Float32:
+    case Compare_String:
+    case Compare_Symbol:
+    case Compare_Object:
+    case Compare_BigInt:
+    case Compare_BigInt_Int32:
+    case Compare_BigInt_Double:
+    case Compare_BigInt_String:
+    case Compare_WasmAnyRef:
+      return this;
+  }
+
+  auto* left = lhs();
+  auto* right = rhs();
+
+  // Both operands have the same Int type.
+  MOZ_ASSERT(left->type() == right->type());
+  MOZ_ASSERT(IsIntType(left->type()));
+
+  // One operand must be a constant.
+  if (!left->isConstant() && !right->isConstant()) {
+    return this;
+  }
+
+  auto* constant =
+      left->isConstant() ? left->toConstant() : right->toConstant();
+  auto* operand = left->isConstant() ? right : left;
+
+  int64_t value;
+  switch (constant->type()) {
+    case MIRType::Int32:
+      value = constant->toInt32();
+      break;
+
+    case MIRType::Int64:
+      value = constant->toInt64();
+      break;
+
+    case MIRType::IntPtr:
+      value = constant->toIntPtr();
+      break;
+
+    default:
+      MOZ_CRASH("unexpected int type");
+  }
+
+  auto op = jsop();
+  if (operand == right) {
+    op = ReverseCompareOp(op);
+  }
+
+  if (!CanCompareAgainstZero(value, op, isSigned)) {
+    return this;
+  }
+  return newCompareInt(alloc, operand, value, op, isSigned);
 }
 
 MDefinition* MCompare::foldsTo(TempAllocator& alloc) {
@@ -6016,6 +6145,10 @@ MDefinition* MCompare::foldsTo(TempAllocator& alloc) {
     return folded;
   }
 
+  if (MDefinition* folded = tryFoldIntZero(alloc); folded != this) {
+    return folded;
+  }
+
   return this;
 }
 

js/src/jit/MIR.h

@@ -2930,6 +2930,14 @@ class MCompare : public MBinaryInstruction, public ComparePolicy::Data {
   [[nodiscard]] MDefinition* tryFoldBigInt64(TempAllocator& alloc);
   [[nodiscard]] MDefinition* tryFoldBigIntPtr(TempAllocator& alloc);
   [[nodiscard]] MDefinition* tryFoldBigInt(TempAllocator& alloc);
+  [[nodiscard]] MDefinition* tryFoldIntZero(TempAllocator& alloc);
+
+  // Create a new comparison with |operand| as the left-hand side operand and
+  // |value| as the right-hand side operand. |operand| must be an integer or
+  // BigInt.
+  [[nodiscard]] MCompare* newCompareInt(TempAllocator& alloc,
+                                        MDefinition* operand, int64_t value,
+                                        JSOp op, bool isSigned = true);
 
  public:
   bool congruentTo(const MDefinition* ins) const override {