ParparVM performance: parity with warmed Java 25 (geomean 1.00x)

[shai-almog]

Summary

This branch takes ParparVM from a ~1.5-36x deficit against warmed Java 25 (HotSpot C2) to geomean 1.00x parity across the ten-benchmark suite, with six benchmarks at or below HotSpot. Everything is measured on Apple M2, best-of-5 interleaved runs, ThinLTO release configuration, against azul-25 with full warmup; every optimization is gated on bit-identical checksums vs HotSpot plus the GC stress gauntlet.

bench	ratio		bench	ratio
stringBuilding	0.67x		arrayRandom	0.96x
arraySequential	0.82x		intArithmetic	1.07x
quicksort	0.92x		longArithmetic	1.12x
hashMapChurn	0.95x		objectAllocation	1.19x
mathTranscendental	0.96x		recursion	1.60x

intArithmetic/longArithmetic run at exact pure-C parity (verified against same-flags C controls); the residual is C2-vs-clang scheduling of the dependency chain, not VM overhead. recursion is HotSpot's speculative inlining, accepted.

What the emitted code looks like, before and after

1. Frameless codegen (recursion 4.6x -> 1.6x, feeds everything else)

Every Java method used to push a GC-visible frame of type-tagged slots and route every intermediate value through it:

/* BEFORE: one call frame per invocation, every value tagged + memory-resident */
JAVA_LONG fib(CODENAME_ONE_THREAD_STATE, JAVA_INT n) {
    stack = pushFrameOnThreadStack(threadStateData, locals=2, stack=4);
    memset(stack, 0, 6 * sizeof(elementStruct));     /* per CALL */
    locals[0].type = CN1_TYPE_INT; locals[0].data.i = n;
    (*SP).type = CN1_TYPE_INT; (*SP).data.i = 2; SP++;   /* push constant 2 */
    if (locals[0].data.i < SP[-1].data.i) ...            /* compare via memory */
    releaseForReturn(threadStateData, ...);              /* frame pop */
}

Methods proven safe (no try/catch, no synchronization; object roots covered by the conservative native-stack scan) now compile to plain C:

/* AFTER: locals are C locals -> registers; no frame, no tags, no memset */
JAVA_LONG fib(CODENAME_ONE_THREAD_STATE, JAVA_INT n) {
    JAVA_INT ilocals_0_ = n;
    CN1_FRAMELESS_SOE_GUARD(0);            /* stack-overflow check only */
    if (ilocals_0_ < 2) return ilocals_0_;
    return fib(threadStateData, ilocals_0_ - 1) + fib(threadStateData, ilocals_0_ - 2);
}

2. Diverging array checks (quicksort 1.23x -> 0.92x)

The bounds-check helper used in fused comparisons returns a dummy after throwing, so its cold path rejoins the loop. That put a reachable call inside every loop cycle, and clang must assume a call clobbers memory:

/* BEFORE: while (a[i] < pivot) i++;  -- the scan loop of quicksort */
label_scan:
    if (cn1_array_element_int(ts, locals[0].data.o, i) >= pivot) goto done;
    /*  ^ on bounds failure: throwException(...); return 0; ...and CONTINUE.
        The call is reachable on every iteration, so clang RELOADS
        array->data AND array->length every pass: 3 loads per element. */
    i++;
    goto label_scan;

In frameless methods the failure path now throws and returns from the method (the same pattern the stack-overflow guard uses), so no cycle of the loop contains a call and the header loads hoist:

/* AFTER: throw path diverges; loop body is load/compare/branch */
label_scan:
    { JAVA_OBJECT a = locals[0].data.o; JAVA_INT idx = i;
      CN1_ARRAY_CHECK_DIVERGE(a, idx, );   /* null/oob -> throw; return; */
      if (((JAVA_ARRAY_INT*)(*(JAVA_ARRAY)a).data)[idx] >= pivot) goto done; }
    i++;
    goto label_scan;

Measured on the sort alone: 216ms -> 164ms, vs HotSpot's 197ms.

3. Compact HashMap: no entry objects (hashMapChurn 36x -> 0.95x, with the box cache)

BEFORE  put(k,v):  table[i] = new Entry(k, v, hash, table[i]);   // heap alloc per put
        get(k):    e = table[i]; while (e && !eq(e.key,k)) e = e.next;  // pointer chase
        clear():   table = new Entry[n];   // N dead Entry objects for the GC

AFTER   storage:   meta[] (int: 0=empty, 1=tombstone, else spread-hash|MSB)
                   keys[] / vals[] (parallel arrays)
        put(k,v):  linear-probe meta[] comparing plain ints; store into 3 arrays  // zero alloc
        get(k):    same probe; values live in cache-adjacent array slots
        clear():   three array wipes; nothing for the collector

LinkedHashMap keeps its ordering as two parallel int link arrays (prev/next slot indices) over the same storage. The hot five operations (get/put/remove/containsKey/clear) run as C natives probing the raw array data.

