Extending Basic Block Versioning with Typed Object Shapes

TL;DR

This paper presents two techniques, typed shapes and shape propagation, to reduce dynamic checks in JavaScript engines, significantly improving performance and code size in a JIT compiler.

Contribution

It introduces typed shapes and shape propagation methods that effectively eliminate redundant property checks, enhancing JavaScript JIT compilation efficiency.

Findings

48% reduction in type tests on average

17% smaller code size

25% faster execution times

Abstract

Typical JavaScript (JS) programs feature a large number of object property accesses. Hence, fast property reads and writes are crucial for good performance. Unfortunately, many (often redundant) dynamic checks are implied in each property access and the semantic complexity of JS makes it difficult to optimize away these tests through program analysis. We introduce two techniques to effectively eliminate a large proportion of dynamic checks related to object property accesses. Typed shapes enable code specialization based on object property types without potentially complex and expensive analyses. Shape propagation allows the elimination of redundant shape checks in inline caches. These two techniques combine particularly well with Basic Block Versioning (BBV), but should be easily adaptable to tracing Just-In-Time (JIT) compilers and method JITs with type feedback. To assess the effectiveness of the techniques presented, we have implemented them in Higgs, a type-specializing JIT compiler for JS. The techniques are compared to a baseline using polymorphic Inline Caches (PICs), as well as commercial JS implementations. Empirical results show that across the 26 benchmarks tested, these techniques eliminate on average 48% of type tests, reduce code size by 17% and reduce execution time by 25%. On several benchmarks, Higgs performs better than current production JS virtual machines