1. Untyped Compilation
function f(left, right) {
var t = left + right
...
}

2. Untyped Compilation
Compile Everything!
function f(left, right) {
var t = left + right
...
}

3. Untyped Compilation
Compile Everything!
... but only one type at a time.
function f(left, right) {
var t = left + right
...
}

4. Let’s Compile Numbers
JavaScript numbers are floats
function f(left, right) {
var t = left + right
...
}
f(5, 10);

5. Let’s Compile Numbers
JavaScript numbers are floats
... but we can use integers, too
function f(left, right) {
var t = left + right
...
}
f(5, 10);

6. Integer Add
Register Variable
edi left.type
eax left.data
ebx right.type
edx right.data

7. Integer Add
Register Variable
edi left.type
eax left.data
add edx, eax ebx right.type
edx right.data

8. Register Variable Value
edi left.type STRING
eax left.data “a”
add edx, eax ebx right.type INT32
edx right.data 35

9. Oh no, a string
Register Variable Value
edi left.type STRING
eax left.data “a”
add edx, eax ebx right.type INT32
edx right.data 35

10. Oh no, a string
Register Variable Value
edi left.type STRING
Integer add is bogus! eax left.data “a”
add edx, eax ebx right.type INT32
edx right.data 35

11. Integers, Untyped JIT
Register Variable
edi left.type
cmp edi, 0xffffff81
jne other eax left.data
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type
edx right.data

12. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

13. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

14. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

15. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

16. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

17. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

18. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

19. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

20. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

21. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

22. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

23. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 35

24. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 27
cmp ebx, 0xffffff81
jne other
add edx, eax ebx t.type
right.type INT32
edx t.data
right.data 62
35

25. What about...
Calling f() with a huge integer?
function f(left, right) {
var t = left + right
...
}
f(2147483647, 2147483647);

26. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 2^31-1

27. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
edx right.data 2^31-1

28. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax ebx t.type
right.type INT32
edx t.data
right.data -2
2^31-1

29. JavaScript Numbers
js> 2147483647 + 2147483647

30. JavaScript Numbers
js> 2147483647 + 2147483647 ↵
4294967294

31. JavaScript Numbers
js> 2147483647 + 2147483647
4294967294
js> 4294967294 == -2

32. JavaScript Numbers
js> 2147483647 + 2147483647
4294967294
js> 4294967294 == -2 ↵
false

33. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax ebx right.type INT32
jo stub
edx right.data 2^31-1

34. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax
jo stub
ebx t.type
right.type INT32
edx t.data
right.data -2
2^31-1

35. Integers, Untyped JIT
Register Variable Value
edi left.type INT32
cmp edi, 0xffffff81
jne other eax left.data 2^31-1
cmp ebx, 0xffffff81
jne other
add edx, eax
jo stub
ebx t.type
right.type INT32
edx t.data
right.data -2
2^31-1

36. Hey! What about
floats?
function f(left, right) {
var t = left + right
...
}
f(2.717, Math.PI);

37. Floats, Untyped JIT
cmp edi, 0xffffff81
jne other
cmp ebx, 0xffffff81
jne other
add edx, eax
jo stub

38. Floats, Untyped JIT
cmp edi, 0xffffff80
jae stub
cmp edi, 0xffffff80
jb skip_convert
cmp ebx, 0xffffff81
jne stub
cmp edi, 0xffffff81 cvtsi2sd xmm5, eax
jne other jmp converted
cmp ebx, 0xffffff81 skip_convert:
movd xmm5, eax
jne other pinsrd xmm5, ebx, 1
add edx, eax converted:
jo stub movd xmm6, edx
pinsrd xmm6, edi, 1
jmp add

39. Floats, Untyped JIT
cmp edi, 0xffffff80
jae stub
cmp edi, 0xffffff80
jb skip_convert
cmp ebx, 0xffffff81
jne stub
cmp edi, 0xffffff81 cvtsi2sd xmm5, eax
jne other jmp converted
cmp ebx, 0xffffff81 skip_convert:
movd xmm5, eax
jne other pinsrd xmm5, ebx, 1
add edx, eax converted:
jo stub movd xmm6, edx
pinsrd xmm6, edi, 1
jmp add
cmp ebx, 0xffffff80
jae stub
cvtsi2sd xmm6, ecx
movd xmm5, eax
pinsrd xmm5, ebx, 1
jmp add

