The JavaScriptCore Virtual Machine Filip Pizlo Apple Inc. 3 Pizlo - PowerPoint PPT Presentation

Optimizations • Generatorification • Strength Reduction • Inlining • Tail Duplication • Strength Reduction • Switch Inference • CSE (local and global) • Float Inference • LICM • DCE • Type/Bounds/Overflow Check Removal • Register Allocation • Object Allocation Sinking • Linear Scan • Arguments/Varargs Elimination • Briggs • Sparse Conditional Constant • Iterated Register Coalescing Propagation • Stack Allocation • Barrier Placement

Interpreters and JITs • Optimized for breadth • Four tiers • Many optimizations in many IRs • Speculative

Object Model

{x: 1, y: 2} {x: 42, y: 3} {x: -5, y: 7}

{x, y} {1, 2} {42, 3} {-5, 7}

prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

prototype structure {x, y} global object {1, 2} {42, 3} {-5, 7}

Mono Proto Poly Proto proto proto 1 {x, y} {x, y} global global object object {1, 2} {1, 2} {42, 3} {42, 3} {-5, 7} {-5, 7} proto 2 poly proto just landed last Thursday @saambarati and I have been working on it for ~2 months

Structures • Fast property access • Property type inference • Immutable property inference • Prototype optimizations

JSC Object Model cell state indexing structure flags type … butterfly pointer inline slot 0 inline slot 1 ID public vector … … out of line slot 0 array slot 0 length length

JSC Object Model 64 bits 64 bits 64 bits 64 bits cell state indexing structure flags type … butterfly pointer inline slot 0 inline slot 1 ID 64 bits 64 bits 64 bits public vector … … out of line slot 0 array slot 0 length length

JSC Object Model cell state indexing structure flags type … butterfly pointer inline slot 0 inline slot 1 ID public vector … … out of line slot 0 array slot 0 length length

JSC Object Model statically configurable cell state indexing structure flags type … butterfly pointer inline slot 0 inline slot 1 ID public vector … … out of line slot 0 array slot 0 length length

JSC Object Model statically configurable cell state indexing structure flags type … butterfly pointer inline slot 0 inline slot 1 ID public vector … … out of line slot 0 array slot 0 length length dynamically configurable

Empty JSObject cell state indexing structure flags type null ID

Fast JSObject cell state indexing structure flags type null 0xffff000000000005 0xffff000000000006 ID var o = {f: 5, g: 6};

JSObject with dynamically added fields cell state indexing structure flags type butterfly 0xffff000000000005 0xffff000000000006 ID 0xffff000000000007 var o = {f: 5, g: 6}; o.h = 7;

JSArray with room for 3 array elements cell state indexing structure flags type butterfly ID <hole> <hole> <hole> 0 3 var a = [];

Object with fast properties and array elements cell state indexing structure flags type butterfly 0xffff000000000005 0xffff000000000006 ID 0xffff000000000007 <hole> <hole> 1 3 var o = {f: 5, g: 6}; o[0] = 7;

Object with fast and dynamic properties and array elements cell state indexing structure flags type butterfly 0xffff000000000005 0xffff000000000006 ID 0xffff000000000008 0xffff000000000007 <hole> 1 2 var o = {f: 5, g: 6}; o[0] = 7; o.h = 8;

Exotic object with dynamic properties and array elements cell state indexing structure flags type butterfly <C++ state> <C++ state> ID 0xffff000000000008 0xffff000000000007 <hole> 1 2 var o = new Date(); o[0] = 7; o.h = 8;

Object Model • Structures • Cells • Butterflies

Type Inference

Type Inference • Watchpoints • Value Profiles • Polymorphic Inline Caches

Type Inference • Watchpoints • Value Profiles • Polymorphic Inline Caches

Watchpoints

Watchpoint class Watchpoint { public: virtual void fire() = 0; };

numberToStringWatchpoint

numberToStringWatchpoint 1. Compiler wants to optimize 42.toString() to “42” 2. Check if already invalidated • If invalid, don’t do the optimization. • If valid, register watchpoint and do the optimization.

Many watchpoints • haveABadTime • Structure transition • InferredValue • InferredType • many others

Garbage Collector

Garbage Collector • No copying • Conservative on the stack

Garbage Collector • Constraint-based • Generational • Concurrent • Parallel

Garbage Collector • Constraint-based • Generational • Concurrent • Parallel

Constraint-Based Marking • Transitive reachability is not always enough • Common examples: • Soft references • Weak map

Constraint-Based Marking • Transitive reachability is not always enough • WebKit examples: • Type inference • Weak map • DOM • Native code

Constraint-Based Marking • Transitive reachability is not always enough • WebKit examples: • Type inference • Weak map • DOM • Native code

Type Inference

Structure prototype {x, y} global object {1, 2} Objects {42, 3} {-5, 7}

prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

Is this a weak reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

JIT code references a structure • Strong reference? • Weak reference? • Marking constraint?

Strong reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

Strong reference? JIT code prototype {x, y} global object

Strong reference? JIT code prototype {x, y} global object

Strong reference? JIT code prototype {x, y} global object so many leaks

Weak reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}