Avm2虚拟机浅析与as3性能优化PPT学习课件.ppt

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,2,#,By,陈士凯,(CSK),csk,Ver.2010.5.29,AVM2,虚拟机浅析,&AS3,性能优化,1,2,An Introduction to AVM2&AS3.0 Optimization,Agenda,AVM2,虚拟机介绍,AS3,代码优化启发,对,AS3,进行性能分析,对,AVM2,进行扩充和改造,Demos,2,2,An Introduction to AVM2&AS3.0 Optimization,I,Introduction to AVM2,AVM2,虚拟机,从,Flash Player 9.0,开始引入，用于,AS3.0,代码的解释和二进制翻译执行。,采用,JIT/Interpret,混合执行，大幅提高运行效率,AS3,比,AS1/2,运行速度提升,10 x,内建对,XML,Array,类型的处理支持,已经开源,:,Tamarin Project,3,2,An Introduction to AVM2&AS3.0 Optimization,Flash Framework,ActionScript Runtime,OS,AVM1/AVM2,.ABC(Actionscript Byte Code),Flash Player,SWF files,4,2,An Introduction to AVM2&AS3.0 Optimization,研究,AVM2,的目的与意义,了解,AVM2,实现和工作特性对,AS3,执行效率的影响,AS3,代码性能优化,Flash,项目的代码保护和逆向工程,增强,/,扩充,AVM2,性能,/,功能，开发第三方,AVM2,引擎,虚拟机实现的学习和研究,*,5,2,An Introduction to AVM2&AS3.0 Optimization,6,2,An Introduction to AVM2&AS3.0 Optimization,.ABC,指令集,基于堆栈机,共,172,条指令。,(,数据来源：,ActionBlockConstants.h),原生支持类、,Closure,、异常等,OO,特性,原生支持,Array,、,XML,数据结构,7,2,An Introduction to AVM2&AS3.0 Optimization,.ABC,指令集一览,指令类别,举例,Load/Store,getlocal,setlocal,数值运算,increment,decrement,lessthan,位运算,bitnot,bitand,bitor,类型转化,coerce,convert_b,coerce_a,convert_i,对象创建,/,操作,newclass,newobject,newarray,栈管理,pushnull,pushundefined,pushtrue,dup,控制流,iflt,ifle,ifnlt,ifnle,函数调用,/,返回,Call,callproperty,callsuper,异常处理,throw,调试支持,Debugfile,debugline,原生数据支持,*,Newarray,checkfilter,dxns,8,2,An Introduction to AVM2&AS3.0 Optimization,AS3-.ABC,AS3,function func(x:int):int,var ans:int;,ans=x+10;,return ans;,.abc,0 getlocal0,1 pushscope,2 pushbyte 0,4 setlocal2,5 getlocal1,6 pushbyte 10,8 add,9 convert_i,10 setlocal2,11 getlocal2,12 returnvalue,9,2,An Introduction to AVM2&AS3.0 Optimization,对,ABC,的解析执行,(Interpret),.abc,0 getlocal0,1 pushscope,2 pushbyte 0,4 setlocal2,5 getlocal1,6 pushbyte 10,8 add,9 convert_i,10 setlocal2,11 getlocal2,12 returnvalue,for(;),switch(*pc+),case op_add:,a1=sp-1;,a2=sp0;,sp-;,dest=,toplevel-add2(a1,a2);,逐条解析执行，没有优化、低效,10,2,An Introduction to AVM2&AS3.0 Optimization,对,ABC,的即时二进制翻译,(JIT),.abc,0 getlocal0,1 pushscope,2 pushbyte 0,4 setlocal2,5 getlocal1,6 pushbyte 10,8 add,9 convert_i,10 setlocal2,11 getlocal2,12 returnvalue,MIR/LIR,40 use 17 0,41 use 22 1,42 imm 10,46 add 41 42,47 def 46,49 usea 47,50 st 8(7)MIR/LIR-Target Native Code,高效率、允许进行运行时优化，如,CSE,和死码删除,11,2,An Introduction to AVM2&AS3.0 Optimization,对,ABC,的即时二进制翻译,(JIT),.abc,0 getlocal0,1 pushscope,2 pushbyte 0,4 setlocal2,5 getlocal1,6 pushbyte 10,8 add,9 convert_i,10 setlocal2,11 getlocal2,12 returnvalue,MIR/LIR,40 use 17 0,41 use 22 1,42 imm 10,46 add 41 42,47 def 46,49 usea 47,50 st 8(7)MIR/LIR-Target Native Code,高效率、允许运行时优化，如,CSE,和死码删除,12,2,An Introduction to AVM2&AS3.0 Optimization,JIT V.S.Interpret,同一段代码在第一次,JIT,时往往花费的时间较长,代码翻译比较耗时,当再次执行这段代码后，,VM,将直接调用先前的翻译结果，速度提高。,Interpert,对同一段代码均具有大致相同的执行速度。