4. Fused objects: @Fused (String, StringBuilder, annotatable user classes)

BEFORE  new String(chars, off, len):
            heap object #1: the String
            heap object #2: its char[] value array
        -> two allocations, two sweep slots, a pointer dereference between them

AFTER   one block: [ String header | fields | char[] header | c0 c1 c2 ... ]
        -> one allocation, one sweep slot; the child has no independent GC
           identity (interior pointers resolve to the owner); the constructor's
           field-init is rewritten keep-if-null, so reflection / oversize
           fallback / delegating ctors still work unchanged

5. Allocation fast path + init-before-publish (objectAllocation 20x -> 1.19x)

/* BEFORE: every new */
o = malloc(size); memset(o, 0, size);        /* zero everything...       */
placeObjectInHeapCollection(o);              /* O(n) slot search, lock   */
init header; run ctor;                       /* ...then overwrite most of it */

/* AFTER: inlined at the allocation site (BiBOP size-class bump) */
CN1BibopPage* p = bibopCurrent[SIZE_CLASS];   /* compile-time class index  */
o = page_slot(p, p->bumpIndex++);             /* pointer bump              */
/* NO body zeroing: the inlined ctor writes every field, and the class
   pointer is stored LAST -- until that store, the parentCls==0 guard keeps
   a signal-stopped GC scan from tracing the half-built body. */
o->field1 = arg1; o->field2 = arg2;
o->parentCls = &class__Foo;                   /* PUBLISH */

Dead pages whose every slot is garbage are reclaimed O(1) (the page flips back to bump-from-zero) instead of per-slot sweeping.

6. Escape analysis: non-escaping StringBuilders live on the C stack

javac lowers "item-" + i + '/' + n to new StringBuilder().append(...)...toString(). A CFG walk proves the builder reference is only ever the receiver of StringBuilder calls (append returns this, so the alias is tracked through chains, re-stores into the same local, and the ternary-in-argument diamonds javac emits). Proven sites:

/* AFTER: one struct + buffer per SITE, reused across loop iterations */
struct obj__java_lang_StringBuilder __cn1stk_17;                  /* C stack */
long long __cn1stkbuf_17[CN1_FUSED_ARR_BYTES(32, CHAR) / 8];      /* C stack */
...
/* NEW: init header, install array header into the stack blob, point
   value at it -- the keep-if-null ctor keeps it. Appends write into
   stack memory. The ONLY heap allocation of the whole concatenation
   is the result String (one fused block). */

GC safety falls out of the conservative native-stack scan: if the buffer grows onto the heap, the replacement pointer sits in scanned stack memory.

7. Devirtualization + call-site intrinsics

/* BEFORE: JIT-opaque indirect call for every virtual invoke */
virtual_java_lang_String_hashCode___R_int(ts, obj);   /* vtable dispatch */

/* AFTER (closed world, no reachable override): direct call, ThinLTO can inline */
java_lang_String_hashCode___R_int(ts, obj);

/* AFTER (hottest methods): renamed to an inlined fast path with the
   out-of-line native as its cold fallback -- semantics single-sourced */
static inline JAVA_INT cn1InlStrHash(CODENAME_ONE_THREAD_STATE, JAVA_OBJECT s) {
    JAVA_INT h = ((struct obj__java_lang_String*)s)->java_lang_String_hashCode;
    if (h != 0) return h;              /* cached hash: two instructions */
    ... inline 4-way reassociated compute, result cached ...
}

The same round removed the enteringNativeAllocations() bracket (four flag stores on every native call) under conservative roots, where the native stack is scanned and the bracket protects nothing: string-building floor 27.1ms -> 20.4ms from that alone.

GC

Non-moving BiBOP heap with concurrent mark/sweep; conservative native-stack root scanning (default-on) with generation-counted signal-stop; parallel marking; the snapshot's page-table sort is cached (the page registry is grow-only, so the sorted order only changes on registration).

Two real trigger bugs found and fixed (exposed by churn workloads, affect production): allocationsSinceLastGC was an int accumulating bytes -- GB-per-cycle workloads wrapped it negative, isHighFrequencyGC() returned false, and the GC slept its 30s idle wait while dead pages ballooned into the GB range; and cn1BibopMaybeGc skipped its 24MB trigger entirely in nativeAllocationMode, so workloads allocating only inside natives never collected.

