perf: stop re-entering the runtime to append to and pop from an Array subclass's own elements store (−9.5% / −11.4%)

changelog.d/8984-private-field-updates.md

@@ -0,0 +1,7 @@
+Private class fields now preserve their value under compound and logical
+assignments instead of reading `undefined` and storing `NaN`.
+
+Private fields no longer occupy public class-shape keys, so they stay absent
+from `Object.keys`, `Object.getOwnPropertyNames`, `for...in`, spread, and JSON
+serialization. An ordinary property whose name matches Perry's transient
+private-member routing spelling is now retained as ordinary user data.

changelog.d/8985-elements-lean-push-pop.md

@@ -0,0 +1,4 @@
+### Changed
+
+- Appending to and popping from a `class X extends Array` instance no longer re-classifies its own elements store: an in-capacity append and a non-hole tail pop run without a handle scope, a proxy probe, forwarding-stub cleaning or flag resolution, keeping only the element bookkeeping the read tiers and the loop guard consume. Growth, holes, an empty store and every exotic flag keep the complete runtime entry.
+- `sub.pop()` on such an instance now pops inline as well: the codegen tier resolves the payload through the meta record and runs the same length/read/take blocks on it, instead of calling the runtime entry that only re-derives the store.

crates/perry-codegen/src/codegen/mod.rs

@@ -1164,15 +1164,17 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         // first (walking from deepest ancestor down) so the slot
         // order matches `class_field_global_index`'s assumption.
         let mut packed_keys = String::new();
-        // Skip computed-key fields (`[Symbol.for("k")] = …`): their key is an
-        // expression evaluated at runtime, not a stable string, so they don't
-        // get an inline slot. Including their synthetic `__computed_field_*`
-        // names in the packed keys would surface them as enumerable own
-        // properties via Object.keys() and inflate the inline-slot count.
-        // Their values are stored via `apply_field_initializers_recursive`'s
-        // IndexSet path → js_object_set_field / js_object_set_symbol_property.
+        // Skip computed-key fields (`[Symbol.for("k")] = …`) and private
+        // fields. Computed keys are evaluated at construction time; private
+        // fields live in class-id-qualified runtime storage installed by
+        // `js_private_field_add`. Neither is a public inline shape key.
+        // Including either synthetic/source spelling in packed keys leaks it
+        // through reflection and inflates/misaligns the inline-slot layout.
         let count_keyable = |fields: &[perry_hir::ClassField]| -> u32 {
-            fields.iter().filter(|f| f.key_expr.is_none()).count() as u32
+            fields
+                .iter()
+                .filter(|f| f.key_expr.is_none() && !f.is_private)
+                .count() as u32
         };
         let mut total_field_count = count_keyable(&c.fields);
         // (parent_name, resolved_fields) captured during the chain walk so we
@@ -1251,15 +1253,15 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         // (which would risk re-picking the wrong same-named stub).
         for (_parent_name, parent_fields) in parent_chain.iter().rev() {
             for f in parent_fields {
-                if f.key_expr.is_some() {
+                if f.key_expr.is_some() || f.is_private {
                     continue;
                 }
                 packed_keys.push_str(&f.name);
                 packed_keys.push('\0');
             }
         }
         for f in &c.fields {
-            if f.key_expr.is_some() {
+            if f.key_expr.is_some() || f.is_private {
                 continue;
             }
             packed_keys.push_str(&f.name);
@@ -1351,7 +1353,13 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         );
         class_keys_globals_map.insert(c.name.clone(), global_name.clone());
         let mut packed_keys = String::new();
-        let mut total_field_count = c.fields.len() as u32;
+        let keyable_count = |fields: &[perry_hir::ClassField]| -> u32 {
+            fields
+                .iter()
+                .filter(|f| f.key_expr.is_none() && !f.is_private)
+                .count() as u32
+        };
+        let mut total_field_count = keyable_count(&c.fields);
         // Issue #485: imported subclass stubs also need their parent's
         // fields prepended to the packed-keys, so allocations on this
         // importing side reserve enough inline slots for parent +
@@ -1379,12 +1387,12 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
                 resolve_parent(&parent_name, child_prefix.as_deref())
             {
                 parent_chain.push((parent_name.clone(), parent_fields.clone()));
-                total_field_count += parent_fields.len() as u32;
+                total_field_count += keyable_count(&parent_fields);
                 p = parent_extends;
                 child_prefix = Some(parent_prefix);
             } else if let Some(parent) = hir.classes.iter().find(|cls| cls.name == parent_name) {
                 parent_chain.push((parent_name.clone(), parent.fields.clone()));
-                total_field_count += parent.fields.len() as u32;
+                total_field_count += keyable_count(&parent.fields);
                 p = parent.extends_name.clone();
                 child_prefix = Some(module_prefix.clone());
             } else {
@@ -1393,11 +1401,17 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         }
         for (_parent_name, parent_fields) in parent_chain.iter().rev() {
             for f in parent_fields {
+                if f.key_expr.is_some() || f.is_private {
+                    continue;
+                }
                 packed_keys.push_str(&f.name);
                 packed_keys.push('\0');
             }
         }
         for f in &c.fields {
+            if f.key_expr.is_some() || f.is_private {
+                continue;
+            }
             packed_keys.push_str(&f.name);
             packed_keys.push('\0');
         }