40. Floats, Untyped JIT
cmp edi, 0xffffff80
jae stub
cmp edi, 0xffffff80
jb skip_convert
cmp ebx, 0xffffff81
jne stub
cmp edi, 0xffffff81 cvtsi2sd xmm5, eax
jne other jmp converted
cmp ebx, 0xffffff81 skip_convert:
movd xmm5, eax
jne other pinsrd xmm5, ebx, 1
add edx, eax converted:
jo stub movd xmm6, edx
pinsrd xmm6, edi, 1
jmp add
cmp ebx, 0xffffff80
jae stub
cvtsi2sd xmm6, ecx
movd xmm5, eax
add: pinsrd xmm5, ebx, 1
addsd xmm6, xmm5 jmp add
movsd [ebp+0x50], xmm6
movl edx, [ebp+0x50]
jmp rejoin

41. Floats, Untyped JIT
cmp edi, 0xffffff80
jae stub
cmp edi, 0xffffff80
jb skip_convert
cmp ebx, 0xffffff81
jne stub
cmp edi, 0xffffff81 cvtsi2sd xmm5, eax
jne other jmp converted
cmp ebx, 0xffffff81 skip_convert:
movd xmm5, eax
jne other pinsrd xmm5, ebx, 1
add edx, eax converted:
jo stub movd xmm6, edx
pinsrd xmm6, edi, 1
jmp add
cmp ebx, 0xffffff80
jae stub
cvtsi2sd xmm6, ecx
movd xmm5, eax
add: pinsrd xmm5, ebx, 1
addsd xmm6, xmm5 jmp add
movsd [ebp+0x50], xmm6
movl edx, [ebp+0x50]
jmp rejoin 30 instructions!

42. Benchmark...

43. Benchmark...
function distance(a, b) {
var t;
for (var i = 0; i < a; i++) {
for (var j = 0; j < b; j++) {
t = ((a - i) * (a - i)) +
((b - j) * (b - j));
}
}
}

44. The Whole Loop
cmp $0xffffff81,%ebx
jne 0xf73ef58f
(b - j)
cmp $0xffffff81,%edi cmp $0xffffff81,%edx
jne 0xf73ef353
(a - i)
jne 0xf73ef5cc
cmp $0xffffff81,%esi cmp $0xffffff81,%edx sub %esi,%eax cmp $0xffffff81,%edx
jne 0xf73ef390 jne 0xf73ef4ce jo 0xf73ef5f4 jne 0xf73ef72b cmp $0xffffff81,%edi
sub %edx,%ecx cmp $0xffffff81,%ebx cmp $0xffffff81,%ebx jne 0xf73ef7f5
jo 0xf73ef3b8
*
jne 0xf73ef50b
imul %eax,%ecx
jo 0xf73ef550
*
jne 0xf73ef768
imul %edi,%eax
jo 0xf73ef7b0
+
cmp $0xffffff81,%ebx
jne 0xf73ef832
add %eax,%edx
cmp $0xffffff81,%edi test %ecx,%ecx cmp $0xffffff81,%ebx test %eax,%eax jo 0xf73ef85a
jne 0xf73ef40c je 0xf73ef533 jne 0xf73ef65a je 0xf73ef790
(a - i)
cmp $0xffffff81,%esi
jne 0xf73ef449
sub %edx,%eax
(b - j)
cmp $0xffffff81,%edx
jne 0xf73ef697
sub %esi,%edi
jo 0xf73ef471 jo 0xf73ef6bf

45. The Whole Loop
~230 instructions
cmp $0xffffff81,%ebx
jne 0xf73ef58f
(b - j)
cmp $0xffffff81,%edi cmp $0xffffff81,%edx
jne 0xf73ef353
(a - i)
jne 0xf73ef5cc
cmp $0xffffff81,%esi cmp $0xffffff81,%edx sub %esi,%eax cmp $0xffffff81,%edx
jne 0xf73ef390 jne 0xf73ef4ce jo 0xf73ef5f4 jne 0xf73ef72b cmp $0xffffff81,%edi
sub %edx,%ecx cmp $0xffffff81,%ebx cmp $0xffffff81,%ebx jne 0xf73ef7f5
jo 0xf73ef3b8
*
jne 0xf73ef50b
imul %eax,%ecx
jo 0xf73ef550
*
jne 0xf73ef768
imul %edi,%eax
jo 0xf73ef7b0
+
cmp $0xffffff81,%ebx
jne 0xf73ef832
add %eax,%edx
cmp $0xffffff81,%edi test %ecx,%ecx cmp $0xffffff81,%ebx test %eax,%eax jo 0xf73ef85a
jne 0xf73ef40c je 0xf73ef533 jne 0xf73ef65a je 0xf73ef790
(a - i)
cmp $0xffffff81,%esi
jne 0xf73ef449
sub %edx,%eax
(b - j)
cmp $0xffffff81,%edx
jne 0xf73ef697
sub %esi,%edi
jo 0xf73ef471 jo 0xf73ef6bf

