perf(codegen): reach user-written constructors with the dead-field-init elision (#7512)

#7469's `ctor_prologue_param_assigned_fields` matched the constructor prologue
on `Expr::PropertySet`. No user syntax lowers to that node — `lower_expr`'s
assignment arm turns every source `obj.prop = value` into `Expr::PutValueSet`,
and `PropertySet` is emitted only by synthesized HIR (the anon-shape
object-literal ctor). The elision therefore fired on object literals and was
structurally unreachable for the declared class its changelog claimed to cover.

That is the #7512 anomaly: `new Node(v, w)` with two declared `number` fields
emitted FOUR field-store IC diamonds per construction against the equivalent
`{v, w}` literal's two — two of them storing a compile-time-constant
`undefined` that the next two statements overwrite. Both dead diamonds took the
cold arm on every construction, not occasionally: a fresh instance has no
typed-shape descriptor yet (`js_gc_init_typed_shape_layout` runs after the ctor
returns), so a `requires_raw_f64` set-guard cannot pass and
`js_class_field_set_fallback` — record-fallback plus a linear-key-search
by-name store — ran twice per object.

One recognizer, `prologue_assigned_field`, now accepts both spellings of
`this.<field> = <plain parameter>`. The proof obligation is unchanged and is
about the operands rather than the store opcode: `This` and `LocalGet` of a
plain parameter cannot throw, allocate, or observe `this`. `PutValueSet`
additionally requires a constant string key and a `This` receiver.

Emitted-IR census, same workload and compiler: the class constructor drops from
314 to 157 IR lines and from 4 store diamonds to 2, matching the literal's 2;
the literal's constructor is byte-identical to before.

Claude-Session: https://claude.ai/code/session_019EHcmXKArA7m42SihYCcgH

Author: Ralph Küpper

changelog.d/7515-class-ctor-dead-field-init.md

@@ -0,0 +1,59 @@
+### Codegen: the dead-default-field-init elision now reaches user-written constructors (#7512)
+
+#7469 elides the default-`undefined` write for a class field the constructor's
+own prologue provably overwrites. Its changelog said it covered "plain user
+ctors like `constructor(a, b) { this.a = a; this.b = b }`". It did not, and
+could not: `ctor_prologue_param_assigned_fields` matched the prologue on
+`Expr::PropertySet`, and **no user syntax lowers to that node**.
+`perry-hir/src/lower/lower_expr/assignment.rs` turns every source-level
+`obj.prop = value` — `this.v = v` included — into the spec `PutValue` node
+`Expr::PutValueSet`. `Expr::PropertySet` is emitted only by *synthesized* HIR,
+which is exactly what the anon-shape object-literal constructor
+(`lower/context.rs::mint_anon_shape_class`) is built from. The elision was
+therefore measured on the one construction form it reached, and was
+structurally unreachable for the declared class it was documented as covering.
+
+The visible consequence is the anomaly filed as #7512: `new Node(v, w)` with two
+declared `number` fields was **slower** than the equivalent `{v, w}` literal, so
+the most statically-known construction form in the language was the least
+optimized one. Emitted-IR census of the two constructors, same workload, same
+compiler (`--trace llvm`):
+
+| per construction | `{v, w}` literal | `new Node(v, w)` before | after |
+|---|--:|--:|--:|
+| field-store IC diamonds | 2 | **4** | 2 |
+| `js_typed_feedback_class_field_set_guard` | 2 | 2 | 0 |
+| `js_class_field_set_fallback` | 2 | 2 | 0 |
+| `js_array_numeric_value_to_raw_f64` | 0 | 4 | 2 |
+| constructor body, IR lines | 111 | **314** | 157 |
+
+The two extra diamonds each stored a compile-time-constant `undefined` that the
+next two statements overwrote. Both took the cold by-name arm on *every*
+construction rather than occasionally: a freshly allocated instance carries no
+typed-shape descriptor (`js_gc_init_typed_shape_layout` runs after the
+constructor returns), so a `requires_raw_f64` set-guard on a declared `number`
+field cannot pass, and `js_class_field_set_fallback` — a feedback-fallback
+record plus a linear-key-search `js_object_set_field_by_name` — ran twice per
+object. A class whose fields are declared `any` paid the same two dead diamonds.
+
+The fix is one recognizer, `prologue_assigned_field`, accepting both spellings
+of `this.<field> = <plain parameter>`. The proof obligation is unchanged and is
+about the *operands*, not the store opcode: `This` and `LocalGet` of a plain
+parameter cannot throw, allocate, or observe `this`, so the prologue write is
+reached before any other effect of the constructor. `PutValueSet` additionally
+requires a constant string key and a `This` receiver. Every existing refusal
+still applies — derived classes, field initializers, computed keys, parameter
+defaults, setter-shadowed fields, and any statement that breaks the leading run.
+
+Behaviour is unchanged: an 11-case semantics probe (unassigned fields still read
+`undefined`, `Object.keys`/JSON shape, prototype-setter shadowing, derived
+classes, post-construction reassignment, 200-instance shared-shape consistency)
+produces byte-identical output before and after, and matches Node on 10 of 11 —
+the eleventh is a pre-existing, unrelated divergence in how a declared field
+interacts with a same-named prototype accessor, identical on both compilers.
+
+**Not fixed here, and worth its own ticket:** the residual gap is an ordering
+one. `lower_call/new.rs` emits `js_gc_init_typed_shape_layout` *after* the
+constructor call, so no raw-f64-declared class-field store inside any
+constructor can ever pass its guard — the surviving real stores still take
+`js_put_value_set`. That belongs with #7510's construction-path item.

