perf(object): keep populated-delete ICs stable per key

changelog.d/9064-stable-delete-ic.md

@@ -0,0 +1,13 @@
+### perf(runtime,codegen): keep populated-delete ICs stable per key
+
+Owned ordinary objects now keep one ShapeId across tombstone delete/re-add
+epochs. Read and write IC hits validate the cached value slot against
+`TAG_HOLE`, while a guarded re-add lane appends the key to preserve enumeration
+order and re-primes both megamorphic caches. Squeeze still publishes a fresh
+immutable shape, and flag-off in-place compaction retires growth-era prefix
+tokens before shifting keys.
+
+On Linux, a min-of-seven interleaved run of `bench_popdel.ts` against the exact
+main tip improves from 329 ms to 57 ms (Node: 21 ms, Perry: 2.71x Node), while
+the six #9029 differentials remain byte-identical in both tombstone modes.
+Fixes #9064.

crates/perry-codegen/src/expr/class_field_inline_guard.rs

@@ -47,11 +47,13 @@ const GC_TYPE_OBJECT: &str = "2";
 const GC_FLAG_FORWARDED_I8: &str = "-128"; // 0x80 as i8
 const TYPED_LAYOUT_INTACT_BIT: &str = "4096"; // GC_OBJ_TYPED_LAYOUT_INTACT (0x1000)
 const OBJ_FLAG_FROZEN_BIT: &str = "1"; // OBJ_FLAG_FROZEN (0x01)
-const OBJ_FLAG_HAS_DESCRIPTORS_BIT: &str = "2048"; // OBJ_FLAG_HAS_DESCRIPTORS (0x800)
 const OBJ_FLAG_PACKED_NUMERIC_PROOF_BIT: &str = "128"; // OBJ_FLAG_PACKED_NUMERIC_PROOF (0x080)
-/// `OBJ_FLAG_FROZEN | OBJ_FLAG_HAS_DESCRIPTORS | OBJ_FLAG_PACKED_NUMERIC_PROOF`
-/// — all live in the same `GcHeader::_reserved` i16, so one mask tests them.
-const OBJ_FLAG_WRITE_FAST_PATH_BLOCKED: &str = "2177";
+/// `OBJ_FLAG_HAS_DESCRIPTORS | OBJ_FLAG_STABLE_TOMBSTONES`.
+const OBJ_FLAG_READ_FAST_PATH_BLOCKED: &str = "3072";
+/// `OBJ_FLAG_FROZEN | OBJ_FLAG_STABLE_TOMBSTONES |
+/// OBJ_FLAG_HAS_DESCRIPTORS | OBJ_FLAG_PACKED_NUMERIC_PROOF` — all live in the
+/// same `GcHeader::_reserved` i16, so one mask tests them.
+const OBJ_FLAG_WRITE_FAST_PATH_BLOCKED: &str = "3201";
 const F64_EXP_MASK: &str = "9218868437227405312"; // 0x7FF0_0000_0000_0000
 
 /// A widening arm for the class-field shape check: one concrete subclass whose
@@ -298,9 +300,9 @@ pub(crate) fn emit_class_field_loop_preheader_check(
         // gate, so the hoisted check must vet the per-object flag — once, for
         // the whole loop: installing a descriptor mid-loop would require a
         // runtime call, which the call-free fast clone cannot make.
-        let has_desc = blk.and(I16, &reserved, OBJ_FLAG_HAS_DESCRIPTORS_BIT);
-        let no_desc = blk.icmp_eq(I16, &has_desc, "0");
-        acc = blk.and(I1, &acc, &no_desc);
+        let blocked = blk.and(I16, &reserved, OBJ_FLAG_READ_FAST_PATH_BLOCKED);
+        let unblocked = blk.icmp_eq(I16, &blocked, "0");
+        acc = blk.and(I1, &acc, &unblocked);
 
