perf(hir): hoist a loop-invariant property array out of counted loops (20.6 → 0.50 ns, now beats node) - #9149

What

for (let i = 0; i < holder.arr.length; i++) … holder.arr[i] … re-did the property lookup on every iteration, and — worse — never entered the packed-array machinery at all, because that matcher requires the array expression to be a bare local. Writing the hoist by hand (const a = holder.arr;) was worth 27×, which told us the ceiling before any code was written. This HIR pass reaches it automatically.

Numbers

Quiet Mac mini, node v26.5.1, ns/op, medians of 3. Both perry columns are the same binary, switched with PERRY_LOOP_PROPERTY_HOIST, so this is an A/B of the pass and not of two builds:

The module-global row goes from 37× slower than node to faster than node, and the local-receiver row from 6.3× slower to faster. The control row is flat, which is the point: it was already hoisted by hand, so the pass has nothing to do there.

The bottom two rows are deliberately untouched — a parameter or an aliased capture is not a const x = { … } binding, so the data-property proof below does not cover them. Both are follow-ups; the captured row looks reachable by propagating the proof through const aliases, while a parameter needs a real runtime guard, since an annotated { arr: number[] } can be satisfied by an object with a getter.

Why it is sound

Three checks, all made before rewriting:

1. The property is a data field. Only receivers bound by const x = { … } whose initializer lowered to a closed-shape record class qualify; is_closed_shape already rejects getters and setters, so reading such a field cannot run user code.
2. Nothing can rebind the receiver. Any assignment to it anywhere in the loop refuses the rewrite. This one cannot be delegated to a runtime check: two objects from the same literal share a shape, so a shape guard would happily accept the stale array.
3. Nothing can write the property. Calls, closures, new, property writes and index writes all refuse, as does any construct the scan does not positively recognise.

The check that matters most is #1, and it is keyed on the initializer, not the binding's type. Keying it on the type is both non-functional and unsound, in opposite directions: const holder = { arr, n } infers as a structural Object(ObjectType) rather than Named("__AnonShape_…"), so a type check never fires at all — the pass shipped as a silent no-op in my first build — while an annotated structural object type can still be backed by an accessor, so where a type check did fire it could be wrong. The initializer is the only place the accessor question is actually settled.

Doing this in HIR rather than codegen dissolves two hazards by construction rather than by argument: the hoisted value is an ordinary Stmt::Let, so it is GC-tracked exactly like any other local — no cached raw pointer and no rooting question — and the transform is invisible to the later loop-cloning passes.

Tests

crates/perry/tests/loop_property_array_hoist.rs compiles each program twice, hoist on and off, and asserts both print the same thing; running the kill-switch build against the same expectation is what makes it a test of equivalence rather than of the hoisted path alone. Both builds run under PERRY_GC_FORCE_EVACUATE / PERRY_GC_VERIFY_EVACUATION, since "the temp is GC-tracked like any other local" deserves proof.

Most cases pin refusals, which is the half a regression would break silently: receiver rebound mid-loop to a same-shaped object (510, not 60), a call that overwrites the property, a getter receiver whose five invocations must all survive, and a direct write to the property. Plus an array grown during iteration, nested loops, string elements, and an empty array. Every expected value was checked against node first — one of them was wrong when I wrote it by hand.

Binary size

size(1) .text on the benchmark: 10,963,348 → 10,963,028, i.e. −320 bytes (−0.003%) across 2 hoisted sites, ≈ −160 bytes per site. The pass replaces a per-iteration by-name lookup and its IC-miss path with a single load, so it removes code rather than adding it.

Kill switch

PERRY_LOOP_PROPERTY_HOIST=0 restores the previous lowering.

Gates

-D warnings clean; perry-hir 587/0; perry-codegen 1835/0; perry-runtime lib 2822/0 (--test-threads=1); shape-descriptor census, address-classification audit, file-size and raw-handle-debt lints all pass with no ceiling raised. Integration: the new suite 7/7, plus issue_8655_array_subclass_indexing 2/2, issue_8690_loop_versioned_arraylike 3/3 and issue_8897_field_push_writeback 3/3 — the three suites that own the loop and array-admission paths this pass feeds.

Follow-ups

• A const alias (const h = holder) inherits the proof, which also reaches receivers read inside a closure since the capture keeps the same LocalId; that covers the captured row above.
• The safety scan currently refuses any loop containing a nested loop or a return, both of which recurse soundly.
• A parameter receiver needs an actual runtime guard, since { arr: number[] } can be satisfied by an object with a getter.

Summary by CodeRabbit

• Performance

  • Improved counted loops that repeatedly access stable array properties by reusing the property value when it is safe to do so.
  • Automatically avoids the optimization when code could change the receiver or property, including getters, writes, and function calls.
  • Added an option to disable this optimization when needed.

• Bug Fixes

  • Preserved correct behavior for nested loops, changing arrays, empty arrays, and string elements.

• Tests

  • Added coverage verifying identical results with optimization enabled and disabled, including memory-management scenarios.