Dynamic pacing cap -- high-throughput threads are never starved. The BiBOP backpressure paces a fast allocator against the concurrent collector: past a fixed 72MB uncollected-volume cap, the allocating thread parked in a sleep spin until the collector caught up. On an allocation-heavy render (vector-map tile decode) the EDT spent most of every GC cycle parked, serializing the render behind the collector -- measured as the single biggest tunable cost (20% of wall; the mark/sweep passes themselves overlap the mutator and measure ~0%). The cap is now dynamic: baseline 1/8 of available RAM (never tighter than the old cap), and high-throughput threads -- the EDT, or any thread allocating heavily this cycle -- get up to 1/2 of available RAM of headroom so they keep running while the concurrent GC catches up. Available memory counts reclaimable pages (free + inactive + purgeable; iOS/macOS free_count alone under-reports by an order of magnitude), snapshot once per cycle.

Real-workload render: vector-tile decode (MvtBench)

A faithful repro of the VectorMap first-render (a real bundled MVT tile decoded 400x through the protobuf -> layers/features/geometry pipeline, holding a rolling window of live tiles), interleaved best-of runs on Apple M2:

build	wall
master ParparVM	3.73s
this PR	1.77s	2.1x faster than master
Java 25 warmed (ref)	0.36s	remaining gap is cross-TU call inlining, tracked below

Two fixes beyond the suite work got it there: the dynamic pacing cap above, and no-signal-mask setjmp on Apple -- Darwin's setjmp/longjmp save and restore the caller's signal mask, a sigprocmask syscall on each side, and every Java try-block entry compiles to a setjmp, so exception-scoped hot loops paid a kernel round-trip per iteration (~19% of this workload's mutator samples). The VM never changes the signal mask per frame, so Apple platforms now use _setjmp/_longjmp (glibc already omits the mask; Windows has none) -- this speeds up every try/catch-containing hot path on iOS/tvOS/watchOS/macOS. The residual 5x vs warmed HotSpot is the per-byte readByte() cross-TU call chain (HotSpot inlines it; measured: ThinLTO recovers a further 15% and the GC accounts for <6% -- follow-up codegen work, not GC).

Correctness fixes found along the way (all real bugs)

• Thread.start/join visibility race (alive flag set on the wrong thread).
• Use-after-free in the conservative root-snapshot build.
• Apple signal-stop register capture was 56 bytes of pointer, not the register file: the stop-signal handler did memcpy(gcSigRegs, ucv, sizeof(ucontext_t)) where ucv is the handler's ucontext* -- on Darwin that copies the small ucontext header (56 bytes), not the 816-byte machine context it points to, so the conservative scan of a signal-stopped thread read garbage "registers" and could miss a register-only-reachable object -> swept while live (surfaced as an intermittent tvOS EDT NPE inside paintDirty, corrupting the next frame). Now copies the GPR block (uc_mcontext->__ss) -- and only the GPRs, keeping NEON noise out of the scan.
• StringBuilder.setLength expansion never zero-filled within capacity (masked by the old copy-on-write share).
• StringBuilder.charAt/getChars were capacity-bounded instead of count-bounded (JDK contract), fixed in C natives and JS-port twins.
• Non-ObjC String.toUpperCase/toLowerCase were stubs returning this.
• setjmp/longjmp UB in the try/catch codegen (pre-existing, latent for years): restoreTo<label> is assigned at try-entry -- AFTER the setjmp -- and read in the catch handler AFTER a longjmp; C11 makes it indeterminate there. gcc register-allocates it, so the handler restored threadObjectStackOffset from a rolled-back register and every callee frame after a caught exception was allocated ON TOP of the current frame's locals. Every clang build worked by luck (clang spills). Found via the musl CI job (the only gcc-compiled platform in CI) hanging deterministically; reproduced locally with gcc-16 (FusedTest segfault, bit-identical at -O0); fixed with volatile on the two try-entry variables. This plausibly affected every gcc-built Codename One Linux app that ever caught an exception.
• Trivial-accessor inlining: a multi-arg setter whose body stores only arg1 folded to a PUTFIELD, stranding the extra argument on the operand stack (now requires exactly one arg); and the fold's visibility depended on class emission order via in-place instruction-list mutation, emitting a field reference without its header include (now resolves through forwarder chains, order-independent).

Benchmark fix

Bench.stringBuilding previously built a string, read hash+length, and dropped it -- a shape where HotSpot's escape analysis scalar-replaces a String that real code would keep. Measured head-to-head: consume-and-drop 1.49x vs escaping 1.14x (pre-fix). The benchmark now parks each string in a ring buffer that outlives the iteration (batch-consumed, every string still hashed exactly once), so both VMs materialize every String -- measuring string building rather than EA-vs-no-EA.

Benchmark suite (in this PR)

The complete performance + correctness suite is included under vm/benchmarks/:

export JDK_8_HOME=/path/to/jdk8
export BENCH_JAVA=/path/to/jdk25/bin/java   # reference JVM (default: `java`)

vm/benchmarks/run-benchmark.sh      # interleaved best-of-5 vs the host JVM, ratio table + geomean
vm/benchmarks/run-gauntlet.sh       # correctness gate: all tortures byte-identical + GC stress
                                    # in cooperative AND forced-signal stop modes
CN1_BENCH_CC=gcc-16 vm/benchmarks/run-gauntlet.sh   # the gcc leg (what caught the setjmp bug)

The harness refuses to print ratios if any checksum differs from the host JVM — divergence is a VM bug by definition, never a perf trade. The README documents each workload and the torture coverage.

