perf: plain function constructors and instanceof from shape facts (#10507)

changelog.d/11787-function-constructors.md

@@ -0,0 +1,15 @@
+Plain function constructors are cheap (#10507). A function body the compiler
+emitted now carries `FN_COMPILED_BODY` in its info, so `new F()` and
+`x instanceof F` decide once per body that `F` is an ordinary function and skip
+the built-in, bound, proxy and native-module probes. A construction replays the
+birth record kept on `F.prototype` (class id and birth ShapeId) instead of
+three hash lookups and two shape interns; `F.prototype` is read through the
+function's ShapeId. `x instanceof F` is one shape compare when `x`'s ShapeId
+names `F.prototype`, and otherwise OrdinaryHasInstance's prototype walk, so an
+object created before `F.prototype` was reassigned is no longer reported as an
+instance. `instanceof` on a bound function now answers for its target. A
+method call whose name a class also declares sends receivers of no such class
+to the method site rather than the by-name dispatcher, so methods on a
+function's prototype are called directly. Repro (instructions per op):
+`new F()` 5,048 -> ~1,150, `x instanceof F` 2,809 -> ~430, decimal.js-shaped
+`x.plus(i)` 15,848 -> ~4,300.

crates/perry-abi/src/lib.rs

@@ -348,6 +348,13 @@ pub const FN_HAS_DECLARED: u32 = 1 << 11;
 /// Dylib bodies omit this bit: a shape must not retain their info address
 /// beyond `dlclose` or mistake a reused address for the same body.
 pub const FN_PERMANENT_IMAGE: u32 = 1 << 12;
+/// The compiler emitted this body from JavaScript source (every info
+/// `perry-codegen` renders carries it; no runtime-native info does). A
+/// function object on such a body is never a built-in, bound, native-module
+/// or class constructor, so its `[[Construct]]` and `instanceof` are the
+/// ordinary ones: the runtime decides that from this bit, once per body,
+/// instead of probing the callee against every built-in on each use.
+pub const FN_COMPILED_BODY: u32 = 1 << 13;
 
 /// Byte offsets of the fields codegen emits and emitted code reads.
 pub const JS_FUNCTION_INFO_CODE_OFFSET: usize = 0;

crates/perry-codegen/src/fn_info.rs

@@ -25,9 +25,9 @@
 use std::collections::{BTreeMap, BTreeSet};
 
 use crate::runtime_abi::{
-    FN_ARROW, FN_ASYNC, FN_ASYNC_GENERATOR, FN_GENERATOR, FN_HAS_DECLARED, FN_HAS_LENGTH,
-    FN_PERMANENT_IMAGE, FN_REST_SYNTHETIC_ARGUMENTS, FN_REST_USER, FN_REST_USER_AND_ARGUMENTS,
-    FN_STRICT,
+    FN_ARROW, FN_ASYNC, FN_ASYNC_GENERATOR, FN_COMPILED_BODY, FN_GENERATOR, FN_HAS_DECLARED,
+    FN_HAS_LENGTH, FN_PERMANENT_IMAGE, FN_REST_SYNTHETIC_ARGUMENTS, FN_REST_USER,
+    FN_REST_USER_AND_ARGUMENTS, FN_STRICT,
 };
 
 /// The LLVM type of a `JsFunctionInfo`, field for field (perry-abi's
@@ -235,7 +235,9 @@ fn render_definition(
         ty = INFO_TYPE,
         params = saturate_u16(def.params as u64),
         rest = facts.rest_fixed,
+        // Every body this renders is compiled source (`FN_COMPILED_BODY`).
         flags = facts.flags
+            | FN_COMPILED_BODY
             | if permanent_image {
                 FN_PERMANENT_IMAGE
             } else {
@@ -288,7 +290,7 @@ mod tests {
             vec![format!(
                 "@perry_closure_m__3$info = internal constant {INFO_TYPE} {{ ptr @perry_closure_m__3, \
                  i16 2, i16 1, i32 {}, i32 1, i32 0, ptr null, i64 0, ptr null, i32 0, i16 0, i16 0, i64 0 }}",
-                FN_REST_USER | FN_HAS_LENGTH | FN_ARROW
+                FN_REST_USER | FN_HAS_LENGTH | FN_ARROW | FN_COMPILED_BODY
             )]
         );
     }
@@ -299,8 +301,11 @@ mod tests {
         state.request("perry_closure_m__3");
         let transient = state.render_globals(|_| defined(0, "internal"), [], false);
         let permanent = state.render_globals(|_| defined(0, "internal"), [], true);
-        assert!(transient[0].contains("i32 0, i32 0"));
-        assert!(permanent[0].contains(&format!("i32 {FN_PERMANENT_IMAGE}, i32 0")));
+        assert!(transient[0].contains(&format!("i32 {FN_COMPILED_BODY}, i32 0")));
+        assert!(permanent[0].contains(&format!(
+            "i32 {}, i32 0",
+            FN_PERMANENT_IMAGE | FN_COMPILED_BODY
+        )));
     }
 
