JavaScript JavaScript Core & WebCore JavaScript VM JavaScript Compiler JavaScript JIT (SSA,CSE,Inline Cache...)

1. JavaScript Core 概述
陈浩
Jun/2013

2. Agenda
• JavaScript
• JavaScript Core & WebCore
• JavaScript VM
• JavaScript Compiler
• JavaScript JIT
• And ……

3. JavaScript

4. JavaScript
• Garbage collection
• Dynamic typing
• No classes, prototypes allow OOP
• eval, call, apply, inner functions, closures

5. JavaScript - OOP

6. JavaScript – Closure & Scope Chain

7. id win = [webView windowScriptObject];
id location = [win valueForKey:@"location"];
NSString *href = [location valueForKey:@"href"];
JavaScript in Objective-C

8. JavaScript Core and WebCore

9. 模块

11. JavaScript – Running Environment
• VM
• Global Object
• Execution Context
– Exec State

13. Property Access

14. Execution Context
.Global Code
.Function Code
.Eval Code

16. JS Binding
• W3C Web IDL

17. JS Binding

18. JS Binding

19. Console

20. JavaScript Execution
页面解析相关
执行相关

21. JavaScript Execution

22. JavaScript Execution

23. Script Element

24. HTML Parser

25. JavaScript Execution

26. JS blocked by CSS

27. JavaScript Execution - async

28. JavaScript Execution - defer

29. W3C Standard
• Running a script
– <LINK>

30. Inside of JSC

31. Running in JSC

32. 模块功能
Front-end
Back-end

33. 前端功能组
后端功能组

35. Parser

36. Lexer & Parser
i=3;
Variable Equal Constant End
To assign 3 to variable i.

42. VM
• Register-Based
[ 0] enter
[ 1] mov r0, Cell: 0133FC40(@k0)
[ 4] put_by_id r0, a(@id0), Int32:
100(@k1)
[ 13] mov r0, Cell: 0133FC40(@k0)
[ 16] put_by_id r0, b(@id1), Int32:
200(@k2)
[ 25] mov r0, Cell: 0133FC40(@k0)
[ 28] put_by_id r0, c(@id2), Int32:
300(@k3)
[ 37] resolve_global r0, a(@id0)
[ 43] resolve_global r1, b(@id1)
[ 49] add r0, r0, r1
[ 54] resolve_global r1, c(@id2)
[ 60] mul r0, r0, r1
[ 65] ret r0

43. VM
• Stack Based 0： bipush 100
2: istore_1
3: sipush 200
6: istore_2
7: sipush 300
10: istore_3
11: iload_1
12: iload_2
13: iadd
14: iload_3
15: imul
16: ireturn

44. function sub(a,b)
{
return a-b;
}
function add(a,b)
{
return a+b;
}
i=0;
while(i<3000)
{
value = add(i,i+2);
i=i+1;
}
value = value + 1;
[ 0] enter
[ 1] mov r0, Undefined(@k0)
[ 4] resolve_base r1, i(@id0), 20975696, 20978944
[ 11] mov r0, Int32: 0(@k1)
[ 14] put_to_base r1, i(@id0), r0, 20978944
[ 19] resolve r1, i(@id0), 20975712
[ 24] jnless r1, Int32: 3000(@k2), 78(->102)
[ 28] loop_hint
[ 0] enter
[ 1] add r0, r-8, r-9
[ 6] ret r0

45. Low Level Interpreter
• 执行ByteCode
• Offlineasm

47. Bytecode
[ 32] put_to_base r1, s(@id0), r0, 35719584
[ 37] resolve_base r1, i(@id2), 35719328, 35719616
[ 44] mov r0, Int32: 0(@k3)
[ 47] put_to_base r1, i(@id2), r0, 35719616
[ 52] resolve r1, i(@id2), 35719344
[ 57] jnless r1, Int32: 3000(@k4), 78(->135)
[ 61] loop_hint
[ 62] resolve_base r1, value(@id3), 35719360, 35719648
[ 69] resolve_with_this r5, r2, add(@id4), 35719376
[ 75] resolve r4, i(@id2), 35719344
[ 80] resolve r6, i(@id2), 35719344
[ 0] enter
[ 1] sub r0, r-8, r-9
[ 6] ret r0

49. JIT – Just in time
• 编译为本地代码
• 占用执行时间

50. JIT - Interpreter
• Classic Interpreter
– Implementation
• while(1) { switch(…) …}
– Easy implementation
– Performance limitation
• Obsoleted in WebKit.

51. JIT
• ◮ Compiler generates machine code from bytecode (jit/*)
• ◮ Big switch with emit-calls
• ◮ Uses target specific macro assembler and assembler classes
• ◮ Target specific assember constructs instruction words
• ◮ Register allocation

52. Baseline JIT
• 与Interpreter相似, 执行ByteCode
• 转为机器码执行

53. DFG JIT
• Data Flow Graph JIT
• 推测优化、局部寄存器分配
• 基于数据流图的类型推测
– SSA

54. Traced JIT

55. Execution – Dynamic Compiler

56. Type Inference
• 对已知类型的数据操作要比查表法快得多，所以需要越早
知道数据类型，越有利于提升性能。

57. Type Inference
o.x * o.x + o.y * o.y
1. Type Prediction
2. Type Checks

58. Garbage Collection
• Mark – Sweep
– Reference Counting
– Bitmap

59. Forward …

60. Compiler

61. SSA
• 转为直线型代码，优化的基础

62. Trampolines
• 机器码函数存根
• JIT编译后，替换为真实函数的指针。

63. Trampolines

64. Inline Cache

65. Inline Cache
• Polymorphic Inline Cache
– Source Code:PolymorphicPutByIdList.h/.cpp

66. Common Sub-expression Elimination
• Value numbering
• CSE

67. Register Allocation
• Linear Scan
• Register Allocation
RegisterID *BytecodeGenerator::newRegister()

68. Generational GC
• Card marking Write Barriers
Tracer:
Marks and traces
Java Mutator:
Modifies Blue and Green objects
Write barrier on objects
Tracer:
Traces rest of graph
Tracer:
Clean blue object

69. Any more…

70. • LLVM IR to JavaScript (Emscripten)
– Python,Ruby,Lua for WebBrowser
– C++ to JavaScript
• JavaScript on LLVM
– Farbic Engine
VM/JIT

72. Garbage Collection
• Pause time
• Pause predictability
• CPU usage
• Memory footprint
• Virtual memory interaction
• Cache interaction
• Effects on program locality
• Compiler and runtime impact

73. • ECMA Harmony
– 6th version

74. Key Reference
• Virtual Machine & JavaScript Engine
– <LINK>