1854877 - Major parts of profile (that are Js-centric) on this page (http://xem.github.io/arrayduce/) are always unsymbolicated

Status: NEW

(Core :: Gecko Profiler, enhancement, P3)

Description

[Mayank Bansal]

Go to http://xem.github.io/arrayduce/
start the profiler
Click on Minify

https://share.firefox.dev/3PyD3Tt , https://share.firefox.dev/3ZxPT9e

Comment 1

[Mayank Bansal]

Attachment: about:support

Comment 2

[Julien Wajsberg [:julienw]]

The function calling these "unsymbolicated symbols" is https://github.com/xem/arrayduce/blob/9642183abee496e13685efca83f19c4982c1514b/index.html#L76-L130, I reproduce the code below:

b.onclick=function(){
  // Make an array
  eval("list = " + before.value);

  // The best solution
  solution = "["+list.join(",")+"].indexOf(value)";

  // Initial length
  initial_length = solution.length;
  
  // Test if array values are unique
  if(!array_has_unique_numbers(list)){
    mini.value = "Your array can't have repeated values!";
    return;
  }
  
  // Range of the offset applied to value
  offset_range = [-min(list), 1000];
  
  // Range of the modulo applied to value + offset
  modulo_range = [1, min(list)];
  
  m=0;
  // Loop on offsets
  for(x = offset_range[0]; x < offset_range[1]; x++){
    
    // Loop on modulos
    for(y = modulo_range[0]; y < modulo_range[1]; y++){
    
      // Reset temp array
      tmp = [];
      
      // Loop on values
      for(z = 0; z < list.length; z++){
        
        // Add value + offset % modulo to temp array
        tmp.push((list[z] + x) % y);
      }
      
      // Test uniqueness of temp array values
      if(array_has_unique_numbers(tmp)){
      
        // If OK, save itt as the best solution if it's shorter than the existing one
        tmp = ("["+tmp.join(",")+"].indexOf("+(x?"(":"")+"value"+(x?x<0?x:"+"+x:"")+(x?")":"")+"%"+y+")");
        if(tmp.length < solution.length){
          solution = tmp;
        }
      }
      i++;
    }
  }
  
  mini.value = "// This code saves you "+(initial_length - solution.length)+" characters\n\n";
  mini.value += solution;
}

My rough guess is that the "onclick" function is split into several parts (maybe each loop or each block) that are themselves compiled in different versions.

Hey Iain, would you be able to shed some light on this?

Comment 3

[Iain Ireland [:iain]]

Looks like it might be ICs? IIRC, the profiler has some difficulty with ICs because they don't use frame pointers by default.

Markus, does anything here look weird/concerning? Can we reliably detect that these samples belong to ICs and give the symbol some sort of default name?

Comment 4

[Markus Stange [:mstange]]

Indeed, that's a baseline IC. Here's a profile from ETW: https://share.firefox.dev/3LDXfSI

(In reply to Iain Ireland [:iain] from comment #3)

Can we reliably detect that these samples belong to ICs and give the symbol some sort of default name?

I'd hope so - JSJitProfilingFrameIterator::tryInitWithPC(void* pc) might be a good place to start. I think fixing this bug should be possible entirely within Spidermonkey code.
Denis, I think we talked about this in the past, but I don't remember what the status was. Did you ever end up doing any work on exposing ICs to the profiling frame iterator?

Long term I think it would make sense to do our JIT profiling using native stack walking + "builtin jitdump", but I think for the foreseeable future we'll stick with ProfilingFrameIterator.

Comment 5

[Denis Palmeiro [:denispal]]

Yes I should have a patch for this somewhere which also covers Trampolines. I was holding back on posting it until we finalized the jitdump approach but I'll try to dig it up and post it.

Comment 6

[Denis Palmeiro [:denispal]]

Here's an updated profile with baseline IC and trampoline names: https://share.firefox.dev/3LGVcNG

Comment 7

[Mayank Bansal]

Still repros: https://share.firefox.dev/3Z4ntEi