7 ms·

In modern JS engines with 64-bit CPU when the engine cannot deduce types and must use a generic word to represent any kind of values numbers (double values) are

by _0w8t 3y ago

In modern JS engines with 64-bit CPU when the engine cannot deduce types and must use a generic word to represent any kind of values numbers (double values) are not boxed. Rather for everything else a NaN tag bit pattern is used. I.e. code checks if the word matches the NaN pattern. If not, a double is assumed. Otherwise the NaN is checked if it is a real NaN o something else masked as NaN. This slows down object access as detecting and stripping the NaN tag requires few CPU instructions. Plus it assumes that pointers only have 48 bits with rest are zeros (true for AMD, ARM and Intel) or at least have fixed values (can be arranged on more exotic CPUs). But that does not require to box numbers greatly reducing GC pressure.

jsheard 3y ago
> Plus it assumes that pointers only have 48 bits with rest are zeros (true for AMD, ARM and Intel) Except when it isn't: https://en.wikipedia.org/wiki/Intel_5-level_paging https://en.wikipedia.org/wiki/Intel_5-level_paging That's not something you're likely to run into on consumer hardware, but with JS being used on the server I wonder if/when JS engines will need to deal with that.
- aapoalas 3y ago
  ARM also has pointer cryptography which may one day become a blocker.
- toast0 3y ago
  That's probably quite some time off. As an application, you'd only get the new level of paging if you asked for it, like with PAE. And you're only going to ask for it if you need more than 256TB of address space, which seems like a rather large space to need. I guess you could have a lot of files mmaped though?
- _0w8t 3y ago
  When there are more bits in a pointer than NaN 52 bits allows, the trick is to replace pointers with indexes from the start of JS heap. This is not efficient even with arrangement like having heap aligned, say, on 4GB or even more granular address so to get the full pointer one just use bit operation, not an add. But if one wants efficiency, then make sure that types in the code is stable and JIT will generate type-specific code.
esprehn 3y ago
Not all engines use NaN boxing, for example v8 uses pointer tagging: https://stackoverflow.com/questions/63550957/why-does-v8-uses-pointer-tagging-and-not-nan-boxing https://stackoverflow.com/questions/63550957/why-does-v8-use... https://news.ycombinator.com/item?id=16985390 https://news.ycombinator.com/item?id=16985390
- _0w8t 3y ago
  This describes 32 bit CPU. As opposite to V8, SpiderMonkey, Mozilla’s JS engine, uses 64 bit words and NaN boxing, even on a 32 bit CPU, to represent a generic JS thing.
  - esprehn 3y ago
    I'm pretty sure even on 64bit v8 doesn't use NaN boxing. Do you have docs or code that show it does? Yes other engines use NaN boxing, but not all engines do.

by _0w8t 3y ago

jsheard 3y ago

> Plus it assumes that pointers only have 48 bits with rest are zeros (true for AMD, ARM and Intel) Except when it isn't: https://en.wikipedia.org/wiki/Intel_5-level_paging https://en.wikipedia.org/wiki/Intel_5-level_paging That's not something you're likely to run into on consumer hardware, but with JS being used on the server I wonder if/when JS engines will need to deal with that.

aapoalas 3y ago
ARM also has pointer cryptography which may one day become a blocker.
toast0 3y ago
That's probably quite some time off. As an application, you'd only get the new level of paging if you asked for it, like with PAE. And you're only going to ask for it if you need more than 256TB of address space, which seems like a rather large space to need. I guess you could have a lot of files mmaped though?
_0w8t 3y ago
When there are more bits in a pointer than NaN 52 bits allows, the trick is to replace pointers with indexes from the start of JS heap. This is not efficient even with arrangement like having heap aligned, say, on 4GB or even more granular address so to get the full pointer one just use bit operation, not an add. But if one wants efficiency, then make sure that types in the code is stable and JIT will generate type-specific code.

esprehn 3y ago

Not all engines use NaN boxing, for example v8 uses pointer tagging: https://stackoverflow.com/questions/63550957/why-does-v8-uses-pointer-tagging-and-not-nan-boxing https://stackoverflow.com/questions/63550957/why-does-v8-use... https://news.ycombinator.com/item?id=16985390 https://news.ycombinator.com/item?id=16985390

_0w8t 3y ago
This describes 32 bit CPU. As opposite to V8, SpiderMonkey, Mozilla’s JS engine, uses 64 bit words and NaN boxing, even on a 32 bit CPU, to represent a generic JS thing.
- esprehn 3y ago
  I'm pretty sure even on 64bit v8 doesn't use NaN boxing. Do you have docs or code that show it does? Yes other engines use NaN boxing, but not all engines do.