Dromaeo's test harness keeps re-numbering the shape of the global object by overwriting properties of the global object with newly created lambda functions/constructors (prototype.js:1118). This blocks tracing by constantly flushing the trace cache, but also slows down the interpreter by making the property cache mismatch constantly. There are no easy fixes for this. Is this an intentional and meaningful design pattern the code uses here? This will also negatively impact V8's hidden classes approach (not sure about SFX). Maybe the test harness should be lightweight and it should not interfere with name bindings while it runs tests. In its current form the benchmark essentially measures how well the VM deals with unstable name bindings, and not really the test thats being run.

(In reply to comment #0) > Dromaeo's test harness keeps re-numbering the shape of the global object by > overwriting properties of the global object with newly created lambda > functions/constructors (prototype.js:1118). What's this line? I can't find anything relevant at that source line in prototype-1.5.1.1. Is it just one var hash = Class.create(...); that is being rebound each time? On IRC I argued that this does not hurt benchmark test interpreter (property cache) performance, provided the test runs in the iframe and this hash var is set in the parent window. Anything else would interfere too much wiht the test. So tracing should strive to avoid dynamic global scope shape change from invalidating the (iframe) static global scope of the benchmarks. Seems doable, several bugs stand in the way, Andreas kindly offered to file them. We could track them as blockers of this bug. /be

this hits a corner case and regresses perf vs. the interpreter, we should fix if it's not too risky.

Graydon and I discussed the implications of the bug and the fixes needed on top of david's patch. I think its low-impact, and will potentially yield a small perf win in general. It also removes a bunch of out-of-malloc situations: Basic design: - Use a hash table with accepted collisions for frequency counting. Once threshold is met, looking fragments in a 2-level hashmap. - Fragments are allocated into the lirbuf, instead of malloc. Fragments are thus freed on cache flush, and we won't hit separate out of heap conditions.

Forking out the original source of the bug into a new one (shape renumbering), and leaving that with brendan. Stealing the boring parts and distributing to graydon and myself.