Formally verified speculation and deoptimization in a JIT compiler

Abstract

Just-in-time compilers for dynamic languages routinely generate code under assumptions that may be invalidated at run-time, this allows for specialization of program code to the common case in order to avoid unnecessary overheads due to uncommon cases. This form of software speculation requires support for deoptimization when some of the assumptions fail to hold. This paper presents a model just-in-time compiler with an intermediate representation that explicits the synchronization points used for deoptimization and the assumptions made by the compiler's speculation. We also present several common compiler optimizations that can leverage speculation to generate improved code. The optimizations are proved correct with the help of a proof assistant. While our work stops short of proving native code generation, we demonstrate how one could use the verified optimization to obtain significant speed ups in an end-to-end setting.

Type stability in Julia: avoiding performance pathologies in JIT compilation

“…Myreen [2010] formalized self-modifying code for x86. Finally, Flückiger et al [2018] formally described speculation and deoptimization and proved correctness of some optimizations; Barriere et al [2021] extended and mechanized these results.…”

Preventing Timing Side-Channels via Security-Aware Just-In-Time Compilation

“…Optimistic compilation (Topti). Optimistic compilation is a type of speculation optimizations [6]. During the JIT compilation of a method, the compiler speculates on the most likely executed branches by pruning rarely executed branches.…”

“…On the theoretical side, we first lay the foundations for timing side-channel security under JIT compilation by presenting a formal operational semantics and defining a notion of constant-time for a fragment of the JVM under JIT compilation. We do not model concrete JIT compilation as done by [6,24]. Instead, we leave them abstract in our model and model JIT compilation via compilation directives controlled by the adversary.…”

Deoptless: Speculation with Dispatched On-Stack Replacement and Specialized Continuations

“…This was also noted by Wimmer et al [31], who describe it as "a two-way matching of two scope descriptors describing the same abstract frame. " The one-step architecture is further simplified in optimizers with identical source and target language, in which case the states on both ends of OSR have the same representation [3,4,29].…”