Shulou(Shulou.com)05/31 Report--

How to analyze the JS engine in the Inline Cache technology, many novices are not very clear, in order to help you solve this problem, the following editor will explain in detail for you, people with this need can come to learn, I hope you can gain something.

01 citation example

Function Point (XMagol y) {this.x = XTX this.y = y;} var p = new Point (0,1); var Q = new Point (2Jing 3); var r = new Point (4pm 5)

In order to avoid the influence of unstable factors in API calls, the timestamp is inserted internally by modifying the V8 source code. On a 3.2g 8-core machine, it takes time to execute the this.x=x statement when you test three calls to new Point (XQuery y), and the results are shown in the following table.

Time-consuming statistics for executing code this.x=x

Var p = new Point (0jue 1); 4.11nsvar Q = new Point (2jue 3); 6.63nsvar r = new Point (4meme 5); 0.65ns

As can be seen from the results in the table, it is not as expected that the speed will be faster from the second execution, on the contrary, the second time is slower than the first time, and the speed will not be faster until the third time. Later in this article, we will analyze the V8 IC mechanism to explain why the second time is the slowest and the third time is faster.

02 problem analysis

1. Object's hidden class (Hidden Class)

Because JavaScript objects have no type information, almost all JS engines use hidden classes (Hidden Class/Shape/Map, etc.) to describe the layout information of objects, to distinguish the types of different objects in the virtual machine, so as to complete some type-based optimization.

V8 uses HeapObject to describe and store JavaScript objects, each JavaScript object is a subclass of HeapObject, and each HeapObject uses Map to describe the layout of objects. The Map of an object describes the type of object, that is, the number of members, the name of the member, the location of the member in memory, and so on.

The objects p, Q and r in the above source code are all generated by the same constructor Point, so they have the same memory layout and can be described by the same Map.

two。 Hidden Class transition (Map Transition)

Because JavaScript is a highly dynamic programming language, members of objects can be dynamically added, deleted, or even modified at will. Therefore, the hidden class of an object may change during the running of the program, which is called hidden class transition (Map Transition) in V8.

In the above code, for example, when Point function is declared, V8 creates a hidden class map0 for Point. Because there are no attributes yet, map0 is empty. When this.x=x is executed, V8 creates a second Hidden Class map1,map1 that is based on map0 and describes the location of attribute x in memory, where the Hidden Class of the this object becomes map1 through Map Transition. When this.y=y is executed, the previous operation is repeated, a new Hidden Class map2 is created, and the Hidden Class of the this object is updated to map2. The process of changing the Map of a this object from map0 to map1 and then to map2 is called Map Transition. Figure 1 depicts the process of Map Transition during the creation of Point class objects.

Map Transition schematic diagram

3. Type feedback vector (type feedback vector)

The principle of the IC mechanism mentioned earlier is that for a code statement such as this.x=x, compare whether the cached Map and the object's current Map are the same when the statement was last executed, and if so, execute the corresponding IC-Hit code, and vice versa, execute the IC-Miss code. So how does V8 organize cached Map and IC-Hit code? As an example of the above code, V8 adds an array member named type_feedback_vector to the Point function object. For every code in the function that may generate IC, the type_feedback_vector in the Point object caches the Map of the object and the corresponding IC-Hit code (called IC-Hit Handler within V8) the last time the statement was executed. There are two possible IC statements in the Point function above, this.x=x and this.y=y. Assuming that the Map of the object this is map0 when executing to this.x=x and the Map of this is map1 when executing to this.y=y, the type_feedback_vector data content of the Point object is as follows:

Array subscript IC corresponding to source cached Map and corresponding IC-Hit Handler0this.x=x1this.y=y

To put it simply, type_feedback_vector caches Map and its corresponding IC-Hit handler, so the IC-related logic is reduced to simply accessing the type_eedback_vector to determine whether or not to IC Hit and execute the corresponding IC-Hit Handler.

4. IC state machine

To describe the state changes of IC in V8, this section describes the state changes of the most common IC types in V8 in the form of state machines. The most commonly used IC in V8 is divided into five states, as shown in figure 2. The initial state is uninitialized, and when an IC-Miss occurs, it will change into pre-monomorphic state, then IC-Miss will enter monomorphic state, and if it continues to IC-Miss, it will enter polymorphic state. After entering polymorphic, if you continue to IC-Miss 3 times, you will enter the megamorphic state and finally stabilize in the megamophi state.

IC state machine

The code in the example refers to the first three states of the IC state machine.

Take the popular this.x=x statement of the Point function as an example. When the this.x=x statement is executed for the first time, IC-Miss occurs because Point.type_feedback_vetor is empty. Setting the IC status from uninitialized to pre-monomorphic,IC-Miss Handler will analyze that the Map of the this object does not contain the attribute x, so the member x will be added, and then Map Transition will occur, that is, the hidden class of the this object mentioned earlier will change from map0 to map1. Considering that most functions may only be called once, the strategy of V8 is that when the first IC-Miss occurs, the map will not be cached and the IC-Hit handler will not be generated.

When the constructor is called for the second time to execute this.x=x, a second IC-Miss occurs because Point.type_feedback_vector is still empty, and the state of IC is changed to monomorphic. This time, in addition to Map Transition, IC-Miss Hanlder compiles and generates IC-Hit Handler, and caches map0 and IC Hit Handler into Point.type_feedback_vector. Since it is time-consuming for IC-Miss Handler to compile IC-Hit Handler, the second execution of this.x=x is the slowest.

When you call this.x=x in the constructor for the third time, it is found that Point.type_feedback_vector is not empty, and the cached map0 is the same as the Map of the this object at this time, so IC-Hit Handler will be called directly to add member x and Map transition. Since there is no need to analyze map0 or compile IC-Hit Handler this time, it is more efficient than the previous two times.

So far, it has been explained why when V8 executes the constructor, the second pass is the slowest and the third is the fastest. 5. Polymorphic and Megamorphic

Function f (o) {return o.x;} f ({xlv 1}) / / pre-monomorphicf ({x pre-monomorphicf 2}) / / monomorphicf ({x v v 3, y v v}) / / polymorphic degree 2f ({x v v 4, z v 1}) / / polymorphic degree 3f ({x v v 5, a v 1}) / / polymorphic degree 4f ({x v v 6, b v 1}) / / megamorphic the above code describes both the polymorphic state and the megamophicke state in figure 2 state machine. As mentioned in above 3, type_feedback_vector caches Map and IC-Hit Handler, but if there are too many IC states, such as reaching the megamorph state, Map and IC-Hit Handler will no longer be cached in the feedback_vector of the Point object, but will be stored in a fixed-size global hashtable. If the IC state is more than the size of the hashtable, the previous cache will be overwritten. From the above analysis, we can sum up the performance of different IC states: if you can IC-Hit in the monomorphic state every time, the code runs fastest; in the polymorphic IC-Hit, the cache needs to be looked up linearly; Megamorphic is the lowest performance IC-Hit, because you need to look up the hashtable every time, but the performance of megamorphic ic hit is still better than IC-Miss.

IC-Miss performance is the worst.

Is it helpful for you to read the above content? If you want to know more about the relevant knowledge or read more related articles, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.