perf(repsel): resolve object-literal element types in the element-shape loop clone (#7480)

#7480's own kernel (`keep: {v, w}[]`, 200k x 50 sweeps) went from 408 ms to
12 ms on the pinned quiet mini — parity with node (12 ms) and bun (12 ms),
down from 34x node. The named-class arm #7612 already covered is unchanged
at 13 ms. Checksums identical across every arm and runtime.

`element_class_name` resolved `Array(Named(C))` only, so an object-literal
element type never reached the clone. It now also resolves the declared
object type to the `__AnonShape_<hash>` class its literals allocate, by
matching the declared property order against the module's anon shapes
(ambiguity declines rather than guessing, so the answer does not depend on
`ctx.classes` iteration order).

`receiver_class_name` is deliberately NOT widened — that is the #6377 blast
radius #7612 refused. The clone is made self-contained instead: its
`ElementShapeLoopFact` already carried the class name and packed slot index,
and the three sites that would otherwise re-derive the class from the
receiver now consult that fact through one predicate.

Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix

Author: Ralph Küpper

crates/perry-codegen/src/expr/binary.rs

@@ -58,7 +58,19 @@ fn lower_arithmetic_operand(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<(String,
             return Ok((value, true));
         }
     }
-    if expr_may_return_boxed_value_from_raw_f64_fallback(ctx, expr) {
+    // repsel #7480 step 3: a tracked `arr[i].field` read inside an
+    // element-shape fast clone routes to the raw-f64 lowering WITHOUT the
+    // boxed-fallback test below. That test asks `receiver_class_name`, which
+    // by design does not resolve an object-literal element type, so the read
+    // would otherwise fall through to `lower_expr` — a generic diamond, whose
+    // calls then fail the clone's call-free admission and cost the clone
+    // entirely. The predicate is left alone rather than widened: this read has
+    // no boxed fallback at all (the residual per-element check proves the slot
+    // is a raw double before the load), so claiming one here would be a lie
+    // that other consumers of that predicate would read.
+    let in_element_shape_clone = matches!(expr, Expr::PropertyGet { object, property, .. }
+        if crate::expr::element_shape_loop_fact_for_property_get(ctx, object, property).is_some());
+    if in_element_shape_clone || expr_may_return_boxed_value_from_raw_f64_fallback(ctx, expr) {
         if let Some(value) =
             super::property_get::lower_raw_f64_class_field_get_for_number_context(ctx, expr)?
         {

crates/perry-codegen/src/expr/mod.rs

@@ -1605,21 +1605,56 @@ pub(crate) struct ElementShapeLoopFact {
     pub max_field_index: u32,
 }
 
