land #8794: reuse exact ShapeId transitions (#8806)

* perf(runtime): reuse exact ShapeId transitions

* docs(changelog): note ShapeId transition reuse

* fix(runtime): guard cached shape transition invariants

* chore: landing fixes for #8794 (object/mod.rs split, raw-handle ceilings)

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

Author: proggeramlug

changelog.d/8794-shapeid-transition-cache.md

@@ -0,0 +1 @@
+Dynamic property writes now reuse exact structural transitions by stable predecessor ShapeId and interned key, then stamp the learned successor ShapeId directly after fail-closed content and identity guards. Anonymous-object construction avoids repeated descriptor hashing and publication, shared shape-key arrays retain an all-pointer layout, reverse indices update incrementally, and full GC drops transition roots after their weak key or predecessor descriptor dies.

crates/perry-runtime/src/gc/tests/dead_owner_side_tables.rs

@@ -1499,28 +1499,28 @@ fn test_live_boxed_primitive_payload_owner_survives_full_gc() {
     js_shadow_slot_set(0, 0);
 }
 
-/// #8192. A transition-cache entry carries TWO metadata-only keys — the
-/// pre-transition `keys_array` and the interned property-name string — while
-/// only `next_keys` is a strong root. Either weak half dying is enough to make
-/// the entry's rekey read recycled bytes, so either is enough to drop it.
+/// #8192. A transition-cache entry carries one metadata-only key — the
+/// interned property-name string — while `next_keys` is a strong root and both
+/// ShapeIds are stable non-pointer metadata. A dead weak key drops the entry.
 #[test]
-fn test_dead_transition_cache_prev_keys_pruned_on_full_gc() {
+fn test_dead_transition_cache_key_pruned_on_full_gc() {
     let _guard = CopyingNurseryTestGuard::new(1);
     gc_register_mutable_root_scanner(crate::object::scan_transition_cache_roots_mut);
 
     // `next_keys` is a strong root of the entry and must stay live, or the test
     // would be measuring the wrong pointer. It goes in OLD-GEN on purpose:
     // arena block reset is all-or-nothing, so a reachable neighbour in
-    // `dead_prev`'s own nursery block would force-MARK it (#7975,
+    // `dead_key`'s own nursery block would force-MARK it (#7975,
     // `mark_block_persisting_arena_objects`) and the prune would correctly
     // decline — the test would then blame the prune for something it got right.
     let next_keys = crate::arena::arena_alloc_gc_old(64, 8, GC_TYPE_ARRAY) as usize;
     js_shadow_slot_set(0, ptr_bits(next_keys));
     crate::arena::arena_reset_all_blocks_to_zero();
-    let dead_prev = crate::arena::arena_alloc_gc(64, 8, GC_TYPE_ARRAY) as usize;
+    let dead_key = crate::arena::arena_alloc_gc(64, 8, GC_TYPE_STRING) as usize;
+    let prev_shape_id = crate::object::shapes::shape_id_for_keys_ensure(std::ptr::null(), 0);
 
     let occupancy_before = crate::object::test_transition_cache_occupancy();
-    crate::object::test_seed_transition_cache_entry(dead_prev, 0, next_keys);
+    crate::object::test_seed_transition_cache_entry(prev_shape_id, dead_key, next_keys);
     assert_eq!(
         crate::object::test_transition_cache_occupancy(),
         occupancy_before + 1,
@@ -1532,32 +1532,65 @@ fn test_dead_transition_cache_prev_keys_pruned_on_full_gc() {
     assert_eq!(
         crate::object::test_transition_cache_occupancy(),
         occupancy_before,
-        "a transition entry whose prev_keys array died must be dropped, not \
+        "a transition entry whose interned key died must be dropped, not \
          rekeyed out of the bytes that replaced it"
     );
     js_shadow_slot_set(0, 0);
 }
 
