perf(buffer): give the buffer-registry probe the set filter its window can no longer be

changelog.d/9823-for-in-deferred-shadow-set.md

@@ -0,0 +1,28 @@
+**`for-in` no longer allocates a heap string and a hash entry for every own
+name at every prototype level** (#9823).
+
+`js_for_in_keys_value` kept a `HashSet<String>` of every own name — enumerable
+or not — at every level of the prototype chain, so that a name owned closer to
+the receiver hides the same name further along it (ECMA-262 14.7.5, 12.6.4-2).
+It built that set unconditionally, which meant materialising a second key array
+per level (all own names, on top of the enumerable ones) and turning every name
+at every level into an owned `String` purely so it could be hashed.
+
+That set can only filter a level at or below the first prototype, and a level
+that contributes no enumerable keys of its own never consults it. It is now
+built on demand — at the moment a prototype level actually has an enumerable
+key to filter — from exactly the levels already walked, so the emitted key
+sequence is unchanged.
+
+On the compiled claude-code TUI, one 400-character reply: **159,947 `String`
+allocations and 159,947 hash inserts become zero**, and the key arrays
+materialised per call halve from 4.00 to 2.00. Across 17,281 `for-in` loops in
+that reply, **no key was emitted from a prototype level at all**, so the set
+that cost all of that filtered nothing. The strings totalled 1.91 MB, which is
+why an allocation-byte ranking never surfaced this: the cost was 160,000
+mallocs, memcpys, hashes and frees, not the bytes they held. The collection
+schedule is unchanged (41 vs 43 copying minors, 46 vs 48 budgeted full-cycle
+steps).
+
+`PERRY_ENUM_DIAG=<path>` reports the counters above. `PERRY_FORIN_LAZY_SHADOW=0`
+restores the eager set.

changelog.d/9828-buffer-registry-addr-filter.md

@@ -0,0 +1,32 @@
+**The buffer-registry probe stops answering "maybe" to three quarters of the
+addresses it is asked about** (#9828).
+
+`is_registered_buffer` guards its three registries with
+`BUFFER_LIKE_ADDR_WINDOW`, a process-global min/max span, and the 98.0 %
+rejection rate in its doc comment is measured on `claude-code --help` — a run
+that registers **10** buffers. A streaming turn registers **213**, scattered
+across a **527 MB** span, so `[lo, hi]` covers half a gigabyte of ordinary heap
+and stops discriminating: on one 400-character reply, 34.6 million probes, of
+which the window admits **73.63 %** to the out-of-line lookup, and **99.79 % of
+those find nothing**.
+
+The probe now consults `RegistryAddrFilter` behind the window — the set filter
+added after #9272 for exactly this failure, where a registry's entries are
+ordinary heap objects interleaved with everything else. Rejection goes from
+26.37 % to **96.46 %**, removing **24.25 million out-of-line calls per reply**,
+each of which cost a thread-local resolution and a hash. True positives are
+unchanged.
+
+The saturation question that structure demands was answered before adopting it:
+`RegistryAddrFilter` accrues bits per admission and never clears them, so a
+high-churn set would degrade it into the state #9807 documented for the
+per-object layout filter. Buffers are the opposite case — probing is hot,
+registration is rare — and 213 cumulative admissions against 1,024 bits gives a
+10.0 % false-positive rate. `PERRY_BUFFER_DIAG` reports the occupancy, the
+window bounds and the rejection rate so the question stays answerable.
+
+In the profile, `is_registered_buffer_slow` falls from 169 to 25 leaf samples
+(−85 %); its inline caller rises 96 to 123 as the filter's hashes move there,
+so the pair falls 44 % overall. That is roughly half of the 3.19 % the profile
+attributed to the slow path, and it is below the streaming rig's resolution, so
+turn CPU is unchanged.

crates/perry-runtime/src/buffer/header.rs

@@ -217,6 +217,56 @@ static BUFFER_LIKE_EVER_REGISTERED: RegistryLatch = RegistryLatch::new();
 /// [`RegistryAddrWindow`] for the ordering rule that makes it so.
 static BUFFER_LIKE_ADDR_WINDOW: RegistryAddrWindow = RegistryAddrWindow::new();
 
