531132 - (TM:MIC) Traversing a DOM on trace is hard due to megamorphism

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Basic issue: different DOM node classes have different shapes.  So any loop that walks a DOM and does stuff to them ends up branchy.

Testcases coming up.  First one has only <div>s in the DOM and generates these jitstats:

recorder: started(1), aborted(0), completed(1), different header(0), trees trashed(0), slot promoted(0), unstable loop variable(0), breaks(0), returns(0), merged loop exits(0), unstableInnerCalls(0), blacklisted(0)
monitor: exits(1), timeouts(0), type mismatch(0), triggered(1), global mismatch(0), flushed(0)

Second one walks the HTML5 spec DOM (which is not that unreasonable as DOMs go in terms of size, but happens to be easier to de-script than most large pages) and generates these jitstats:

recorder: started(15), aborted(0), completed(109), different header(0), trees trashed(0), slot promoted(0), unstable loop variable(0), breaks(0), returns(0), merged loop exits(0), unstableInnerCalls(0), blacklisted(0)
monitor: exits(204), timeouts(6), type mismatch(0), triggered(210), global mismatch(5), flushed(5)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Simple testcase; traces well

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: More realistic testcase (unzip and load test.html); traces not as well

Comment 3

[Brendan Eich [:brendan]]

This may be a dup of bug 518487.

Boris, can you enable the DEBUG_notme code before TraceRecorder::guardShape and attach a shape-guard dump file? Thanks,

/be

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: The requested log

Comment 5

[Brendan Eich [:brendan]]

This is not bug 518487, this is the bug where we should figure out how to despecialize megamorphic sites and not cycle through the PIC we'll have via fixing bug 518487, and perform just one generic, slower than shape-guarded "get" but faster than interpreter "get" for all node types.

/be

Comment 6

[Brendan Eich [:brendan]]

This looks like an important bug to get assigned and owned, at least in the deep thinking sense where you sleep on it, think about it outside of work, etc. The usual PIC techniques help, since PICs are really instrumentation devices more than inlining devices, and low cache hit rate with high cache test count means megamorphic callsite. So it may depend on the TM:PIC bug.

/be

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Obsolete with the removal of tracejit.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Well, JM has similar (though less pronounced) issues: it'll end up with IC misses and slow stubcalls.  Not sure there's anything we can do about that, though.