46. The Whole Loop
~230 instructions
cmp $0xffffff81,%ebx
jne 0xf73ef58f
(b - j)
cmp $0xffffff81,%edi cmp $0xffffff81,%edx
jne 0xf73ef353
(a - i)
jne 0xf73ef5cc
cmp $0xffffff81,%esi cmp $0xffffff81,%edx sub %esi,%eax cmp $0xffffff81,%edx
jne 0xf73ef390 jne 0xf73ef4ce jo 0xf73ef5f4 jne 0xf73ef72b cmp $0xffffff81,%edi
sub %edx,%ecx cmp $0xffffff81,%ebx cmp $0xffffff81,%ebx jne 0xf73ef7f5
jo 0xf73ef3b8
*
jne 0xf73ef50b
imul %eax,%ecx
jo 0xf73ef550
*
jne 0xf73ef768
imul %edi,%eax
jo 0xf73ef7b0
+
cmp $0xffffff81,%ebx
jne 0xf73ef832
add %eax,%edx
cmp $0xffffff81,%edi test %ecx,%ecx cmp $0xffffff81,%ebx test %eax,%eax jo 0xf73ef85a
jne 0xf73ef40c je 0xf73ef533 jne 0xf73ef65a je 0xf73ef790
(a - i)
cmp $0xffffff81,%esi
jne 0xf73ef449
sub %edx,%eax
(b - j)
cmp $0xffffff81,%edx
jne 0xf73ef697
sub %esi,%edi
jo 0xf73ef471 jo 0xf73ef6bf
JägerMonkey runs 100mil
iterations in 1012ms

47. Can we do better?
function distance(a, b) {
var t;
for (var i = 0; i < a; i++) {
for (var j = 0; j < b; j++) {
t = ((a - i) * (a - i)) +
((b - j) * (b - j));
}
}
}

48. Typed Optimizations
function distance(a, b) {
var t;
for (var i = 0; i < a; i++) {
for (var j = 0; j < b; j++) {
t = ((a - i) * (a - i)) +
((b - j) * (b - j));
}
}
}

49. Hoisting
Move computation
outside of the loop
function distance(a, b) {
var t;
for (var i = 0; i < a; i++) {
var t0 = ((a - i) * (a - i));
for (var j = 0; j < b; j++) {
t = t0 + ((b - j) * (b - j));
}
}
}

50. Why only Typed JITs?
var ham = 0;
var obj = { valueOf: function () {
return ham++;
}
}
f(obj, obj);

51. Why only Typed JITs?
“ham” must be incremented
var ham = 0;
var obj = { valueOf: function () {
return ham++;
}
}
f(obj, obj);

52. Typed Optimization
function distance(a, b) {
var t;
for (var i = 0; i < a; i++) {
var t0 = ((a - i) * (a - i));
for (var j = 0; j < b; j++) {
t = t0 + ((b - j) * (b - j));
}
}
}

53. Elimination
Redundant (b - j)
function distance(a, b) { eliminated
var t;
for (var i = 0; i < a; i++) {
var t0 = ((a - i) * (a - i));
for (var j = 0; j < b; j++) {
var temp = (b - j);
t = t0 + (temp * temp);
}
}
}

54. Typed JIT - IonMonkey
sub eax, ecx ; t0 = (b - j)
jo 0xf73ed01d
imul eax, eax ; t1 = (t0 * t0)
jo 0xf73ed022
test eax, eax
je 0xf73ed022
add ebx, eax ; t2 = (expr) + t1
jo 0xf73ed027

55. Typed JIT - IonMonkey
sub eax, ecx ; t0 = (b - j)
jo 0xf73ed01d
imul eax, eax ; t1 = (t0 * t0)
jo 0xf73ed022
test eax, eax
je 0xf73ed022
add ebx, eax ; t2 = (expr) + t1
jo 0xf73ed027
Runs in 250ms, or 3.8X faster!

56. Smarter
sub eax, ecx ; t0 = (b - j)
jo 0xf73ed01d
imul eax, eax ; t1 = (t0 * t0)
jo 0xf73ed022
add ebx, eax ; t2 = (expr) + t1
jo 0xf73ed027
Runs in 220ms, or 4.6X faster!

57. Arithmetic in C
movl ecx, ebx
subl ecx, ebx
imul ecx, ecx
addl ecx, esi

58. Arithmetic in C
movl ecx, ebx •C: 97ms
subl ecx, ebx •Untyped JIT within 10X
imul ecx, ecx •Typed JIT within ~2X
addl ecx, esi

59. Semantic Gap
• No way to tell JS, “use integers”
• C distinguishes float/ints