Open Bug 1351471 Opened 2 years ago Updated 2 years ago

Profiling phase for megamorphic stubs

Categories

(Core :: JavaScript Engine: JIT, enhancement, P3)

enhancement

Tracking

()

People

(Reporter: evilpie, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [qf-])

Attachments

(1 file)

Attached patch profilingSplinter Review
I think we sometimes attach megamorphic stubs even when it's not necessary. So I have been looking into profiling the shapes we see during those lookups and how often.

Consider for example: https://threejs.org/examples/webgl_performance_doublesided.html

We attach a megamorphic stub for "children":

"children"
count: 128
shape: 0x7f5abc19fda8 count: 1
shape: 0x7f5abc1ab588 count: 20
shape: 0x7f5abc1abd08 count: 107
total: 3

So after 128 calls to GetNativeDataProperty we have seen 0x7f5abc1abd08 107 times.

After 524288, this is still the most common case.

"children"
count: 524288
shape: 0x7f5abc1ab588 count: 2100
shape: 0x7f5abc1abd08 count: 521564
shape: 0x7f5abc19cc40 count: 104
shape: 0x7f5abc19f178 count: 104
shape: 0x7f5abc19f628 count: 104
shape: 0x7f5abc19fcb8 count: 104
shape: 0x7f5abc19fd30 count: 104
shape: 0x7f5abc19fda8 count: 104
total: 8

Sometimes I even see only a single shape entry after a few thousand lookups. This happens even on Speedometer with React.

I am not sure yet how to actually use this information, but one thing I think that might be common: The lookups in a program might change after it reached a stable point, i.e. finished initialization. So instead of attaching a megamorphic stub, we have a pre-megamorphic state where we throw away every stubs as well and give the ICs a second chance.

We could of course also use this profiling information to attach a number of ICs *before* the megamorphic stub.
Whiteboard: [qf]
Priority: -- → P3
Whiteboard: [qf] → [qf-]
You need to log in before you can comment on or make changes to this bug.