crates/perry-codegen/src/lower_call/field_init.rs

@@ -13,15 +13,87 @@ use crate::expr::{lower_expr, FnCtx};
 use crate::nanbox::{double_literal, POINTER_MASK_I64};
 use crate::types::{DOUBLE, I32, I64};
 
+/// The field name a constructor-prologue statement assigns from a plain
+/// parameter, or `None` if the statement is not of that shape.
+///
+/// **Two HIR shapes mean the same thing here, and matching only one of them is
+/// what #7512 was** (`new Node(v, w)` measured 63% slower than the equivalent
+/// `{v, w}` literal, the reverse of the expected ordering):
+///
+/// - `Expr::PropertySet` is what the compiler SYNTHESIZES. Every anon-shape
+///   object-literal constructor (`lower/context.rs::mint_anon_shape_class`)
+///   and the destructuring lowering emit it directly.
+/// - `Expr::PutValueSet` is what USER SOURCE lowers to. `lower_expr`'s
+///   assignment arm (`perry-hir/src/lower/lower_expr/assignment.rs`) turns
+///   *every* source-level `obj.prop = value` — `this.v = v` in a hand-written
+///   constructor included — into the spec `PutValue` node. Nothing a user can
+///   type produces `Expr::PropertySet`.
+///
+/// So #7469's elision, which only ever matched `PropertySet`, fired on the
+/// synthesized literal ctor and was structurally unreachable for the declared
+/// class it was documented as covering. The class paid two extra full
+/// class-field-set IC diamonds per construction — a guard call plus a
+/// by-name `js_class_field_set_fallback` each, since a fresh instance has no
+/// typed-shape descriptor yet and the raw-f64 guard therefore cannot pass —
+/// writing a compile-time-constant `undefined` that the next two statements
+/// overwrite.
+///
+/// The proof obligation is identical for both shapes and is entirely about the
+/// *operand* expressions, not the store opcode: `This` and `LocalGet(<plain
+/// param>)` cannot throw, allocate, or observe `this`, so the assignment is
+/// reached before any other effect of the constructor. Both nodes' misses
+/// route through a `[[Set]]` that honours an inherited setter, so neither adds
+/// prototype-chain exposure the other lacks — and the caller separately
+/// refuses any field the class itself declares a setter for.
+///
+/// `PutValueSet` additionally requires a constant string key (a computed key
+/// is an arbitrary expression that can run user code) and `receiver` to be
+/// `This` as well, since codegen evaluates both.
+fn prologue_assigned_field<'a>(
+    stmt: &'a Stmt,
+    param_ids: &std::collections::HashSet<u32>,
+) -> Option<&'a str> {
+    let is_plain_param = |e: &Expr| matches!(e, Expr::LocalGet(id) if param_ids.contains(id));
+    match stmt {
+        // Synthesized (anon-shape ctor, destructuring lowering).
+        Stmt::Expr(Expr::PropertySet {
+            object,
+            property,
+            value,
+        }) if matches!(object.as_ref(), Expr::This) && is_plain_param(value.as_ref()) => {
+            Some(property.as_str())
+        }
+        // User-written `this.f = p;`.
+        Stmt::Expr(Expr::PutValueSet {
+            target,
+            key,
+            value,
+            receiver,
+            strict: _,
+        }) if matches!(target.as_ref(), Expr::This)
+            && matches!(receiver.as_ref(), Expr::This)
+            && is_plain_param(value.as_ref()) =>
+        {
+            match key.as_ref() {
+                Expr::String(property) => Some(property.as_str()),
+                _ => None,
+            }
+        }
+        _ => None,
+    }
+}
+
 /// Field names whose default-`undefined` initializer write is provably dead
 /// because the class's own constructor unconditionally overwrites them before
