perf(runtime): [[Prototype]] is part of shape identity; store sites prove their chain once

changelog.d/11342-inherited-prototype-in-shape.md

@@ -0,0 +1,26 @@
+**[[Prototype]] is part of shape identity.** A shape is canonical per
+(prototype, ordered keys): `setPrototypeOf`, `__proto__`, `new F()` after
+`F.prototype` is replaced, `Object.create(p)` and class evaluation each move
+the object to the shape naming its new prototype, and two objects with the
+same keys but different prototypes never share a shape. The shape generation
+now tracks only descriptor, delete and freeze changes.
+
+Key-adding and shadowing stores on class instances (`this.x = …` in a
+constructor with no field declarations, `this.m = this.m.bind(this)`) no
+longer run the full `[[Set]]` each time: the store site keeps the verdict
+that the prototype chain does not intercept the key, keyed by the prototype
+identity the receiver's shape records, and appends through the shape
+transition. Also fixes a stale store plan that skipped an inherited setter
+after `F.prototype` was replaced.
+
+**Behaviour change: a method read off `this` is the class's method, not a
+receiver snapshot.** `const f = this.m` now answers the same canonical
+function as `obj.m` and `C.prototype.m` (`this.m === C.prototype.m` holds),
+and the value binds no receiver — calling it bare runs with `this`
+undefined, as in Node. This retires the #4548 snapshot contract, under
+which every `this.m` read built and named a fresh bound closure and a
+captured `this.m` kept its receiver after an own-property replacement. The
+constructor self-rebind `this.m = this.m.bind(this)` that #4548 fixed keeps
+working.
+
+zod: −32.7% instructions and −30% peak RSS; tsc transpile: −3.1% instructions (one run).

crates/perry-codegen/src/codegen/string_pool.rs

@@ -642,10 +642,12 @@ pub(super) fn emit_string_pool(
                 ],
             )
         } else {
+            // The class id rides along: a birth shape names the prototype
+            // its class implies ([[Prototype]] is a shape fact).
             blk.call(
                 I32,
-                "js_object_shape_id_for_keys",
-                &[(I64, &arr), (I32, &fc_str)],
+                "js_object_shape_id_for_class_keys",
+                &[(I64, &arr), (I32, &fc_str), (I32, &cid_str)],
             )
         };
         let shape_global = format!(

crates/perry-codegen/src/expr/property_get/helpers.rs

@@ -62,18 +62,15 @@ pub(crate) fn lower_class_method_bind(
 ) -> Result<String> {
     let recv_box = lower_expr(ctx, object)?;
     let key_idx = ctx.strings.intern(method_name);
-    if matches!(object, Expr::This) {
-        let entry = ctx.strings.entry(key_idx);
-        let bytes_global = format!("@{}", entry.bytes_global);
-        let len_str = entry.byte_len.to_string();
-        let blk = ctx.block();
-        let bytes_i64 = blk.ptrtoint(&bytes_global, I64);
-        return Ok(blk.call(
-            DOUBLE,
-            "js_class_method_snapshot_bind",
-            &[(DOUBLE, &recv_box), (I64, &bytes_i64), (I64, &len_str)],
-        ));
-    }
+    // `this.m` is an ordinary [[Get]]: it answers the class's one canonical
+    // method value, exactly like `obj.m` below, with no receiver captured. It
+    // used to call `js_class_method_snapshot_bind`, which built and named a
+    // fresh bound closure on EVERY read (#4548's contract) — 26% of Zod's
+    // cycles, since `ZodType`'s constructor reads twenty inherited methods
+    // this way to `.bind` them. The contract's own motivating case, the
+    // constructor self-rebind `this.m = this.m.bind(this)`, needs only that
+    // the value not be re-resolved BY NAME when called, which the canonical
+    // value already guarantees.
     let dispatch_global = ctx.strings.static_dispatch_global(key_idx);
     let blk = ctx.block();
     let method_id = crate::strings::emit_static_dispatch_id(blk, &dispatch_global);

crates/perry-codegen/src/lower_call/alloc_hot_tests.rs

@@ -38,7 +38,7 @@ const OUTLINED_CALL: &str = "call i64 @js_object_alloc_class_inline_keys";
 /// Rung 2's outlined entry has an explicit ShapeId argument.
 const STAMPED_OUTLINED_CALL: &str = "call i64 @js_object_alloc_class_inline_keys_stamped(";
 /// One mint per class at module init, never per allocation.
-const SHAPE_MINT_CALL: &str = "call i32 @js_object_shape_id_for_keys(";
+const SHAPE_MINT_CALL: &str = "call i32 @js_object_shape_id_for_class_keys(";
 /// The immutable id is hoisted to the function-entry setup like keys_array.
 const SHAPE_GLOBAL_LOAD: &str = "load i32, ptr @perry_class_shape_id_";
 /// #8122: the inline allocator's 16-byte header prefix — packed GcHeader word