+#[test]
+fn test_dead_transition_cache_predecessor_shape_pruned_on_full_gc() {
+    let _guard = CopyingNurseryTestGuard::new(1);
+    gc_register_mutable_root_scanner(crate::object::scan_transition_cache_roots_mut);
+
+    let next_keys = crate::arena::arena_alloc_gc_old(64, 8, GC_TYPE_ARRAY) as usize;
+    js_shadow_slot_set(0, ptr_bits(next_keys));
+    crate::arena::arena_reset_all_blocks_to_zero();
+    let dead_predecessor_keys = crate::arena::arena_alloc_gc(64, 8, GC_TYPE_ARRAY) as usize;
+    let prev_shape_id = crate::object::shapes::shape_id_for_keys_ensure(
+        dead_predecessor_keys as *const crate::ArrayHeader,
+        0,
+    );
+
+    let occupancy_before = crate::object::test_transition_cache_occupancy();
+    crate::object::test_seed_transition_cache_entry(prev_shape_id, 0, next_keys);
+    assert_eq!(
+        crate::object::test_transition_cache_occupancy(),
+        occupancy_before + 1,
+        "test premise: the transition entry must be installed"
+    );
+
+    full_gc();
+
+    assert_eq!(
+        crate::object::test_transition_cache_occupancy(),
+        occupancy_before,
+        "a transition whose predecessor descriptor died must release its rooted target"
+    );
+    js_shadow_slot_set(0, 0);
+}
+
 #[test]
 fn test_live_transition_cache_entry_survives_full_gc() {
-    // Two shadow slots: both halves of the entry have to be rooted.
+    // Two shadow slots: the strong target and weak lookup key both stay live.
     let _guard = CopyingNurseryTestGuard::new(2);
     gc_register_mutable_root_scanner(crate::object::scan_transition_cache_roots_mut);
 
     let next_keys = crate::arena::arena_alloc_gc_old(64, 8, GC_TYPE_ARRAY) as usize;
-    let live_prev = crate::arena::arena_alloc_gc(64, 8, GC_TYPE_ARRAY) as usize;
+    let live_key = crate::arena::arena_alloc_gc(64, 8, GC_TYPE_STRING) as usize;
+    let prev_shape_id = crate::object::shapes::shape_id_for_keys_ensure(std::ptr::null(), 0);
     js_shadow_slot_set(0, ptr_bits(next_keys));
-    js_shadow_slot_set(1, ptr_bits(live_prev));
+    js_shadow_slot_set(1, ptr_bits(live_key));
 
     let occupancy_before = crate::object::test_transition_cache_occupancy();
-    crate::object::test_seed_transition_cache_entry(live_prev, 0, next_keys);
+    crate::object::test_seed_transition_cache_entry(prev_shape_id, live_key, next_keys);
 
     full_gc();
 
     assert_eq!(
         crate::object::test_transition_cache_occupancy(),
         occupancy_before + 1,
-        "an entry whose prev_keys array is still ROOTED must survive"
+        "an entry whose interned key is still ROOTED must survive"
     );
     js_shadow_slot_set(0, 0);
     js_shadow_slot_set(1, 0);

