650715 - JM+TI: do SSA

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Backend optimizations in JM+TI already do things in several places that are subsumed by SSA, tracking values as they are pushed and values of variables in straight-line code.  Doing full-blown SSA would simplify these and would make future analysis and inference work easier and more precise (interval analysis for bug 650496, bug 649260).  IonMonkey will also need SSA, but its needs as I understand them will be somewhat different --- the plan there is an SSA-based IR which can be transformed by high level optimizations, while here we need static information that easily maps to and from the bytecode.  Can just implement this now (since we need it now) and figure out the interaction with IonMonkey later.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: restructuring

Restructure frontend analyses so that all analyses have the same lifetime as inference data (persist until the next GC) and allocate from the same per-compartment arena as type inference.  Also flattens analyze::Script, analyze::LifetimeScript and types::TypeScript into a single data structure analyze::ScriptAnalysis, which holds all analysis and type information for the script (destroyed on each GC).

There was a real hodgepodge of different lifetimes and arenas around, this simplifies things and makes it easier to add SSA as an optional frontend pass.  Skeleton SSA structures are here, no algorithm and all this does is compile.

Comment 2

[Brian Hackett [Laid off!]]

Attachment: WIP

Has an SSA implementation now, not tested at all and needs integration with inference, other analyses and the compiler itself.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: WIP 2

Inference and Compiler using SSA values, works on small examples, still some missing functionality.

Comment 4

[Brian Hackett [Laid off!]]

Attachment: WIP 3

Passes jit-tests with --jitflags=na (i.e. no methodjit, but the methodjit changes aren't that big).

Comment 5

[Brian Hackett [Laid off!]]

Attachment: patch

Patch landed on JM.

http://hg.mozilla.org/projects/jaegermonkey/rev/90a7b141e0cf

Speeds up SS and other benchmarks slightly for me, I think due to the lowered recompilation penalty --- we only need to do the compilation pass and not redo the analysis passes.  But doing this analysis doesn't seem to cost much, and the implementation is pretty clean.  One way it could be improved:

- Depends on lifetime analysis having been done first.  At loop heads we eagerly generate phi nodes for all variables modified in the loop, which requires lifetimes indicating to figure out that modified set.  Making this lazier would cut this dependency, which would be good as for IonMonkey the lifetime analysis will I believe want to be done on the SSA form.

Comment 6

[Brian Hackett [Laid off!]]

Looks to have broken one of the Kraken crypto tests, does anyone mind doing a testcase reduction?  (Need to learn to use these myself one of these days...).  A new MochiTest-4 failure too, surprisingly green otherwise.