crates/perry-codegen/src/lower_call/typed_shape_bake_tests.rs

@@ -578,7 +578,7 @@ fn imported_pointer_layout_does_not_invent_a_consumer_typed_shape_id() {
     let ir =
         String::from_utf8(compile_module(&module, opts).unwrap()).expect("LLVM IR should be UTF-8");
     assert!(
-        ir.contains("call i32 @js_object_shape_id_for_keys("),
+        ir.contains("call i32 @js_object_shape_id_for_class_keys("),
         "the consumer must share the producer's canonical structural ShapeId:\n{ir}"
     );
     assert!(

crates/perry-codegen/src/runtime_decls/strings.rs

@@ -1182,6 +1182,7 @@ pub fn declare_phase_b_strings(module: &mut LlModule) {
     );
     module.declare_function("js_build_class_keys_array", I64, &[I32, I32, PTR, I32]);
     module.declare_function("js_object_shape_id_for_keys", I32, &[I64, I32]);
+    module.declare_function("js_object_shape_id_for_class_keys", I32, &[I64, I32, I32]);
     module.declare_function("js_register_class_guard_shape", VOID, &[PTR]);
     // #10123: (shape_id, NaN-boxed key) -> inline slot index, or -1. The
     // element-shape loop clone's shape-keyed preheader resolves each tracked

crates/perry-codegen/tests/native_proof_regressions.rs

@@ -15098,7 +15098,7 @@ fn ir_function_body<'a>(ir: &'a str, marker: &str) -> &'a str {
 }
 
 #[test]
-fn this_method_value_uses_receiver_snapshot_bind() {
+fn this_method_value_is_the_canonical_method_not_a_receiver_snapshot() {
     let mut snapshot = class(8955, "Snapshot", Vec::new());
     snapshot.methods.push(Function {
         id: 89550,
@@ -15146,9 +15146,16 @@ fn this_method_value_uses_receiver_snapshot_bind() {
 
     let ir = compile_ir_for_module_with_opts(module, empty_opts()).unwrap();
     let capture = ir_function_body(&ir, "Snapshot__capture(");
+    // `this.method` is an ordinary [[Get]] of an inherited method: the class's
+    // one canonical value, as for any other receiver. A per-read receiver
+    // snapshot allocated and named a bound closure on every read.
     assert!(
-        capture.contains("call double @js_class_method_snapshot_bind"),
-        "a this.method value read must capture the receiver instead of using the canonical owner marker:\n{capture}"
+        capture.contains("call double @js_class_method_bind_by_id"),
+        "a this.method value read must answer the canonical method value:\n{capture}"
+    );
+    assert!(
+        !capture.contains("js_class_method_snapshot_bind"),
+        "a this.method value read must not build a receiver snapshot:\n{capture}"
     );
 }
 

