feat(runtime): O(1) object deletes via tombstones (flag-gated; populated delete 6.5x on, -11% off)

changelog.d/9029-object-tombstone-deletes.md

@@ -0,0 +1,44 @@
+O(1) object deletes via tombstones, flag-gated (`PERRY_OBJECT_TOMBSTONES=1`,
+default OFF). With the flag on, `bench_populated_delete` drops
+2089 → **1050 ms (−50%)**, with the combined overwrite and realistic-name-read
+loops unchanged.
+
+`delete obj[k]` on an OWNED keys array (no `GC_FLAG_SHAPE_SHARED` — the same
+authority two existing call sites already trust for the clone-or-mutate
+decision) writes a hole marker over the key slot and clears the value through
+the barriered stores, exactly #9020's Map-tombstone idiom. Survivors keep
+their slots: no value shift, no layout rebuild, no index shift, no live-bound
+update. Tombstones are squeezed out when they reach half the slots, one
+overlap-safe pass mirroring `compact_map_entries`.
+
+**Shape identity per delete is forced, and its lifecycle is the hard part.**
+The per-site dyn-IC ways live in generated-code globals the runtime cannot
+reach, so retiring a deleted key's cached `(token, key) → slot` entries
+requires changing the token itself: every hole-delete publishes a successor id
+(fresh semantic generation + `hole_count`, now part of `ShapeFacts` identity
+and covered by the facts-exhaustiveness test). The first version left every
+predecessor id alive against ONE stable array address — the reverse-index list
+grew per delete and every publish walked it, measuring **26× slower** than the
+compacting delete. Retiring just the direct predecessor halved that;
+delete-then-re-add cycles also mint an id on the APPEND side, so the publish
+now sweeps EVERY stale id for the owned address (each is unreachable the
+moment the header word is restamped; single owner by the same flag the gate
+trusts). With the sweep the flag-on path is 2× faster than flag-off.
+
+Walkers: `js_object_keys`' raw-push fast path, `getOwnPropertyNames`' walk,
+and `JSON.stringify`'s field walk skip the marker explicitly. Note
+`js_array_get` translates `TAG_HOLE` to `undefined` per OrdinaryGet (#323), so
+key walks reading through it must skip BOTH forms — comparing `TAG_HOLE` alone
+was dead code and let holes reach output as JSON `null`; `undefined` is never
+a legal key, so the two-form skip is safe. Every other enumeration path
+resolves keys through `js_string_key_bytes`, which rejects the marker.
+
+Verification: suite 2799 passed, all 60 lint gates pass. Four differentials
+byte-identical to node in BOTH flag states: the enumeration suite
+(keys/values/entries/for-in/stringify/spread/rest across interleaved deletes,
+re-adds, threshold crossings, and overflow-slot objects — this suite caught
+the getOwnPropertyNames and hole-canonicalization bugs), the adversarial
+property suite, the computed-key suite, and the stale-slot suite.
+
+Remaining flag-on cost is the per-delete publish/sweep machinery (~5 µs/op vs
+node's 0.1); reducing that is the follow-up before default-on.

crates/perry-runtime/src/json/stringify.rs

@@ -1244,6 +1244,10 @@ pub(crate) unsafe fn stringify_object_inner(ptr: *const u8, buf: &mut String, de
     };
     for j in 0..actual_fields {
         let f = pos(j);
+        // Tombstoned slot from an O(1) delete: not a key, not serialized.
+        if key_at(f).to_bits() == crate::value::TAG_HOLE {
+            continue;
+        }
         // Private elements (`#x`) live in a class instance's keys_array but are
         // not serializable own properties. (`has_prototype_chain` == class_id != 0.)
         if has_prototype_chain

crates/perry-runtime/src/object/delete_rest.rs

@@ -348,6 +348,60 @@ pub extern "C" fn js_object_delete_field(
         let keys_gc_header =
             (keys as *const u8).sub(crate::gc::GC_HEADER_SIZE) as *const crate::gc::GcHeader;
         let keys_owned = (*keys_gc_header).gc_flags & crate::gc::GC_FLAG_SHAPE_SHARED == 0;
+        // O(1) tombstone delete (flag-gated, #9020's Map pattern applied to
+        // objects). An OWNED keys array can take a hole marker in place of
+        // the deleted key: survivors keep their slots, so nothing shifts, no
+        // layout rebuilds, and the live inline-slot bound is untouched. The
+        // shape publish mints a fresh semantic generation, which is what
+        // retires every cached (token, key) pair for this receiver — a
+        // deleted key must stop hitting even though the array address and
+        // every surviving slot are byte-identical, or a stale IC hit would
+        // return the cleared slot instead of walking the prototype chain.
+        // The read-plan epoch was already bumped at this function's entry.
+        //
+        // Tombstones are squeezed out when they reach half the slots (the
+        // Map threshold), which amortizes compaction to O(1) per delete and
+        // bounds the array at 2x its live size.
+        if keys_owned && object_tombstone_deletes_enabled() {
+            let holes = super::shapes::object_shape_hole_count(obj);
+            let threshold_hit = key_count >= 16 && (holes + 1) * 2 > key_count as u32;
+            if !threshold_hit {
+                let successor = super::shapes::publish_object_shape_holes(obj, holes + 1);
+                if successor != 0 {
+                    let elements = (keys as *mut u8).add(std::mem::size_of::<crate::ArrayHeader>())
+                        as *mut f64;
+                    // Barriered stores, exactly the Map delete's idiom: the
+                    // hole overwrites a key POINTER and the clear overwrites
+                    // the value, so SATB marking must shade both children.
+                    crate::gc::runtime_store_external_jsvalue_slot(
+                        keys as usize,
+                        elements.add(i) as usize,
+                        crate::value::TAG_HOLE,
+                    );
+                    if i < alloc_limit {
+                        let fields_ptr =
+                            (obj as *mut u8).add(std::mem::size_of::<ObjectHeader>()) as *mut u64;
+                        crate::gc::runtime_store_jsvalue_slot(
+                            obj as usize,
+                            fields_ptr.add(i) as usize,
+                            i,
+                            crate::value::TAG_UNDEFINED,
+                        );
+                    } else {
+                        overflow_set(obj as usize, i, crate::value::TAG_UNDEFINED);
+                    }
+                    return 1;
+                }
+                // Unstamped/unshaped receiver: fall through to the
+                // compacting delete below, which needs no shape stamp.
+            } else {
+                // Threshold: squeeze every hole plus this key in one pass,
+                // then continue through the ordinary compaction bookkeeping
+                // is unnecessary — the squeeze does its own.
+                squeeze_holes_and_delete(obj, keys, i, key_count, alloc_limit, field_count);
+                return 1;
+            }
+        }
         let index_migrated = if keys_owned {
             let elements =
                 (keys as *mut u8).add(std::mem::size_of::<crate::ArrayHeader>()) as *mut f64;
@@ -1084,3 +1138,82 @@ mod sso_tests_1781 {
         }
     }
 }
+
+/// Gate for O(1) tombstone deletes (`PERRY_OBJECT_TOMBSTONES=1`). Default OFF
+/// while the walker audit and differentials bake; the sibling Map tombstones
+/// (#9020) shipped default-on after the same sequence.
+fn object_tombstone_deletes_enabled() -> bool {
+    static ON: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *ON.get_or_init(|| {
+        matches!(
+            std::env::var("PERRY_OBJECT_TOMBSTONES").as_deref(),
+            Ok("1") | Ok("on") | Ok("true")
+        )
+    })
+}
+
+/// Threshold compaction for a tombstoned keys array: squeeze every hole AND
+/// the key at `delete_slot` out in one overlap-safe pass, values moved to
+/// match, then republish layout, live bound and shape. The cost equals what
+/// ONE pre-tombstone delete paid, amortized over the deletes that created
+/// the holes — `compact_map_entries`' argument, applied to objects.
+///
+/// # Safety
+/// `obj` live and owned `keys` as its current keys array; `delete_slot <
+/// key_count`; caller already bumped the read-plan epoch.
+unsafe fn squeeze_holes_and_delete(
+    obj: *mut ObjectHeader,
+    keys: *const crate::ArrayHeader,
+    delete_slot: usize,
+    key_count: usize,
+    alloc_limit: usize,
+    field_count: u32,
+) {
+    let keys = keys as *mut crate::ArrayHeader;
+    let elements = (keys as *mut u8).add(std::mem::size_of::<crate::ArrayHeader>()) as *mut f64;
+    let fields_ptr = (obj as *mut u8).add(std::mem::size_of::<ObjectHeader>()) as *mut u64;
+    let mut out = 0usize;
+    for s in 0..key_count {
+        let kv = std::ptr::read(elements.add(s));
+        if s == delete_slot || kv.to_bits() == crate::value::TAG_HOLE {
+            continue;
+        }
+        if out != s {
+            // Keys move DOWN within one buffer (out < s always) — same
+            // overlap argument as `compact_map_entries`.
+            // GC_STORE_AUDIT(EXTERNAL_BARRIERED): the dirty-span barrier after
+            // this loop covers every surviving key slot written here, exactly
+            // as compact_map_entries' squeeze is audited.
+            std::ptr::write(elements.add(out), kv);
+            // Value follows its key. Read through the index path against the
+            // PRE-squeeze bound (the same boundary it was written under),
+            // then store through the barriered inline/overflow split.
+            let v =
+                crate::object::field_get_set::object_field_at_with_live(obj, s as u32, field_count);
+            if out < alloc_limit {
+                crate::gc::runtime_store_jsvalue_slot(
+                    obj as usize,
+                    fields_ptr.add(out) as usize,
+                    out,
+                    v.bits(),
+                );
+            } else {
+                overflow_set(obj as usize, out, v.bits());
+            }
+        }
+        out += 1;
+    }
+    (*keys).length = out as u32;
+    if out > 0 {
+        // GC_STORE_AUDIT(EXTERNAL_BARRIERED): dirty-span barrier over the
+        // compacted key slots, mirroring compact_map_entries.
+        crate::gc::runtime_write_barrier_external_slot_span(keys as usize, elements as usize, out);
+    }
+    super::rebuild_array_layout_from_slots(keys);
+    set_object_live_slot_count(obj, std::cmp::min(out, alloc_limit) as u32);
+    // Slots moved: the per-array key index and any stale descriptors for the
+    // pre-squeeze states are wrong now. Drop the index (rebuilt on demand)
+    // and publish the squeezed shape at hole_count = 0.
+    crate::object::shapes::shape_drop(keys);
+    super::shapes::publish_object_shape_holes(obj, 0);
+}

