Capstone: optimize a hot path
One slow request handler, every layer of the engine in play. Profile it, read the deopt and IC traces, fix the shape, the boxing, the GC churn, and the microtask stall — then prove the win. The whole track, applied to one function.
A scoring endpoint that used to clear 40k requests/second now barely manages 6k, and the only “change” was a refactor that “just tidied up the object construction.” Nothing looks wrong in the code. Everything you learned in this track is about to converge on one 30-line function — because the engine is doing five different slow things at once, and you can name and fix every one.
The method, before the function
Optimisation without measurement is superstition. The loop is always the same: profile to find the dominant cost, name the mechanism, make one change, re-measure. This track gave you the vocabulary for the “name the mechanism” step — which is where most engineers get stuck, guessing instead of reading the trace. By the end of this capstone you will have named and fixed every slow thing in this function — and know exactly which tool to reach for next time.
Here is the regressed handler. Read it as the engine would.
function scoreBatch(rows) {
const out = [];
for (const row of rows) {
const e = {};
e.id = row.id;
if (row.name) e.name = row.name; // conditional field
e.score = row.weight * 1e9 + row.bonus; // overflows Smi range
if (row.flagged) e.flag = true; // late conditional field
out.push(e);
log(`scored ${e.id}`); // synchronous console in the hot loop
}
return out;
}Layer 1 — the shape (units 02–03)
--trace-ic shows the access site that reads .score downstream going megamorphic. The cause is the conditional fields: name and flag are added only sometimes, so objects walk different transition-tree branches and land on different hidden classes (unit 03). The IC at the consumer sees five-plus maps and falls back to the generic lookup — tens of cycles instead of one. When you see megamorphic or GENERIC in a trace, your first question should be: which call site produces objects with inconsistent shapes?
Fix: initialise every property unconditionally, in a fixed order, so all objects share one Map.
const e = {
id: row.id,
name: row.name ?? null,
score: 0, // set below
flag: row.flagged === true,
};Layer 2 — the boxing and the deopt (units 02, 04)
--trace-deopt shows scoreBatch deoptimising on a CheckSmi guard. row.weight * 1e9 overflows the Smi range (±2³¹), so the result becomes a HeapNumber — a heap-allocated box (unit 02). TurboFan had speculated Smi from early feedback; the first overflow fails the guard and triggers a deopt, and because it recurs every batch, you get a deopt loop (unit 04): optimise → deopt → re-optimise, never staying fast.
Fix: stop pretending the value is an integer. Compute in double from the start so the optimiser specialises on Float64 and never guards on Smi — or, if the consumer is numeric-heavy, accumulate scores into a Float64Array instead of object fields, eliminating the box entirely.
- Megamorphic property load vs monomorphic
- ~10–50×
- Deopt loop (optimise/deopt churn)
- stays interpreted
- HeapNumber box vs Smi
- alloc + deref vs 1 instr
- Minor GC triggered by per-row allocation
- sub-ms, but frequent
- Synchronous log() in a 100k loop
- blocks the turn
Layer 3 — the GC churn (unit 06)
Even with shapes fixed, allocating one out object per row floods new space; the bump-pointer allocator fills a semi-space and triggers a Scavenge (unit 06) far more often than necessary. Minor GC is cheap individually but death by a thousand cuts at this volume, and survivors get promoted to old space, eventually forcing a major GC.
Fix: reduce allocation. If out feeds a reducer, fold rows directly instead of materialising an array of objects; if the array is required, pre-size it (new Array(rows.length) is fine here because you fill every slot, keeping it PACKED). Fewer, longer-lived allocations beat a storm of short-lived ones.
Layer 4 — the scheduling (unit 07)
The log() call is synchronous I/O inside the loop. Beyond its own cost, in a request context it interleaves with the event loop: a flood of synchronous work on the stack delays the microtask checkpoint and starves other handlers (unit 07). The fix is not “make logging async” — it is don’t log per row on a hot path. Aggregate and emit once, or sample.
Layer 5 — prove it, then guard it (unit 08)
Measure the rewrite against the original on warmed-up code, consuming the result so dead-code elimination can’t delete your benchmark (unit 08), with allocation kept out of the timed region and the engine recorded. Then add a CI microbenchmark asserting a throughput floor, plus a unit test that counts distinct Object.keys signatures from scoreBatch and fails if it ever exceeds one. The shape regression that started this incident now cannot ship silently again.
Why fix the hidden-class instability before chasing the deopt or the GC churn?
`row.weight * 1e9 + row.bonus` triggered a deopt loop. What is the precise mechanism?
Order the optimisation method for this incident.
