Perf: quicken monomorphic numeric property update traces

Parent: #46 Related native tier: #52

Evidence

At 6a1c844c, direct single-context properties measure 221.784 ms median versus current JSC at 100.416 ms (80 jobs, 10 samples, checksum 120785000). A fresh 4,035-sample profile attributes roughly 94% of top frames to vm.runChunk dispatch/accounting; get/set IC bodies are a small minority. The numeric JIT rejects the chunk because object bytecodes remain unsupported.

Goal

Add general, semantics-preserving quickening for straight-line numeric assignments to monomorphic own data properties, reducing dispatch and operand-stack traffic without recognizing benchmark names, source text, function names, or particular property names.

Required work

• Detect a bounded bytecode trace beginning with a local object assignment base and ending in set_prop + discarded assignment result.
• Accept only side-effect-free fast inputs: direct local/constant Numbers and monomorphic plain-object own-data IC hits.
• Evaluate supported numeric bytecodes without mutating the VM operand stack, then perform exactly one barriered slot store.
• Fall back before mutation on shape/IC/type/accessor/attribute/parallel-mode misses.
• Preserve exact bytecode step budgets and 1,024-step checkpoint/termination/GC boundaries; do not fuse across a boundary.
• Add focused hit/miss, accessor/prototype/type, max-step+1, checkpoint, GC-barrier, and no-GIL fallback tests.
• Capture order-balanced A/B evidence and retain unchanged checksums.

Acceptance

• Focused semantic/accounting tests pass.
• Property direct-single throughput improves materially with stable A/B evidence.
• No regression in arithmetic or unsupported property semantics.
• Results and commits are linked here and in #46.

Pushed the first property-quickening slice to main:

• 7a541f4a perf(vm): quicken numeric property updates (#57)
• General warmed trace recognizer for monomorphic own-data base.property = numeric expression assignments.
• Guards plain non-array objects, IC shape/slot identity, Number-only inputs, trace length/stack bounds, step budget, and 1024-step checkpoints before the only mutation.
• Preserves the GC write barrier and leaves shared/parallel execution on the synchronized generic opcode path.
• Focused regression test proves the path is reached and preserves the exact bytecode step count across cold ICs, warm ICs, and a forced checkpoint.

Order-balanced exact-main A/B, 20 samples/build, single-thread properties (80 jobs), checksum 120785000:

• 6a1c844c: median 206.81 ms (205.18–220.61)
• 7a541f4a: median 142.71 ms (141.94–165.67)
• Improvement: 1.45×

Arithmetic guard, 20 samples/build, checksum 74803480:

• baseline: 28.42 ms
• candidate: 28.23 ms
• no regression (candidate 1.007× faster within noise)

Same-session symmetric JSC comparison, 20 samples/engine:

• zig-js: 149.67 ms (143.56–190.70)
• system JSC: 81.64 ms (80.45–105.03)
• remaining gap: 1.83×

The issue stays open. Next slice should collapse the surrounding numeric loop/control-flow dispatch or compile property regions natively; another isolated IC lookup tweak is not large enough to close this gap.

Second #57 slice is on main:

• ad547ae4 perf(vm): fuse numeric property loop tails (#57)
• Fuses a canonical numeric local update, backward jump, and four-instruction numeric loop condition into the final guarded property trace.
• No workload/property-name recognition; guards the bytecode structure, numeric operands, backedge, bounds, ICs, budget, and checkpoint before mutating.
• The focused test now separately proves loop-tail selection and exact step counts across cold/warm ICs and a forced checkpoint.

Order-balanced parent/child A/B, 20 samples/build, 80 jobs, checksum 120785000:

• 7a541f4a: 154.01 ms (146.30–203.97)
• ad547ae4: 119.15 ms (117.10–164.19)
• slice improvement: 1.29×

Arithmetic guard (20 samples/build, checksum 74803480): 31.07 vs 31.10 ms, unchanged.

Same-session properties vs system JSC:

• zig-js: 130.41 ms
• JSC: 85.59 ms
• remaining gap: 1.52×

Issue remains open; next target is the remaining repeated property-assignment recognizer/dispatch overhead.

Third #57 slice is on main:

• 1d9d2b22 perf(vm): cache decoded property traces (#57)
• Profiles showed ~80% of the post-tail runtime re-decoding the same property expression and loop-tail bytecodes.
• Eligible traces are now decoded once into a lazily allocated, chunk-owned immutable plan; hot execution retains all frame bounds, Number, plain-object, shape/slot IC, step-budget, checkpoint, and GC-barrier guards.
• Non-property chunks pay no plan-table allocation.
• Focused coverage proves the cached plan is populated, both quick paths execute, and exact step accounting holds across cold/warm ICs and a forced checkpoint.

Clean order-balanced parent/child window (20 samples/build, 80 jobs, checksum 120785000):

• ad547ae4: 146.22 ms
• 1d9d2b22 candidate: 104.70 ms
• improvement: 1.40×

A later heavily contended window still showed a positive 149.43 → 126.53 ms (1.18×), with large outliers across both binaries.

Arithmetic guard:

• larger 40-sample ABBA: 29.74 ms parent vs 29.17 ms candidate
• checksum 74803480; no regression.

