Re:How JavaScript works: inside the V8 engine
by foldr on Tuesday August 22, 2017 @05:36AM
(#15070857)
>[1]: If you can read assembly, this one's hilarious: https://godbolt.org/g/81qWoq
I only barely read assembly, so I was just trying to figure this one out.
So, the compiler has figured out that it just needs to test v against 0 (since the array is immutable), but it does this 2 times, and with a couple of apparently redundant 'je' instructions. Is that what's weird about the output?
In case it changed, this is the output I saw:
example::exists_in_table:
push rbp
mov rbp, rsp
mov al, 1
test edi, edi
je .LBB0_5
je .LBB0_5
test edi, edi
je .LBB0_5
je .LBB0_5
xor eax, eax
.LBB0_5:
pop rbp
ret
Re:How JavaScript works: inside the V8 engine
by Veedrac on Tuesday August 22, 2017 @11:06AM
(#15073106)
Basically, yes. The first test and je show the compiler has managed the hard part, but the next je obviously can't be hit, the test after that literally doesn't do anything, and the two jumps after that also can't be hit. It's funny because this is all so trivial.
If I write it as some C
bool should_jump = edi == 0;
if (should_jump) goto LBB0_5;
if (should_jump) goto LBB0_5;
bool should_jump = edi == 0;
if (should_jump) goto LBB0_5;
if (should_jump) goto LBB0_5;
I can guarantee the compiler is going to produce good code from it.
Re:How JavaScript works: inside the V8 engine
by eddyb on Tuesday August 22, 2017 @06:30AM
(#15071072)
This looks like yet-another-phase-ordering-issue in LLVM. I hit so many of these it's not even funny. Arguably one could find C code that shows the exact problem under clang. Example of optimized LLVM IR for that sample (press LLVM IR on https://play.rust-lang.org/?gist=b60ec85886eff967b21c7abc899...):
br i1 false, label %bb9, label %bb6
SimplifyCFG would instantly kill that. But it doesn't get to run again after whatever simplified the branch condition. I've heard rumors that LLVM is working on a new pass manager, maybe they will eventually fix this pervasive issue.
Re:How JavaScript works: inside the V8 engine
by Veedrac on Tuesday August 22, 2017 @10:37AM
(#15072786)
Apologies for prodding a sore spot! The phase ordering problem is a well known demon for compilers; makes me wonder why I've not heard anything about unphased compilation.
Re:How JavaScript works: inside the V8 engine
by eddyb on Tuesday August 22, 2017 @02:04PM
(#15074914)
No worries, I'm just surprised you managed to find a simple testcase that exhibits it, so, really, thank you!
I've opened a (a bit vague for now) issue so at least I don't forget about it: https://github.com/rust-lang/rust/issues/44041
As for phase ordering - someone did show me recently VSDG, which claims to solve at least part of the problem (specifically, https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-705.pdf and http://sro.sussex.ac.uk/7576/1/Stanier%2C_James.pdf).
Re:How JavaScript works: inside the V8 engine
by Veedrac on Wednesday August 23, 2017 @06:50PM
(#15085885)
Awesome references, seems I have some fun reading :). (Trivia: Alan Mycroft actually supervised me for my undergraduate dissertation.)
Re:How JavaScript works: inside the V8 engine
by pjmlp on Monday August 21, 2017 @02:40PM
(#15066656)
You can at least use the browser profiler tools.
Re:How JavaScript works: inside the V8 engine
by fenomas on Monday August 21, 2017 @10:00PM
(#15069186)
Browser profiling tools are great but their granularity stops at the function level - they can't tell you anything about what happens within a given function, just how that function compares to others.
That said, I don't actually know allocation is the problem; it's a suspect, but unlike a native script I can't just run `perf` to get performance counters and assembly listings. All I really know is that the non-allocating order is a lot faster.
[1]: If you can read assembly, this one's hilarious: https://godbolt.org/g/81qWoq