perf(codegen): collapse the generic property-get tower to two exits

changelog.d/10196-generic-get-two-exits.md

@@ -0,0 +1,12 @@
+Collapse the generic (untyped) property-get inline cache from a 33-block diamond
+with six runtime call sites to the inline hit path plus the polymorphic ways and
+two out-of-line exits: `js_object_get_field_ic_nonptr` for non-pointer receivers
+(SSO, class refs, nullish throw, primitives) and `js_object_get_field_ic_slow`
+for a pointer receiver that failed a guard (overflow slot, Array-subclass
+named-prefix proofs, miss and prime). Per site: 191 → 106 IR instructions,
+6 → 2 call sites. The packed-MRU hit path, the ways and every cache decision are
+unchanged; the field address is emitted as a typed `gep` so instruction selection
+keeps the scaled addressing mode. On @babel/parser `.text` shrinks 14.4 % and
+`.perry_gcmap` 11.7 %; total benchmark instructions drop 0.5 % (`interp.ts`
+−1.5 %) with RSS unchanged. A new gap test exercises every arm that moved out of
+line against Node.

crates/perry-codegen/src/codegen/trusted_box_callback_tests.rs

@@ -347,7 +347,9 @@ fn additive_property_callback_gets_a_cold_deopting_private_body() {
     );
     assert!(
         special.contains("pic.miss.call")
-            && special.contains("js_object_get_field_ic_miss")
+            // T1 renamed the property-GET slow path this cold arm reaches
+            // (`js_object_get_field_ic_miss_packed` -> the tower's object exit).
+            && special.contains("js_object_get_field_ic_slow")
             && special.contains("guarded_add.dynamic")
             && special.contains("versioned_callback.deopt.mark"),
         "both observable cold arms must poison the loop before fallback:\n{special}"

crates/perry-codegen/src/eh_mode.rs

@@ -105,9 +105,19 @@ mod tests {
 
     #[test]
     fn cold_property_miss_is_still_throwing() {
-        let name = "js_object_get_field_ic_miss_packed";
-        assert_eq!(crate::module::helper_decl_attrs(name), " cold");
-        assert!(!callee_is_nothrow(name));
+        for name in [
+            "js_object_get_field_ic_miss_packed",
+            // T1: the generic-get tower's two slow exits carry the same `cold`
+            // placement hint — and the same ability to throw, now including
+            // the nullish-receiver TypeError the emitted arm used to raise
+            // inline. A `cold` helper that lost its invoke edge would silently
+            // swallow every `Cannot read properties of undefined`.
+            "js_object_get_field_ic_slow",
+            "js_object_get_field_ic_nonptr",
+        ] {
+            assert_eq!(crate::module::helper_decl_attrs(name), " cold", "{name}");
+            assert!(!callee_is_nothrow(name), "{name}");
+        }
         assert!(!callee_is_nothrow("js_object_get_field_ic_miss"));
         assert!(!callee_is_nothrow("unknown_runtime_helper"));
     }

crates/perry-codegen/src/gc_call_effects.rs

@@ -750,6 +750,11 @@ mod tests {
             "js_rel_lt",
             "js_rel_gt",
             "js_object_get_field_ic_miss_packed",
+            // T1: the generic-get tower's two slow exits. One reaches the same
+            // `get_field_ic_miss_impl`, the other the by-name helper, so both
+            // allocate and can run a user getter.
+            "js_object_get_field_ic_slow",
+            "js_object_get_field_ic_nonptr",
         ] {
             assert_ne!(
                 classify_direct_callee(name),

crates/perry-codegen/src/module/linkage.rs

@@ -251,7 +251,10 @@ pub(crate) fn helper_decl_attrs(name: &str) -> &'static str {
         // register saves and code layout focused on the inline continuation.
         // `cold` is only a profitability hint: both calls remain fully
         // memory-clobbering and the cache miss remains GC-capable/throwing.
-        "js_object_get_field_ic_miss_packed" | "js_write_barrier_root_nanbox" => " cold",
+        "js_object_get_field_ic_miss_packed"
+        | "js_object_get_field_ic_slow"
+        | "js_object_get_field_ic_nonptr"
+        | "js_write_barrier_root_nanbox" => " cold",
         // PURE — each verified: pure bit tests/masking on the f64/i64 args,
         // total over arbitrary bits, no memory access anywhere in the body.
         //   js_nanbox_pointer        value/nanbox.rs — tag ladder, 0 → TAG_NULL

