627600 - global shape changes don't blacklist

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

This loop records N times since each iteration has a different global times:

  for (var i = 0; i < 1000; ++i) {
      this[i] = 3;
      for (var j = 0; j < 15; ++j) {}
  }

The problem is that things like "recordAttempts" etc are attached to the TreeFragment which is looked up via the tuple (global,globalShape,argc,pc), so each new global shape gets a new TreeFragment and fresh recordAttempts.

Since the vmfragments table is in the compartment, perhaps we can keep a map:
  global -> shapeChangesAfterRecordingComplete
and when that gets too high for any global, we blacklist the whole global.

Comment 1

[Luke Wagner [:luke]]

Alternatively, we could take globalShape out of the fragment key, put it into the TreeFragment, and then check it after looking up, doing blacklisting etc the normal way.