Inside Mozilla's New JavaScript JIT Compiler

An anonymous reader writes "IonMonkey is the name of Mozilla's new JavaScript JIT compiler, which aims to enable many new optimizations in the SpiderMonkey JavaScript engine. InfoQ had a small Q&A with Lead Developer David Anderson, about this new development that could bring significant improvements in products that use the SpiderMonkey engine like Firefox, Thunderbird, Adobe Acrobat, MongoDB and more. This new JIT infrastructure, will feature SSA compiler intermediate representations which will facilitate advanced optimizations such as type specialization, function inlining, linear-scan register allocation, dead-code elimination, and loop-invariant code motion."

LLVM

[nhaehnle]

I'd be interested to hear why the Mozilla developers don't use an existing compiler framework like LLVM, which already implements many advanced optimization techniques. I am aware that JavaScript-specific problems need to be dealt with anyway, but it seems like they could save themselves a lot of hassle in things like register allocation etc. Those are not so interesting problems that are handled by existing tools like LLVM quite well, so why not use that?

Re:types

[BZ]

OK. Let's look at http://code.jquery.com/jquery-1.5.2.js [jquery.com] very quick. This isn't even a minified version; just the original source. Pretend like you don't know what jquery is doing. The first few functions with arguments here:

> function( selector, context )

What are the types of those?

> function( selector, context, rootjQuery )

And those?

> function( num )

And that one? Hint: the function expects it to be "null" or at least "undefined" sometimes.

> function( elems, name, selector )

And that? Note that the function itself is not sure what to expect in |elems| and has different codepaths depending on what it finds there.

The point is, going from name to type is not really that easy.

Worse yet, "type" in this context also means what JS engines variously call "shape" or "hidden type": two instances of Object are considered the same type if they have the same properties in the same order. Telling _that_ from a variable name is pretty hard.