perf(array): serve the object keys walk from the array's own words (#7768)

The object field-get funnel already proves `keys` is a live `GC_TYPE_ARRAY` and
caps the index below its capacity, then called `js_array_get` per key — which
re-establishes both facts from scratch: a `clean_arr_ptr` forwarding walk, a
lazy-header probe, the exotic-receiver classifications and a descriptor-flag
read. That funnel was 78% of all `js_array_get_f64` samples on
`gc-handoff/apps/asyncpipe_big.ts`. `keys_array_len_capped_to_capacity` paid the
same toll through `js_array_length` once per property read.

`keys_array_slot` serves the dense, descriptor-free, non-forwarded case from the
array's own words and delegates everything else — a hole, an out-of-range index,
a forwarded or descriptor-carrying array, a null pointer — so no general
semantics move. A test-only per-thread fallback counter pins both directions, so
a fast path that stopped applying and one that started swallowing a shape it
should have delegated are equally red.

Also switches the #7768 receiver-tag read to `addr_class::try_read_gc_header`:
this file's usual `>= GC_HEADER_SIZE + 0x1000` floor sits BELOW the handle band,
and `js_array_length` reaches it before proxy/handle receivers are routed. Keeps
the addr-class ratchet green too.

Author: Ralph Küpper

crates/perry-runtime/src/array/collection_tag_tests.rs

@@ -216,6 +216,65 @@ fn a_stale_registry_entry_over_recycled_bytes_does_not_read_as_a_map() {
     assert_eq!(js_map_size(map), 3);
 }
 
+/// `keys_array_slot` must be the general getter, minus the work the field-get
+/// funnel already did — and must refuse every shape it cannot serve on those
+/// terms rather than guess. Both directions are asserted against the fallback
+/// counter, so "stopped applying" and "started swallowing" are equally red.
+#[test]
+fn keys_array_slot_matches_the_general_getter_and_delegates_what_it_cannot_serve() {
+    let dense_keys = dense(&[10.0, 20.0, 30.0]);
+
+    let before = crate::array::test_keys_array_slot_fallbacks();
+    for i in 0..3u32 {
+        let fast = unsafe { crate::array::keys_array_slot(dense_keys, i) };
+        let general = crate::array::js_array_get(dense_keys, i);
+        assert_eq!(
+            fast.bits(),
+            general.bits(),
+            "slot {i} must read identically through both paths"
+        );
+    }
+    assert_eq!(
+        crate::array::test_keys_array_slot_fallbacks(),
+        before,
+        "a dense, descriptor-free keys array is exactly what the fast path \
+         exists for — it must not delegate"
+    );
+
+    // Out of range, and a hole, both delegate: the general getter walks the
+    // prototype chain for those and the dense words cannot answer.
+    let before = crate::array::test_keys_array_slot_fallbacks();
+    let oob = unsafe { crate::array::keys_array_slot(dense_keys, 7) };
+    assert_eq!(oob.bits(), crate::array::js_array_get(dense_keys, 7).bits());
+    assert_eq!(
+        crate::array::test_keys_array_slot_fallbacks(),
+        before + 1,
+        "an out-of-range index must reach the general getter"
+    );
+
+    let holey = js_array_alloc_with_length(3);
+    js_array_set_f64(holey, 1, 42.0);
+    let before = crate::array::test_keys_array_slot_fallbacks();
+    let hole = unsafe { crate::array::keys_array_slot(holey, 0) };
+    assert_eq!(hole.bits(), crate::array::js_array_get(holey, 0).bits());
+    assert_eq!(
+        crate::array::test_keys_array_slot_fallbacks(),
+        before + 1,
+        "a HOLE reads through the prototype chain, so it must delegate"
+    );
+    let filled = unsafe { crate::array::keys_array_slot(holey, 1) };
+    assert_eq!(filled.bits(), crate::array::js_array_get(holey, 1).bits());
+
+    // A null / low pointer must delegate rather than dereference.
+    let before = crate::array::test_keys_array_slot_fallbacks();
+    let _ = unsafe { crate::array::keys_array_slot(std::ptr::null(), 0) };
+    assert_eq!(
+        crate::array::test_keys_array_slot_fallbacks(),
+        before + 1,
+        "a null keys pointer must delegate, never be dereferenced"
+    );
+}
+
 /// The invariant the whole gate rests on: a registered collection's address IS
 /// its `arena_alloc_gc` header, so its `obj_type` is a complete answer.
 ///