-/// anything can observe `this` (#7469).
+/// anything can observe `this` (#7469; extended to user-written constructors
+/// by #7512).
 ///
 /// A field declared without an initializer must normally be written as
 /// `undefined` in the init phase (#486: `new C().x === undefined` is spec, not
 /// zero-bytes-from-the-allocator). But the most common constructor shape —
-/// including every synthesized anon-shape literal ctor
-/// (`lower/context.rs::mint_anon_shape_class`) — opens with a run of plain
+/// every synthesized anon-shape literal ctor
+/// (`lower/context.rs::mint_anon_shape_class`), and the hand-written
+/// `constructor(v, w) { this.v = v; this.w = w }` — opens with a run of plain
 /// `this.f = <param>` statements. For those fields the `undefined` write is a
 /// dead store: it is overwritten before any code that could read `this.f`
 /// runs. On `churn.ts` that dead store was 2 of the 4 guarded field-store
@@ -49,18 +121,18 @@ use crate::types::{DOUBLE, I32, I64};
 /// - **Every constructor parameter is plain**: no default (a default expression
 ///   evaluates before the prologue and, in the general lowering, could observe
 ///   `this`), no rest, no decorators, no `arguments` materialization.
-/// - **No setter shares a name with a prologue-assigned field** — the
-///   PropertySet would dispatch to the setter instead of writing the slot, and
-///   the elided `undefined` write was the only slot write.
+/// - **No setter shares a name with a prologue-assigned field** — the store
+///   would dispatch to the setter instead of writing the slot, and the elided
+///   `undefined` write was the only slot write.
 /// - The field itself is public and non-computed (`is_private` false,
 ///   `key_expr` none).
 ///
-/// The prologue is the maximal leading run of
-/// `Stmt::Expr(PropertySet { object: This, property, value: LocalGet(<param>) })`
-/// statements. A `LocalGet` of a plain parameter cannot throw, allocate, or
-/// observe `this`, so every field it assigns is written before ANY other
-/// effect of the constructor — which is exactly the guarantee that makes the
-/// earlier `undefined` write dead.
+/// The prologue is the maximal leading run of statements that
+/// [`prologue_assigned_field`] recognizes as `this.<f> = <plain param>`. A
+/// `LocalGet` of a plain parameter cannot throw, allocate, or observe `this`,
+/// so every field it assigns is written before ANY other effect of the
+/// constructor — which is exactly the guarantee that makes the earlier
+/// `undefined` write dead.
 fn ctor_prologue_param_assigned_fields(
     class: &perry_hir::Class,
 ) -> std::collections::HashSet<String> {
@@ -91,17 +163,11 @@ fn ctor_prologue_param_assigned_fields(
     let param_ids: std::collections::HashSet<_> = ctor.params.iter().map(|p| p.id).collect();
     let mut assigned = std::collections::HashSet::new();
     for stmt in &ctor.body {
-        match stmt {
-            Stmt::Expr(Expr::PropertySet {
-                object,
-                property,
-                value,
-            }) if matches!(object.as_ref(), Expr::This)
-                && matches!(value.as_ref(), Expr::LocalGet(id) if param_ids.contains(id)) =>
-            {
-                assigned.insert(property.clone());
+        match prologue_assigned_field(stmt, &param_ids) {
+            Some(property) => {
+                assigned.insert(property.to_string());
             }
-            _ => break,
+            None => break,
         }
     }
     if assigned.is_empty() {
@@ -449,3 +515,6 @@ pub(crate) fn apply_field_initializers_recursive(
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests;