maegaki_4_suzuki_yuusuke.pdf

Size: px

Start display at page:

Download "maegaki_4_suzuki_yuusuke.pdf"

ようたかわらい
5 years ago
Views:

1 JavaScript, ECMA (June 2011) TC39 Conformance Suite Test262 Building modern JavaScript Engine YUSUKE SUZUKI, We implemented an engine that is fully compliant with ECMA (June 2011) and confirmed it by using Conformance Suite Test262 provided by TC39. And we optimized it. 1. ECMAScript JavaScript TC39 (Technical Committee 39) 1. ECMA V8 3, JavaScriptCore 4, SpiderMonkey 5.,,. ECMA lv5. ECMA ,, 2. TC39, ECMA262 Test Suite Test262 6 Cybozu Labs Youth 3 3rd grade of Department of Science and Technology, Keio University publications/standards/ecma-262.htm Test. Test sputniktests 7 ES5 Conformance Suite 8,,, lv5 Test Suite. Opera Safari GoogleChrome : V Firefox 8.0 lv5 : 1 1. lv5, Test , 99.83% pass 18 Test262, Test262 1 Test pass fail (%) Opera Safari GoogleChrome Firefox lv

1. 1 2 3 4, Test262 3. lv5 lv5, 3.1 NaN boxing ECMAScript. JSVal. JSVal,, JSVal 64bit 2 IEEE 754 IEEE 754 (Exp) 1 (Fraction) 0 quiet NaN, NaN NaN, NaN, boxing. LuaJIT 5 2 IEEE 754 1 https://bugs.

2 , Test lv5 lv5, 3.1 NaN boxing ECMAScript. JSVal. JSVal,, JSVal 64bit 2 IEEE 754 IEEE 754 (Exp) 1 (Fraction) 0 quiet NaN, NaN NaN, NaN, boxing. LuaJIT 5 2 IEEE JavaScriptCore SpiderMonkey. 32bit, 32bit 32bit, int32 t boxing, JSVal 64bit 64bit 64bit., Linux, Windows OS 16bit 0, boxing. Solaris JSVal 128bit. 6 NaN 16bit 0x0000 0xFFF0. -Infinity. 16bit 1, 0x0001 0xFFF1., 0x0000, NaN 7, 16bit 0x0000,, GC lv5, BoehmGC 8 GC, xFFF

3 3.2 Stack VM AST, ECMA262., VM. VM,, ECMAScript. VM ECMAScript,, ECMAScript VM, C, VM ECMAScript, finally return 3.3 ECMAScript, STACK, HEAP, DY- NAMIC, GLOBAL 4,.,.,,,,. STACK.,.,, HEAP.,, HEAP.,,, Global, Global, Global function stack() { function heap() { inner(); function global() { function with_dynamic() { var obj = {; with (obj) { function with_not_dynamic() { var obj = {; with (obj) { function eval_dynamic() { eval("var i = 20"); 3 GLOBAL. ECMAScript,,. DYNAMIC. (1) with 3 with dynamic i 173

4 function Point(x, y) { this.x = x; this.y = y; Point.prototype.add = function(rhs) { return new Point( this.x + rhs.x, this.y + rhs.y); var point = new Point(0, 10); 4 class with with, with trap. DYNAMIC with not dynamic i trap, (2) direct call to eval eval eval, direct call to eval., eval, eval, strict, 1,., eval, eval, 3 eval dynamic i DYNAMIC. (3) arguments arguments,. strict, arguments, HEAP. 3.4 Inline Cache Inline Cache Self 1,V8 Hidden Class 2 V8, JavaScriptCore 3. ECMAScript, prototypal, intl/ja/apis/v8/design.html#prop_access 3 blog/214/introducing-squirrelfish-extreme/,, ECMAScript,, ECMAScript. 4, Point x, y, add rhs Point V8 HiddenClass 4, JavaScriptCore Structure., Map Map Map. Map, Map Map, transit., Map transit,, transit Map Map Map Map., rhs.x, Map,, Map, Map, 3.5 Global ECMAScript Global Global, Global., Global ECMAScript, Global Inline Cache. 4 Map 174

5 lv5, Own Property. Global, [[Prototype]] Object.prototype 3.6, eval,,,,. 3.7 String Rope ECMAScript String., String Rope, lv5 Rope String. 3.8,. 3.9 RegExp V8 JavaScriptCore JSCRE, ECMA262, RegExp strict ECMA262 5 strict. strict, strict arguments arguments strict 5 normal, arguments[0], x.,, arguments, HEAP arguments, arguments, arguments, strict arguments., strict lv5 x STACK,, function normal(x) { arguments[0] = 20; console.assert(x === 20); normal(10); function strict(x) { "use strict"; arguments[0] = 20; console.assert(x === 10); strict(10); 5 function normal() { function outer(str) { eval(str); function strict() { "use strict"; function outer(str) { eval(str); 6 strict arguments mode strict eval STACK, HEAP eval strict eval, 6 normal, outer( var i = 50 ) eval i trap, i strict, 6 strict, inner i outer eval trap. strict 175

6 2 SunSpider (ms) lv lv Opera 212 Safari 185 GoogleChrome 214 Firefox 223 SpiderMonkey JIT 950 SpiderMonkey C 3657 eval 1,, i strict i, lv5 HEAP. 4., SunSpider 1., , GC BoehmGC GC, GC,, C++ RAII Exact GC, Mark & Sweep 5.2 JIT ECMAScript JIT. JIT dispatch, V8 VM JavaScript- Core VM VM, VM, JIT, 1 Inline Cache. 5.3 RegExp JIT RegExp, RegExp VM,. 5.4 V8 API V8, ECMAScript node.js 2,, V8Monkey 3 SpiderMonkey V8 API, lv5 V8 API. 6. Test262, ECMA , lv5. lv5 4,,,,, 1) Urs Hlzle, Craig Chambers, and David Ungar: Optimizing Dynamically-Typed Object- Oriented Programming Languages with Polymorphic Inline Caches (1991). 2) Russ Cox: Regular Expression Matching: the Virtual Machine Approach (2009). 3) Standard ECMA-262 ECMAScript Language Specification Edition 5.1: publications/standards/ecma-262.htm. 4) V8: 5) WebKit:

#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma

#include <stdio.h> unsigned char x86[] = { 0x8b, 0x44, 0x24, 0x04, // mov eax,[esp+4] 0x03, 0x44, 0x24, 0x08, // add eax,[esp+8] 0xc3 // ret }; int ma x86 JIT Web JavaScript x86 JIT JIT x86 JIT Windows OS DEP x86 ASLR DEP ASLR Return-Oriented Programming JIT-Spraying JavaScript JIT x86 x86 JIT How to execute arbitrary code on x86 JIT Compiler Yoshinori