+/// The set filter behind the window, for the addresses `[lo, hi]` cannot
+/// discriminate.
+///
+/// The window's 98.0 % rejection rate above is measured on `claude-code
+/// --help`, which registers **10** buffers. On a streaming turn cc registers
+/// **213**, scattered across a **527 MB** span — so `[lo, hi]` covers half a
+/// gigabyte of ordinary heap and stops rejecting. `PERRY_BUFFER_DIAG`, one
+/// 400-character reply:
+///
+/// ```text
+/// probes=34,603,009 admits=25,627,160 (74.06 %) rejected=8,975,849 (25.94 %)
+/// true_positives=53,109 (0.207 % of admits)
+/// window [0x5b718eb73e8, 0x5b739e1c0b8] span 527.4 MB
+/// registrations=213 unregistrations=12 live_max=201
+/// ```
+///
+/// 25.6 million out-of-line probes per reply, 99.79 % of which find nothing.
+/// That is the failure [`RegistryAddrFilter`] was built for after #9272
+/// (`is_registered_symbol`: a window rejects 38.3 %, the filter 99.58 %) — its
+/// entries are ordinary heap objects interleaved with everything else, which
+/// its doc comment names as the case a window cannot serve.
+///
+/// **The capacity question this structure demands was asked before adopting
+/// it.** `RegistryAddrFilter` accrues bits per ADMISSION and never clears them,
+/// so a high-churn set saturates it — the trap #9807 documented for the
+/// per-object layout filter, which held 162,258 keys against 4,096 bits and
+/// answered "may hold" to every probe. Buffers are not that case: probing is
+/// hot but registration is rare, and **213 cumulative admissions against 1,024
+/// bits and 3 hashes is a 10.0 % false-positive rate**, so the filter rejects
+/// about nine of every ten addresses the window admits. The counter that says
+/// so ships with it.
+///
+/// The window stays in front: two static loads reject 25.94 % for less than
+/// the filter's three hashes cost.
+static BUFFER_LIKE_ADDR_FILTER: crate::registry_latch::RegistryAddrFilter =
+    crate::registry_latch::RegistryAddrFilter::new();
+
+/// `PERRY_BUFFER_ADDR_FILTER=0` restores the window-only probe, so one binary
+/// carries both and the A/B is one environment variable.
+fn buffer_addr_filter_enabled() -> bool {
+    use std::sync::OnceLock;
+    static CACHED: OnceLock<bool> = OnceLock::new();
+    *CACHED.get_or_init(|| {
+        !matches!(
+            std::env::var("PERRY_BUFFER_ADDR_FILTER").as_deref(),
+            Ok("0") | Ok("off") | Ok("false")
+        )
+    })
+}
+
 #[cfg(test)]
 thread_local! {
 /// Test-only count of `is_registered_buffer` calls that got past the address
@@ -256,6 +306,7 @@ pub(crate) fn note_buffer_like_registered(addr: usize) {
     // checks the latch and then the window, so both must already cover this
     // address by the time it becomes findable.
     BUFFER_LIKE_ADDR_WINDOW.admit(addr);
+    BUFFER_LIKE_ADDR_FILTER.admit(addr);
     BUFFER_LIKE_EVER_REGISTERED.arm();
 }
 
@@ -405,12 +456,17 @@ pub fn register_buffer(ptr: *const BufferHeader) {
     // the idle fast path and denies it. See `crate::registry_latch`.
     let addr = ptr as usize;
     BUFFER_LIKE_ADDR_WINDOW.admit(addr);
+    BUFFER_LIKE_ADDR_FILTER.admit(addr);
     BUFFER_LIKE_EVER_REGISTERED.arm();
     BUFFER_ADDR_RANGE.with(|r| {
         let (lo, hi) = r.get();
         r.set((lo.min(addr), hi.max(addr)));
     });
     BUFFER_REGISTRY.with(|r| r.borrow_mut().insert(addr));
+    if crate::hot_diag::buffer_on() {
+        let live = BUFFER_REGISTRY.with(|r| r.borrow().len());
+        crate::hot_diag::buffer_note_registration(live);
+    }
 }
 
 /// Historical tier boundary, retained for callers that size test fixtures
@@ -442,7 +498,12 @@ pub fn is_registered_buffer(addr: usize) -> bool {
     // call, the thread-local resolution, the `RefCell` borrow or the hash.
     // Every writer widens the window before it publishes, which is what makes
     // rejecting sound; see `BUFFER_LIKE_ADDR_WINDOW`.
-    if !BUFFER_LIKE_ADDR_WINDOW.may_contain(addr) {
+    let admitted = BUFFER_LIKE_ADDR_WINDOW.may_contain(addr)
+        && (!buffer_addr_filter_enabled() || BUFFER_LIKE_ADDR_FILTER.may_contain(addr));
+    if crate::hot_diag::buffer_on() {
+        crate::hot_diag::buffer_note_probe(addr, admitted, BUFFER_LIKE_ADDR_WINDOW.bounds());
+    }
+    if !admitted {
         // Machine-check the completeness of the writer set instead of trusting
         // an enumeration of it. The window is only sound if EVERY route into
         // the three tables below calls `admit` first; an enumeration of those
@@ -468,7 +529,11 @@ pub fn is_registered_buffer(addr: usize) -> bool {
     }
     #[cfg(test)]
     TEST_BUFFER_REGISTRY_PROBES.with(|c| c.set(c.get().wrapping_add(1)));
-    is_registered_buffer_slow(addr)
+    let found = is_registered_buffer_slow(addr);
+    if found && crate::hot_diag::buffer_on() {
+        crate::hot_diag::buffer_note_true_positive();
+    }
+    found
 }
 
 /// `PERRY_BUFFER_RANGE_FILTER=0` restores the unconditional hash lookup.
@@ -1081,6 +1146,9 @@ pub(crate) fn finalize_collected_dead_buffer(addr: usize) {
     BUFFER_REGISTRY.with(|r| {
         r.borrow_mut().remove(&addr);
     });
+    if crate::hot_diag::buffer_on() {
+        crate::hot_diag::buffer_note_unregistration();
+    }
     FOREIGN_BACKING_REGISTRY.with(|r| {
         r.borrow_mut().remove(&addr);
     });