High Performance JavaScript: JITs in Firefox Optimize Integer Math

High Performance JavaScript: JITs in Firefox

How did we get here? ,[object Object]

Adding new technologies, like video, audio, integration and 2D+3D drawing,[object Object]

Getting a Webpage www.intel.com 192.198.164.158

Getting a Webpage www.intel.com 192.198.164.158 GET / HTTP/1.0 (HTTP Request)

Getting a Webpage <html><head><title>Laptop, Notebooks, ...</title></head><script language="javascript">functiondoStuff() {...}</script><body>... (HTML, CSS, JavaScript)

Core Web Components ,[object Object]

JavaScript provides a programming interface,[object Object]

WebGL (OpenGL + JavaScript),[object Object]

CSS Cascading Style Sheets Separates presentation from content <b class=”warning”>This is red</b> .warning {color: red;text-decoration: underline;}

What is JavaScript? ,[object Object]

Interacts with the DOM and the browser,[object Object]

Displaying a Webpage Layout engine applies CSS to DOM Computes geometry of elements JavaScript engine executes code This can change DOM, triggers “reflow” Finished layout is sent to graphics layer

Initial version written in 10 days

Anything from small browser interactions, complex apps (Gmail) to intense graphics (WebGL),[object Object]

Think LISP or Self, not Java Untyped - no type declarations Multi-Paradigm – objects, closures, first-class functions Highly dynamic - objects are dictionaries

No Type Declarations ,[object Object],functionf(a) {var x =72.3;if (a) x = a +"string";return x;}

No Type Declarations ,[object Object],if a is: number: add; string: concat; functionf(a) {var x =“hi”;if (a) x = a +33.2;return x;}

Functional ,[object Object],functionf(a) {returnfunction () {return a; }}var m = f(5);print(m());

Properties may be deleted or added at any time!var point = { x : 5, y : 10 };deletepoint.x;point.z=12;

Prototypes Every object can have a prototype object If a property is not found on an object, its prototype is searched instead … And the prototype’s prototype, etc..

Engines use 32-bit integers to optimize

Must preserve semantics: integers overflow to doubles,[object Object]

JavaScript Implementations ,[object Object]

Execution engine (VM),[object Object]

Unboxed values required for computation,[object Object]

64-bits for double, pointer, or integer

Too big! We have to pack better.,[object Object]

51 bits of NaN space!IA32, ARM Nunboxing

Nunboxing IA32, ARM Type Payload 0x400c0000 0x00000000 63 0 ,[object Object]

Type is double because it’s not a NaN

Encodes: (Double, 3.5),[object Object]

Value is (Int32, 0x00000040),[object Object]

Bits >> 47 == 0x1FFFF == INT32

Bits 47-63 masked off to retrieve payload

Value(Int32, 0x00000040),[object Object]

Garbage Collection Need to reclaim memory without pausing user workflow, animations, etc Need very fast object allocation Consider lots of small objects like points, vectors Reading and writing to the heap must be fast

Mark and Sweep All live objects are found via a recursive traversal of the root value set All dead objects are added to a free list Very slow to traverse entire heap Building free lists can bring “dead” memory into cache

Marking can be incremental, interleaved with program execution,[object Object]

Generational GC Inactive Active Newborn Space 8MB 8MB Tenured Space

After Minor GC Active Inactive Newborn Space 8MB 8MB Tenured Space

Barriers Incremental marking, generational GC need read or write barriers Read barriers are much slower Azul Systems has hardware read barrier Write barrier seems to be well-predicted?

Unknowns How much do cache effects matter? Memory GC has to touch Locality of objects What do we need to consider to make GC fast?

Running JavaScript ,[object Object]

Basic JIT – Simple, untyped compiler

Advanced JIT – Typed compiler, lightspeed,[object Object]

Handles all edge cases of JS semantics,[object Object]

Interpreter case OP_ADD: { Value lhs = POP(); Value rhs = POP(); Value result;if (lhs.isInt32() && rhs.isInt32()) {int left = rhs.toInt32();int right = rhs.toInt32();if (AddOverflows(left, right, left + right)) result.setInt32(left + right);elseresult.setNumber(double(left) + double(right)); } elseif (lhs.isString() || rhs.isString()) { String *left = ValueToString(lhs); String *right = ValueToString(rhs); String *r = Concatenate(left, right);result.setString(r); } else {double left = ValueToNumber(lhs);double right = ValueToNumber(rhs);result.setDouble(left + right); }PUSH(result);break;

Interpreter Very slow! Lots of opcode and type dispatch Lots of interpreter stack traffic Just-in-time compilation solves both

Just In Time Compilation must be very fast Can’t introduce noticeable pauses People care about memory use Can’t JIT everything Can’t create bloated code May have to discard code at any time

Basic JIT JägerMonkey in Firefox 4 Every opcode has a hand-coded template of assembly (registers left blank) Method at a time: Single pass through bytecode stream! Compiler uses assembly templates corresponding to each opcode

Bytecode GETARG 0 ; fetch x GETARG 1 ; fetch y ADD RETURN functionAdd(x, y) {return x + y;}

Assembling ADD ,[object Object]

Some input types much more common than others,[object Object]

Can consider integers common, or

Basic JIT - ADD if (arg0.type != INT32) gotoslow_add;if (arg1.type != INT32)gotoslow_add; R0 = arg0.data R1 = arg1.data Greedy Register Allocator

Basic JIT - ADD if (arg0.type != INT32) gotoslow_add;if (arg1.type != INT32)gotoslow_add; R0 = arg0.data;R1 = arg1.data; R2 = R0 + R1; if (OVERFLOWED)gotoslow_add;