crates/perry-codegen/src/expr/array_pop.rs

@@ -36,19 +36,30 @@ const POINTER_TAG_HI16: &str = "32765"; // 0x7FFD
 const HANDLE_BAND_TOP: &str = "1048575"; // 0x0FFFFF — heap objects are above
 const HEAP_LIMIT: &str = "140737488355328"; // 2^47
 const GC_TYPE_ARRAY_I8: &str = "1";
+const GC_TYPE_OBJECT_I8: &str = "2";
 const GC_FLAG_FORWARDED_I8: &str = "-128"; // 0x80 as i8
 const MAX_FAST_LENGTH_I32: &str = "100000000";
 
 /// Lower `recv.pop()` for an Array-admitted receiver: the inline tier above
 /// with `js_array_pop_f64` behind it. Returns the popped element (boxed).
 pub(crate) fn lower_array_pop_inline(ctx: &mut FnCtx<'_>, recv_box: &str) -> String {
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
     let hdr_idx = ctx.new_block("apop.hdr");
+    // An elements-backed Array subclass (`ObjectMeta.elements`, word 12) pops
+    // from its store: the header gate resolves the payload and the same
+    // length/read/take blocks run on it, so `sub.pop()` stops paying a runtime
+    // entry that only re-derives the store (5.1% of the wolf-ecs entity cycle).
+    let elem_idx = ctx.new_block("apop.elements");
+    let elem_check_idx = ctx.new_block("apop.elements.check");
     let len_idx = ctx.new_block("apop.len");
     let read_idx = ctx.new_block("apop.read");
     let take_idx = ctx.new_block("apop.take");
     let slow_idx = ctx.new_block("apop.slow");
     let merge_idx = ctx.new_block("apop.merge");
     let hdr_label = ctx.block_label(hdr_idx);
+    let elem_label = ctx.block_label(elem_idx);
+    let elem_check_label = ctx.block_label(elem_check_idx);
     let len_label = ctx.block_label(len_idx);
     let read_label = ctx.block_label(read_idx);
     let take_label = ctx.block_label(take_idx);
@@ -90,18 +101,72 @@ pub(crate) fn lower_array_pop_inline(ctx: &mut FnCtx<'_>, recv_box: &str) -> Str
         let plain = blk.icmp_eq(I16, &blocking, "0");
         let invalidated = blk.load_volatile(I8, "@PERRY_ARRAY_INDEX_FAST_PATH_INVALIDATED");
         let prototype_clean = blk.icmp_eq(I8, &invalidated, "0");
+        let mut ok = blk.and(I1, &not_fwd, &plain);
+        ok = blk.and(I1, &ok, &prototype_clean);
+        let array_ok = blk.and(I1, &ok, &is_array);
+        // A `GC_TYPE_OBJECT` receiver may be an elements-backed Array
+        // subclass; anything else keeps the runtime entry.
+        let is_object = blk.icmp_eq(I8, &gc_type, GC_TYPE_OBJECT_I8);