crates/perry-runtime/src/array/header.rs

@@ -94,16 +94,15 @@ pub(crate) fn array_object_flags(arr: *const ArrayHeader) -> u16 {
 /// stopped being true when they moved into the managed arena.
 #[inline]
 pub(crate) fn array_receiver_gc_tag(arr: *const ArrayHeader) -> (u8, u16) {
-    if (arr as usize) < crate::gc::GC_HEADER_SIZE + 0x1000 {
-        return (0, 0);
-    }
-    // SAFETY: the same `arr - GC_HEADER_SIZE` read `clean_arr_ptr` performs on
-    // this pointer (forwarding chain, lazy/object rejection), under the same
-    // magnitude guard.
-    unsafe {
-        let gc_header =
-            (arr as *const u8).sub(crate::gc::GC_HEADER_SIZE) as *const crate::gc::GcHeader;
-        ((*gc_header).obj_type, (*gc_header)._reserved)
+    // `try_read_gc_header` rather than this file's usual
+    // `>= GC_HEADER_SIZE + 0x1000` floor: that floor sits BELOW the handle
+    // band, and `js_array_length` reaches here before its proxy/handle
+    // receivers have been routed. The canonical predicate rejects the bands
+    // without touching memory, and rejecting an address the old floor would
+    // have read costs nothing — a handle is not a Map either way.
+    match unsafe { crate::value::addr_class::try_read_gc_header(arr as usize) } {
+        Some(header) => (header.obj_type, header._reserved),
+        None => (0, 0),
     }
 }
 

crates/perry-runtime/src/array/indexing.rs

@@ -545,6 +545,20 @@ fn array_get_property_by_key(arr: *const ArrayHeader, key: *const crate::StringH
 /// FOR DENSE KEYS/PROPERTY ARRAYS ONLY — general JS arrays may have
 /// `length > capacity` (sparse), where this cap would be incorrect.
 pub(crate) unsafe fn keys_array_len_capped_to_capacity(arr: *const ArrayHeader) -> usize {
+    // #7768: a well-formed dense keys array answers from its own two words.
+    // `js_array_length` re-derives the same number through a proxy probe, a
+    // second header read for its lazy/object arms, and a `clean_arr_ptr`
+    // forwarding walk — once per property read on the field-get funnel.
+    // `length <= capacity` is exactly the well-formed case; the sparse and
+    // corrupted shapes this cap exists for fall through unchanged.
+    if let Some(header) = crate::value::addr_class::try_read_gc_header(arr as usize) {
+        if header.obj_type == crate::gc::GC_TYPE_ARRAY
+            && header.gc_flags & crate::gc::GC_FLAG_FORWARDED == 0
+            && (*arr).length <= (*arr).capacity
+        {
+            return (*arr).length as usize;
+        }
+    }
     let raw = js_array_length(arr) as usize;
     if arr.is_null() {
         raw
@@ -553,6 +567,66 @@ pub(crate) unsafe fn keys_array_len_capped_to_capacity(arr: *const ArrayHeader)
     }
 }
 