-/// Find the innermost active element-shape loop fact covering
-/// `(array_local_id, index_local_id, class_name, property)`. Returns the fact
-/// and the packed slot index of the field.
-pub(crate) fn element_shape_loop_fact_lookup<'f>(
-    facts: &'f [ElementShapeLoopFact],
-    array_local_id: u32,
-    index_local_id: u32,
-    class_name: &str,
+/// Find the innermost active element-shape loop fact covering a
+/// `PropertyGet`'s receiver: answers `Some((fact, packed_slot_index))` exactly
+/// when `object.property` is a tracked `arr[counter].field` read inside an
+/// element-shape fast clone.
+///
+/// The single entry point for the three sites that must agree about that read
+/// — the field lowering itself
+/// (`expr::property_get::lower_raw_f64_class_field_get_for_number_context`),
+/// `type_analysis::is_numeric_expr`, and `expr::binary`'s arithmetic-operand
+/// router. #7480 step 3 made the clone self-contained by routing all three
+/// through the fact instead of through `receiver_class_name`, which by design
+/// does not resolve an object-literal element type; the fact's own
+/// `class_name` is therefore the authoritative answer rather than a filter on
+/// one the caller supplies.
+///
+/// `(array, counter)` already identifies one loop — a counter local is minted
+/// per `for`, and the matcher admits exactly one array per loop. Cheap
+/// early-out first: outside a fast clone the fact vector is empty.
+///
+/// The **canonical-i32 counter slot is part of the predicate**, not a
+/// precondition the caller re-checks. Answering `Some` is a promise that the
+/// read really does take the bare-load lowering, and `is_numeric_expr` bets a
+/// raw `double` on that promise: if the field lowering declined for want of an
+/// i32 slot while the numeric predicate still said yes, the operand would be
+/// consumed as a real double while the generic lowering handed back a NaN-boxed
+/// value. The matcher declines the whole loop without that slot
+/// (`lower_element_shape_versioned_for`), so today the two can't disagree —
+/// asking here keeps them unable to disagree if the matcher is ever widened.
+pub(crate) fn element_shape_loop_fact_for_property_get<'f>(
+    ctx: &'f FnCtx<'_>,
+    object: &perry_hir::Expr,
     property: &str,
 ) -> Option<(&'f ElementShapeLoopFact, u32)> {
-    facts.iter().rev().find_map(|fact| {
-        if fact.array_local_id != array_local_id
-            || fact.index_local_id != index_local_id
-            || fact.class_name != class_name
-        {
+    use perry_hir::Expr;
+    if ctx.element_shape_loop_facts.is_empty() {
+        return None;
+    }
+    let Expr::IndexGet { object, index } = object else {
+        return None;
+    };
+    let (Expr::LocalGet(array_local_id), Expr::LocalGet(index_local_id)) =
+        (object.as_ref(), index.as_ref())
+    else {
+        return None;
+    };
+    if !ctx.i32_counter_slots.contains_key(index_local_id) {
+        return None;
+    }
+    ctx.element_shape_loop_facts.iter().rev().find_map(|fact| {
+        if fact.array_local_id != *array_local_id || fact.index_local_id != *index_local_id {
             return None;
         }
         fact.fields.get(property).map(|idx| (fact, *idx))

crates/perry-codegen/src/expr/property_get/helpers.rs

@@ -331,6 +331,81 @@ pub(crate) fn lower_raw_f64_class_field_get_for_number_context(
         }
     }
 
+    // repsel #7480 / #5093: inside the fast clone of an ELEMENT-shape
+    // versioned loop, `arr[i].field` in number context lowers to a bare
+    // element load plus the residual per-element check, with no element-read
+    // tier and no guard call (see stmt/element_shape_loop.rs).
+    //
+    // #7480 step 3: this sits ABOVE the `receiver_class_name` gate on purpose.
+    // The clone's element class can be one that resolver does not answer for —
+    // an object-literal element type (`keep: {v: number}[]`) resolves to its
+    // `__AnonShape_<hash>` only inside the matcher, which is where that
+    // resolution is kept so it cannot un-gate anything else (#6377). Every
+    // fact this consults was validated by the matcher when the fact was built:
+    // the class has no computed members and no base, the property is not an
+    // accessor and is not denylisted, and its declared type is a raw-f64
+    // candidate at the packed slot index carried here. So the lowering needs
+    // nothing from the receiver's static type, and asking for it would have
+    // made the whole clone dead IR.
+    if let Some((fact, field_index)) =
+        crate::expr::element_shape_loop_fact_for_property_get(ctx, object, property)
+            .map(|(fact, idx)| (fact.clone(), idx))
+    {
+        if let Expr::IndexGet { object: array, .. } = object.as_ref() {
+            if let Expr::LocalGet(arr_id) = array.as_ref() {
+                // The counter's canonical i32 slot is what the matcher
+                // required; without it there is nothing to index with.
+                if let Some(slot) = ctx.i32_counter_slots.get(&fact.index_local_id).cloned() {
+                    let idx_i32 = ctx.block().load(I32, &slot);
+                    let value = crate::expr::element_shape_guard::emit_element_shape_field_load(
+                        ctx,
+                        &fact,
+                        &idx_i32,
+                        field_index,
+                    );
+                    let lowered = LoweredValue {
+                        semantic: SemanticKind::JsNumber,
+                        rep: NativeRep::F64,
+                        llvm_ty: DOUBLE,
+                        value: value.clone(),
+                    };
+                    ctx.record_lowered_value_with_access_mode_and_facts(
+                        "ElementShapeFieldGet",
+                        Some(*arr_id),
+                        "element_shape_loop.raw_f64_load",
+                        &lowered,
+                        Some(BoundsState::Guarded {
+                            guard_id: "element_shape_loop_preheader_check".to_string(),
+                        }),
+                        None,
+                        Some(BufferAccessMode::CheckedNative),
+                        None,
+                        None,
+                        None,
+                        vec![raw_f64_layout_fact(
+                            Some(*arr_id),
+                            "consumed",
+                            "element_shape_loop_preheader_check",
+                            None,
+                        )],
+                        Vec::new(),
+                        false,
+                        false,
+                        vec![
+                            format!("field={property}"),
+                            format!("class={}", fact.class_name),
+                            "loop_versioning=element_shape".to_string(),
+                            "index_range=nonnegative_i32".to_string(),
+                            "length_range=guarded_i32".to_string(),
+                            "element_shape=homogeneous_class".to_string(),
+                        ],
+                    );
+                    return Ok(Some(value));
+                }
+            }
+        }
+    }
+
     let Some(class_name) = receiver_class_name(ctx, object) else {
         return Ok(None);
     };
@@ -368,80 +443,6 @@ pub(crate) fn lower_raw_f64_class_field_get_for_number_context(
         return Ok(None);
     };
 