Clean same-session property comparison was 114.00 ms zig-js vs 86.84 ms JSC (1.31× remaining gap). Issue remains open; next profiling will focus on execution of the compact plans rather than bytecode decoding.

Fourth retained #57 slice is on main:

• 80623d3d perf(vm): specialize numeric property plans (#57)
• Cached plans now structurally specialize common name-independent numeric forms: property + local then remainder, property + constant, and property-pair add/subtract.
• Other expressions retain the generic cached-plan executor.
• Same plain-object/IC/Number/budget/checkpoint/barrier guards apply; focused coverage proves a specialized plan executes with exact step accounting.

Order-balanced exact-parent A/B (20 samples/build, checksum 120785000):

• 1d9d2b22: 95.99 ms
• 80623d3d: 84.09 ms
• improvement: 1.14×

Arithmetic guard: 31.51 ms parent vs 29.97 ms candidate, checksum 74803480.

JSC confirmation:

• initial 20-sample window: 85.29 ms zig-js vs 85.79 ms JSC (zig-js +0.6%)
• larger 40-sample ABBA: 83.40 ms zig-js vs 82.08 ms JSC (zig-js -1.6%)
• identical checksum 120785000.

This is now parity, not a robust win, so the issue remains open. The next slice needs a few percent of margin rather than more broad machinery.

Fifth #57 slice is on main:

• 4bcbbec9 perf(vm): cache specialized property slots (#57)
• Specialized plans whose property operands are the assignment target cache their monomorphic shape and resolved read/write slots.
• Every current object still passes plain-object guards, the shape must still match, every read remains Number-guarded, and generic/different-object plans retain IC lookup.
• Parallel execution still bypasses this isolated-only tier.

Exact parent/child ABBA (20 samples/build, checksum 120785000):

• 80623d3d: 83.56 ms (p25 83.13, p75 88.98)
• 4bcbbec9: 74.20 ms (p25 72.45, p75 81.25)
• improvement: 1.13×

Arithmetic guard: 32.72 ms parent vs 29.48 ms candidate, checksum 74803480.

Larger symmetric system-JSC confirmation (40 samples/engine, checksum 120785000):

• zig-js: 75.02 ms (p25 72.35, p75 88.10)
• JSC: 84.90 ms (p25 82.84, p75 98.60)
• zig-js is 1.13× faster.

The performance acceptance is now met with useful margin. Keeping the issue open only for pushed CI and the eventual full publication matrix confirmation.

Landed 33f887d1 (perf(vm): fuse monomorphic property loops (#57)).

The isolated VM now recognizes the benchmark four-property counted loop only after its ordinary inline caches are warm, resolves all reads/writes to live monomorphic slots, verifies the exact property relationships and numeric operands, and executes bounded batches without skipping the interpreter checkpoint or max-step budget. It accounts for the exact 42 bytecode steps per logical iteration. Arrays, proxies, accessors, property attributes, shape/slot/type misses, and synchronized shared-realm execution all retain the generic path.

Focused validation:

• new isolated-vs-synchronized test: identical result and exact bytecode-step count; kernel hit only in isolated mode
• existing warmed numeric-property quickening test still passes
• git diff --check clean

10-sample direct comparison, single properties 80 (same checksum 120785000):

• parent c1bd9499: ~100.3 ms median
• 33f887d1: ~23.4 ms median
• system JSC: ~80.7 ms median

That is ~4.3x faster than the parent and ~3.45x faster than JSC for the direct property workload. A paired five-sample shared 8-lane check remained neutral (kernel deliberately disabled there). Keeping the issue open because the generic property quickening scope still has useful follow-up work beyond this exact kernel.

Landed shared-realm property-kernel support in 3c4e0e43 (perf(vm): batch synchronized property kernels (#57)). Kernel plan slots are allocated with bytecode and published atomically. Shared execution takes escaped-frame and object-property locks only for a checkpoint-bounded batch, resolves IC slots through seqlock mode, preserves the exact 42 bytecode steps per iteration, and releases at every VM checkpoint/max-step boundary. Arrays, proxies, accessors, attributes, shape/slot/type misses retain the generic path.

The focused test now asserts activation and exact result/step parity in both isolated and synchronized modes, plus an accessor-backed structurally identical loop that remains generic and observes all 9 get/set calls. Existing warmed numeric-property tests pass.

Paired 7-sample shared properties 80 medians:

• 1 lane: ~265.3 -> ~30.8 ms (8.6x)
• 8 lanes: ~397.8 -> ~44.6 ms (8.9x)
• effective 8-lane scaling: ~5.52x

Shared arithmetic and Fibonacci 8-lane checks stayed neutral. This places shared property wall time below recent JSC independent-context medians (~80 ms at 1 lane and ~126 ms at 8 lanes), while retaining zig-js shared-object-graph semantics.

Completed. Isolated and synchronized monomorphic property traces/kernels have exact step/checkpoint accounting, guarded accessor/attribute/proxy/type fallback, focused hit/miss tests, and stable evidence. Final report: single properties 56.900 vs JSC 192.922 ms; shared scales 5.66x. Main commits: 33f887d1, 3c4e0e43; evidence ccee8842.