+/// Read slot `index` of a dense internal keys/property array.
+///
+/// The object field-get funnel has already proved `keys` is a live
+/// `GC_TYPE_ARRAY` — it reads the `GcHeader` and returns `undefined` otherwise
+/// — and has capped `index` below the array's own capacity (see
+/// [`keys_array_len_capped_to_capacity`]). Those are precisely the two facts
+/// [`js_array_get_f64`] re-establishes from scratch on every call: a
+/// `clean_arr_ptr` forwarding walk, a lazy-header probe, the exotic-receiver
+/// classifications and a descriptor-flag read — per key examined, per property
+/// read. On `gc-handoff/apps/asyncpipe_big.ts` that one funnel was 78% of all
+/// `js_array_get_f64` samples.
+///
+/// Falls back to the general getter for anything it cannot serve on those
+/// terms — a forwarded array (which `clean_arr_ptr` would relocate), one
+/// carrying index descriptors, an out-of-range index, or a hole (which reads
+/// through the prototype chain) — so no general semantics move. Keys arrays
+/// are dense and descriptor-free, so the fallback is the cold arm.
+#[inline]
+pub(crate) unsafe fn keys_array_slot(
+    keys: *const ArrayHeader,
+    index: u32,
+) -> crate::value::JSValue {
+    if let Some(header) = crate::value::addr_class::try_read_gc_header(keys as usize) {
+        if header.obj_type == crate::gc::GC_TYPE_ARRAY
+            && header.gc_flags & crate::gc::GC_FLAG_FORWARDED == 0
+            && header._reserved & crate::gc::OBJ_FLAG_ARRAY_DESCRIPTORS == 0
+            && index < (*keys).length
+            && index < (*keys).capacity
+        {
+            let elements =
+                (keys as *const u8).add(std::mem::size_of::<ArrayHeader>()) as *const f64;
+            let raw = std::ptr::read(elements.add(index as usize));
+            if raw.to_bits() != crate::value::TAG_HOLE {
+                return crate::value::JSValue::from_bits(raw.to_bits());
+            }
+        }
+    }
+    #[cfg(test)]
+    KEYS_ARRAY_SLOT_FALLBACKS.with(|c| c.set(c.get().wrapping_add(1)));
+    crate::array::js_array_get(keys, index)
+}
+
+/// Times [`keys_array_slot`] could NOT serve a slot from the dense words and
+/// had to delegate. Asserted in both directions by
+/// `array::collection_tag_tests` — zero for the dense keys arrays the fast path
+/// exists for, non-zero for every shape it must refuse — so a fast path that
+/// silently stopped applying, or one that started swallowing a shape it should
+/// have delegated, both go red.
+/// Per THREAD — `cargo test` runs every case on its own thread in one process,
+/// so a process-global counter would be moved by whatever else is running.
+#[cfg(test)]
+thread_local! {
+    static KEYS_ARRAY_SLOT_FALLBACKS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+pub(crate) fn test_keys_array_slot_fallbacks() -> u64 {
+    KEYS_ARRAY_SLOT_FALLBACKS.with(|c| c.get())
+}
+
 /// Auto-opt dead-strip anchor: codegen emits a bare `js_array_length` symbol in
 /// native-region wrappers (`__perry_wrap_*`) and elsewhere, so it must be a
 /// `#[no_mangle]` C export AND survive dead-stripping even when no Rust caller

crates/perry-runtime/src/array/mod.rs

@@ -105,7 +105,7 @@ pub use self::immutable::{
 pub(crate) use self::indexing::{
     array_has_own_index, array_iteration_is_exotic, array_proto_iterator_modified,
     array_prototype_addr, array_prototype_has_index_flag, array_spec_get, array_spec_has_index,
-    invalidate_array_index_fast_path, keys_array_len_capped_to_capacity,
+    invalidate_array_index_fast_path, keys_array_len_capped_to_capacity, keys_array_slot,
     note_array_proto_iterator_write, note_object_prototype_index_write, object_prototype_addr,
     object_prototype_addr_matches, object_prototype_has_index_flag,
     PERRY_ARRAY_INDEX_FAST_PATH_INVALIDATED,
@@ -120,7 +120,9 @@ pub use self::indexing::{
     scan_prototype_addr_cache_roots_mut,
 };
 #[cfg(test)]
-pub(crate) use self::indexing::{test_array_proto_addr_cache, test_object_proto_addr_cache};
+pub(crate) use self::indexing::{
+    test_array_proto_addr_cache, test_keys_array_slot_fallbacks, test_object_proto_addr_cache,
+};
 pub use self::is_array::js_array_is_array;
 pub(crate) use self::iter_methods::throw_reduce_of_empty;
 pub use self::iter_methods::{

crates/perry-runtime/src/map.rs

@@ -196,18 +196,23 @@ fn register_map(ptr: *mut MapHeader, entries: *mut f64, capacity: usize) {
 /// receiver-tag gates (#7768) are asserted against this: a plain-array element
 /// read must not move it. Remove those gates and the assertion fails, which is
 /// the point — a fast path nobody can prove ran is not a fast path.
+///
+/// Per THREAD, not per process: the registries themselves are thread-local, and
+/// `cargo test` runs every case on its own thread in one process, so a global
+/// counter would be moved by whatever else happens to be running.
 #[cfg(test)]
-pub(crate) static TEST_MAP_REGISTRY_PROBES: std::sync::atomic::AtomicU64 =
-    std::sync::atomic::AtomicU64::new(0);
+thread_local! {
+    static TEST_MAP_REGISTRY_PROBES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
 
 #[cfg(test)]
 pub(crate) fn test_map_registry_probe_count() -> u64 {
-    TEST_MAP_REGISTRY_PROBES.load(std::sync::atomic::Ordering::Relaxed)
+    TEST_MAP_REGISTRY_PROBES.with(|c| c.get())
 }
 
 pub fn is_registered_map(addr: usize) -> bool {
     #[cfg(test)]
-    TEST_MAP_REGISTRY_PROBES.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    TEST_MAP_REGISTRY_PROBES.with(|c| c.set(c.get().wrapping_add(1)));
     // #7469: nothing has ever been registered ⟹ nothing can be found. Checked
     // first because it is the only arm that costs neither a thread-local
     // resolution nor a hash.

crates/perry-runtime/src/object/field_get_set/get_field_by_name.rs

@@ -175,7 +175,7 @@ pub extern "C" fn js_object_get_field_by_name(
                                     crate::array::keys_array_len_capped_to_capacity(keys);
                                 if key_count <= 4096 {
                                     for i in 0..key_count {
-                                        let kv = crate::array::js_array_get(keys, i as u32);
+                                        let kv = crate::array::keys_array_slot(keys, i as u32);
                                         if crate::string::js_string_key_matches(kv, key) {
                                             super::super::prop_plan::read_plan_record(
                                                 keys as usize,

crates/perry-runtime/src/object/field_get_set/get_field_by_name_tail.rs

@@ -1601,7 +1601,7 @@ pub(crate) fn get_field_by_name_object_tail(
         if let Some(field_idx) = cached {
             let idx = field_idx as usize;
             let cache_hit_valid = if idx < key_count {
-                let key_val = crate::array::js_array_get(keys, field_idx);
+                let key_val = crate::array::keys_array_slot(keys, field_idx);
                 // #1781: SSO-aware match — pre-fix the `is_string()` here
                 // false-invalidated cache hits for ≤5-byte keys stored
                 // as SHORT_STRING_TAG values.
@@ -1676,7 +1676,7 @@ pub(crate) fn get_field_by_name_object_tail(
         }
 
         for i in 0..key_count {
-            let key_val = crate::array::js_array_get(keys, i as u32);
+            let key_val = crate::array::keys_array_slot(keys, i as u32);
             // #1781: accept inline SSO short keys here too — the
             // slow-path lookup is what backs `obj[k]` for ≤5-byte
             // keys after a field-cache miss.

crates/perry-runtime/src/set.rs

@@ -224,17 +224,18 @@ fn register_set(ptr: *mut SetHeader, elements: *mut f64, capacity: usize) {
 /// Every entry into [`is_registered_set`]. Twin of
 /// `map::TEST_MAP_REGISTRY_PROBES` — see that counter for what it pins down.
 #[cfg(test)]
-pub(crate) static TEST_SET_REGISTRY_PROBES: std::sync::atomic::AtomicU64 =
-    std::sync::atomic::AtomicU64::new(0);
+thread_local! {
+    static TEST_SET_REGISTRY_PROBES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
+}
 
 #[cfg(test)]
 pub(crate) fn test_set_registry_probe_count() -> u64 {
-    TEST_SET_REGISTRY_PROBES.load(std::sync::atomic::Ordering::Relaxed)
+    TEST_SET_REGISTRY_PROBES.with(|c| c.get())
 }
 
 pub fn is_registered_set(addr: usize) -> bool {
     #[cfg(test)]
-    TEST_SET_REGISTRY_PROBES.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    TEST_SET_REGISTRY_PROBES.with(|c| c.set(c.get().wrapping_add(1)));
     // #7469: nothing registered ⟹ nothing to find, without a thread-local
     // resolution or a hash. See `map::is_registered_map` for the pairing.
     if set_registry_never_used() {

scripts/addr_class_allowlist.txt

@@ -151,3 +151,4 @@ crates/perry-runtime/src/child_process/value_util.rs | * | pre-existing GcHeader
 crates/perry-runtime/src/closure/dispatch/ | * | pre-existing GcHeader probe predating addr_class; address validated by call-site guards (magnitude/registry/is_valid_obj_ptr) -- migrate to addr_class::try_read_gc_header in a follow-up (split of closure/dispatch.rs)
 crates/perry-runtime/src/bun_compat/string_width.rs | 0xE0000..=0xE007F | Unicode "Tags" codepoint block (U+E0000..U+E007F) tested against a char, not a handle-band address
 crates/perry-runtime/src/bun_compat/width_tables.rs | * | pure Unicode East-Asian-width codepoint-range table; every hex literal is a Unicode code point (e.g. U+F0000 / U+100000 SPUA-A/B planes), never a handle-band address
+crates/perry-runtime/src/array/collection_tag_tests.rs | * | unit tests for the #7768 receiver-tag gate: they read AND re-stamp `GcHeader.obj_type` on an address they allocated themselves, which is the whole subject under test. `try_read_gc_header` cannot serve them (it hands out a shared reference, and the recycling test must WRITE the tag to model `arena_alloc_gc` handing the bytes to the next owner).