715766 - IonMonkey: Track Bailout rate and provide localization data in debug builds.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

The idea of this bug is to provide a mean to highlight abnormal bailout rate and to help us find what is the instruction (JSOP, MIR, LIR) involved in the production of this bailout.

The reported number can be the number of start/loop header the script hit before hitting the bailout. (opposite of the rate, but the idea is the same)  A repeated small number of hit for one bailout will likely indicate a point which need to be optimized or debug.

Localization data would be extremely useful to avoid tracking them by hand which can become unpractical especially on benchmarks.

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Copy the Opcodes which lead to a snapshot.

This patch copy the history of opcodes used until the encoding of a snapshot.
This history is printed each time the snapshot is read, which is convenient for tracking unexpected bailouts.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 588562 [details] [diff] [review]
Copy the Opcodes which lead to a snapshot.

Review of attachment 588562 [details] [diff] [review]:
-----------------------------------------------------------------

Instead of:
#ifdef DEBUG // TRACK_BAILOUT
Could we have:
#ifdef TRACK_BAILOUT
And conditionally #define it in Ion.h or something? The comment is kind of jarring and doesn't help to explain the code.

::: js/src/ion/LIR.h
@@ +703,5 @@
> +        return ins_;
> +    }
> +
> +  public:
> +    void setInstruction(LInstruction *ins) {

This will need a non-DEBUG implementation.

Comment 3

[Sean Stangl [:sstangl]]

hg.mozilla.org/projects/ionmonkey/rev/81769819d9e6

Comment 4

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/projects/ionmonkey/rev/e6091710117c

As an addendum: also prints instruction IDs and moves output to 'bailouts'.