+        blk.cond_br(&array_ok, &len_label, &elem_label);
+        let _ = is_object;
+    }
+    let hdr_end = ctx.block_label(hdr_idx);
+
+    ctx.current_block = elem_idx;
+    let store = {
+        let blk = ctx.block();
+        let gc_type_addr = blk.sub(I64, &handle, "8");
+        let gc_type_ptr = blk.inttoptr(I64, &gc_type_addr);
+        let gc_type = blk.load(I8, &gc_type_ptr);
+        let is_object = blk.icmp_eq(I8, &gc_type, GC_TYPE_OBJECT_I8);
+        let meta_addr = blk.add(I64, &handle, &meta_offset);
+        let meta_slot = blk.inttoptr(I64, &meta_addr);
+        let meta = blk.load(I64, &meta_slot);
+        let has_meta = blk.icmp_ne(I64, &meta, "0");
+        let can_read_meta = blk.and(I1, &is_object, &has_meta);
+        // `select` keeps the load of word 12 off a null meta pointer.
+        let safe_meta = blk.select(I1, &can_read_meta, I64, &meta, &handle);
+        let meta_ptr = blk.inttoptr(I64, &safe_meta);
+        let store_slot = blk.gep(I64, &meta_ptr, &[(I64, "12")]);
+        let store = blk.load(I64, &store_slot);
+        let has_store = blk.icmp_ne(I64, &store, "0");
+        let ok = blk.and(I1, &can_read_meta, &has_store);
+        blk.cond_br(&ok, &elem_check_label, &slow_label);
+        store
+    };
+
+    ctx.current_block = elem_check_idx;
+    {
+        let blk = ctx.block();
+        let gc_type_addr = blk.sub(I64, &store, "8");
+        let gc_type_ptr = blk.inttoptr(I64, &gc_type_addr);
+        let gc_type = blk.load(I8, &gc_type_ptr);
+        let is_array = blk.icmp_eq(I8, &gc_type, GC_TYPE_ARRAY_I8);
+        let gc_flags_addr = blk.sub(I64, &store, "7");
+        let gc_flags_ptr = blk.inttoptr(I64, &gc_flags_addr);
+        let gc_flags = blk.load(I8, &gc_flags_ptr);
+        let fwd_bits = blk.and(I8, &gc_flags, GC_FLAG_FORWARDED_I8);
+        let not_fwd = blk.icmp_eq(I8, &fwd_bits, "0");
+        let reserved_addr = blk.sub(I64, &store, "6");
+        let reserved_ptr = blk.inttoptr(I64, &reserved_addr);
+        let reserved = blk.load(I16, &reserved_ptr);
+        let blocking = blk.and(I16, &reserved, POP_BLOCKING_FLAGS_I16);
+        let plain = blk.icmp_eq(I16, &blocking, "0");
         let mut ok = blk.and(I1, &is_array, &not_fwd);
         ok = blk.and(I1, &ok, &plain);
-        ok = blk.and(I1, &ok, &prototype_clean);
         blk.cond_br(&ok, &len_label, &slow_label);
     }
+    let elem_end = ctx.block_label(elem_check_idx);
 