         if require_raw_f64 {
             let intact = blk.and(I16, &reserved, TYPED_LAYOUT_INTACT_BIT);
@@ -536,9 +538,9 @@ pub(crate) fn emit_class_field_inline_precheck(
         // process-global gate above stay open for such installs (only
         // prototype-level descriptors flip it), so unrelated instances keep the
         // fast path.
-        let has_desc = blk.and(I16, &reserved, OBJ_FLAG_HAS_DESCRIPTORS_BIT);
-        let no_desc = blk.icmp_eq(I16, &has_desc, "0");
-        acc = blk.and(I1, &acc, &no_desc);
+        let blocked = blk.and(I16, &reserved, OBJ_FLAG_READ_FAST_PATH_BLOCKED);
+        let unblocked = blk.icmp_eq(I16, &blocked, "0");
+        acc = blk.and(I1, &acc, &unblocked);
 
         if require_raw_f64 {
             // The slot is read/written as a raw double, so the per-object typed

crates/perry-codegen/src/expr/property_get/composed_ics.rs

@@ -54,10 +54,12 @@ pub(super) fn lower_symbol_then_named_property_ic(
 
         let identity_idx = ctx.new_block("symfield.identity");
         let hit_idx = ctx.new_block("symfield.hit");
+        let live_idx = ctx.new_block("symfield.live");
         let miss_idx = ctx.new_block("symfield.miss");
         let merge_idx = ctx.new_block("symfield.merge");
         let identity_label = ctx.block_label(identity_idx);
         let hit_label = ctx.block_label(hit_idx);
+        let live_label = ctx.block_label(live_idx);
         let miss_label = ctx.block_label(miss_idx);
         let merge_label = ctx.block_label(merge_idx);
 
@@ -105,18 +107,25 @@ pub(super) fn lower_symbol_then_named_property_ic(
         ctx.block().cond_br(&hit, &hit_label, &miss_label);
 
         ctx.current_block = hit_idx;
-        crate::expr::emit_typed_feedback_record_call(
-            ctx.block(),
-            "js_typed_feedback_record_guard_pass",
-            &[(I64, &feedback_site_id)],
-        );
         let cached_slot_ptr = ctx.block().gep(I64, &field_cache, &[(I64, "1")]);
         let cached_slot = ctx.block().load(I64, &cached_slot_ptr);
         let slot_bytes = ctx.block().shl(I64, &cached_slot, "3");
         let fields_base = ctx.block().add(I64, &intermediate_handle, "16");
         let field_addr = ctx.block().add(I64, &fields_base, &slot_bytes);
         let field_ptr = ctx.block().inttoptr(I64, &field_addr);
         let hit_value = ctx.block().load(DOUBLE, &field_ptr);
+        let hit_bits = ctx.block().bitcast_double_to_i64(&hit_value);
+        let deleted = ctx
+            .block()
+            .icmp_eq(I64, &hit_bits, crate::nanbox::TAG_HOLE_I64);
+        ctx.block().cond_br(&deleted, &miss_label, &live_label);
+
+        ctx.current_block = live_idx;
+        crate::expr::emit_typed_feedback_record_call(
+            ctx.block(),
+            "js_typed_feedback_record_guard_pass",
+            &[(I64, &feedback_site_id)],
+        );
         let hit_end = ctx.block().label.clone();
         ctx.block().br(&merge_label);
 