crates/perry-runtime/src/object/field_set_by_name.rs

@@ -26,7 +26,11 @@ pub use attr_variants::{
     js_object_set_field_by_name_nonconfigurable, js_object_set_field_by_name_nonenum,
 };
 pub use fast_paths::js_object_set_field_by_name_transition_fast;
-pub(crate) use fast_paths::try_existing_own_data_overwrite;
+pub(crate) use fast_paths::{
+    object_set_field_by_name_transition_only_fast, try_existing_own_data_overwrite,
+};
+#[cfg(test)]
+pub(crate) use fast_paths::{test_reset_transition_fast_hits, test_transition_fast_hits};
 pub(crate) use tail::set_field_by_name_object_tail;
 pub(crate) use write_helpers::nm_field_set_override;
 use write_helpers::string_key_eq;
@@ -162,13 +166,10 @@ pub extern "C" fn js_object_set_field_by_name(
                         && !super::prototype_chain::object_has_prototype_override(raw)
                         && super::prop_plan::store_plan_check(class_id, key as usize)
                     {
-                        let keys = crate::object::object_keys_array(o);
-                        let keys_ok = keys.is_null()
-                            || (((keys as u64) >> 48) == 0
-                                && crate::value::addr_class::is_above_handle_band(keys as usize));
-                        if keys_ok {
-                            if let Some((next_keys, slot_idx)) =
-                                transition_cache_lookup(keys as usize, key)
+                        let prev_shape_id = super::shapes::object_shape_stamp(o);
+                        if prev_shape_id != 0 {
+                            if let Some((next_keys, slot_idx, target_shape_id)) =
+                                transition_cache_lookup(prev_shape_id, key)
                             {
                                 // Same store semantics as the in-body fast
                                 // path: strip a raw-null POINTER_TAG value,
@@ -182,8 +183,14 @@ pub extern "C" fn js_object_set_field_by_name(
                                 } else {
                                     vbits
                                 };
-                                set_object_keys_array(o, next_keys as *mut ArrayHeader);
-                                super::mark_object_dynamic_shape_unknown(o);
+                                if !super::shapes::install_cached_object_shape_transition(
+                                    o,
+                                    prev_shape_id,
+                                    target_shape_id,
+                                    next_keys as *mut ArrayHeader,
+                                ) {
+                                    set_object_keys_array(o, next_keys as *mut ArrayHeader);
+                                }
                                 // #8113: one bound probe, reused.
                                 let live_slots = crate::object::object_live_slot_count(o);
                                 let alloc_limit = std::cmp::max(

crates/perry-runtime/src/object/field_set_by_name/fast_paths.rs

@@ -5,6 +5,21 @@
 
 use super::*;
 
+#[cfg(test)]
+thread_local! {
+    static TEST_TRANSITION_FAST_HITS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+pub(crate) fn test_reset_transition_fast_hits() {
+    TEST_TRANSITION_FAST_HITS.with(|hits| hits.set(0));
+}
+
+#[cfg(test)]
+pub(crate) fn test_transition_fast_hits() -> u64 {
+    TEST_TRANSITION_FAST_HITS.with(std::cell::Cell::get)
+}
+
 /// Non-allocating-in-the-GC-heap overwrite for an existing own data field.
 ///
 /// This is the common assignment case for ordinary objects.  It is deliberately
@@ -132,15 +147,40 @@ pub(crate) unsafe fn try_existing_own_data_overwrite(
 ///
 /// This is intentionally narrower than `js_object_set_field_by_name`: it only
 /// handles plain object-shape transitions that have already been learned by
-/// the runtime transition cache. Accessors/descriptors, frozen/sealed objects,
-/// class/prototype receivers, closures, native handles, arrays, strings, and
-/// cache misses return 0 so callers preserve the full setter semantics by
+/// the runtime transition cache. In addition to class-id-zero objects, HIR's
+/// registered anonymous-shape classes qualify: they are the runtime backing
+/// for source-level object literals and have ordinary `Object.prototype`
+/// semantics. User class instances, accessors/descriptors, frozen/sealed
+/// objects, prototype overrides, closures, native handles, arrays, strings,
+/// and cache misses return 0 so callers preserve the full setter semantics by
 /// falling back to `js_object_set_field_by_name`.
 #[no_mangle]
 pub extern "C" fn js_object_set_field_by_name_transition_fast(
     obj: *mut ObjectHeader,
     key: *const crate::StringHeader,
     value: f64,
+) -> i32 {
+    object_set_field_by_name_transition_fast_impl(obj, key, value, true)
+}
+
+/// Transition-only form for callers that already own a complete semantic
+/// fallback. If `key` is an existing property, no append edge can exist for
+/// `(current_keys, key)`, so the lookup returns 0 and the caller performs the
+/// ordinary write. Skipping the up-front linear overwrite scan is important
+/// for repeated computed-key object construction.
+pub(crate) fn object_set_field_by_name_transition_only_fast(
+    obj: *mut ObjectHeader,
+    key: *const crate::StringHeader,
+    value: f64,
+) -> i32 {
+    object_set_field_by_name_transition_fast_impl(obj, key, value, false)
+}
+
+fn object_set_field_by_name_transition_fast_impl(
+    obj: *mut ObjectHeader,
+    key: *const crate::StringHeader,
+    value: f64,
+    try_overwrite: bool,
 ) -> i32 {
     if key.is_null() || (key as usize) < 0x10000 {
         return 0;
@@ -174,7 +214,7 @@ pub extern "C" fn js_object_set_field_by_name_transition_fast(
         return 0;
     }
 
