The JavaScriptCore Virtual Machine. Filip Pizlo Apple Inc.

Transcription

1 The JavaScriptCore Virtual Machine Filip Pizlo Apple Inc.

2 3 Pizlo Keynotes / Week ICCV 17 Symmetry as the fundamental prior in human 3D vision Zygmunt Pizlo

3 webkit.org

4 Safari

5 What JSC Supports ECMAScript WebAssembly

6 What JSC Supports ECMAScript WebAssembly

7 Architecture

8 Architecture Interpreters and JITs Object Model Type Inference Garbage Collector

9 Interpreters and JITs

10 Four Tiers LLInt (interpreter) Baseline (template JIT) DFG (less optimizing JIT) FTL (optimizing JIT) latency throughput

11 Four tiers for JavaScript Two tiers for WebAssembly Two tiers for regular expressions

12 Four tiers for JavaScript Two tiers for WebAssembly Two tiers for regular expressions

13 Four Tiers How we tier up How the tiers work How we OSR exit

14 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency time

15 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency LLInt time

16 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency LLInt trigger time

17 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency LLInt trigger baseline compiler time

18 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency LLInt trigger baseline compiler LLInt time

19 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency baseline compiler LLInt trigger LLInt OSR time

20 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency baseline compiler DFG compiler FTL compiler LLInt trigger LLInt OSR Baseline trigger Baseline OSR DFG trigger DFG OSR FTL time

21 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency 0.12ms baseline compiler DFG compiler FTL compiler LLInt trigger LLInt OSR Baseline trigger Baseline OSR DFG trigger DFG OSR FTL time

22 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency 0.12ms baseline compiler 0.48ms DFG compiler FTL compiler LLInt trigger LLInt OSR Baseline trigger Baseline OSR DFG trigger DFG OSR FTL time

23 "use strict"; let result = 0; for (let i = 0; i < ; ++i) { let o = {f: i}; result += o.f; } print(result); concurrency 0.12ms 0.48ms 2.86ms baseline compiler DFG compiler FTL compiler LLInt trigger LLInt OSR Baseline trigger Baseline OSR DFG trigger DFG OSR FTL time

24 How We Tier Up Counting trigger Concurrent JITs Parallel JITs OSR

25 Profiling LLInt (interpreter) Baseline (template JIT) DFG (less optimizing JIT) FTL (optimizing JIT)

26 Speculation and OSR LLInt (interpreter) Baseline (template JIT) DFG (less optimizing JIT) FTL (optimizing JIT)

27 Parser AST unlinked bytecode Bytecompiler Generatorification bytecode Bytecode Linker LLInt Baseline Bytecode Template JIT DFG DFG Bytecode Parser DFG Optimizer FTL DFG Bytecode Parser Extended DFG Optimizer DFG IR DFG Backend FTL-to-B3 lowering B3 Optimizer B3 IR Instruction Selection Air Optimizer Air Air Backend

28 function foo(a, b) { return a + b; }

29 [ 0] enter [ 1] get_scope loc3 [ 3] mov loc4, loc3 [ 6] check_traps [ 7] add loc6, arg1, arg2 [ 12] ret loc6

30 [ 0] enter [ 1] get_scope loc3 [ 3] mov loc4, loc3 [ 6] check_traps [ 7] add loc6, arg1, arg2 [ 12] ret loc6

31 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid) 28: W:SideState, Exits, bc#12) arg1 arg2 Add Return

32 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

33 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

34 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

35 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

36 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

37 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

38 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

39 [ 7] add loc6, arg1, arg2 23: arg1(b<int32>/flushedint32), R:Stack(6), bc#7) 24: arg2(c<boolint32>/flushedint32), R:Stack(7), bc#7) 25: CheckOverflow, Exits, bc#7) 26: loc6, W:SideState, ClobbersExit, bc#7, ExitInvalid)

40 DFG SSA state arg1 arg2 Add Return

41 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 Add Return

42 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 Add Return

43 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 Add MovHint Return

44 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 Add MovHint Return

45 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 25: Add MovHint Return

46 DFG SSA state DFG Exit state arg1 loc0 loc1 loc3 loc4 loc5 loc6 arg2 25: Add MovHint Return loc6

47 OSR exit

48 Deoptimization OSR exit Invalidation Jettison

49 = Trunc(@27, DFG:@25) = Trunc(@22, DFG:@25) = generator = 0x109ec5b90, earlyclobbered = [], lateclobbered = [], usedregisters = [], ExitsSideways Reads:Top, DFG:@25) = ZExt32(@39, DFG:@28) = Add(@40, $ (@13), DFG:@28) = Return(@41, Terminal, DFG:@28)

50 Patch &BranchAdd32, Overflow, %tmp4, %tmp5, Move32 %tmp3, Add64 %tmp1, %tmp2, Move %tmp0, Ret64

51 Patch &BranchAdd32, Overflow, %rcx, %rdx, Add64 %rdx, %rax, Ret64

52 add %ecx, %edx jo 0x267160c025ed add %rdx, %rax

53 Optimizations Generatorification Inlining Strength Reduction CSE (local and global) LICM Type/Bounds/Overflow Check Removal Object Allocation Sinking Arguments/Varargs Elimination Sparse Conditional Constant Propagation Barrier Placement Strength Reduction Tail Duplication Switch Inference Float Inference DCE Register Allocation Linear Scan Briggs Iterated Register Coalescing Stack Allocation

