More Type Instability and Specialization in JavaScript

A while back I talked about type instability in JavaScript, and how TraceMonkey optimizes it by connecting type-specialized traces together. This stitching mechanism was only half complete.

TraceMonkey has a global cache called the “trace monitor.” As the original version did not type-specialize any loop (tree) more than once, there was a design decision to only monitor one global object at a time. This is significant because there can be many global objects in JavaScript. Each window in the browser has its own global object as a security measure (windows can’t poison other windows).

Let’s say there’s a window A with global object of shape X. The monitor notices this and compiles a bunch of traces specialized to that global object. Then window B with global object of shape Y starts running an intensive loop. The trace monitor kicks in, notices that the global object is different, and flushes its entire cache. A cache flush invalidates every trace, meaning the JIT’d code is deleted.

The trace monitor also locked itself to the types of every property in the global object it was tracking. If any variable in the global object changed, the cache would flush, even if most of the traces never used this variable. Any type of global instability, either from changed global variables or different global objects, would throw out all JIT’d code.

This would be fine:

Select All Code:
function f() { 
   for (var i in ["1", "1", "1", 1, 1, 1.5])
      ;
}

This would continually flush the cache, as i is global and type unstable:

Select All Code:
for (var i in ["1", "1", "1", 1, 1, 1.5])
 ;

Luckily we’re now working on fixing this, and the first major step landed last week. The trace monitor no longer keeps track of global types. This information is tracked in each tree and each guard, and the old principles of “multitrees” apply. If a global variable is not type-stable across a loop, the loop is left unclosed and the dangling edge becomes an “unstable exit.” If there ever exists a tree whose entry types match an unstable exit, the edges are joined together.

See the original post for diagrams.

The only additional complication with global variables is that they are lazily tracked by the trace monitor. This is an optimization. If there are 50,000 globals in play and only 5 ever get used, there’s no need to iterate through every single one. As traces get recorded, every tracked global variable is included in a tree’s specialization. Old trees that don’t include newly tracked globals will be updated automatically. This removes the need for complex dependency tracking for branches and nested trees.

So now that global types are specialized pre-tree, what’s the next step? The plan is to include the actual identity of the global object in per-tree specializations. The easiest way to do this is probably to probably divide up the trace monitor, so that it can maintain separate caches for each global object. This way if a global object’s shape changes, only its cache will be flushed.

Fine-grained specialization continues to be the most interesting and promising aspect of trace compilation for dynamic languages.

14 thoughts on “More Type Instability and Specialization in JavaScript

  1. ahmed deedat

    hi!,I love your writing so so much! share we keep up
    a correspondence more approximately your post on AOL?
    I need a specialist in this house to resolve my problem.
    May be that’s you! Having a look forward to look you.

    Reply
  2. Movie Studio business

    I definitely wanted to develop a brief message so as to say thanks to you for all the fantastic tips and hints you are placing at this website. My time intensive internet research has now been honored with good quality information to go over with my two friends. I ‘d believe that many of us readers actually are very blessed to dwell in a superb network with so many marvellous people with interesting methods. I feel pretty happy to have used your entire weblog and look forward to plenty of more awesome times reading here. Thanks again for everything.

    Reply
  3. Sol Cbd

    I love all of the points you have made here. I would like to be a teacher in this topic. The human mind is not designed to make us happy, as much as we might wish it were so. I really enjoy this! I really do wish I was able to fully understand the finer details of this subject but most of this is lost on me. I have been following this website for some time now and I really enjoy the improvements you’ve made to your website.

    Reply
  4. Palma

    you are really a good webmaster. The website loading velocity is incredible.
    It sort of feels that you are doing any unique trick. Moreover, The
    contents are masterpiece. you’ve performed a magnificent task in this
    matter!

    Reply

Leave a Reply

Your email address will not be published.