This avoids the potential speed differences between reading from the begin and end of cache lines that exists in the byte-slicing approach. It’s also slightly faster.
I’ve looked at the generated code with -O3, and it looks like it is actually iterating over all data, but it’s hard to be sure. The result is slower than an equivalent that just picks the right value to add directly.
The O2 build assembly is super easy to read for me, and appears clearly correct. O3 is harder to tell due to the inlining.
But I can confirm that even with O3 it’s running all 16 iterations:
0 a63: 83 3c 24 10 cmpl $0x10,(%rsp)
1 a67: 4c 89 84 24 a8 02 00 mov %r8,0x2a8(%rsp)
2 a6e: 00
3 a6f: 0f 85 d3 fe ff ff jne 948 <secp256k1_ecmult_gen+0x188>
(comparion with 16) Still no guarantee that a sufficiently advanced pipeline won’t realize the read is pointless and skip it. :)
ACK. (well, ignoring that it needs to be defined for field GMP)