Bug 1940795: Don't tear aligned subwords in AtomicMemcpy. r=spidermon…

…key-reviewers,jandem

Reads/writes to integer typed arrays mustn't tear, so they can't be split into
single byte operations.

Replace single byte copy loops with `AtomicCopy{Down,Up}NoTearIfAlignedUnsynchronized`,
which performs additional checks when aligned word or dword copying is needed.

Test262 tests: <tc39/test262#4369>

Differential Revision: https://phabricator.services.mozilla.com/D233710

UltraBlame original commit: 968d34f043635337c9ab03c4c3f975c39e52f057

js/src/jit/GenerateAtomicOperations.py

@@ -7309,6 +7309,55 @@
 "
 )
 
+elif
+size
+=
+=
+2
+:
+
+insns
++
+=
+fmt_insn
+(
+"
+movw
+OFFSET
+(
+%
+[
+src
+]
+)
+%
+[
+scratch
+]
+"
+)
+
+insns
++
+=
+fmt_insn
+(
+"
+movw
+%
+[
+scratch
+]
+OFFSET
+(
+%
+[
+dst
+]
+)
+"
+)
+
 elif
 size
 =
@@ -7471,6 +7520,112 @@
 "
 )
 
+elif
+size
+=
+=
+2
+:
+
+insns
++
+=
+fmt_insn
+(
+"
+ldrh
+%
+w
+[
+scratch
+]
+[
+%
+x
+[
+src
+]
+OFFSET
+]
+"
+)
+
+insns
++
+=
+fmt_insn
+(
+"
+strh
+%
+w
+[
+scratch
+]
+[
+%
+x
+[
+dst
+]
+OFFSET
+]
+"
+)
+
+elif
+size
+=
+=
+4
+:
+
+insns
++
+=
+fmt_insn
+(
+"
+ldr
+%
+w
+[
+scratch
+]
+[
+%
+x
+[
+src
+]
+OFFSET
+]
+"
+)
+
+insns
++
+=
+fmt_insn
+(
+"
+str
+%
+w
+[
+scratch
+]
+[
+%
+x
+[
+dst
+]
+OFFSET
+]
+"
+)
+
 else
 :
 
@@ -7586,6 +7741,57 @@
 "
 )
 
+elif
+size
+=
+=
+2
+:
+
+insns
++
+=
+fmt_insn
+(
+"
+ldrh
+%
+[
+scratch
+]
+[
+%
+[
+src
+]
+#
+OFFSET
+]
+"
+)
+
+insns
++
+=
+fmt_insn
+(
+"
+strh
+%
+[
+scratch
+]
+[
+%
+[
+dst
+]
+#
+OFFSET
+]
+"
+)
+
 else
 :
 
@@ -9133,7 +9339,43 @@
 gen_copy
 (
 "
-AtomicCopyByteUnsynchronized
+AtomicCopy32Unsynchronized
+"
+"
+uint32_t
+"
+4
+1
+"
+down
+"
+)
+
+contents
++
+=
+gen_copy
+(
+"
+AtomicCopy16Unsynchronized
+"
+"
+uint16_t
+"
+2
+1
+"
+down
+"
+)
+
+contents
++
+=
+gen_copy
+(
+"
+AtomicCopy8Unsynchronized
 "
 "
 uint8_t