Tracing just-in-time compilation

Technical details

A tracing JIT compiler goes through various phases at runtime. First, profiling information for loops is collected. After a hot loop has been identified, a special tracing phase is entered, which records all executed operations of that loop. This sequence of operations is called a trace. The trace is then optimized and compiled to machine code. When this loop is executed again, the compiled trace is called instead of the program counterpart.

These steps are explained in detail in the following:

Profiling phase

The goal of profiling is to identify hot loops. This is often done by counting the number of iterations for every loop. After the count of a loop exceeds a certain threshold, the loop is considered to be hot, and tracing phase is entered.

Tracing phase

In the tracing phase the execution of the loop proceeds normally, but in addition every executed operation is recorded into a trace. The recorded operations are typically stored in a trace tree, often in an intermediate representation (IR). Tracing follows function calls, which leads to them being inlined into the trace. Tracing continues until the loop reaches its end and jumps back to the start.

Since the trace is recorded by following one concrete execution path of the loop, later executions of that trace can diverge from that path. To identify the places where that can happen, special guard instructions are inserted into the trace. One example for such a place are if statements. The guard is a quick check to determine whether the original condition is still true. If a guard fails, the execution of the trace is aborted.

Since tracing is done during execution, the trace can be made to contain runtime information (e.g., type information). This information can later be used in the optimization phase to increase code efficiency.

Optimization and code-generation phase

Traces are easy to optimize, since they represent only one execution path, which means that no control flow exists and needs no handling. Typical optimizations include common-subexpression elimination, dead code elimination, register allocation, invariant-code motion, constant folding, and escape analysis.

After the optimization, the trace is turned into machine code. Similarly to optimization, this is easy due to the linear nature of traces.

Execution

After the trace has been compiled to machine code, it can be executed in subsequent iterations of the loop. Trace execution continues until a guard fails.

History

Whereas the idea of JITs reaches back to the 1960s, tracing JITs have become used more often only recently. The first mention of an idea that is similar to today's idea of tracing JITs was in 1970. It was observed that compiled code could be derived from an interpreter at runtime by simply storing the actions performed during interpretation.

The first implementation of tracing is Dynamo, "a software dynamic optimization system that is capable of transparently improving the performance of a native instruction stream as it executes on the processor". To do this, the native instruction stream is interpreted until a "hot" instruction sequence is found. For this sequence an optimized version is generated, cached and executed.

Dynamo was later extended to DynamoRIO. One DynamoRIO-based project was a framework for interpreter construction that combines tracing and partial evaluation. It was used to "dynamically remove interpreter overhead from language implementations".

In 2006, HotpathVM, the first tracing JIT compiler for a high-level language was developed. This VM was capable of dynamically identifying frequently executed bytecode instructions, which are traced and then compiled to machine code using static single-assignment form (SSA) construction. The motivation for HotpathVM was to have an efficient JVM for resource constrained mobile devices.

Another example of a tracing JIT is TraceMonkey, one of Mozilla’s JavaScript implementations for Firefox (2009). TraceMonkey compiles frequently executed loop traces in the dynamic language JavaScript at runtime and specializes the generated code for the actual dynamic types occurring on each path.

Another project that utilizes tracing JITs is PyPy. It enables the use of tracing JITs for language implementations that were written with PyPy's translation toolchain, thus improving the performance of any program that is executed using that interpreter. This is possible by tracing the interpreter itself, instead of the program that is executed by the interpreter.

Tracing JITs have also been explored by Microsoft in the SPUR project for their Common Intermediate Language (CIL). SPUR is a generic tracer for CIL, which can also be used to trace through a JavaScript implementation.

Example of a trace

Consider the following Python program that computes a sum of squares of successive whole numbers until that sum exceeds 100000:

<span id="mwZw"></span><span class="k" id="mwaA">def</span><span class="w" id="mwaQ"> </span><span class="nf" id="mwag">square</span><span class="p" id="mwaw">(</span><span class="n" id="mwbA">x</span><span class="p" id="mwbQ">):</span> <span class="k" id="mwbg">return</span> <span class="n" id="mwbw">x</span> <span class="o" id="mwcA">*</span> <span class="n" id="mwcQ">x</span> <span class="n" id="mwcg">i</span> <span class="o" id="mwcw">=</span> <span class="mi" id="mwdA">0</span> <span class="n" id="mwdQ">y</span> <span class="o" id="mwdg">=</span> <span class="mi" id="mwdw">0</span> <span class="k" id="mweA">while</span> <span class="kc" id="mweQ">True</span><span class="p" id="mweg">:</span> <span class="n" id="mwew">y</span> <span class="o" id="mwfA">+=</span> <span class="n" id="mwfQ">square</span><span class="p" id="mwfg">(</span><span class="n" id="mwfw">i</span><span class="p" id="mwgA">)</span> <span class="k" id="mwgQ">if</span> <span class="n" id="mwgg">y</span> <span class="o" id="mwgw">></span> <span class="mi" id="mwhA">100000</span><span class="p" id="mwhQ">:</span> <span class="k" id="mwhg">break</span> <span class="n" id="mwhw">i</span> <span class="o" id="mwiA">=</span> <span class="n" id="mwiQ">i</span> <span class="o" id="mwig">+</span> <span class="mi" id="mwiw">1</span>

A trace for this program could look something like this:

<span id="mwjw"></span> <span class="n" id="mwkA">loopstart</span><span class="p" id="mwkQ">(</span><span class="n" id="mwkg">i1</span><span class="p" id="mwkw">,</span> <span class="n" id="mwlA">y1</span><span class="p" id="mwlQ">)</span> <span class="n" id="mwlg">i2</span> <span class="o" id="mwlw">=</span> <span class="n" id="mwmA">int_mul</span><span class="p" id="mwmQ">(</span><span class="n" id="mwmg">i1</span><span class="p" id="mwmw">,</span> <span class="n" id="mwnA">i1</span><span class="p" id="mwnQ">)</span> <span class="c1" id="mwng"># i*i</span> <span class="n" id="mwnw">y2</span> <span class="o" id="mwoA">=</span> <span class="n" id="mwoQ">int_add</span><span class="p" id="mwog">(</span><span class="n" id="mwow">y1</span><span class="p" id="mwpA">,</span> <span class="n" id="mwpQ">i2</span><span class="p" id="mwpg">)</span> <span class="c1" id="mwpw"># y += i*i</span> <span class="n" id="mwqA">b1</span> <span class="o" id="mwqQ">=</span> <span class="n" id="mwqg">int_gt</span><span class="p" id="mwqw">(</span><span class="n" id="mwrA">y2</span><span class="p" id="mwrQ">,</span> <span class="mi" id="mwrg">100000</span><span class="p" id="mwrw">)</span> <span class="n" id="mwsA">guard_false</span><span class="p" id="mwsQ">(</span><span class="n" id="mwsg">b1</span><span class="p" id="mwsw">)</span> <span class="n" id="mwtA">i3</span> <span class="o" id="mwtQ">=</span> <span class="n" id="mwtg">int_add</span><span class="p" id="mwtw">(</span><span class="n" id="mwuA">i1</span><span class="p" id="mwuQ">,</span> <span class="mi" id="mwug">1</span><span class="p" id="mwuw">)</span> <span class="c1" id="mwvA"># i = i+1</span> <span class="n" id="mwvQ">jump</span><span class="p" id="mwvg">(</span><span class="n" id="mwvw">i3</span><span class="p" id="mwwA">,</span> <span class="n" id="mwwQ">y2</span><span class="p" id="mwwg">)</span>

Note how the function call to square is inlined into the trace and how the if statement is turned into a guard_false.