     ctx.current_block = len_idx;
+    let payload = ctx
+        .block()
+        .phi(I64, &[(&handle, &hdr_end), (&store, &elem_end)]);
     let new_length = {
         let blk = ctx.block();
         // ArrayHeader: length @0 (i32), capacity @4 (i32), elements @8.
-        let length = blk.safe_load_i32_from_ptr(&handle);
-        let cap_addr = blk.add(I64, &handle, "4");
+        let length = blk.safe_load_i32_from_ptr(&payload);
+        let cap_addr = blk.add(I64, &payload, "4");
         let cap_ptr = blk.inttoptr(I64, &cap_addr);
         let capacity = blk.load(I32, &cap_ptr);
         let nonempty = blk.icmp_ne(I32, &length, "0");
@@ -119,7 +184,7 @@ pub(crate) fn lower_array_pop_inline(ctx: &mut FnCtx<'_>, recv_box: &str) -> Str
         let blk = ctx.block();
         let new_length_i64 = blk.zext(I32, &new_length, I64);
         let elem_off = blk.shl(I64, &new_length_i64, "3");
-        let elements_addr = blk.add(I64, &handle, "8");
+        let elements_addr = blk.add(I64, &payload, "8");
         let elem_addr = blk.add(I64, &elements_addr, &elem_off);
         let elem_ptr = blk.inttoptr(I64, &elem_addr);
         let elem = blk.load(DOUBLE, &elem_ptr);
@@ -132,7 +197,7 @@ pub(crate) fn lower_array_pop_inline(ctx: &mut FnCtx<'_>, recv_box: &str) -> Str
     ctx.current_block = take_idx;
     {
         let blk = ctx.block();
-        let len_ptr = blk.inttoptr(I64, &handle);
+        let len_ptr = blk.inttoptr(I64, &payload);
         // `length` is a plain i32 word: no pointer, no barrier, no layout
         // note — exactly the runtime fast path's single store.
         blk.store(I32, &new_length, &len_ptr);
@@ -337,6 +402,21 @@ mod tests {
             slow.contains("call double @js_array_pop_f64("),
             "{what}: the runtime pop must remain the fallback:\n{slow}"
         );
+        // An elements-backed Array subclass resolves its payload through the
+        // meta record (`ObjectMeta.elements`, word 12) and pops from it with
+        // the same length/read/take blocks — no runtime entry for that case.
+        let elements = super::super::class_field_barrier_tests::block_body(ir, "apop.elements.")
+            .expect("the elements probe block exists");
+        assert!(
+            elements.contains("getelementptr i64, ptr %") && elements.contains(", i64 12"),
+            "{what}: the probe must load ObjectMeta.elements at word 12:\n{elements}"
+        );
+        let check = super::super::class_field_barrier_tests::block_body(ir, "apop.elements.check.")
+            .expect("the store validation block exists");
+        assert!(
+            check.contains(", 1031") && check.contains("icmp eq i8"),
+            "{what}: the store must clear the same integrity mask as a plain array:\n{check}"
+        );
     }
 
     /// Both `pop` routes — the erased class-field receiver

crates/perry-codegen/src/expr/index_get/inline_dyn_typed_array.rs

@@ -387,9 +387,8 @@ pub(super) fn lower_inline_dyn_typed_array_get(
     } else {
         8
     };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - meta_ptr_size)
-        .to_string();
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
 
     // Reject every non-pointer / handle-band / noncanonical-index case before
     // touching a managed header. The miss helper retains full ToPropertyKey,

crates/perry-codegen/src/expr/property_get/composed_ics.rs

@@ -228,9 +228,8 @@ pub(super) fn emit_array_subclass_length_ic(
     } else {
         8
     };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - meta_ptr_size)
-        .to_string();
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
     // An elements-backed Array-subclass instance (`ObjectMeta.elements`):
     // `length` is the inner Array's length word — no shape IC. A probe miss
     // (no meta, no store) is the shape-carried form and keeps the IC below.

crates/perry-codegen/src/expr/property_get/generic_dispatch.rs

@@ -597,9 +597,8 @@ pub(crate) fn lower_generic_property_get(
     } else {
         8
     };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - meta_ptr_size)
-        .to_string();
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
     let meta_addr = ctx.block().add(I64, &obj_handle, &meta_offset);
     let meta_slot = ctx.block().inttoptr(I64, &meta_addr);
     let meta_load_ty = if meta_ptr_size == 4 { I32 } else { I64 };