crates/perry-runtime/src/object/descriptors.rs

@@ -1625,6 +1625,19 @@ fn js_object_get_own_property_names_shape(obj_value: f64) -> f64 {
         let mut sso_buf = [0u8; crate::value::SHORT_STRING_MAX_LEN];
         for i in 0..len {
             let key_val = crate::array::js_array_get(keys, pos(i));
+            // Tombstoned slot from an O(1) delete: not a key. Same raw-push
+            // hole hazard as `js_object_keys`' fast path — this loop emitted
+            // the marker itself (visible as `null` in getOwnPropertyNames).
+            if key_val.bits() == crate::value::TAG_HOLE
+                || key_val.bits() == crate::value::TAG_UNDEFINED
+            {
+                // Tombstoned slot from an O(1) delete. `js_array_get` translates
+                // TAG_HOLE to `undefined` per OrdinaryGet (#323), so the marker
+                // arrives here in EITHER form — and `undefined` is never a legal
+                // key, so both are skips. Comparing TAG_HOLE alone was dead code
+                // and let the hole reach the output as JSON `null`.
+                continue;
+            }
             if hide_private || hide_wasi_state {
                 if let Some(b) = crate::string::js_string_key_bytes(key_val, &mut sso_buf) {
                     if super::field_get_set::is_internal_runtime_key_bytes(b)

crates/perry-runtime/src/object/field_get_set/enumeration.rs

@@ -1302,6 +1302,20 @@ fn js_object_keys_shape(obj: *const ObjectHeader) -> *mut ArrayHeader {
             let out = crate::array::js_array_alloc(len as u32);
             for j in 0..len {
                 let key_val = crate::array::js_array_get(keys, pos(j));
+                // Tombstoned slot from an O(1) delete: not a key. The slow
+                // path below skips holes for free (`js_string_key_bytes`
+                // rejects them); this raw-push path must skip explicitly or
+                // `Object.keys` would emit the hole marker itself.
+                if key_val.bits() == crate::value::TAG_HOLE
+                    || key_val.bits() == crate::value::TAG_UNDEFINED
+                {
+                    // Tombstoned slot from an O(1) delete. `js_array_get` translates
+                    // TAG_HOLE to `undefined` per OrdinaryGet (#323), so the marker
+                    // arrives here in EITHER form — and `undefined` is never a legal
+                    // key, so both are skips. Comparing TAG_HOLE alone was dead code
+                    // and let the hole reach the output as JSON `null`.
+                    continue;
+                }
                 crate::array::js_array_push_f64(out, f64::from_bits(key_val.bits()));
             }
             return out;

crates/perry-runtime/src/object/keys_lookup.rs

@@ -80,12 +80,19 @@ pub(crate) unsafe fn keys_find_slot_by_bytes(
         // (1570 -> 3064 ms measured). Appends maintain the index incrementally
         // (shape_note_append), so stable-shape workloads still hit; churny
         // ones fall back to the raw dense scan below instead of thrashing.
-        if let Some(slot) = shapes::shape_slot_lookup(keys, key_bytes, h, key_count, false) {
-            return Some(slot);
+        match shapes::shape_slot_lookup_verdict(keys, key_bytes, h, key_count, false) {
+            shapes::KeysIndexVerdict::Found(slot) => return Some(slot),
+            // A COMPLETE index (indexed_len == key_count) proves absence:
+            // every present key is indexed, holes index as nothing, and a
+            // stale bucket entry for a tombstoned key fails its content
+            // validation without disproving completeness. Skipping the
+            // backstop here is what makes tombstone-delete churn cheap — the
+            // re-add's find-before-append otherwise linear-scanned up to 2x
+            // the live keys per delete (60.4% of the flag-on
+            // bench_populated_delete profile in one symbol).
+            shapes::KeysIndexVerdict::Absent => return None,
+            shapes::KeysIndexVerdict::Unindexed => {}
         }
-        // A miss from a fully built index is authoritative in the common case,
-        // but the index can decline (shrunk arrays, partial builds); the raw
-        // scan below is cheap enough to serve as the correctness backstop.
     }
     let (slots, slot_len) = keys_array_dense_slots(keys);
     if slots.is_null() {