JavaScriptCore is experimenting with adopting the LLVM for a top-tier high-throughput optimizing JIT, which we call the FTL (Fourth Tier LLVM). See ​https://bugs.webkit.org/show_bug.cgi?id=112840 for the bug tracking this work. It is still experimental, and still disabled by default.

Overview

The FTL is integrated as an alternative backend for the DFG JIT but largely reuses existing DFG functionality. The FTL differs from the DFG as follows:

• Instead of generating machine code directly from the DFG IR, the DFG IR is lowered to LLVM IR and then the LLVM optimization pipeline and backend are invoked to generate machine code. That machine code is then managed by the JSC executable memory manager no differently than if it were generated by our own backends.
• Additional DFG phases are used. Running in FTL mode causes the DFG to lower to SSA even before lowering to LLVM IR. Additional optimizations like LICM are performed on the DFG-SSA IR.

The FTL JIT already supports key DFG concepts like OSR entry, OSR exit, and concurrent compilation.

Try it out

You can try out the FTL JIT on the Mac port by doing:

Tools/Scripts/build-jsc --ftl-jit --debug

or:

Tools/Scripts/build-jsc --ftl-jit --release

The FTL JIT is runtime-disabled even when it is buildtime-enabled. Hence to run a program with the FTL JIT you also need:

DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --useExperimentalFTL=true <my JS program>

Testing

You can run the test suite including the FTL JIT by doing:

Tools/Scripts/run-javascriptcore-tests --debug --ftl-jit

or:

Tools/Scripts/run-javascriptcore-tests --release --ftl-jit

Looking at IR

Additional options allow for inspecting the IR that the FTL generates.

See if LLVM is being used to compile a function

DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --useExperimentalFTL=true --reportCompileTimes=true <my JS program>

Dump all LLVM IR

DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --useExperimentalFTL=true --dumpLLVMIR=true <my JS program>

Dump DFG IR and LLVM IR before and after LLVM optimization

DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --useExperimentalFTL=true --verboseCompilation=true <my JS program>

This will also tell if why some functions don't get FTL compiled. The FTL doesn't have full coverage over DFG IR yet. If JSC chooses not to use the FTL JIT for a code block, you will see a dump explaining why.

Dump all machine code

DYLD_FRAMEWORK_PATH=WebKitBuild/Debug WebKitBuild/Debug/jsc --useExperimentalFTL=true --showDFGDisassembly=true <my JS program>

This will also dump FTL disassembly, using the LLVM disassembler.