     #[test]
@@ -323,7 +328,7 @@ mod tests {
         );
         assert!(lines[0].starts_with(&format!("@{} = hidden constant", info_symbol(body))));
         assert!(lines[0].contains(&format!("ptr @{body}")));
-        assert!(lines[0].contains(&format!("i32 {FN_PERMANENT_IMAGE}")));
+        assert!(lines[0].contains(&format!("i32 {}", FN_PERMANENT_IMAGE | FN_COMPILED_BODY)));
     }
 
     #[test]

crates/perry-codegen/src/lower_call/property_get/dynamic_dispatch.rs

@@ -432,6 +432,7 @@ pub(crate) fn try_lower_instance_method_call(
                     Vec::new()
                 };
             let mut shape_probe_cid: Option<String> = None;
+            let mut site_arm: Option<(String, String)> = None;
             if !shape_probe_arms.is_empty() {
                 let (cid, shape_id) =
                     crate::lower_call::method_override::emit_inline_direct_method_shape_probe(
@@ -464,6 +465,43 @@ pub(crate) fn try_lower_instance_method_call(
                     blk.cond_br(&exact, &probe_dispatch_label, &miss_label);
                 }
                 ctx.current_block = own_idx;
+                // #10507: a receiver whose class id names no implementor
+                // (a plain object, a function-constructed instance, a
+                // primitive) can only reach the tower's default. It takes the
+                // universal method site instead — own and inherited entries
+                // call the body directly, and its miss is the same by-name
+                // dispatch — with no own-property probe call first.
+                let site_idx = ctx.new_block("idisp.site");
+                let own_call_idx = ctx.new_block("idisp.own_probe_call");
+                let site_label = ctx.block_label(site_idx);
+                let own_call_label = ctx.block_label(own_call_idx);
+                {
+                    let blk = ctx.block();
+                    let mut implementor_hit: Option<String> = None;
+                    for (class_id, _) in implementors.iter() {
+                        let eq = blk.icmp_eq(I32, &cid, &class_id.to_string());
+                        implementor_hit = Some(match implementor_hit {
+                            None => eq,
+                            Some(prev) => blk.or(I1, &prev, &eq),
+                        });
+                    }
+                    let hit = implementor_hit.unwrap_or_else(|| "false".to_string());
+                    blk.cond_br(&hit, &own_call_label, &site_label);
+                }
+                ctx.current_block = site_idx;
+                let v_site = crate::lower_call::console_promise::emit_native_method_str_dispatch(
+                    ctx,
+                    property,
+                    call_byte_offset,
+                    &recv_box,
+                    &static_user_args,
+                );
+                let after_site = ctx.block().label.clone();
+                if !ctx.block().is_terminated() {
+                    ctx.block().br(&probe_outer_merge_label);
+                }
+                site_arm = Some((v_site, after_site));
+                ctx.current_block = own_call_idx;
             }
 
             let own_method_probe = ctx.block().call(
@@ -792,13 +830,14 @@ pub(crate) fn try_lower_instance_method_call(
 
             // Outer merge: phi over override and dispatch values.
             ctx.current_block = probe_outer_merge_idx;
-            let v_probe_phi = ctx.block().phi(
-                DOUBLE,
-                &[
-                    (v_override_probe.as_str(), after_override_probe.as_str()),
-                    (v_dispatch_phi.as_str(), after_dispatch_phi.as_str()),
-                ],
-            );
+            let mut outer_inputs: Vec<(&str, &str)> = vec![
+                (v_override_probe.as_str(), after_override_probe.as_str()),
+                (v_dispatch_phi.as_str(), after_dispatch_phi.as_str()),
+            ];
+            if let Some((v_site, after_site)) = site_arm.as_ref() {
+                outer_inputs.push((v_site.as_str(), after_site.as_str()));
+            }
+            let v_probe_phi = ctx.block().phi(DOUBLE, &outer_inputs);
             // The release has to post-dominate BOTH arms of the override probe
             // and every case block of the tower, which is why this group is
             // `open_rooted_group` and the release sits in the outer merge.

crates/perry-runtime/src/closure/dispatch.rs

@@ -42,7 +42,7 @@ pub use calln::{
 };
 pub use direct::{DirectCall1, DirectCall2, DirectCall3, DirectCall4};
 
-pub(crate) use value_call::native_call_value_this;
+pub(crate) use value_call::{call_compiled_closure_this, native_call_value_this};
 pub use value_call::{
     js_closure_call_apply_with_spread, js_closure_call_array, js_native_call_value,
 };

crates/perry-runtime/src/closure/dispatch/value_call.rs

@@ -206,6 +206,39 @@ unsafe fn native_call_value_this_impl(
         }
         return crate::object::js_new_function_construct(func_value, args_ptr, args_len);
     }
+    call_closure_body(closure, info, func_ptr, this, args_ptr, args_len)
+}
+
+/// Call `closure` — a compiled ordinary function body (`FN_COMPILED_BODY`),
+/// which none of the exotic callees [`js_native_call_value`] tests first
+/// (class refs, proxies, bound native exports, no-op-backed built-ins,
+/// class objects) can carry — with receiver `this` (#10507).
+///
+/// # Safety
+/// `closure` is a live closure whose info carries `FN_COMPILED_BODY`;
+/// `args_ptr` holds `args_len` values.
+pub(crate) unsafe fn call_compiled_closure_this(
+    closure: *const ClosureHeader,
+    this: crate::closure::JsThis,
+    args_ptr: *const f64,
+    args_len: usize,
+) -> f64 {
+    let info = crate::closure::closure_info(closure);
+    let func_ptr = info.map_or(std::ptr::null(), |info| info.code);
+    call_closure_body(closure, info, func_ptr, this, args_ptr, args_len)
+}
+
+/// The arity-padding / rest-bundling tail of a value call, once the callee is
+/// known to be a closure with a body.
+#[inline(always)]
+unsafe fn call_closure_body(
+    closure: *const ClosureHeader,
+    info: Option<&crate::closure::JsFunctionInfo>,
+    func_ptr: *const u8,
+    this: crate::closure::JsThis,
+    args_ptr: *const f64,
+    args_len: usize,
+) -> f64 {
     let dispatch_args_len = match info {
         Some(info) if crate::closure::info_rest(info).is_none() => {
             args_len.max(usize::from(info.params))

crates/perry-runtime/src/closure/mod.rs

@@ -61,12 +61,12 @@ pub(crate) use registry::{
     info_versioned_loop_direct,
 };
 
-pub(crate) use dispatch::native_call_value_this;
 pub(crate) use dispatch::{
     bound_function_lazy_name, bound_function_length, bound_method_source_func_ptr,
     coerce_call_this, rebind_explicit_this, rebind_explicit_this_allocates,
     reify_function_method_value, reset_throw_not_callable_counter,
 };
+pub(crate) use dispatch::{call_compiled_closure_this, native_call_value_this};
 pub use dispatch::{
     clean_closure_ptr, dispatch_bound_function, dispatch_bound_method, get_valid_func_ptr,
     get_valid_info, js_closure_call0, js_closure_call1, js_closure_call10, js_closure_call11,

crates/perry-runtime/src/closure/shape.rs

@@ -423,6 +423,93 @@ fn keyed_shape_lacks_key(id: u32, key: &[u8]) -> bool {
     }
 }
 
+/// The function's own `prototype` value, read through its ShapeId (#10507):
+/// `Some(Some(v))` the value, `Some(None)` no own `prototype` yet (a base
+/// shape: nothing materialized it), `None` the shape does not say (a
+/// FunctionDictionary or class function object, or a key outside the inline
+/// slots) and the caller asks the bag.
+///
+/// A keyed Function shape is minted from the bag's ordinary descriptor
+/// (`refresh_closure_shape`), so its key list and live inline bound are the
+/// bag's: the slot of `prototype` is a fact of the immutable id, cached per
+/// agent like the intrinsic verdicts above. `prototype` of a function is a
+/// non-configurable data property, so the slot always holds its value.
+///
+/// # Safety
+/// `closure` is a proven, live closure cell.
+#[inline]
+pub(crate) unsafe fn closure_own_prototype_by_shape(
+    closure: *const ClosureHeader,
+) -> Option<Option<f64>> {
+    let id = (*closure).shape_id;
+    let slot = (id as usize).wrapping_mul(0x9E37_79B9) >> 26 & (VERDICT_CACHE_LEN - 1);
+    // SAFETY: this agent's own cell; no reference to it outlives the read.
+    let cached = PROTOTYPE_SLOT_CACHE.with(|c| (*c.as_ptr())[slot]);
+    let index = if cached.0 == id && id != 0 {
+        cached.1
+    } else {
+        let index = prototype_slot_of_shape(closure, id);
+        PROTOTYPE_SLOT_CACHE.with(|c| (*c.as_ptr())[slot] = (id, index));
+        index
+    };
+    match index {
+        PROTOTYPE_SLOT_UNKNOWN => None,
+        PROTOTYPE_SLOT_ABSENT => Some(None),
+        index => {
+            let bag = (*closure).props;
+            debug_assert!(!bag.is_null(), "a keyed Function shape has a bag");
+            let fields = (bag as *const u8).add(std::mem::size_of::<crate::object::ObjectHeader>())
+                as *const u64;
+            Some(Some(f64::from_bits(*fields.add(index as usize))))
+        }
+    }
+}
+
+const PROTOTYPE_SLOT_UNKNOWN: u32 = u32::MAX;
+const PROTOTYPE_SLOT_ABSENT: u32 = u32::MAX - 1;
+
+crate::perry_thread_local! {
+    /// Per-agent cache of Function ShapeIds' inline slot of `prototype`
+    /// ([`closure_own_prototype_by_shape`]); ShapeIds are never reused, so an
+    /// entry can only go unused, never wrong.
+    static PROTOTYPE_SLOT_CACHE: std::cell::Cell<[(u32, u32); VERDICT_CACHE_LEN]> =
+        const { std::cell::Cell::new([(0, 0); VERDICT_CACHE_LEN]) };
+}
+
+/// The inline slot of `prototype` the Function ShapeId `id` describes, or
+/// one of the two markers.
+#[cold]
+#[inline(never)]
+unsafe fn prototype_slot_of_shape(closure: *const ClosureHeader, id: u32) -> u32 {
+    if id == function_dictionary_shape() || is_class_info((*closure).info) {
+        return PROTOTYPE_SLOT_UNKNOWN;
+    }
+    let Some(descriptor) = shapes::shape_descriptor_by_id(id) else {
+        return PROTOTYPE_SLOT_UNKNOWN;
+    };
+    if descriptor.object_kind != ShapeObjectKind::Function {
+        return PROTOTYPE_SLOT_UNKNOWN;
+    }
+    if descriptor.keys == 0 || descriptor.logical_key_count == 0 {
+        return PROTOTYPE_SLOT_ABSENT;
+    }
+    let keys = descriptor.keys as usize as *const crate::array::ArrayHeader;
+    match crate::object::keys_find_slot_by_bytes_resolved(
+        keys,
+        descriptor.logical_key_count,
+        b"prototype",
+    ) {
+        None => PROTOTYPE_SLOT_ABSENT,
+        Some(index)
+            if (index as u32) < descriptor.live_inline_slot_count
+                && !crate::object::key_attrs::key_is_accessor_at(keys, index as u32) =>
+        {
+            index as u32
+        }
+        Some(_) => PROTOTYPE_SLOT_UNKNOWN,
+    }
+}
+
 /// Raw kind probe for a pointer the caller has already range/band-checked
 /// (the successor of the old `*(ptr + 12) == CLOSURE_MAGIC` read, with the
 /// same safety contract): the GC header's type byte says CLOSURE and the

crates/perry-runtime/src/object/alloc_basic.rs

@@ -122,6 +122,42 @@ fn object_alloc_with_parent_impl(
     }
 }
 
+/// An object born on a known birth shape: `class_id`, `field_count` live
+/// inline slots (all `undefined`), stamped `shape_id` — a keyless ShapeId
+/// minted for exactly that class and bound (#10507's prototype birth
+/// record), so no descriptor is derived from the object.
+pub(crate) fn object_alloc_born(
+    class_id: u32,
+    field_count: u32,
+    shape_id: u32,
+) -> *mut ObjectHeader {
+    let alloc_field_count = std::cmp::max(field_count as usize, crate::object::INLINE_SLOT_FLOOR);
+    let total_size =
+        std::mem::size_of::<ObjectHeader>() + alloc_field_count * std::mem::size_of::<JSValue>();
+    let ptr = arena_alloc_gc(total_size, 8, crate::gc::GC_TYPE_OBJECT) as *mut ObjectHeader;
+    unsafe {
+        (*ptr).class_id = class_id;
+        (*ptr).parent_class_id = 0;
+        // GC_STORE_AUDIT(INIT): fresh object starts with no per-object meta record (#6759 B).
+        (*ptr).meta = ptr::null_mut();
+        let fields_ptr = (ptr as *mut u8).add(std::mem::size_of::<ObjectHeader>()) as *mut JSValue;
+        for i in 0..alloc_field_count {
+            // GC_STORE_AUDIT(INIT): freshly allocated object field slot is initialized pointer-free.
+            ptr::write(fields_ptr.add(i), JSValue::undefined());
+        }
+        crate::gc::layout_init_pointer_free(ptr as *mut u8);
+        if crate::arena::pointer_in_nursery(ptr as usize) {
+            // A nursery newborn: no proof to retire, nobody inherits from it
+            // and no old-generation carrier to note — the stamp is the store.
+            // GC_STORE_AUDIT(POINTER_FREE): a ShapeId, never a heap reference.
+            (*ptr).parent_class_id = shape_id;
+        } else {
+            crate::object::shapes::stamp_object_shape_id_with_carrier_note(ptr, shape_id);
+        }
+    }
+    ptr
+}
+
 /// Fast object allocation using bump allocator - NO field initialization
 /// This is significantly faster for hot paths where constructor immediately sets all fields
 /// Returns a pointer to the object header with UNINITIALIZED fields

crates/perry-runtime/src/object/class_registry.rs

@@ -49,6 +49,7 @@ mod construct;
 #[cfg(feature = "regex-engine")]
 pub(crate) use construct::construct_two_rooted;
 pub(crate) use construct::{construct_rooted_arguments, scan_current_new_target_root_mut};
+pub(crate) use construct::{ordinary_compiled_function_has_instance, OrdinaryInstanceof};
 mod decl_accessors;
 pub(crate) use decl_accessors::{
     class_chain_getter_value, class_chain_setter_apply, decl_prototype_own_accessor,
@@ -163,10 +164,10 @@ pub use prototype_methods::{
 
 // ── construct.rs / vm_brand.rs ──────────────────────────────────────────────
 pub(crate) use construct::{
-    extends_target_must_throw, is_callable_function_value, js_value_is_constructor,
-    lookup_own_prototype_method, lookup_prototype_method, nm_ctor_child_process, nm_ctor_cluster,
-    nm_ctor_fs, nm_ctor_readline, nm_ctor_repl, nm_ctor_stream, nm_ctor_tls, nm_ctor_tty,
-    nm_ctor_vm, nm_ctor_wasi, promise_parent_in_chain,
+    bound_function_target_value, extends_target_must_throw, is_callable_function_value,
+    js_value_is_constructor, lookup_own_prototype_method, lookup_prototype_method,
+    nm_ctor_child_process, nm_ctor_cluster, nm_ctor_fs, nm_ctor_readline, nm_ctor_repl,
+    nm_ctor_stream, nm_ctor_tls, nm_ctor_tty, nm_ctor_vm, nm_ctor_wasi, promise_parent_in_chain,
 };
 pub use construct::{
     js_ctor_return_override, js_new_function_construct, js_new_function_construct_apply,