crates/perry-runtime/src/gc/layout/typed_shape.rs

@@ -68,6 +68,10 @@ unsafe fn mask_words<'a>(words: *const u64, word_count: u32) -> &'a [u64] {
 #[derive(Clone, Hash, PartialEq, Eq)]
 struct RegisteredTypedShapeKey {
     class_id: u32,
+    /// The prototype identity the class id names when it registers: a shape
+    /// fact, so two registrations of one class id that name different
+    /// prototypes (per-module class ids collide) get two ShapeIds.
+    proto_id: u64,
     slot_count: u32,
     raw_f64_words: Vec<u64>,
     pointer_words: Vec<u64>,
@@ -88,6 +92,9 @@ struct RegisteredTypedShapes {
     ids_by_layout: crate::fast_hash::FastKeyHashMap<RegisteredTypedShapeKey, u32>,
     /// Bare `u32` ShapeId key -> `PtrHasher` (single multiply + avalanche).
     layouts_by_id: crate::fast_hash::PtrHashMap<u32, TypedLayoutDescriptor>,
+    /// Typed ShapeId -> the prototype identity it was minted with, for
+    /// installing it into another module's slots or another agent.
+    proto_by_id: crate::fast_hash::PtrHashMap<u32, u64>,
     /// `(class id, slot count)` -> the first typed ShapeId registered for it.
     /// Read when an importing module registers its compiled ShapeId slots.
     typed_by_class: std::collections::HashMap<(u32, u32), u32>,
@@ -166,8 +173,10 @@ pub extern "C" fn js_gc_typed_shape_id_for_keys(
         eprintln!("Perry internal error: invalid pre-registered typed shape masks");
         std::process::abort();
     }
+    let proto_id = crate::object::shapes::class_proto_id(class_id);
     let key = RegisteredTypedShapeKey {
         class_id,
+        proto_id,
         slot_count,
         raw_f64_words: raw_f64_slice.to_vec(),
         pointer_words: pointer_slice.to_vec(),
@@ -183,6 +192,7 @@ pub extern "C" fn js_gc_typed_shape_id_for_keys(
             shape_id,
             keys as usize as *const crate::array::ArrayHeader,
             slot_count,
+            proto_id,
         ) {
             eprintln!("Perry internal error: typed ShapeId structural mismatch");
             std::process::abort();
@@ -193,9 +203,11 @@ pub extern "C" fn js_gc_typed_shape_id_for_keys(
     let shape_id = crate::object::shapes::mint_registered_typed_shape_id(
         keys as usize as *const crate::array::ArrayHeader,
         slot_count,
+        proto_id,
     );
     registered.ids_by_layout.insert(key, shape_id);
     registered.layouts_by_id.insert(shape_id, descriptor);
+    registered.proto_by_id.insert(shape_id, proto_id);
     publish_to_imported_slots(&mut registered, class_id, slot_count, shape_id);
     shape_id
 }
@@ -243,22 +255,31 @@ fn publish_to_imported_slots(
         .entry((class_id, slot_count))
         .or_insert(shape_id);
     if let Some(slots) = registered.pending_imported.remove(&(class_id, slot_count)) {
+        let proto_id = registered.proto_by_id.get(&shape_id).copied();
         for slot in slots {
-            unsafe { rewrite_imported_shape_slot(slot, slot_count, shape_id) };
+            if let Some(proto_id) = proto_id {
+                unsafe { rewrite_imported_shape_slot(slot, slot_count, shape_id, proto_id) };
+            }
         }
     }
 }
 
 /// # Safety
 /// `slot` must hold the addresses codegen registered: a live `u64` keys global,
 /// a `u32` ShapeId global and a null or `<2 x i64>` header image global.
-unsafe fn rewrite_imported_shape_slot(slot: ImportedShapeSlot, slot_count: u32, shape_id: u32) {
+unsafe fn rewrite_imported_shape_slot(
+    slot: ImportedShapeSlot,
+    slot_count: u32,
+    shape_id: u32,
+    proto_id: u64,
+) {
     let keys = std::ptr::read(slot.keys_slot as *const u64);
     if keys == 0
         || !crate::object::shapes::install_registered_typed_shape_id(
             shape_id,
             keys as usize as *const crate::array::ArrayHeader,
             slot_count,
+            proto_id,
         )
     {
         return;
@@ -322,7 +343,11 @@ pub extern "C" fn js_register_imported_class_shape_slot(
         .get(&(class_id, slot_count))
         .copied()
     {
-        Some(shape_id) => unsafe { rewrite_imported_shape_slot(slot, slot_count, shape_id) },
+        Some(shape_id) => {
+            if let Some(proto_id) = registered.proto_by_id.get(&shape_id).copied() {
+                unsafe { rewrite_imported_shape_slot(slot, slot_count, shape_id, proto_id) }
+            }
+        }
         None => registered
             .pending_imported
             .entry((class_id, slot_count))

crates/perry-runtime/src/gc/mod.rs

@@ -1065,6 +1065,10 @@ pub fn gc_init() {
     // address cannot be recycled under the entry, and rewritten, so a
     // compacting or copying pass leaves it pointing at the same object.
     reg_scanner!(crate::object::inherited_read_cache::scan_inherited_read_cache_roots_mut);
+    // Inherited-access lane: a store site's chain verdict names its interned
+    // key and the receiver's recorded prototype, and compares them on every
+    // use, so both are STRONG roots (`object::chain_store`).
+    reg_scanner!(crate::object::chain_store::scan_chain_store_roots_mut);
     reg_scanner!(crate::map::scan_map_iterator_array_roots_mut);
     reg_scanner!(crate::set::scan_set_iterator_array_roots_mut);
     reg_scanner!(crate::perf_hooks::scan_perf_entries_roots_mut);

crates/perry-runtime/src/object/alloc.rs

@@ -392,9 +392,10 @@ pub(crate) fn alloc_class_instance_with_keys(
     let (ptr, birth_slots, _, keys) =
         object_alloc_class_inline_keys_impl(class_id, parent_class_id, field_count, keys, 0);
     unsafe {
-        let id = crate::object::shapes::shape_id_for_keys_ensure(
+        let id = crate::object::shapes::shape_id_for_class_keys_ensure(
             keys.arr() as *const ArrayHeader,
             keys.count(),
+            class_id,
         );
         crate::object::shapes::birth_stamp_object_shape(ptr, id, birth_slots);
     }