Browser & Frontend Runtime
DevTools flame strip and the frame lifecycle
You open DevTools Performance, record a scroll, and see a sea of coloured bars. Some bars are red. Most are yellow. You know jank is somewhere in there — but you don’t know which bar to fix. The flame strip is a map. This lesson teaches you to read it.
Reading the DevTools Performance flame strip
Open DevTools → Performance, click record, do whatever caused the jank, stop recording.
Track colours (Main thread):
- Yellow — scripting (JavaScript executing)
- Purple — rendering (style recalc + layout)
- Green — paint
- Dark blue — compositing
Track colours (Frames):
- Green — on-time frame
- Yellow — late frame
- Red — dropped frame
The flame strip stacks calls top-down: the top bar is what JS triggered; each bar below is what that called. Find a long bar in red or yellow — that is your bottleneck. Hover to see exact ms.
Common DevTools patterns → diagnosis
Yellow JS bar → purple Layout bar
JS triggered a forced synchronous layout. The most common render-performance bug.
Wide purple Recalculate Style after a class change high in the tree
You cascaded style invalidation to too many descendants. Move the class change lower or use contain: style.
Wide green Paint after filter: blur(…) change
You exceeded paint complexity. filter is paint-heavy because each pixel requires multi-pixel sampling.
Wide dark-blue Composite Layers when nothing else looks wrong
Too many layers, often from will-change abuse. Audit with Layer Borders.
The frame lifecycle: exact order
Inside one frame the browser runs work in a strict order defined by the HTML spec:
- Collect input events (mousemove, keypress)
- Run setTimeout / setInterval callbacks if their time has elapsed
- Run microtasks (promise resolutions) until the queue is empty
- Run requestAnimationFrame callbacks
- Run ResizeObserver and IntersectionObserver callbacks
- Compute style and layout
- Paint
- Composite
After step 8 the browser yields to the OS and waits for the next vsync.
Crucial property: rAF runs before style/layout, so a write inside rAF is followed by exactly one layout pass for the frame — that is the entire purpose of rAF. ResizeObserver fires after layout but before paint; you can react to layout changes without triggering another forced layout. IntersectionObserver fires asynchronously across frames, never blocking the current one.
Microtasks vs tasks: scheduling boundaries
The microtask queue (promises, queueMicrotask) drains to empty between every step of the event loop, including between rAF callbacks.
A misbehaving promise chain that schedules itself indefinitely starves rendering — the browser cannot reach step 6 until the queue empties. This is why long promise chains and tight await loops appear in DevTools as a single uninterrupted yellow scripting bar, not a series of small ones.
Modern code that wants to yield to the renderer mid-task uses:
scheduler.yield()(Scheduler API, Chrome 115+) — designed specifically for thissetTimeout(fn, 0)— drops work onto the macrotask queue and unblocks rendering
Reactive frameworks and the pipeline
When React re-renders, DOM updates happen on the main thread, then the pipeline runs style and layout on changed nodes. Reconciliation itself is pure JS — it shows up as yellow in DevTools. If your re-render touches a node near the top of the tree, style invalidation cascades down the tree; if it touches an isolated leaf, the invalidation is local.
Key practice: keep state local, as close to the leaf as possible. A useState in a leaf component invalidates one node; a useContext on a top-level provider can invalidate hundreds. The same principle applies to Svelte stores, MobX observables, Vue refs — every reactivity model eventually writes to the DOM, and a DOM write triggers the same pipeline.
Why this works
Understanding the frame lifecycle order is what separates “scheduling tricks that work” from “scheduling tricks that quietly thrash.” A common mistake: writing a CSS property inside setTimeout(fn, 0) expecting it to batch with rAF-driven writes. It does not — setTimeout fires at step 2, before rAF at step 4, so the write happens one step before the rAF writes and cannot be batched together. Always put visual writes inside rAF, not macrotask callbacks.
Drag the events into the order they happen inside one frame, according to the HTML spec's rendering steps.
- 1 Browser processes input events (mousemove, keypress)
- 2 setTimeout / setInterval callbacks fire if due
- 3 Microtasks drain (promise.then handlers)
- 4 requestAnimationFrame callbacks run
- 5 ResizeObserver / IntersectionObserver callbacks fire
- 6 Style and layout are computed
- 7 Paint runs on the main thread
- 8 Compositor thread assembles and ships the frame
In the DevTools Performance panel, a yellow JS bar is immediately followed by a purple Layout bar of similar length. What happened?
An infinite `await` loop in a promise chain runs for 200 ms. What does the DevTools Performance panel show?
You want to read the new size of a resized element and update a sibling's style in response. Which observer fires at the right time to avoid triggering a second layout?
- 01In what order do these fire inside one frame: rAF, setTimeout, microtasks, ResizeObserver, style/layout?
- 02Why does an infinite promise chain starve rendering?
- 03What colour are layout bars in the DevTools Performance panel, and what colour are scripting bars?