-    if unsafe { try_existing_own_data_overwrite(obj, key, value) } {
+    if try_overwrite && unsafe { try_existing_own_data_overwrite(obj, key, value) } {
         return 1;
     }
 
@@ -219,21 +259,26 @@ pub extern "C" fn js_object_set_field_by_name_transition_fast(
         let key_gc =
             (key as *const u8).sub(crate::gc::GC_HEADER_SIZE) as *const crate::gc::GcHeader;
 
-        // The append-transition half below is intentionally restricted to
-        // class-id-zero plain objects. Existing own-data overwrites were
-        // already handled by `try_existing_own_data_overwrite` before the
-        // rooting scope.
-        if (*obj).class_id != 0 {
+        // Closed source-level object literals are represented as synthetic
+        // `__AnonShape_*` classes so their static fields can use the same
+        // ShapeId machinery as class instances. Semantically they are still
+        // plain objects: codegen registers their class ids at module init and
+        // prototype/constructor dispatch already treats them as having
+        // ordinary Object semantics. Admit exactly that registered population
+        // alongside genuinely class-id-zero objects; a real user class must
+        // retain the full inherited-setter/prototype walk.
+        let class_id = (*obj).class_id;
+        if class_id != 0 && !crate::object::is_anon_shape_class_id(class_id) {
             return 0;
         }
 
         // #6084 item 6: this used to be a `GLOBAL_DESCRIPTORS_IN_USE` check at
         // the top of the function — one `Object.freeze` anywhere in the process
         // (even on an unrelated object) permanently disabled this fast path for
         // every object. Vet the receiver's own flag (above) and its prototype
-        // chain (here) instead. `class_id` is 0 at this point, so the only
-        // inherited interceptor is `Object.prototype` (or a recorded
-        // `setPrototypeOf` target).
+        // chain (here) instead. Pass semantic class id zero for an anon shape:
+        // its nonzero runtime id is an implementation detail, not a JS class
+        // whose vtable/prototype chain can carry instance accessors.
         let key_f64 = f64::from_bits(JSValue::string_ptr(key as *mut _).bits());
         if super::plain_data_write_may_intercept(obj as usize, 0, key_f64) {
             return 0;
@@ -255,24 +300,36 @@ pub extern "C" fn js_object_set_field_by_name_transition_fast(
         obj = obj_handle.get_raw_mut_ptr::<ObjectHeader>();
         let value = value_handle.get_nanbox_f64();
 
-        let keys = crate::object::object_keys_array(obj);
-        let prev_keys = keys as usize;
-        if !keys.is_null() {
-            let keys_ptr = keys as usize;
-            if (keys_ptr as u64) >> 48 != 0 || keys_ptr < 0x10000 {
-                return 0;
-            }
-        }
-
-        let Some((next_keys, slot_idx)) = transition_cache_lookup(prev_keys, interned_key) else {
+        let prev_shape_id = super::shapes::object_shape_stamp(obj);
+        let Some((next_keys, slot_idx, target_shape_id)) =
+            transition_cache_lookup(prev_shape_id, interned_key)
+        else {
             return 0;
         };
         if next_keys == 0 {
             return 0;
         }
 
