[Webkit-unassigned] [Bug 202005] New: Consider a 14-bit JSValue tag scheme with always materializing one of the 3 needed masks.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=202005

            Bug ID: 202005
           Summary: Consider a 14-bit JSValue tag scheme with always
                    materializing one of the 3 needed masks.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

If we're willing to use 3 tag registers or always materialize one of them, we can also adopt a 14-bit tag as follows:

    Pointer {  0000:PPPP:PPPP:PPPP
             / 0002:****:****:****
    Double  {         ...
             \ FFFC:****:****:****
    Integer {  FFFF:0000:IIII:IIII

where we need to use 3 different masks to differentiate between cells, ints, and doubles:
    NumberMask is 0xfffc: any bits set in the top 14 bits is a number.
    IntMask is 0xffff: value is int if value & IntMask == IntMask.
    NotCellMask is NumberMask | OtherTag.

Since the highest double is "negative" pureNaN i.e. starts with 0xfff8, adding a DoubleEncodeOffset of 1<<50 (starts with 0x0004) produces 0xfffc which is still less than 0xffff (the IntMask).

The downside of this scheme is that materializing a mask or burning a 3rd register on a mask, will have performance impact.  We can measure if this impact is significant.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190919/dd04d639/attachment-0001.html>