crates/perry-codegen/src/expr/property_get/generic_dispatch.rs

@@ -367,6 +367,7 @@ pub(crate) fn lower_generic_property_get(
     // through phis (`false`/`0` on the early-exit edges, which is exactly
     // what the flat predicate computed there).
     let hit_idx = ctx.new_block("pic.hit");
+    let hit_live_idx = ctx.new_block("pic.hit.live");
     let prefix_guard_idx = ctx.new_block("pic.prefix.guard");
     let prefix_meta_idx = ctx.new_block("pic.prefix.meta");
     let prefix_token_idx = ctx.new_block("pic.prefix.token");
@@ -384,6 +385,7 @@ pub(crate) fn lower_generic_property_get(
     let call_idx = ctx.new_block("pic.miss.call");
     let merge_idx = ctx.new_block("pic.merge");
     let hit_label = ctx.block_label(hit_idx);
+    let hit_live_label = ctx.block_label(hit_live_idx);
     let prefix_guard_label = ctx.block_label(prefix_guard_idx);
     let prefix_meta_label = ctx.block_label(prefix_meta_idx);
     let prefix_token_label = ctx.block_label(prefix_token_idx);
@@ -548,11 +550,6 @@ pub(crate) fn lower_generic_property_get(
     ctx.current_block = hit_idx;
     let cache_slot_ptr = ctx.block().gep(I64, &cache_ref, &[(I64, "1")]);
     let slot = ctx.block().load(I64, &cache_slot_ptr);
-    crate::expr::emit_typed_feedback_record_call(
-        ctx.block(),
-        "js_typed_feedback_record_guard_pass",
-        &[(I64, &feedback_site_id)],
-    );
     let offset = ctx.block().shl(I64, &slot, "3");
     // arm64_32 watchOS: the object fields region begins at
     // `size_of::<ObjectHeader>()` past the user pointer — 16 on LP64 and
@@ -563,6 +560,19 @@ pub(crate) fn lower_generic_property_get(
     let field_addr = ctx.block().add(I64, &base, &offset);
     let field_ptr = ctx.block().inttoptr(I64, &field_addr);
     let val_hit = ctx.block().load(DOUBLE, &field_ptr);
+    let val_hit_bits = ctx.block().bitcast_double_to_i64(&val_hit);
+    let hit_deleted = ctx
+        .block()
+        .icmp_eq(I64, &val_hit_bits, crate::nanbox::TAG_HOLE_I64);
+    ctx.block()
+        .cond_br(&hit_deleted, &call_label, &hit_live_label);
+
+    ctx.current_block = hit_live_idx;
+    crate::expr::emit_typed_feedback_record_call(
+        ctx.block(),
+        "js_typed_feedback_record_guard_pass",
+        &[(I64, &feedback_site_id)],
+    );
     let hit_end_label = ctx.block().label.clone();
     ctx.block().br(&merge_label);
 
@@ -834,7 +844,9 @@ pub(crate) fn lower_generic_property_get(
         .expect("PIC_WAYS is non-zero, so the reduction leaves exactly one lane");
     way_hit = ctx.block().and(I1, &way_hit, &way_any);
     let way_load_idx = ctx.new_block("pic.way.load");
+    let way_live_idx = ctx.new_block("pic.way.live");
     let way_load_label = ctx.block_label(way_load_idx);
+    let way_live_label = ctx.block_label(way_live_idx);
     ctx.block().cond_br(&way_hit, &way_load_label, &call_label);
 
     ctx.current_block = way_load_idx;
@@ -843,6 +855,14 @@ pub(crate) fn lower_generic_property_get(
     let way_field_addr = ctx.block().add(I64, &way_base, &way_offset);
     let way_field_ptr = ctx.block().inttoptr(I64, &way_field_addr);
     let val_way = ctx.block().load(DOUBLE, &way_field_ptr);
+    let val_way_bits = ctx.block().bitcast_double_to_i64(&val_way);
+    let way_deleted = ctx
+        .block()
+        .icmp_eq(I64, &val_way_bits, crate::nanbox::TAG_HOLE_I64);
+    ctx.block()
+        .cond_br(&way_deleted, &call_label, &way_live_label);
+
+    ctx.current_block = way_live_idx;
     let way_end_label = ctx.block().label.clone();
     ctx.block().br(&merge_label);
 

crates/perry-codegen/src/expr/proxy_reflect.rs

@@ -46,6 +46,10 @@ use super::{
     lower_expr, nanbox_pointer_inline, unbox_str_handle, unbox_to_i64, FnCtx,
 };
 