,JIT,并非性能总优于,Interpret:,运行时间,执行次数,JIT,触发阈值,Interpret,JIT,13,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,的,JIT,策略,对,JIT,阈值的选择：,没有传统的热点,(Hotspot),检测机制,固定策略：,对,$init,和,$cinit,区代码进行,Interpreting,，其他代码均进行,JIT,Note:,$cinit,并非一个类的构造函数。,14,2,An Introduction to AVM2&AS3.0 Optimization,AVM2 JIT,优化,Concurrent with Verifier,Early Binding,Constant Folding,Copy&Constant Propagation,Common Subexpression Elimination(CSE),Dead Code Elimination(DCE),*ActionScript 3.0 and AVM2:Performance Tuning,15,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,的开源进程,-Tamarin Project,www.mozilla.org/projects/tamarin/,所有,AVM2,核心部分：,AVM2 core,nanoJIT,核心,AS3,库,(Array/Math/Regexp),ByteArray,等部分,Flash,动画渲染部分并未包括,对其他开源项目的影响,Red-tamarin,SpiderMonkey(NanoJIT,GC),了解,AVM2,的最有利资源,Tamarin,动,绢毛猴,(,南美洲产,),16,2,An Introduction to AVM2&AS3.0 Optimization,Tamarin Project,的衍生项目,Tamarin-Tracing Project,Adoble,贡献于,Mozilla,使用,Hotspot Detection,进行,JIT,Red-Tamarin Project,注重,Shell,部分开发，扩充,AS3,对本地资源设备的控制能力，致力于实现第三方类,Flash Player/AIR,平台。,.,17,2,An Introduction to AVM2&AS3.0 Optimization,II,AS3 Performance Tuning,AS3,代码性能分析与优化,对,AVM2,自身特性的了解有助于进行,AS3,代码性能调优,途径：,静态分析,-SWF,文件反汇编,动态分析,-Code Tracing,和,Profiling,信息,AVM,虚拟机实现研究,*,18,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript 3,的优化注意点,需要手工进行,CSE,，例如,array.length,的情况,for(var j:int=0;j list.length;j+),copy.push(listi);,var arrLen:int=list.length;,for(var j:int=0;j arrLen;j+),copy.push(listi);,320ms(list.length=50000),93ms(list.length=50000),19,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript 3,的优化注意点,显式进行类型转换,var i:int;,/i*2 gets promoted to Number,for(i=0;i10000;i+),ai*2=0;,for(i=0;i b(5.8ms)c(5ms),*,Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,SWF,的反汇编,有诸多工具帮助进行,swf-abc,的反汇编工作,swfdump,Flex sdk,自带,abcdump.as,自身也是用,AS3,实现，运行于,Tamarin,的,AVM2,虚拟机中,比较推荐,ASV,收费,23,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,对编译器产生的,abc,字节码进行分析，评估代码的执行效率。,private function cse_testing(x:int):int,var a:int,b:int;,a=x+10;,b=x+10;,return a;,24,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,mxmlc,优化性能分析,目前的,mxmlc(flex sdk 4.0.0 build 14159),似乎,不存在,实质的代码优化,private function cse_testing(x:int):int,var a:int,b:int;,a=,x+10,;,b,=,x+10,;,return a;,共用子表达式,无用变量,(,死码,),a=x+10,b=x+10,*,采用优化模式、非,debug,版本编译,25,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,mxmlc,优化性能分析,目前的,mxmlc(flex sdk 4.0.0 build 14159),似乎,不存在,实质的代码优化,JIT,会进行,Common Sub-expression elimination),和,DCE(Dead Code Elimination),，从而弥补编译器的薄弱优化,影响和暗示,Interpret,执行时效果将非常差,存在无用功：,e.g.,var a=/Very Slow Operation(no function call),var b=/Very Slow Operation(no function call),return a;/b,的动作完全是无效果的,JIT,的启动阶段将消耗更多时间。代码优化比较耗时,AS3,编写注意点,：,尽可能手工进行,CSE,和,DCE,的优化,26,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,mxmlc,优化性能分析,2,对,int-Number,类型的静态行为分析,var a:int;,a=x+10;,var a:int;,a=int(x+10);,AS3,pushbyte 10,add,convert_i,setlocal2,AS3,pushbyte 10,add,callproperty int(1),convert_i,add,指令默认操作数均为,Number,类型，纯整数指令为,add_i,。