Slow Paths slow_add: Value result = runtime::Add(arg0, arg1);

Inline Out-of-line if (arg0.type != INT32) gotoslow_add;if (arg1.type != INT32)gotoslow_add;R0 = arg0.data;R1 = arg1.data;R2 = R0 + R1; if (OVERFLOWED)gotoslow_add;rejoin: slow_add: Value result = Interpreter::Add(arg0, arg1); R2 = result.data; goto rejoin;

Rejoining Inline Out-of-line if (arg0.type != INT32) gotoslow_add; if (arg1.type != INT32)gotoslow_add; R0 = arg0.data; R1 = arg1.data; R2 = R0 + R1; if (OVERFLOWED)gotoslow_add; R3 = TYPE_INT32;rejoin: slow_add: Value result = runtime::Add(arg0, arg1); R2 = result.data; R3 = result.type; goto rejoin;

Final Code Inline Out-of-line if (arg0.type != INT32) goto slow_add; if (arg1.type != INT32)goto slow_add;R0 = arg0.data;R1 = arg1.data;R2 = R0 + R1; if (OVERFLOWED)goto slow_add; R3 = TYPE_INT32;rejoin: return Value(R3, R2); slow_add: Value result = Interpreter::Add(arg0, arg1); R2 = result.data; R3 = result.type; goto rejoin;

Observations Even though we have fast paths, no type information can flow in between opcodes Cannot assume result of ADD is integer Means more branches Types increase register pressure

Basic JIT – Object Access ,[object Object]

How can we create a fast-path?

We could try to cache the lookup, but

We want it to work for >1 objectsfunctionf(x) {returnx.y;}

Object Access Observation Usually, objects flowing through an access site look the same If we knew an object’s layout, we could bypass the dictionary lookup

Object Layout var obj = { x: 50, y: 100, z: 20 };

Object Layout varobj = { x: 50, y: 100, z: 20 }; … varobj2 = { x: 78, y: 93, z: 600 };

Familiar Problems We don’t know an object’s shape during JIT compilation ... Or even that a property access receives an object! Solution: leave code “blank,” lazily generate it later

Inline Caches functionf(x) {returnx.y;}

Inline Caches ,[object Object],if (arg0.type != OBJECT)gotoslow_property; JSObject *obj = arg0.data;

[object Object], if (arg0.type != OBJECT)gotoslow_property; JSObject *obj = arg0.data; gotoproperty_ic; Inline Caches

Property ICs functionf(x) {returnx.y;} f({x: 5, y: 10, z: 30});

Inline Caches ,[object Object], if (arg0.type != OBJECT)gotoslow_property; JSObject *obj = arg0.data; gotoproperty_ic;

Inline Caches ,[object Object], if (arg0.type != OBJECT)gotoslow_property; JSObject *obj = arg0.data; if (obj->shape != SHAPE1) gotoproperty_ic; R0 = obj->slots[1].type; R1 = obj->slots[1].data;

Add another fast-path...functionf(x) {returnx.y;}f({ x: 5, y: 10, z: 30});f({ y: 40});

Polymorphism Main Method if (arg0.type != OBJECT)gotoslow_path;JSObject *obj = arg0.data;if (obj->shape != SHAPE1)gotoproperty_ic;R0 = obj->slots[1].type;R1 = obj->slots[1].data;rejoin:

Polymorphism Main Method Generated Stub if (arg0.type != OBJECT)gotoslow_path;JSObject *obj = arg0.data; if (obj->shape != SHAPE0)gotoproperty_ic; R0 = obj->slots[1].type; R1 = obj->slots[1].data;rejoin: stub: if (obj->shape != SHAPE2)gotoproperty_ic; R0 = obj->slots[0].type;R1 = obj->slots[0].data; goto rejoin;

Polymorphism Main Method Generated Stub if (arg0.type != OBJECT) goto slow_path; JSObject *obj = arg0.data;if (obj->shape != SHAPE1)goto stub; R0 = obj->slots[1].type; R1 = obj->slots[1].data;rejoin: stub: if (obj->shape != SHAPE2)goto property_ic; R0 = obj->slots[0].type;R1 = obj->slots[0].data; goto rejoin;

Chain of Stubs if(obj->shape == S1) { result = obj->slots[0]; } else { if (obj->shape == S2) { result = obj->slots[1]; } else { if (obj->shape == S3) { result = obj->slots[2]; } else { if (obj->shape == S4) { result = obj->slots[3]; } else { goto property_ic; } } } }

Self-modifying, but single threaded

Concerned about protection-flipping expense,[object Object]

Inline caches adapt code based on runtime observations

Lots of guards, poor type information,[object Object]

We could generate an IR, but without type information...

Slow paths prevent most optimizations.,[object Object]

Code Motion? functionAdd(x, n) { varsum = 0; vartemp0 = x + n;for (vari = 0; i < n; i++) sum += temp0; return sum;} Let’s try it.

Wrong Result var global =0;varobj= {valueOf: function () {return++global; }}Add(obj, 10); ,[object Object]

Hoisted version returns 110!,[object Object]

Ideal Scenario ,[object Object]

High Performance JavaScript: JITs in Firefox Optimize Integer Math

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a High Performance JavaScript: JITs in Firefox Optimize Integer Math

Similar a High Performance JavaScript: JITs in Firefox Optimize Integer Math (20)

Último

Último (20)

High Performance JavaScript: JITs in Firefox Optimize Integer Math

Notas del editor