[JAEGER] Increase HOTLOOP to 4; blacklist after 300 execs.

js/src/jstracer.cpp

@@ -294,7 +294,7 @@ ValueToTypeChar(const Value &v)
  * Number of iterations of a loop where we start tracing.  That is, we don't
  * start tracing until the beginning of the HOTLOOP-th iteration.
  */
-#define HOTLOOP 2
+#define HOTLOOP 4
 
 /* Attempt recording this many times before blacklisting permanently. */
 #define BL_ATTEMPTS 2
@@ -302,6 +302,9 @@ ValueToTypeChar(const Value &v)
 /* Skip this many hits before attempting recording again, after an aborted attempt. */
 #define BL_BACKOFF 32
 
+/* Number of times a loop can execute before it becomes blacklisted. */
+#define MAX_LOOP_EXECS 300
+
 /* Number of times we wait to exit on a side exit before we try to extend the tree. */
 #define HOTEXIT 1
 
@@ -1548,6 +1551,7 @@ TreeFragment::initialize(JSContext* cx, SlotList *globalSlots, bool speculate)
                              sizeof(double);
     this->maxNativeStackSlots = nStackTypes;
     this->maxCallDepth = 0;
+    this->execs = 0;
 }
 
 UnstableExit*
@@ -6727,13 +6731,12 @@ ExecuteTree(JSContext* cx, TreeFragment* f, uintN& inlineCallCount,
                      f->typeMap.data(), global, stack);
 
     AUDIT(traceTriggered);
-    debug_only_printf(LC_TMTracer,
-                      "entering trace at %s:%u@%u, native stack slots: %u code: %p\n",
-                      cx->fp->script->filename,
-                      js_FramePCToLineNumber(cx, cx->fp),
-                      FramePCOffset(cx, cx->fp),
-                      f->maxNativeStackSlots,
-                      f->code());
+    debug_only_printf(LC_TMTracer, "entering trace at %s:%u@%u, execs: %u code: %p\n",
+           cx->fp->script->filename,
+           js_FramePCToLineNumber(cx, cx->fp),
+           FramePCOffset(cx, cx->fp),
+           f->execs,
+           f->code());
 
     debug_only_stmt(uint32 globalSlots = globalObj->numSlots();)
     debug_only_stmt(*(uint64*)&tm->storage->global()[globalSlots] = 0xdeadbeefdeadbeefLL;)
@@ -7112,6 +7115,19 @@ LeaveTree(TraceMonitor *tm, TracerState& state, VMSideExit* lr)
     state.innermost = innermost;
 }
 
+static bool
+ApplyBlacklistHeuristics(JSContext *cx, TreeFragment *tree)
+{
+    if (tree->execs >= MAX_LOOP_EXECS) {
+        debug_only_printf(LC_TMTracer, "tree %p executed %d times, blacklisting\n",
+                          (void*)tree, tree->execs);
+        Blacklist((jsbytecode *)tree->ip);
+        return false;
+    }
+    tree->execs++;
+    return true;
+}
+
 JS_REQUIRES_STACK MonitorResult
 MonitorLoopEdge(JSContext* cx, uintN& inlineCallCount, RecordReason reason)
 {
@@ -7247,6 +7263,9 @@ MonitorLoopEdge(JSContext* cx, uintN& inlineCallCount, RecordReason reason)
     VMSideExit* lr = NULL;
     VMSideExit* innermostNestedGuard = NULL;
 
+    if (!ApplyBlacklistHeuristics(cx, match))
+        return MONITOR_NOT_RECORDING;
+
     if (!ExecuteTree(cx, match, inlineCallCount, &innermostNestedGuard, &lr))
         return MONITOR_ERROR;
 
@@ -16229,6 +16248,9 @@ MonitorTracePoint(JSContext* cx, uintN& inlineCallCount, bool& blacklist)
             VMSideExit* lr = NULL;
             VMSideExit* innermostNestedGuard = NULL;
 
+            if (!ApplyBlacklistHeuristics(cx, match))
+                return TPA_Nothing;
+
             /* Best case - just go and execute. */
             if (!ExecuteTree(cx, match, inlineCallCount, &innermostNestedGuard, &lr))
                 return TPA_Error;

js/src/jstracer.h

@@ -696,6 +696,7 @@ struct TreeFragment : public LinkableFragment
     Queue<Value>            gcthings;
     Queue<JSScopeProperty*> sprops;
     unsigned                maxNativeStackSlots;
+    uintN                   execs;
 
     inline unsigned nGlobalTypes() {
         return typeMap.length() - nStackTypes;