- 1 Profile to find the dominant cost (--prof, --trace-deopt, --trace-ic, heap snapshot)
- 2 Name the engine mechanism behind it (shape / boxing / GC / scheduling)
- 3 Make the smallest change that targets that mechanism
- 4 Re-measure on warmed-up code with the result consumed
- 5 Add a regression gate so the win cannot silently revert
▸More practice
Apply this to your own code: pick one function your profiler flags as hot. Before touching it, write down which of the five layers you expect to be the cost, then run --trace-deopt and a heap snapshot to check. Most engineers are wrong about which layer dominates — that gap between intuition and the trace is exactly what this track was built to close.
- 01The handler is slow. Walk the full diagnostic method end to end.
- 02Why does conditional property initialisation regress a hot consumer, and what's the fix?
- 03When is rewriting the hot path in WASM/Rust actually justified?
This capstone put the whole track on one function. A regressed scoring handler was slow for five overlapping reasons, each nameable from this track: conditional property initialisation split objects across hidden classes and drove a consumer IC megamorphic (units 02–03); an integer that overflowed the Smi range became a HeapNumber and triggered a TurboFan deopt loop (units 02, 04); per-row object allocation churned new space into frequent Scavenges (unit 06); a synchronous log per iteration stalled the microtask checkpoint (unit 07). The method is invariant: profile to find the dominant cost, name the exact mechanism, change one thing, re-measure on warmed-up code with the result consumed, and lock the win behind a regression gate (unit 08). Fix shape first, because a stable shape is the precondition for the optimiser to produce trustworthy code and trustworthy measurements. Now when you see a slow handler, you will reach for the trace first, name the mechanism precisely, and fix one layer at a time — because that is what turns guessing into engineering.
Practice
Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.
appears again in184
- Why GraphQL gets N+1junior
- DataLoader mechanics: tick-boundary batchingmiddle
- Batch function contracts: ordering, shapes, errorsmiddle
- Federation and lookahead: batching beyond DataLoadermiddle
- Query complexity defences: depth, cost, persisted queriesmiddle
- Senior GraphQL API: scheduling contract, tenant isolation, observabilitysenior
- Why idempotency: making retries safejunior
- Server-side state machine: four states of an idempotency keymiddle
- Outbox and inbox: effectively-once across the dual-write boundarymiddle
- Concurrency and cache architecture for idempotency at scalesenior
- Observability, production failures, and global-scale designsenior
- The event loop: one thread, three queuesjunior
- Tasks, microtasks, and scheduler.yield()middle
- Microtask starvation, Long Tasks, and LoAFsenior
- Node.js event loop: phases, nextTick, and loop lagsenior
- React, Vue, and INP observability in productionsenior
- The render pipeline: six stages from bytes to pixelsjunior
- Stage costs and the renderer process modelmiddle
- Invalidation, dirty bits, and containmiddle
- Compositor layers: promotion, overlap, and GPU memorymiddle
- DevTools flame strip and the frame lifecyclemiddle
- Layout thrash: forced synchronous layoutsenior
- BeginMainFrame, compositor-driven animations, and GPU memorysenior
- Production observability: LoAF, INP, and the full attack surfacesenior
- What V8 is and why performance varies 100×junior
- V8''''s four-tier JIT pipeline and profile-guided tieringmiddle
- Hidden classes, transition trees, and memory layoutmiddle
- Inline caches, IC states, and deoptimizationmiddle
- Orinoco GC: parallel scavenger, concurrent marking, and write barriersmiddle
- TurboFan''''s speculative engine and the deopt-loop trapsenior
- V8 in production: isolates, pointer compression, and real failuressenior
- Service worker lifecycle and cache strategiesmiddle
- Service worker edge cases: version skew, durability, and navigation trapssenior
- What the reconciler does: render vs commitjunior
- The fiber object and the double-buffer treemiddle
- Render phase purity and commit phase sub-stepsmiddle
- Reconciliation: diffing heuristics and the key trapmiddle
- Priority lanes, time-slicing, and useTransitionmiddle
- Bailout, memoisation, and tearingsenior
- React Profiler, the Compiler, and production observabilitysenior
- Rendering strategies: SSG, SSR, ISR, streaming, and hydrationjunior
- SSG, SSR, ISR, streaming, and RSC — how each worksmiddle
- Hydration cost: selective, progressive, islands, resumabilitymiddle
- Hydration mismatch: causes, detection, and the determinism rulesenior
- RSC, per-route strategy, and production observabilitysenior
- Core Web Vitals: what LCP, INP, and CLS measurejunior
- CLS: why layout shifts happen and how to stop themmiddle
- Metric tradeoffs, RUM attribution, and the CI+field loopsenior
- The full picture: URL to LCP to INP as a relay racejunior
- Eight layers traced: from the service worker to the second navigationmiddle
- Five canonical breaks: where production reliably diessenior
- The three-track method: reading traces and building a monitored systemsenior