+#[path = "proxy_reflect_write_ic.rs"]
+mod proxy_reflect_write_ic;
+use proxy_reflect_write_ic::StableTombstoneSlotCheck;
+
 /// Runtime write-PIC flags that force the miss path. Class-vs-instance kind is
 /// encoded by the authoritative ShapeId and therefore owns no header flag.
 // Includes the packed Array-subclass numeric-proof authority bit (0x80).
@@ -530,6 +534,9 @@ fn lower_put_value_static_write_ic(
     let dispatch4_idx = ctx.new_block("put.pic.dispatch4");
     let dispatch5_idx = ctx.new_block("put.pic.dispatch5");
     let hit_idx = ctx.new_block("put.pic.hit");
+    let hit_slot_check =
+        StableTombstoneSlotCheck::new(ctx, "put.pic.hit.validate", "put.pic.hit.store");
+    let deleted_idx = ctx.new_block("put.pic.deleted");
     let miss_idx = ctx.new_block("put.pic.miss");
     let miss2_idx = ctx.new_block("put.pic.miss2");
     let miss3_idx = ctx.new_block("put.pic.miss3");
@@ -545,6 +552,7 @@ fn lower_put_value_static_write_ic(
     let dispatch4_label = ctx.block_label(dispatch4_idx);
     let dispatch5_label = ctx.block_label(dispatch5_idx);
     let hit_label = ctx.block_label(hit_idx);
+    let deleted_label = ctx.block_label(deleted_idx);
     let miss_label = ctx.block_label(miss_idx);
     let miss2_label = ctx.block_label(miss2_idx);
     let miss3_label = ctx.block_label(miss3_idx);
@@ -728,6 +736,12 @@ fn lower_put_value_static_write_ic(
         let field_ptr = blk.inttoptr(I64, &field_addr);
         (field_ptr, field_addr)
     };
+    // A stable tombstone keeps the receiver token unchanged, so the selected
+    // slot needs one liveness check. Keep the extra load entirely off ordinary
+    // objects: their already-loaded `_reserved` word takes the direct store
+    // edge, preserving the hot write path.
+    hit_slot_check.emit(ctx, &reserved, &field_ptr, &deleted_label);
+    hit_slot_check.enter_live(ctx);
     if pointer_possible {
         let slot_i32 = ctx.block().trunc(I64, &selected_slot, I32);
         // The one behavioural difference from the `_aware` emitter this
@@ -796,8 +810,23 @@ fn lower_put_value_static_write_ic(
     ctx.block().br(&merge_label);
     let hit_end_label = ctx.block().label.clone();
 
-    ctx.current_block = miss_idx;
+    ctx.current_block = deleted_idx;
     let strict_i32 = if strict { "1" } else { "0" };
+    let deleted_value = ctx.block().call(
+        DOUBLE,
+        "js_put_value_set_ic_miss",
+        &[
+            (DOUBLE, &target_value),
+            (I64, &key_handle),
+            (DOUBLE, &stored_value),
+            (I32, strict_i32),
+            (PTR, &cache_ref),
+        ],
+    );
+    let deleted_end_label = ctx.block().label.clone();
+    ctx.block().br(&merge_label);
+
+    ctx.current_block = miss_idx;
     let miss_value = ctx.block().call(
         DOUBLE,
         "js_put_value_set_ic_miss",
@@ -877,6 +906,7 @@ fn lower_put_value_static_write_ic(
         DOUBLE,
         &[
             (&stored_value, &hit_end_label),
+            (&deleted_value, &deleted_end_label),
             (&miss_value, &miss_end_label),
             (&miss2_value, &miss2_end_label),
             (&miss3_value, &miss3_end_label),
@@ -942,6 +972,8 @@ fn lower_put_value_dyn_ic_inline(
     let way1_idx = ctx.new_block("put.dynic.way1");
     let way2_idx = ctx.new_block("put.dynic.way2");
     let store_idx = ctx.new_block("put.dynic.store");
+    let store_slot_check =
+        StableTombstoneSlotCheck::new(ctx, "put.dynic.store.validate", "put.dynic.store.dispatch");
     let store_scalar_idx = ctx.new_block("put.dynic.store.scalar");
     let store_ref_idx = ctx.new_block("put.dynic.store.ref");
     let slow_idx = ctx.new_block("put.dynic.slow");
@@ -1046,6 +1078,8 @@ fn lower_put_value_dyn_ic_inline(
     let slot_off = ctx.block().add(I64, &slot_bytes, &header_bytes);
     let obj_ptr = ctx.block().inttoptr(I64, &t_handle);
     let slot_ptr = ctx.block().gep_inbounds(I8, &obj_ptr, &[(I64, &slot_off)]);
+    store_slot_check.emit(ctx, &reserved, &slot_ptr, &slow_label);
+    store_slot_check.enter_live(ctx);
     ctx.block()
         .cond_br(&v_scalar, &store_scalar_label, &store_ref_label);
 