54 Interpreters and JITs Optimized for breadth Four tiers Many optimizations in many IRs Speculative

55 Object Model

56 {x: 1, y: 2} {x: 42, y: 3} {x: -5, y: 7}

57 {x, y} {1, 2} {42, 3} {-5, 7}

58 prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

59 structure prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

60 Mono Proto Poly Proto proto proto 1 {1, 2} {x, y} global object {1, 2} {x, y} global object {-5, 7} {42, 3} {-5, 7} {42, 3} proto 2 poly proto just landed last and I have been working on it for ~2 months

61 Structures Fast property access Property type inference Immutable property inference Prototype optimizations

62 JSC Object Model structure ID indexing type flags cell state butterfly pointer inline slot 0 inline slot 1 public length vector length out of line slot 0 array slot 0

63 JSC Object Model 64 bits 64 bits 64 bits 64 bits structure ID indexing type flags cell state butterfly pointer inline slot 0 inline slot 1 64 bits 64 bits 64 bits public length vector length out of line slot 0 array slot 0

64 JSC Object Model structure ID indexing type flags cell state butterfly pointer inline slot 0 inline slot 1 public length vector length out of line slot 0 array slot 0

65 JSC Object Model statically configurable structure ID indexing type flags cell state butterfly pointer inline slot 0 inline slot 1 public length vector length out of line slot 0 array slot 0

66 JSC Object Model statically configurable structure ID indexing type flags cell state butterfly pointer inline slot 0 inline slot 1 public length vector length out of line slot 0 array slot 0 dynamically configurable

67 Empty JSObject structure ID indexing type flags cell state null

68 Fast JSObject structure ID indexing type flags cell state null 0xffff xffff var o = {f: 5, g: 6};

69 JSObject with dynamically added fields structure ID indexing type flags cell state butterfly 0xffff xffff xffff var o = {f: 5, g: 6}; o.h = 7;

70 JSArray with room for 3 array elements structure ID indexing type flags cell state butterfly 0 3 <hole> <hole> <hole> var a = [];

71 Object with fast properties and array elements structure ID indexing type flags cell state butterfly 0xffff xffff xffff <hole> <hole> var o = {f: 5, g: 6}; o[0] = 7;

72 Object with fast and dynamic properties and array elements structure ID indexing type flags cell state butterfly 0xffff xffff xffff xffff <hole> var o = {f: 5, g: 6}; o[0] = 7; o.h = 8;

73 Exotic object with dynamic properties and array elements structure ID indexing type flags cell state butterfly <C++ state> <C++ state> 0xffff xffff <hole> var o = new Date(); o[0] = 7; o.h = 8;

74 Object Model Structures Cells Butterflies

75 Type Inference

76 Type Inference Watchpoints Value Profiles Polymorphic Inline Caches

77 Type Inference Watchpoints Value Profiles Polymorphic Inline Caches

78 Watchpoints

79 Watchpoint class Watchpoint { public: virtual void fire() = 0; };

80 numbertostringwatchpoint

81 numbertostringwatchpoint 1. Compiler wants to optimize 42.toString() to Check if already invalidated If invalid, don t do the optimization. If valid, register watchpoint and do the optimization.

82 Many watchpoints haveabadtime Structure transition InferredValue InferredType many others

83 Garbage Collector

84 Garbage Collector No copying Conservative on the stack

85 Garbage Collector Constraint-based Generational Concurrent Parallel

86 Garbage Collector Constraint-based Generational Concurrent Parallel

87 Constraint-Based Marking Transitive reachability is not always enough Common examples: Soft references Weak map

88 Constraint-Based Marking Transitive reachability is not always enough WebKit examples: Type inference Weak map DOM Native code

89 Constraint-Based Marking Transitive reachability is not always enough WebKit examples: Type inference Weak map DOM Native code

90 Type Inference

91 Structure prototype {x, y} global object {1, 2} Objects {-5, 7} {42, 3}

92 prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

93 JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

94 Is this a weak reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

95 JIT code references a structure Strong reference? Weak reference? Marking constraint?

96 Strong reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

97 Strong reference? JIT code prototype {x, y} global object

98 Strong reference? JIT code prototype {x, y} global object

99 Strong reference? JIT code prototype {x, y} global object so many leaks

100 Weak reference? JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

101 Weak reference? JIT code prototype {x, y} global object

102 Weak reference? JIT code prototype {x, y} global object

103 Weak reference? JIT code prototype {x, y} global object recomp storm

104 Marking Constraint JIT code prototype structure global object

105 Marking Constraint JIT code prototype structure global object JIT code references the structure weakly.

106 Marking Constraint if (ismarked(structure->globalobject()) && ismarked(structure->storedprototype())) mark(structure); JIT code prototype structure global object JIT code references the structure weakly. JIT code also registers the above marking constraint.

107 Marking Constraint! JIT code prototype {x, y} global object {1, 2} {42, 3} {-5, 7}

108 Marking Constraint! JIT code prototype {x, y} global object

109 Marking Constraint! JIT code prototype {x, y} global object It s cool - the prototype and global object are long-lived.

110 Marking Constraint! JIT code {x, y}

111 Marking Constraint! JIT code {x, y}

112 Marking Constraint! JIT code {x, y} We want the JIT code to die in this case.

113 Marking Constraint! If the objects that use the structure die, then: Keep structure alive if the user objects it points to are alive anyway. Kill the structure (and the JIT code) if keeping it alive would not be safe-for-space.

114 Marking Constraints Constraints can query which objects are marked. Constraints can mark objects. GC executes constraints to fixpoint.

115 Garbage Collector Constraint-based Generational Concurrent Parallel

116 Conclusion JavaScriptCore Architecture: Interpreters and Multiple JITs Cells, Structures, and Butterflies Watchpoints, Value Profiles, and Inline Caches Constraint-Based GC