crates/perry-codegen/src/lower_call/new_alloc.rs

@@ -173,7 +173,13 @@ fn emit_instance_alloc_inner(
     // Compute total field count including inherited parent fields.
     // The runtime allocates at least 8 inline slots regardless, so this
     // mostly matters for shapes >8 fields.
-    let mut field_count = class.fields.len() as u32;
+    let public_keyable_count = |fields: &[perry_hir::ClassField]| -> u32 {
+        fields
+            .iter()
+            .filter(|field| field.key_expr.is_none() && !field.is_private)
+            .count() as u32
+    };
+    let mut field_count = public_keyable_count(&class.fields);
     // Imported classes now carry their real field_names from the source
     // module. If the field count is still 0 (no fields info available),
     // use a generous default as a safety net.
@@ -183,7 +189,7 @@ fn emit_instance_alloc_inner(
     let mut parent = class.extends_name.as_deref();
     while let Some(parent_name) = parent {
         if let Some(p) = ctx.classes.get(parent_name).copied() {
-            field_count += p.fields.len() as u32;
+            field_count += public_keyable_count(&p.fields);
             parent = p.extends_name.as_deref();
         } else {
             break;
@@ -306,7 +312,7 @@ fn emit_instance_alloc_inner(
         // inline bump-alloc fast path (which would bake the wrong layout).
         let mut packed_keys = String::new();
         for f in &class.fields {
-            if f.key_expr.is_some() {
+            if f.key_expr.is_some() || f.is_private {
                 continue;
             }
             packed_keys.push_str(&f.name);
@@ -688,23 +694,20 @@ fn emit_instance_alloc_inner(
                 break;
             }
         }
-        // Skip computed-key fields: their key is an expression evaluated at
-        // construction time, not a stable string, so they don't get an inline
-        // slot. The runtime stores them via IndexSet → js_object_set_field /
-        // js_object_set_symbol_property paths in `apply_field_initializers_recursive`.
-        // Including their synthetic `__computed_field_*` names in packed_keys
-        // would surface them as enumerable own properties on Object.keys().
+        // Skip computed and private fields: both are initialized through
+        // dedicated runtime paths and neither belongs in the public inline
+        // shape exposed by Object.keys/getOwnPropertyNames.
         for pc in parent_chain.iter().rev() {
             for f in &pc.fields {
-                if f.key_expr.is_some() {
+                if f.key_expr.is_some() || f.is_private {
                     continue;
                 }
                 packed_keys.push_str(&f.name);
                 packed_keys.push('\0');
             }
         }
         for f in &class.fields {
-            if f.key_expr.is_some() {
+            if f.key_expr.is_some() || f.is_private {
                 continue;
             }
             packed_keys.push_str(&f.name);

crates/perry-codegen/src/stmt/stable_packed_loop.rs

@@ -696,9 +696,8 @@ fn build_numeric_access(
     } else {
         8
     };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - pointer_size)
-        .to_string();
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
     let meta_addr = ctx.block().add(I64, live_raw, &meta_offset);
     let meta_slot = ctx.block().inttoptr(I64, &meta_addr);
     let meta_native = ctx
@@ -1071,9 +1070,8 @@ pub(crate) fn try_lower_index_get(
     } else {
         8
     };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - pointer_size)
-        .to_string();
+    let meta_offset =
+        crate::target_layout::object_meta_slot_offset_bytes(ctx.target_triple).to_string();
     let meta_addr = ctx.block().add(I64, &raw, &meta_offset);
     let meta_slot = ctx.block().inttoptr(I64, &meta_addr);
     let meta_native = ctx

crates/perry-codegen/src/target_layout.rs

@@ -88,6 +88,18 @@ pub fn object_header_size_bytes(_target_triple: &str) -> u64 {
     16
 }
 
+/// Byte offset of `ObjectHeader::meta` — the last word of the header — for
+/// the target.
+///
+/// The metadata pointer is the entry point to `ObjectMeta` (the prototype
+/// override, the spill buffer, the Array-subclass elements store), and several
+/// inline tiers load it. Keeping the derivation in one place also keeps the
+/// object-header-size callsite census stable as tiers are added.
+pub fn object_meta_slot_offset_bytes(target_triple: &str) -> u64 {
+    let pointer_size = if target_is_ilp32(target_triple) { 4 } else { 8 };
+    object_header_size_bytes(target_triple) - pointer_size
+}
+
 /// `std::mem::size_of::<perry_runtime::closure::ClosureHeader>()` for the
 /// target.
 ///