crates/perry-codegen/src/expr/proxy_reflect_write_ic.rs

@@ -0,0 +1,69 @@
+//! Stable-tombstone slot validation shared by the static and dynamic write ICs.
+//!
+//! A stable-tombstone receiver deliberately keeps its ShapeId while deletes
+//! leave `TAG_HOLE` in individual slots. Both write ICs therefore need the
+//! same cold validation diamond before their ordinary direct-store block.
+
+use crate::types::{DOUBLE, I16, I64};
+
+use super::FnCtx;
+
+/// Runtime `OBJ_FLAG_STABLE_TOMBSTONES`. The bit is already present in each
+/// generated write guard's `_reserved` load; on a hit it gates the one deleted
+/// slot check required while the receiver keeps a stable ShapeId (#9064).
+const STABLE_TOMBSTONES_OBJ_FLAG: u16 = 0x400;
+
+pub(super) struct StableTombstoneSlotCheck {
+    validate_idx: usize,
+    live_idx: usize,
+    validate_label: String,
+    live_label: String,
+}
+
+impl StableTombstoneSlotCheck {
+    /// Create the cold validation block followed by the ordinary live-slot
+    /// continuation, preserving the caller's basic-block creation order.
+    pub(super) fn new(ctx: &mut FnCtx<'_>, validate_name: &str, live_name: &str) -> Self {
+        let validate_idx = ctx.new_block(validate_name);
+        let live_idx = ctx.new_block(live_name);
+        Self {
+            validate_idx,
+            live_idx,
+            validate_label: ctx.block_label(validate_idx),
+            live_label: ctx.block_label(live_idx),
+        }
+    }
+
+    /// Branch ordinary receivers straight to the direct store. Stable-
+    /// tombstone receivers first prove that the cached slot is still live.
+    pub(super) fn emit(
+        &self,
+        ctx: &mut FnCtx<'_>,
+        reserved: &str,
+        slot_ptr: &str,
+        deleted_label: &str,
+    ) {
+        let stable_tombstones =
+            ctx.block()
+                .and(I16, reserved, &STABLE_TOMBSTONES_OBJ_FLAG.to_string());
+        let needs_slot_validation = ctx.block().icmp_ne(I16, &stable_tombstones, "0");
+        ctx.block().cond_br(
+            &needs_slot_validation,
+            &self.validate_label,
+            &self.live_label,
+        );
+
+        ctx.current_block = self.validate_idx;
+        let old_value = ctx.block().load(DOUBLE, slot_ptr);
+        let old_bits = ctx.block().bitcast_double_to_i64(&old_value);
+        let deleted = ctx
+            .block()
+            .icmp_eq(I64, &old_bits, crate::nanbox::TAG_HOLE_I64);
+        ctx.block()
+            .cond_br(&deleted, deleted_label, &self.live_label);
+    }
+
+    pub(super) fn enter_live(&self, ctx: &mut FnCtx<'_>) {
+        ctx.current_block = self.live_idx;
+    }
+}