编译器并未采用。,进行类型转化在静态编译后只会造成代码膨胀，并且在,Interpret,阶段效率更低。,(,但,JIT,引入后实际影响不大,),27,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,mxmlc,优化性能分析,2,AVM2,中对于,callproperty,的,interpret,实现代码：,28,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,AS3,优化编译器,ASC,Flex,中提供了另一个编译器,asc.jar,其包含比较强大的优化能力,位于目录,Flexsdk_root/lib/,支持编译产生,.swf,.exe,.abc,用于,Tamarin,项目的内置,AS3,类编译,缺陷,使用不方便，需要手工指定所有依赖的类,不支持,mxml,需要,playerglobal.abc,与,global.abc,文件,(,可取自,Adobe Alchemy),对多,AS,文件编译存在问题,*,采用未公开的,-o2,编译选项开关，可能不稳定,29,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的静态分析,AS3,优化编译器,ASC,private function cse_testing(x:int):int,var a:int,b:int;,a=,x+10,;,b,=,x+10,;,return a;,30,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析,Code Tracing,和,Profiling,FlashPlayer,提供了,mm.cfg,文件供开发者开启虚拟机的代码跟踪和性能分析：,文件路径,(Win32),：,%USERPROFILE%mm.cfg,产生的日志文件,(Win32):,%USERPROFILE%Application DataMacromediaFlash PlayerLogs,常用的参数,更多的参数信息：,参考文章：,=1,开启,Trace,输出缓冲,AS3Verbose=1,开启,ABC,代码执行跟踪,AS3Trace=1,开启,AS3,函数级别执行跟踪,AS3StaticProfile=1,开启静态,Profiling,信息,(,代码和尺寸统计,),AS3DynamicProfile=1,开启动态,Profiling,信息,(,各指令用时与统计,),LogGPU=1,开启,GPU,使用信息,31,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析,Code Tracing,和,Profiling,AS3Trace=1,开启,AS3,函数级别执行跟踪,1255552 AVMINF:MTHD ProfilerAgent/stopProfiling()0 x05DA35A0,1255552 AVMINF:MTHD global/flash.sampler:stopSampling()0 x0A8C2B20,1255553 AVMINF:MTHD flash.display:DisplayObject/get root()0 x0A8C06B0,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255553 AVMINF:MTHD:Socket/flush()0 x0A8C2AD0,1255553 AVMINF:MTHD:Socket/close()0 x0A8C2B70,1255553 AVMINF:MTHD:Socket/_init()0 x0A8C0DF0,1255553 AVMINF:MTHD flash.utils:Timer/stop()0 x0A8C2CB0,1255554 AVMINF:MTHD flash.utils:Timer/reset()0 x0A8C1B20,1255554 AVMINF:MTHD flash.utils:Timer/get running()0 x0A8C1C30,1255554 AVMINF:MTHD:Socket/internalClose()0 x0A8C2D00,1255554 AVMINF:MTHD flash.events:EventDispatcher/removeEventListener()0 x0A8C2110,1255554 AVMINF:MTHD flash.utils:Timer/stop()0 x0A8C2CB0,1255554 AVMINF:MTHD flash.system:System$/resume()0 x0A8C2D50,32,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析,Code Tracing,和,Profiling,AS3DynamicProfile=1,total count=278 cycles=35508249 avg CPI=127727,user 1.9%,gc 0%,decoder 97.7%,verifier 1.6%,codegen 0.2%,count cycles%count%time,CPI,opcode,-,2 34714742 0.7 97.7 17357371 decode,211 602237 75.8 1.6 2854 verifyop,6 89138 2.1 0.2 14856 codegenop,3 78305 1.0 0.2,26101 newclass,7 4813 2.5 0.0 687 findpropstrict,6 3922 2.1 0.0 653 setslot,4 3260 1.4 0.0 815 initproperty,4 2724 1.4 0.0,681 getproperty,9 1859 3.2 0.0 206 getlocal0,33,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析,Code Tracing,和,Profiling,使用,ASVerbose=1,开关后，,AVM2,将所有真实的,ABC,执行过程保存在,flashlog.txt,谨慎使用该功能！