4 ms·

It looks like there's another issue that is not quite mentioned: the Chrome code generator is using %rbx to point to the start of the WebAssembly memory, which

by devit 7y ago

It looks like there's another issue that is not quite mentioned: the Chrome code generator is using %rbx to point to the start of the WebAssembly memory, which means that the available addressing modes are severely reduced and a register is used up. It seems like that it could use a %fs or %gs segment override instead (one of which can be programmed arbitrarily at least on Linux), which should be cost-free on all x86-64 processors and would solve the issue. Once this is changed, the only remaining fundamental unfixable differences would be reduced cache efficiency from the extra bytes for the segment override, and the need to reserve an extra register for the wasm stack pointer. However, running WebAssembly code in a separate address space would allow to run arbitrary code, although this would have the drawback of higher memory usage and IPC slowdown. Is there any article discussing the rationale between Firefox and Chrome's current approach and whether they plan to use either segment overrides or process isolation?

titzer 7y ago
> the Chrome code generator is using %rbx The memory base is actually loaded from the instance pointer, and neither of these are pinned to specific registers. They're both allocatable by the register allocator. > %fs or %gs segment override instead This is tricky to do for all platforms that V8 supports. I'm not sure it's free; it's still at the very least another prefix.
- devit 7y ago
  > This is tricky to do for all platforms that V8 supports It can be done only where supported. Ivy Bridge and later have instructions to set them in user space (WRFSBASE/WRGSBASE), and although it needs the OS to enable it, I would expect it can be done on all significant x86-64 OSes. > I'm not sure it's free; it's still at the very least another prefix. There are benchmarks that show TLS is as fast as global variable, so it's probably free (aside from the impact on the I-cache due to increased code size, but using a general purpose register is probably much worse due to additional instructions and extra SIB bytes).

by devit 7y ago

titzer 7y ago

> the Chrome code generator is using %rbx The memory base is actually loaded from the instance pointer, and neither of these are pinned to specific registers. They're both allocatable by the register allocator. > %fs or %gs segment override instead This is tricky to do for all platforms that V8 supports. I'm not sure it's free; it's still at the very least another prefix.

devit 7y ago
> This is tricky to do for all platforms that V8 supports It can be done only where supported. Ivy Bridge and later have instructions to set them in user space (WRFSBASE/WRGSBASE), and although it needs the OS to enable it, I would expect it can be done on all significant x86-64 OSes. > I'm not sure it's free; it's still at the very least another prefix. There are benchmarks that show TLS is as fast as global variable, so it's probably free (aside from the impact on the I-cache due to increased code size, but using a general purpose register is probably much worse due to additional instructions and extra SIB bytes).