- What is a cache stampede and why it makes things worsejunior
- Lock and single-flight: bounding concurrent rebuildsmiddle
- XFetch: coordination-free probabilistic early expirationmiddle
- Stale-while-revalidate and CDN request coalescingmiddle
- Detecting stampedes and designing TTL for productionmiddle
- Metastable failure, fencing tokens, and production postmortemssenior
- What a relation is: tables, rows, keys, and constraintsjunior
- Constraints, keys, and Postgres data typesmiddle
- Normal forms, denormalization, and why schemas stickmiddle
- JSONB, arrays, and when a side table winsmiddle
- Heap storage, TOAST, and column alignmentsenior
- Schema integrity: deferral, versioning, and production failure modessenior
- Relational vs document, wide-column, graph, and key-valuesenior
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- pg_statistic, ANALYZE, and production observabilitymiddle
- Production failure modes and plan stabilitysenior
- MVCC: why readers and writers never wait for each otherjunior
- Row versions and snapshots: the on-disk mechanicsmiddle
- HOT updates and isolation levels: what you gain and what you paymiddle
- Vacuum and bloat: keeping the storage tax boundedmiddle
- CLOG, XID wraparound, and MultiXact: deep visibility internalssenior
- SSI internals and production autovacuum tuningsenior
- Real-world MVCC failures, deployment patterns, and distributed snapshotssenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- What a schema migration is and why it replaces ad-hoc DDLjunior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Expand-contract: zero-downtime for breaking schema changesmiddle
- Advisory locks, migration tools, and deploy coordinationsenior
- Migration failure taxonomy and production disciplinesenior
- Why sharding exists: the single-Postgres ceilingjunior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Partitioning vs sharding: same word, two different thingsmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Schema-based sharding and multi-tenancy alternativessenior
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Raft roles, terms, and why majority quorums prevent split brainjunior
- How Raft replicates a log entry and decides it is safe to commitmiddle
- Raft leader election: timeouts, voting rules, and the four safety propertiesmiddle
- Raft in the real world: partitions, slow disks, and client routingmiddle
- Raft extensions: pre-vote, learners, snapshots, and linearizable readssenior
- Raft in production: membership changes, Multi-Raft, and observabilitysenior
- Where data fetching happens — and why it decides LCPjunior
- Fetch waterfalls — diagnosis and the Promise.all curemiddle
- React Server Components and Suspense streamingmiddle
- Client-side cache: TanStack Query, SWR, and stale-while-revalidatemiddle
- LCP, prefetch, and race conditions in interactive fetchingmiddle
- Senior internals: RSC payload, caching layers, and production failure modessenior
- The three-way handshakejunior
- Sequence numbers and connection statemiddle
- DNS: what it does and why it existsjunior
- The resolver walk: referrals, record types, and gluemiddle
- TTL, caching, and DNS propagationmiddle
- The 1-RTT handshake: key shares and ECDHEmiddle
- Session resumption and 0-RTTmiddle
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket frame format: opcodes, masking, fragmentationmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Health checks, connection draining, and slow startmiddle
- Session affinity, consistent hashing, and the right fixmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- Connection IDs and network migrationmiddle
- 0-RTT resumption and packet encryptionsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- PII redaction and log injectionsenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- SLI, SLO, and the error budget: reliability by the numbersjunior
- Error budget policy, latency SLOs, and composite journeysmiddle
- Production SLO failures, self-observability, security, and the big picturesenior
- The incident loop: from pager to postmortem to preventionmiddle
- Cache lines, struct layout, and false sharingmiddle
- SIMD, SoA vs AoS, and memory bandwidthmiddle
- Cache-oblivious algorithms, PGO, and production failuressenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior
- At-most-once, at-least-once, exactly-once: the three delivery contractsjunior
- The three failure legs — where duplicates and losses actually happenmiddle
- Consumer-side dedup: the cheapest path to exactly-once processingmiddle
- Kafka exactly-once semantics: idempotent producer and transactionsmiddle
- SQS visibility timeout, DLQ, and the outbox patternmiddle
- Exactly-once in production: impossibility proof, hybrid patterns, and real incidentssenior
- What OAuth is and why passwords are not the answerjunior
- Authorization code flow with PKCEmiddle
- ID token validation and JWKS cache managementmiddle
- Refresh token rotation and scope-based least privilegemiddle
- Sender-constrained tokens: DPoP and mTLSsenior
- OAuth in production: audience attacks, observability, and real failuressenior
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.
Apply this
Put this lesson to work on a real build.