,将产生非常大量的,tracing log,AS,代码执行速度会有明显减速,34,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析举例,分析,Flash,启动机制和,JIT,规律,所有代码段均经历类似的三个过程：,Verify(,包含,MIR,产生,)-(,目标,Native code,产生,)-,执行,Native Code/,解析执行,快速定位到自己感兴趣的内容：,e.g.,搜索关键词,verify Main,可定位到,Main,类的构造函数的验证阶段,35,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析举例,分析,Flash,启动机制和,JIT,规律,$init$cinit,和构造函数,$init,为全局脚本的初始化函数，用于初始化一个,as,文件为单位中的类对象（并不是类实例）。,$init,一般的,Qname,是,global$init,或者,script$init,$cinit,是一个,Class,中用于初始化静态变量的静态构造函数。仅在创建类对象时调用，不在创建实例时调用。,Class Main,static var myVal:int;,myVal=someFunction();,Main():void,function Main(),/,构造函数,static function Main$cinit(),myVal=someFunction();,36,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析举例,分析,Flash,启动机制和,JIT,规律,$init$cinit,和构造函数,Tracing,的结果,执行顺序为：,当前,AS,脚本为单位：,global$init()-Main$cinit()-exit global$init()-Main(),非,JIT,部分,37,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析举例,分析,Flash,启动机制和,JIT,规律,结论：,构造函数也会被,JIT,翻译，仅静态构造函数会被解析执行。,图中演示了,$cinit,和构造函数执行相同的,benchmark,的性能表现,38,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的动态分析举例,分析,Flash,启动机制和,JIT,规律,JIT,将对连续整形变量相加失效,*,b=a+a+a;,b=int(a+a)+a;,b=a+a;,b+=a;,a,b,c,用时：,a(15ms)b(5.8ms)c(5ms),getlocal1,getlocal1,add,/,不存在,convert_i,JIT,不做整数优化,getlocal1,add,/convert_i,存在,但前一次结果为,Number,convert_i,setlocal2,findpropstrict int/,额外函数调用,getlocal1,getlocal1,add,callproperty int(1),getlocal1,add,convert_i,setlocal2,getlocal1,getlocal1,add,convert_i,setlocal2,getlocal2,getlocal1,add,convert_i,setlocal2,39,2,An Introduction to AVM2&AS3.0 Optimization,分析,AVM2,实现,(Tamarin),进行,AS3,代码优化,举例,Array,类的,AVM2,端实现：,对应,C+,实现,ArrayObject,和,ArrayClass,采用,2,种数据结构：,HashTable,和,Vector(,固定数组,),对性能的影响,*,：,for(,i=0;i=0;,i-),myArrayi=i;,11ms,44ms,*,Introduction to AVM2&AS3.0 Optimization,分析,AVM2,实现,(Tamarin),进行,AS3,代码优化,举例,Vector,类的,AVM2,端实现：,采用传统,C/C+,定长数组,41,2,An Introduction to AVM2&AS3.0 Optimization,分析,AVM2,实现,(Tamarin),进行,AS3,代码优化,举例,Vector,类的,AVM2,端实现：,与,Array,性能对比,(,读取操作,)*,Data Types,1flash.Vector,2Array,typed,dynamic,Array,Int,19 ms,57 ms,51 ms,UInt,19 ms,57 ms,51 ms,Double8,19 ms,64 ms,57 ms,String,65 ms,61 ms,54 ms,Bool,53 ms,52 ms,46 ms,Object,70 ms,64 ms,58 ms,mean,41 ms,59 ms,53 ms,*,Introduction to AVM2&AS3.0 Optimization,ActionScript,的增强,使用内联汇编或者第三方编译器产生优化,ABC,内联汇编,as3c,编写第三方,AS3,编译器,mxmlc,开源,Tamarin,的,RTC,代码,(Run-time compiler for ActionScript 3),Tamarin,的,ESC,代码,(,ES4 compiler written in ES4,),参考：,AS3eval,使用,Alchemy,和,Haxe,*,43,2,An Introduction to AVM2&AS3.0 Optimization,ActionScript,的增强,AS3C,允许内联,ABC,汇编或者进行代码替换。,e.g.,简单但高效的整数相加,(,目前编译器优化不理想,),public function Main(),var src:int;,src=1;,_asm(,Op.getLocal1();,Op.pushInt(10);,Op.addInt();,Op.setLocal1();,);,44,2,An Introduction to AVM2&AS3.0 Optimization,III,AVM2 Mod,对,AVM2,的定制,Red-Tamarin,扩充,Tamarin,对底层资源的访问：,Socket,，文件、图形、,C+,类调用,Goal,the short goal of the project is to provide most of the C standard library(ANSI and POSIX)to an ActionScript environment.,the medium goal is to provide specialized libraries to use sockets or database like SQLite etc.,the long term goal is to provide a native API that replicate some part of the Flash Player and Adobe Integrated Runtime(AIR)API,45,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,定制,增加自己的,Native Class,利用,Tamarin,的,nativegen.py,实现,AS,代码调用,C+,类函数,实例：简易的,AS3 OpenGL,库,46,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,定制,打包并发布成可执行文件,使用,asc.jar,的,-exe,参数可以将指定的,as,脚本编译并和,AVM2,虚拟机打包成一个可执行文件。