Implicit register operand

[arnaud-lb]

This experiment implements implicit register operands. The idea comes from v8:

In order to reduce the size of the bytecode stream, Ignition has an accumulator register, which is used by many bytecodes as implicit input and output register. This register is not part of the register file on the stack, but is instead maintained in a machine register by Ignition. This minimize loading and storing repeatedly to memory for register operations. It also reduces the size of bytecode by avoiding the need to specify an input and output register for many operations. E.g., binary op bytecodes only require a single operand to specify one of the inputs, with the other input and the output registers being implicitly the accumulator register, rather than having to explicitly specify all three registers.
https://docs.google.com/document/d/11T2CRex9hXxoJwbYqVQ32yIPMh0uouUZLdyrtmMoL44/edit?tab=t.0

Basic principle:

• Introduce a new IS_REG operand type
• Introduce new REG and SPEC(REG) specializations
• REG specializations receive one operand via a zval reg parameter. Calling convention passes this via %r14-%r15.
• SPEC(REG) specializations pass their result to the next opcode via this parameter.
• The DFA pass promotes IS_TMP_VAR operands to IS_REG when possible
• REG and SPEC(REG) specializations were added to some of the most frequently executed pairs of opcodes

const zend_op *ZEND_ADD_SPEC_CV_REG_TAILCALL_HANDLER(ZEND_OPCODE_HANDLER_ARGS, zval reg) {
  zval retreg;
  zval *op1 = EX_VAR(opline->op1.var);
  zval *op2 = ®
  if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)) {
    if (EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
      ZVAL_LONG(&retreg, Z_LVAL_P(op1) + Z_LVAL_P(op2));
    } else ...
  } else ...
  opline++;
  return musttail opline->handler(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU, retreg);
}

If we ignore the Z_TYPE_INFO_P(op1) == IS_LONG checks, the code above compiles to:

        movslq  8(%r13), %rax      # load opline.op1.var
        addq    (%r12,%rax), %r14  # Z_LVAL(retreg) = Z_LVAL(EX_VAR(%rax)) + Z_LVAL(reg)
        movq    32(%r13), %rax     # load (opline+1)->handler
        addq    $32, %r13          # opline++
        movl    $4, %r15d          # Z_TYPE_INFO(retreg) = IS_LONG
        jmpq    *%rax              # tailcall opline->handler
                                                                                                                                                                                                                                

Before optimizer:

0000 CV0($a) = RECV 1
0001 T1 = FETCH_OBJ_R CV0($a) string("x")
0002 RETURN T1

After optimizer:

0000 CV0($a) = RECV 1
0001 REG = FETCH_OBJ_R CV0($a) string("x")
0002 RETURN REG

Results:

Currently the improvements are modest (about 0.75% on symfony) and rely on a patched clang.

This could have more impact in conjunction with variable-size opcodes.

In the symfony benchmark, about 9% of executed handlers where REG or SPEC(REG) specializations (33257 out of 366793).

Calling convention:

The calling convention passes the reg argument via two registers, and the compiler avoids moving it to memory most of the time (as long as we don't pass its address to some external function, and in a few other cases).

This works surprisingly well, but this is fragile as regressions would go unnoticed. In practice we would likely need some linter to prevent that.

Register pressure:

Initial implementation was adding a zval reg argument to all handlers, and passed it to the next handler. This increased register pressure and stack spilling considerably, as this pins most callee-saved registers (r12-r15 for execute_data, opline, and reg). This resulted in a ~1% regression.

In the current implementation we fix this by using two separate variable (reg for input, retreg for output), and adding the zval reg argument only to handlers that use it.

This leads us to the musttail issue:

musttail issue:

musttail requires that the callee and callers have exactly the same signature. This implies that helpers with extra args can not be tail-called, and must return retreg in addition to the next opline, in a large struct {zend_op *opline, zval reg}. Additionally, we must add the zval reg operand on all handlers.

Both of these add considerable overhead.

The current implementation patches clang to disable this requirement, for the sake of the PoC. (See also clang issue 54964).

Other limitations:

We can only promote pairs of successive oplines, because we do not propagate reg/retreg across non-REG handlers. We can not promote oplines whose result is used more than once, for the same reason.

The second opline must not be a branch target. Result of the first opline must not be used by a Phi (unless all nodes can be promoted). These restrictions are not explicitly implemented in the PoC, but none of the supported handlers would fall in these.

We promote only IS_TMP_VAR, so we can assume that IS_REG have the same semantics.

TODO: Try splitting reg/retreg while keeping identical signatures.

TODO: Can DO_FCALL return via retreg too?