1351471 - Profiling phase for megamorphic stubs

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[Tom S [:evilpie]]

Attachment: profiling

I think we sometimes attach megamorphic stubs even when it's not necessary. So I have been looking into profiling the shapes we see during those lookups and how often.

Consider for example: https://threejs.org/examples/webgl_performance_doublesided.html

We attach a megamorphic stub for "children":

"children"
count: 128
shape: 0x7f5abc19fda8 count: 1
shape: 0x7f5abc1ab588 count: 20
shape: 0x7f5abc1abd08 count: 107
total: 3

So after 128 calls to GetNativeDataProperty we have seen 0x7f5abc1abd08 107 times.

After 524288, this is still the most common case.

"children"
count: 524288
shape: 0x7f5abc1ab588 count: 2100
shape: 0x7f5abc1abd08 count: 521564
shape: 0x7f5abc19cc40 count: 104
shape: 0x7f5abc19f178 count: 104
shape: 0x7f5abc19f628 count: 104
shape: 0x7f5abc19fcb8 count: 104
shape: 0x7f5abc19fd30 count: 104
shape: 0x7f5abc19fda8 count: 104
total: 8

Sometimes I even see only a single shape entry after a few thousand lookups. This happens even on Speedometer with React.

I am not sure yet how to actually use this information, but one thing I think that might be common: The lookups in a program might change after it reached a stable point, i.e. finished initialization. So instead of attaching a megamorphic stub, we have a pre-megamorphic state where we throw away every stubs as well and give the ICs a second chance.

We could of course also use this profiling information to attach a number of ICs *before* the megamorphic stub.