feat(vm): implement polymorphic inline cache (PIC) for property access by akash-R-A-J · Pull Request #4740 · boa-dev/boa

akash-R-A-J · 2026-02-26T14:00:54Z

This Pull Request fixes/closes #4656.

Currently Boa uses a monomorphic inline cache for property access sites, storing a single (Shape → Slot) mapping. When the shape does not match, the cache is reset, which causes frequent cache invalidation when accessing the same property across objects with different shapes.

This PR upgrades the inline cache to a polymorphic inline cache (PIC) to better support polymorphic property access patterns commonly seen in JavaScript.

It changes the following:

Replace the monomorphic inline cache with a polymorphic inline cache (PIC) that stores multiple (Shape → Slot) mappings per access site using a small fixed-capacity cache (PIC_CAPACITY = 4).
Add support for a megamorphic state, where the cache is disabled after observing too many shapes to avoid unnecessary overhead.
Update inline cache lookup and insertion logic to support multiple cached shapes and opportunistic cleanup of stale weak shape references.
Update disassembly output to correctly display the cached shape information for PIC.
Add tests covering polymorphic and megamorphic inline cache behavior.

This change reduces inline cache thrashing for polymorphic property access patterns and aligns Boa's inline cache design more closely with modern JavaScript engines.

github-actions · 2026-02-26T14:10:10Z

Test262 conformance changes

Test result	main count	PR count	difference
Total	52,862	52,862	0
Passed	49,505	49,504	-1
Ignored	2,261	2,262	+1
Failed	1,096	1,096	0
Panics	0	0	0
Conformance	93.65%	93.65%	-0.00%

akash-R-A-J · 2026-02-26T15:22:16Z

hii @jedel1043, could you please review this pr? happy to make any changes or address feedback. thanks!

jedel1043 · 2026-02-26T15:25:13Z

Thanks!

Before reviewing anything, can you run https://github.com/boa-dev/data/blob/main/bench/bench-v8/combined.js? This should report benchmark results for your current PR's head commit, and you can compare that with a run against the main branch

akash-R-A-J · 2026-02-26T16:45:12Z

hey @jedel1043, I tried running the V8 combined benchmark (combined.js) on both the main branch and this PR's branch.

Both runs currently overflow the stack on Windows when executing:

target/release/boa.exe combined.js
target/debug/boa.exe combined.js

I also tried increasing the stack size (RUST_MIN_STACK=33554432) and rerunning the benchmark, but it still crashes with the same stack overflow.

If there is a recommended way to run this benchmark on Windows, I'd be happy to try again and report the results.

akash-R-A-J · 2026-02-26T18:09:03Z

hey @jedel1043, here's the report after running both branches on wsl2.

After running on main branch:

After running on this PR's branch:

jedel1043 · 2026-02-26T18:13:00Z

Wow, Splay got a very biiiiig perf boost

core/engine/src/vm/inline_cache/mod.rs

core/engine/src/vm/code_block.rs

core/engine/src/vm/inline_cache/mod.rs

jedel1043 · 2026-02-27T21:40:54Z

core/engine/src/vm/inline_cache/mod.rs

 use std::cell::Cell;

-use boa_gc::GcRefCell;
+use boa_gc::{GcRefCell, Trace as BoaTrace, custom_trace};


Why import Trace as BoaTrace?

The alias was introduced during development while wiring up the Trace implementation to avoid confusion with other imports. After the refactor it was no longer necessary, so it has been removed in the latest update.

jedel1043 · 2026-02-27T21:41:46Z

core/engine/src/vm/inline_cache/mod.rs

+}
+
+#[derive(Clone, Debug, Finalize)]
+pub(crate) struct PicEntries(pub(crate) ArrayVec<PicEntry, PIC_CAPACITY>);


Maybe it would be better to implement Trace on ArrayVec in the boa_gc crate? Should be basically the same as the custom_trace! you implemented.

That makes sense. Initially, I used custom_trace! on the PIC container to keep the changes local, since ArrayVec did not implement Trace. I’ve now implemented Trace for ArrayVec in boa_gc as suggested and updated the PIC implementation to use that instead.

akash-R-A-J · 2026-02-28T07:35:04Z

Hey @jedel1043, thanks for the review and the feedback! After incorporating the suggested changes, the benchmark score improved further (179 → 192 → 206). The largest improvement, as you noted earlier, continues to appear in the Splay benchmark.

Latest benchmark on this PR branch:

jedel1043 · 2026-02-28T15:21:29Z

core/engine/src/vm/inline_cache/mod.rs

+        if entries.len() < PIC_CAPACITY {
+            entries.push(PicEntry {
+                shape: shape.into(),
+                slot,
+            });


Here you should use https://docs.rs/arrayvec/latest/arrayvec/struct.ArrayVec.html#method.try_push

jedel1043 · 2026-02-28T15:26:55Z

core/engine/src/vm/inline_cache/mod.rs

+        let shape_addr = shape.to_addr_usize();
+
+        // If the shape already exists, update its slot.
+        // This handles cases where property transitions preserve the shape but change the slot.


Is this possible? IIRC any property transition will change the shape, so it should be impossible to have two shapes that are the same without them having the same slots.

jedel1043 · 2026-02-28T15:36:43Z

core/engine/src/vm/inline_cache/mod.rs

 #[cfg(test)]
 mod tests;

+pub(crate) const PIC_CAPACITY: usize = 4;


thought: we might have to experiment with this value in the future. Increasing it might increase performance, but it might also cause more cache misses which could decrease performance.

akash-R-A-J requested a review from a team as a code owner February 26, 2026 14:00

akash-R-A-J added 4 commits February 27, 2026 20:39

feat(vm): implement polymorphic inline cache (PIC)

79d9a08

fix(vm): update inline cache disassembly for PIC

4d72456

test(vm): add polymorphic and megamorphic inline cache tests

10f0ea7

style(vm): apply rustfmt and clippy fixes

07457d4

jedel1043 requested changes Feb 27, 2026

View reviewed changes

jedel1043 added performance Performance related changes and issues vm Issues and PRs related to the Boa Virtual Machine. waiting-on-author Waiting on PR changes from the author labels Feb 27, 2026

refactor(vm): address PIC review feedback

207831a

akash-R-A-J force-pushed the feat/pic-inline-cache branch from d48eaa9 to 207831a Compare February 28, 2026 07:16

akash-R-A-J requested a review from jedel1043 February 28, 2026 14:44

jedel1043 requested changes Feb 28, 2026

View reviewed changes

jedel1043 added this to the v1.0.0 milestone Feb 28, 2026

Uh oh!

Conversation

akash-R-A-J commented Feb 26, 2026

Uh oh!

github-actions bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test262 conformance changes

Uh oh!

akash-R-A-J commented Feb 26, 2026

Uh oh!

jedel1043 commented Feb 26, 2026

Uh oh!

akash-R-A-J commented Feb 26, 2026

Uh oh!

akash-R-A-J commented Feb 26, 2026

Uh oh!

jedel1043 commented Feb 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jedel1043 Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

akash-R-A-J Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

jedel1043 Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

akash-R-A-J Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

akash-R-A-J commented Feb 28, 2026

Uh oh!

jedel1043 Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

jedel1043 Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

jedel1043 Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Feb 26, 2026 •

edited

Loading