,47,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,定制,DEMO,AS3,版本的,Fmod,和,Opengl,48,2,An Introduction to AVM2&AS3.0 Optimization,AVM2,定制,-RedTamarin,E.g.Actionscript3 driving that hardware accelerated 3d engine,fps,3D Engine:,Irrlicht,C+Hosting,49,2,An Introduction to AVM2&AS3.0 Optimization,Q&A,Questions?,50,2,An Introduction to AVM2&AS3.0 Optimization,#,Reference,参考资料,ActionScript Virtual Machine 2(AVM2)Overview,Adobe,ActionScript 3.0 and AVM2:Performance Tuning,Adobe,Tamarin Project,www.mozilla.org/projects/tamarin/,AS3 hidden treasure in the mm.cfg file,Tamarin part I:AS3 Array,Tamarin part II More on Array and Vector,Tamarin part III Garbage Collector in Flash(10.0),Introduction to AVM2&AS3.0 Optimization,#,Reference,参考资料,HOWTO work with Native Classes,Player 9+container performance comparison table,Build Documentation,https:/developer.mozilla.org/En/Tamarin/Tamarin_Build_Documentation,Red-Tamarin Project,Introduction to AVM2&AS3.0 Optimization,/,Backups,扩充资料,53,2,An Introduction to AVM2&AS3.0 Optimization,.ABC,指令集,获得完整的指令列表,Adobe ActionScript Virtual Machine 2(AVM2)Overview,官方文档,含有指令行为描述,有少量,bug,有未公开指令,Tamarin,代码,:ActionBlockConstants.h/avmcore.cpp,最详细的指令列表,最详细的指令行为描术,(Interpret,行为代码,),可能与,FlashPlayer,行为存在差别,纯,C+,代码，不便于查阅,FlashPlayer AS3 Tracing Log,FlashPlayer,真实行为的写照,Tracing Log,体积过大，不容易查找,需要有一定反汇编和调试经验,54,2,An Introduction to AVM2&AS3.0 Optimization,AVM2 Verify,过程,55,2,An Introduction to AVM2&AS3.0 Optimization,AVM2 JIT,优化分析,CSE,和,DCE,0:getlocal0,40use 17 0,1:pushscope,2:pushbyte 0,cse 12,4:setlocal2,5:getlocal1,41use 22 1,6:pushbyte 10,42imm 10,8:add,43i2d 41,44i2d 42,45fadd 43 44,9:convert_i,46add 41 42,dead 45,dead 44,dead 43,10:setlocal2,11:getlocal2,12:returnvalue,cse 15,58 ret 57,56,2,An Introduction to AVM2&AS3.0 Optimization,AS3,优化编译器,ASC,使用简介,未公开的优化选项开关,o2,编译一个,as,文件至,swf:,Main.as-800 x600 60fps swf,java jar asc.jar,import global.abc import playerglobal.abc,swf main,800,600,60 main.as,编译,as,至,abc,java jar asc.jar,import otherlibl.abc in otherfile.as o2,main.as,import playerglobal.abc,与,o2,无法同时出现,(Bug?),57,2,An Introduction to AVM2&AS3.0 Optimization,AS3,优化编译器,ASC ASC/Main.java,58,2,An Introduction to AVM2&AS3.0 Optimization,分析,AVM2,实现,(Tamarin),进行,AS3,代码优化,*,Introduction to AVM2&AS3.0 Optimization,Tamarin,的支持平台,Platform,Status,Windows XP,supported,acceptance and performance tests automated in buildbot,Windows 64 bit XP,supported,acceptance and performance tests automated in buildbot,mac x86 OSX 10.4,supported,acceptance and performance tests automated