-    // repsel #7480 / #5093: inside the fast clone of an ELEMENT-shape
-    // versioned loop, `arr[i].field` in number context lowers to a bare
-    // element load plus the residual per-element check, with no element-read
-    // tier and no guard call (see stmt/element_shape_loop.rs). Checked before
-    // the class-field fact because the receiver shapes are disjoint
-    // (`IndexGet` vs `LocalGet`) and this one is the cheaper lowering.
-    if !ctx.element_shape_loop_facts.is_empty() {
-        if let Expr::IndexGet { object, index } = object.as_ref() {
-            if let (Expr::LocalGet(arr_id), Expr::LocalGet(idx_id)) =
-                (object.as_ref(), index.as_ref())
-            {
-                let hit = crate::expr::element_shape_loop_fact_lookup(
-                    &ctx.element_shape_loop_facts,
-                    *arr_id,
-                    *idx_id,
-                    &class_name,
-                    property,
-                )
-                .filter(|(_, loop_idx)| *loop_idx == field_index)
-                .map(|(fact, _)| fact.clone());
-                if let Some(fact) = hit {
-                    // The counter's canonical i32 slot is what the matcher
-                    // required; without it there is nothing to index with.
-                    if let Some(slot) = ctx.i32_counter_slots.get(idx_id).cloned() {
-                        let idx_i32 = ctx.block().load(I32, &slot);
-                        let value = crate::expr::element_shape_guard::emit_element_shape_field_load(
-                            ctx,
-                            &fact,
-                            &idx_i32,
-                            field_index,
-                        );
-                        let lowered = LoweredValue {
-                            semantic: SemanticKind::JsNumber,
-                            rep: NativeRep::F64,
-                            llvm_ty: DOUBLE,
-                            value: value.clone(),
-                        };
-                        ctx.record_lowered_value_with_access_mode_and_facts(
-                            "ElementShapeFieldGet",
-                            Some(*arr_id),
-                            "element_shape_loop.raw_f64_load",
-                            &lowered,
-                            Some(BoundsState::Guarded {
-                                guard_id: "element_shape_loop_preheader_check".to_string(),
-                            }),
-                            None,
-                            Some(BufferAccessMode::CheckedNative),
-                            None,
-                            None,
-                            None,
-                            vec![raw_f64_layout_fact(
-                                Some(*arr_id),
-                                "consumed",
-                                "element_shape_loop_preheader_check",
-                                None,
-                            )],
-                            Vec::new(),
-                            false,
-                            false,
-                            vec![
-                                format!("field={property}"),
-                                "loop_versioning=element_shape".to_string(),
-                                "index_range=nonnegative_i32".to_string(),
-                                "length_range=guarded_i32".to_string(),
-                                "element_shape=homogeneous_class".to_string(),
-                            ],
-                        );
-                        return Ok(Some(value));
-                    }
-                }
-            }
-        }
-    }
-
     // #5093 loop versioning: inside the fast clone of a class-field versioned
     // loop, a tracked number-context field read on the proven receiver lowers
     // to a bare slot load on the preheader-cached object pointer — no shape