crates/perry-codegen/src/runtime_decls/objects.rs

@@ -366,6 +366,17 @@ pub fn declare_phase_b_objects(module: &mut LlModule) {
     // single call for oversized modules. Args: (obj_bits, key_handle, site_id,
     // per-site IC cache global) -> field value.
     module.declare_function("js_object_get_field_ic", DOUBLE, &[I64, I64, I64, PTR]);
+    // T1: the two exits of the inline generic-get tower. Every guard failure —
+    // SSO / INT32 class ref / nullish / non-object receiver / overflow slot /
+    // deleted slot / named prefix / miss+prime — branches to one of these
+    // instead of expanding its own arm and its own call.
+    //
+    // Non-pointer receiver (the emitted tag test failed): (obj_bits, key_handle,
+    // site_id) -> field value. No cache: none of its arms can prime one.
+    module.declare_function("js_object_get_field_ic_nonptr", DOUBLE, &[I64, I64, I64]);
+    // Heap-pointer receiver: (masked obj_handle, key_handle, per-site IC cache
+    // SLOT, per-site packed MRU word) -> field value.
+    module.declare_function("js_object_get_field_ic_slow", DOUBLE, &[I64, I64, PTR, PTR]);
     // Object rest destructuring: copy all properties from src except excluded keys.
     // Takes a src object ptr and an array of NaN-boxed strings (the excluded keys),
     // returns a new object pointer.

crates/perry-codegen/src/stmt/cached_field_index_return.rs

@@ -207,7 +207,11 @@ pub(super) fn try_emit_cached_field_index_return(
         .cond_br(&exact, &field_load_label, &prefix_meta_label);
 
     ctx.current_block = prefix_meta_idx;
-    let cached_prefix_ptr = ctx.block().gep(I64, &cache_ref, &[(I64, "2")]);
+    // The same cache word the generic property-get tower's named-prefix proof
+    // uses, and the same one the runtime publishes it in.
+    let prefix_word =
+        crate::expr::property_get::generic_dispatch::PIC_NAMED_PREFIX_TOKEN.to_string();
+    let cached_prefix_ptr = ctx.block().gep(I64, &cache_ref, &[(I64, &prefix_word)]);
     let cached_prefix = ctx.block().load(I64, &cached_prefix_ptr);
     let prefix_armed = ctx.block().icmp_ne(I64, &cached_prefix, "0");
     let pointer_bytes = if crate::target_layout::target_is_ilp32(ctx.target_triple) {

crates/perry-codegen/src/stmt/element_shape_loop_tests.rs

@@ -992,7 +992,10 @@ fn object_literal_element_resolution_does_not_escape_the_clone() {
         .expect("the merge block should be DEFINED in the emitted IR")..];
     assert!(
         after.contains("js_object_get_field_by_name_f64")
-            || after.contains("js_object_get_field_ic_miss"),
+            || after.contains("js_object_get_field_ic_miss")
+            // T1: the generic tower's cold arms are behind these two entries now.
+            || after.contains("js_object_get_field_ic_slow")
+            || after.contains("js_object_get_field_ic_nonptr"),
         "the post-loop read must stay on the by-name path; emitted:\n{after}"
     );
 }

crates/perry-codegen/tests/native_proof_regressions.rs

@@ -14866,7 +14866,11 @@ fn annotated_class_method_value_uses_generic_lookup() {
     // fallback, which is the exact regression #8033 exists to prevent.
     let generic = ir_function_body(&ir, "__probe$generic(");
     assert!(
-        generic.contains("call double @js_object_get_field_ic_miss"),
+        // T1 renamed the tower's cold exits; this assertion is about the
+        // unguarded body keeping GENERIC lookup, not about which symbol
+        // serves it.
+        generic.contains("call double @js_object_get_field_ic_slow")
+            || generic.contains("call double @js_object_get_field_ic_miss"),
         "an annotation-only class receiver must preserve generic property \
          lookup in the unguarded body:\n{generic}"
     );