-        set_object_keys_array(obj, next_keys as *mut ArrayHeader);
-        super::mark_object_dynamic_shape_unknown(obj);
+        // `Object.prototype[<index>]` must reach the ordinary setter so it can
+        // invalidate array hole/OOB guards through
+        // `note_object_prototype_index_write`. A canonical index must start
+        // with an ASCII digit, so named transitions avoid the prototype TLS
+        // lookup entirely. Probe only after a cache hit; ordinary misses
+        // already take the semantic fallback.
+        let key_starts_with_digit =
+            (*key).byte_len != 0 && (*crate::string::string_data(key)).is_ascii_digit();
+        if key_starts_with_digit && crate::array::object_prototype_addr_matches(obj as usize) {
+            return 0;
+        }
+
+        if !super::shapes::install_cached_object_shape_transition(
+            obj,
+            prev_shape_id,
+            target_shape_id,
+            next_keys as *mut ArrayHeader,
+        ) {
+            set_object_keys_array(obj, next_keys as *mut ArrayHeader);
+        }
 
         // #8113: one bound probe, reused.
         let live_slots = crate::object::object_live_slot_count(obj);
@@ -294,7 +351,67 @@ pub extern "C" fn js_object_set_field_by_name_transition_fast(
         } else {
             overflow_set(obj as usize, slot_usize, vbits);
         }
+
+        #[cfg(test)]
+        TEST_TRANSITION_FAST_HITS.with(|hits| hits.set(hits.get() + 1));
     }
 
     1
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn transition_fast_rejects_object_prototype_even_with_a_cached_edge() {
+        let _lock = crate::gc::global_side_table_test_lock();
+        let scope = crate::gc::RuntimeHandleScope::new();
+        let prototype = crate::array::object_prototype_addr() as *mut ObjectHeader;
+        assert!(!prototype.is_null(), "test premise: Object.prototype");
+        let prototype_handle = scope.root_raw_mut_ptr(prototype);
+
+        let raw_key = crate::string::js_string_from_bytes(b"879400001".as_ptr(), 9);
+        let raw_key_handle = scope.root_string_ptr(raw_key);
+        let raw_key = raw_key_handle.get_raw_const_ptr::<crate::StringHeader>();
+        let key = crate::string::js_string_intern(raw_key, key_content_hash(raw_key));
+        let key_handle = scope.root_string_ptr(key);
+
+        let prototype = prototype_handle.get_raw_mut_ptr::<ObjectHeader>();
+        let predecessor = unsafe { super::super::shapes::object_shape_stamp(prototype) };
+        assert!(
+            super::super::shapes::is_shape_id(predecessor),
+            "test premise: Object.prototype has a resolvable ShapeId"
+        );
+        let old_keys = unsafe { super::super::object_keys_array(prototype) };
+        let next_keys = crate::array::js_array_clone(old_keys);
+        let slot = crate::array::js_array_length(next_keys);
+        let next_keys = crate::array::js_array_push(
+            next_keys,
+            crate::JSValue::string_ptr(key_handle.get_raw_mut_ptr()),
+        );
+        let next_keys_handle = scope.root_raw_mut_ptr(next_keys);
+        let next_keys = next_keys_handle.get_raw_mut_ptr::<ArrayHeader>();
+        let target = super::super::shapes::shape_descriptor_ensure(
+            next_keys,
+            slot + 1,
+            unsafe { super::super::object_live_slot_count(prototype) }.max(slot + 1),
+        )
+        .expect("shape range unexpectedly exhausted");
+        let key = key_handle.get_raw_const_ptr::<crate::StringHeader>();
+        super::super::transition_cache_insert(predecessor, key, next_keys as usize, slot, target);
+        assert!(
+            super::super::transition_cache_lookup(predecessor, key).is_some(),
+            "test premise: the synthetic transition must be cache-resident"
+        );
+
+        test_reset_transition_fast_hits();
+        assert_eq!(
+            object_set_field_by_name_transition_only_fast(prototype, key, 42.0),
+            0,
+            "Object.prototype must use the setter that records indexed writes"
+        );
+        assert_eq!(test_transition_fast_hits(), 0);
+        super::super::test_clear_transition_cache_root();
+    }
+}