The DevTools Performance panel encodes pipeline stages as colours: yellow for JS, purple for layout/style, green for paint, dark blue for composite. The frame lifecycle is fixed by the HTML spec — rAF fires before style/layout, ResizeObserver after layout before paint. Microtasks drain completely between every step, so an infinite promise loop starves the renderer. To yield mid-task use scheduler.yield() (Chrome 115+) or setTimeout(fn, 0). Reactive frameworks trigger the same pipeline on DOM writes; keeping state local to leaf components minimises style-invalidation cascade.
appears again in143
- Why GraphQL gets N+1junior
- DataLoader mechanics: tick-boundary batchingmiddle
- Batch function contracts: ordering, shapes, errorsmiddle
- Federation and lookahead: batching beyond DataLoadermiddle
- Query complexity defences: depth, cost, persisted queriesmiddle
- Senior GraphQL API: scheduling contract, tenant isolation, observabilitysenior
- Why idempotency: making retries safejunior
- Server-side state machine: four states of an idempotency keymiddle
- Outbox and inbox: effectively-once across the dual-write boundarymiddle
- Concurrency and cache architecture for idempotency at scalesenior
- Observability, production failures, and global-scale designsenior
- What is a cache stampede and why it makes things worsejunior
- Lock and single-flight: bounding concurrent rebuildsmiddle
- XFetch: coordination-free probabilistic early expirationmiddle
- Stale-while-revalidate and CDN request coalescingmiddle
- Detecting stampedes and designing TTL for productionmiddle
- Metastable failure, fencing tokens, and production postmortemssenior
- What a relation is: tables, rows, keys, and constraintsjunior
- Constraints, keys, and Postgres data typesmiddle
- Normal forms, denormalization, and why schemas stickmiddle
- JSONB, arrays, and when a side table winsmiddle
- Heap storage, TOAST, and column alignmentsenior
- Schema integrity: deferral, versioning, and production failure modessenior
- Relational vs document, wide-column, graph, and key-valuesenior
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- pg_statistic, ANALYZE, and production observabilitymiddle
- Production failure modes and plan stabilitysenior
- MVCC: why readers and writers never wait for each otherjunior
- Row versions and snapshots: the on-disk mechanicsmiddle
- HOT updates and isolation levels: what you gain and what you paymiddle
- Vacuum and bloat: keeping the storage tax boundedmiddle
- CLOG, XID wraparound, and MultiXact: deep visibility internalssenior
- SSI internals and production autovacuum tuningsenior
- Real-world MVCC failures, deployment patterns, and distributed snapshotssenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- What a schema migration is and why it replaces ad-hoc DDLjunior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Expand-contract: zero-downtime for breaking schema changesmiddle
- Advisory locks, migration tools, and deploy coordinationsenior
- Migration failure taxonomy and production disciplinesenior
- Why sharding exists: the single-Postgres ceilingjunior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Partitioning vs sharding: same word, two different thingsmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Schema-based sharding and multi-tenancy alternativessenior
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Raft roles, terms, and why majority quorums prevent split brainjunior
- How Raft replicates a log entry and decides it is safe to commitmiddle
- Raft leader election: timeouts, voting rules, and the four safety propertiesmiddle
- Raft in the real world: partitions, slow disks, and client routingmiddle
- Raft extensions: pre-vote, learners, snapshots, and linearizable readssenior
- Raft in production: membership changes, Multi-Raft, and observabilitysenior
- Where data fetching happens — and why it decides LCPjunior
- Fetch waterfalls — diagnosis and the Promise.all curemiddle
- React Server Components and Suspense streamingmiddle
- Client-side cache: TanStack Query, SWR, and stale-while-revalidatemiddle
- LCP, prefetch, and race conditions in interactive fetchingmiddle
- Senior internals: RSC payload, caching layers, and production failure modessenior
- The three-way handshakejunior
- Sequence numbers and connection statemiddle
- DNS: what it does and why it existsjunior
- The resolver walk: referrals, record types, and gluemiddle
- TTL, caching, and DNS propagationmiddle
- The 1-RTT handshake: key shares and ECDHEmiddle
- Session resumption and 0-RTTmiddle
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket frame format: opcodes, masking, fragmentationmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Health checks, connection draining, and slow startmiddle
- Session affinity, consistent hashing, and the right fixmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- Connection IDs and network migrationmiddle
- 0-RTT resumption and packet encryptionsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- PII redaction and log injectionsenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- SLI, SLO, and the error budget: reliability by the numbersjunior
- Error budget policy, latency SLOs, and composite journeysmiddle
- Production SLO failures, self-observability, security, and the big picturesenior
- The incident loop: from pager to postmortem to preventionmiddle
- Cache lines, struct layout, and false sharingmiddle
- SIMD, SoA vs AoS, and memory bandwidthmiddle
- Cache-oblivious algorithms, PGO, and production failuressenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior
- At-most-once, at-least-once, exactly-once: the three delivery contractsjunior
- The three failure legs — where duplicates and losses actually happenmiddle
- Consumer-side dedup: the cheapest path to exactly-once processingmiddle
- Kafka exactly-once semantics: idempotent producer and transactionsmiddle
- SQS visibility timeout, DLQ, and the outbox patternmiddle
- Exactly-once in production: impossibility proof, hybrid patterns, and real incidentssenior
- What OAuth is and why passwords are not the answerjunior
- Authorization code flow with PKCEmiddle
- ID token validation and JWKS cache managementmiddle
- Refresh token rotation and scope-based least privilegemiddle
- Sender-constrained tokens: DPoP and mTLSsenior
- OAuth in production: audience attacks, observability, and real failuressenior