crates/perry-codegen/tests/native_proof_regressions/pod_manifest.rs

@@ -652,7 +652,11 @@ fn native_pod_view_length_survives_immutable_local_alias() {
         "an immutable PodView alias must use the validating length helper:\n{ir}"
     );
     assert!(
-        !ir.contains("call double @js_object_get_field_ic_miss"),
+        // T1 renamed the tower's exits; a negative assertion that names only
+        // the retired symbol can no longer fail, so it names the live ones.
+        !ir.contains("call double @js_object_get_field_ic_slow")
+            && !ir.contains("call double @js_object_get_field_ic_nonptr")
+            && !ir.contains("call double @js_object_get_field_ic_miss"),
         "a PodView alias must not enter the ordinary object-property PIC:\n{ir}"
     );
 }

crates/perry-codegen/tests/typed_feedback.rs

@@ -581,8 +581,9 @@ fn a_default_build_emits_no_typed_feedback_recording_calls() {
     // empty string. The property boundaries themselves must still be here —
     // this test proves the RECORDING is gone, not the program.
     assert!(
-        ir.contains("js_object_get_field_by_name_f64")
-            || ir.contains("js_object_get_field_ic_miss"),
+        ir.contains("call double @js_object_get_field_ic_slow(")
+            || ir.contains("call double @js_object_get_field_by_name_f64(")
+            || ir.contains("call double @js_object_get_field_ic_miss"),
         "the property reads themselves must still be lowered; emitted:\n{ir}"
     );
     // And the helpers that DECIDE something, rather than merely counting, are
@@ -598,8 +599,15 @@ fn a_default_build_emits_no_typed_feedback_recording_calls() {
     // the two dispatchers this same fixture still emits -- the property GET
     // (the set dispatcher's twin) and the method call -- and as CALLS, since
     // the old symbol match was satisfied by the `declare` line alone.
+    // T1: the property GET's dispatching wrapper is one indirection further
+    // out. `js_typed_feedback_object_get_field_by_name_f64` is no longer
+    // emitted per site — it is the INT32 class-ref arm of
+    // `js_object_get_field_ic_nonptr`, which the site calls with the same
+    // `site_id`. The line this assertion draws is unchanged: a dispatcher that
+    // DECIDES something is emitted in a default build, a helper that merely
+    // counts is not (all six are asserted absent above).
     assert!(
-        ir.contains("call double @js_typed_feedback_object_get_field_by_name_f64("),
+        ir.contains("call double @js_object_get_field_ic_nonptr("),
         "dispatching feedback wrappers must still be emitted in a default build \
          (property get):\n{ir}"
     );

crates/perry-runtime/src/object/field_get_set.rs

@@ -309,8 +309,14 @@ pub use ic_miss::{
     js_object_set_field_by_property_id, js_private_brand_add, js_private_brand_check,
     js_private_field_add, js_private_guard, PicCache, PicCacheSlot, PIC_CACHE_WORDS,
 };
+/// The one slow exit of the emitted generic property-get tower. Declared here
+/// rather than inside `ic_miss.rs` only because that file sits at the
+/// 2000-line cap; the source lives next to its sibling entries.
+#[path = "field_get_set/ic_miss/ic_slow.rs"]
+mod ic_slow;
 pub(crate) use ic_slot::pic_slot_census;
 pub use ic_slot::{pic_arena_bytes, pic_slot_peek, pic_slot_resolve, pic_slots_resolved};
+pub use ic_slow::{js_object_get_field_ic_nonptr, js_object_get_field_ic_slow};
 
 #[cfg(test)]
 mod buffer_ic_miss_tests {

crates/perry-runtime/src/object/field_get_set/ic_miss.rs

@@ -537,7 +537,7 @@ fn ic_diag_note(
 mod packed_get;
 pub use packed_get::{js_object_get_field_ic_miss, js_object_get_field_ic_miss_packed};
 
-fn get_field_ic_miss_impl(
+pub(super) fn get_field_ic_miss_impl(
     obj: *const ObjectHeader,
     key: *const crate::StringHeader,
     cache_slot: *mut PicCacheSlot,