Moz JS Team Newsletter 7/29-8/9
Sean Stangl has joined the JS team. He worked on JägerMonkey last year as an intern, and now he’s here full-time, initially working on IonMonkey. Welcome, Sean!
Project Status Updates
Type Inference: Brian Hackett is fixing regressions and getting ready to “land” type inference. Landing is tricky because the complexity of the project makes it very difficult to disable or back out the landing. Dave Mandelin posted a proposal in dev-planning for getting type inference out to users by creating parallel aurora and beta repositories and pointing channel users at the new builds.
IonMonkey: David Anderson landed bailouts. Current work is focused on fixing bugs turned up by the test suite.
jsdbg2 is almost there: just one more review. It is expected to land in time for Firefox 8.
Changes to SpiderMonkey that might affect you
In bug 676738, Jeff Walden split JS_GetElement and other JS_XXXElement functions into two forms: one where the index is a jsid (as before), and a new one where the index is a uint32. This goes along with the ‘aslots’ project, which will split int-named ‘element’ storage from string-named ‘property’ storage and allow dense arrays on any object.
Dave Mandelin and Chris Leary attended Black Hat. The talk Attacking Clientside JIT Compilers by Chris Rohlf and Yan Invnitskiy gave a lot of information about JIT spraying, and analyzed Firefox specifically. The good news is that JIT spraying is pretty hard with the kind of code JägerMonkey generates. The bad news is that Firefox currently has few defenses against JIT spraying.
But Chris Leary is on the case: he’s been implementing defenses, which are now public in bug 677272. He should have a strong set of mitigations landed within a week or two.
Bug 649202: Marty Rosenberg landed ICs for typed arrays on ARM, so typed arrays are now fast on ARM too.
Bug 586297: Jacob Bramley improved the generation of branches for ARM. The bug shows an 18% perf improvement on Kraken on ARM with the methodjit only.
Bug 669132: Jacob improved ARM floating-point loads. No perf data in the bug.
Bug 664249: Nikhil Marathe changed typed arrays to hold their properties inside the JSObject slots in order to improve performance. It looks like it got a 2x improvement to property access time in JM.