Binary size & memory

Same app (Bench), same flags (-O3, ThinLTO), master vs this branch, Apple M2:

metric	master	this PR	Java 25 (ref)
binary size (Bench app)	434 KB	451 KB (+3.8%)	—
binary size (Noop, VM floor)	1040 KB	1043 KB (+0.3%)	—
no-op RSS floor	2.2 MB	2.4 MB	~40 MB
peak RSS, Bench (allocation churn)	1.4–2.1 GB	290–390 MB	508 MB

The master peak-RSS blowup is the allocationsSinceLastGC int-overflow bug this PR fixes (the GC slept its 30s idle wait while dead pages accumulated); with the fixed triggers, RSS under heavy churn is bounded below the reference JVM's. The +17 KB binary cost buys the intrinsics, the compact HashMap and the escape-analysis machinery.

API surface

• @Fused is the one new public annotation (applied internally to String/StringBuilder; usable on developer classes with encapsulated primitive buffers). The developer guide's performance chapter now documents it — contract, example, and the automatic optimizations (stack-allocated string building, tagged integers, devirtualization, compact collections, BCE).
• @StackAllocate was removed from the public API before merge: nothing applies it, and its contract (no instance ever escapes its creating frame) depends on every caller — something no reusable class can promise. The machinery remains as the engine behind the automatic, per-call-site-proven StringBuilder stack allocation.
• Tagged integers are now default-on for 64-bit-pointer targets (opt-out -DCN1_DISABLE_TAGGED_INT; auto-disabled on 32-bit pointers incl. Apple Watch). Writing the benchmark scripts exposed that the old opt-in flag was set by NO shipping config — deployed apps never had it (hashMapChurn 2.8x untagged vs 0.97x tagged).
• Review fix: the charAt intrinsic (and the pre-existing native + JS twin) now bound by the string's logical count rather than the backing array's capacity; regression case added to StrCmp.

Validation

Every commit was gated on:

• Bit-identical output vs HotSpot for Bench (10/10 runs, plain and ThinLTO) and the torture suites: MapTorture (10 sections incl. tombstone churn, view removal, 200k PRNG op mix), SbTorture (toString independence, editing ops, surrogates, 100k PRNG mix), StrCmp (unicode + surrogate ordering), FusedTest, IbpTest, ThreadChurn -- plain AND forced-signal-stop mode.
• GcStress 20/20 plain + 10/10 forced-signal; MtStress 10/10 plain+signal.
• JS-port parity maintained: every new native has a runtime binding delegating to the pure-Java *Impl twin.

Escape hatches for bisection: -DCN1_DISABLE_SB_STACK_ALLOC, CN1_DISABLE_SCALAR_REPLACE, -Dcn1.frameless*, CN1_GC_SIGNAL_STOP env.

CI portability + JS-port hardening (follow-up commits)

The branch was developed and validated on macOS (Darwin exposes GNU/BSD APIs by default); CI flagged the gaps, fixed in two follow-up commits:

• Linux: _GNU_SOURCE for pthread_getattr_np/REG_* ucontext indices (glibc+musl); -flto=thin gated on Clang (gcc rejects the thin spelling).
• Windows: signal-stop handler compiled out on _WIN32 (cooperative stop path only); the compat shim gained pthread_once, pthread_detach, posix_memalign (_aligned_malloc -- the page arena never frees, so the pairing rule is moot), PTHREAD_COND_INITIALIZER, and a processor-count fallback without sysconf. Found via a full static POSIX audit rather than iterating on first-error-wins compiles.
• JS port: the tagged-int Integer.cn1Value/valueOf(int) natives got their runtime bindings; and the pure-Java *Impl twins that bindNative delegates call from parparvm_runtime.js are now retention roots in both the unused-method cull and the JS RTA -- no bytecode call site exists, so they were being eliminated and the delegation threw ReferenceError (caught by the new core-slice completeness tests). All 233 JS-target tests pass locally.
• Two BytecodeInstructionIntegrationTest assertions were stale against deliberate emission changes (indy concat now stack-allocates its builder; frameless supersedes the fast-stack macro) -- modernized to accept every current form while guarding the same contract.
• The full gauntlet (FusedTest/ExcTest/MapTorture/SbTorture/Bench/GcStress) now validates bit-identical under both clang and gcc-16 -O3 -- the VM had been clang-only-validated, and gcc's register allocator is what exposed the setjmp bug.

🤖 Generated with Claude Code