BuiltinShape Factory slots: shape-path intrinsic references and throwers; flip Function.prototype

[lahma]

Adds a Factory slot kind to BuiltinShape — the descriptor is produced by a process-shared static factory over the host instance — and teaches the source generator to emit [JsIntrinsicReference] / [JsThrowerAccessor] members on UseShape hosts as Factory slots (previously they hit the UnsupportedShapeMember diagnostic and forced the whole host onto the generated-dictionary path).

• Intrinsic references emit the same lazy per-realm LazyPropertyDescriptor the dictionary path uses, so neither slot materialization nor a deopt forces the realm intrinsic into existence. This is a hard requirement for the upcoming global-object flip: globalThis deopts on any top-level var, and its 56 intrinsic-reference slots must stay lazy through that (the deopt itself stays lazy per Keep builtin-shape deopt lazy: unmaterialized function slots stay deferred #2588).
• Throwers emit realm-pinned %ThrowTypeError% accessor descriptors — materialization may run under a foreign active realm (same class of issue as the cross-realm fix in Serve arguments reads virtually; defer property materialization #2589).
• Emission order interleaves with the dictionary-path order (properties, functions, intrinsic references, accessors, throwers, aliases, instance slots) so own-key enumeration stays byte-identical when a host flips.
• DeoptBuiltinShape stores factory results for untouched slots (cheap/lazy by contract).

The second commit flips Function.prototype to shape storage as the first consumer: its two thrower accessors become Factory slots and its per-realm property dictionary disappears. Both descriptors resolve the same per-realm %ThrowTypeError% singleton, so the spec getter identity (gOPD(fp,"arguments").get === gOPD(fp,"caller").get) holds.

Measurements

FunctionPrototype is a small host, so this is gated as no-regression; the init win arrives with the GlobalObject flip this unblocks. BenchmarkDotNet default jobs, A/B vs main from separate worktrees: EngineConstructionBenchmark (8 cases), MinimalScriptBenchmark, BuiltinShapeBenchmark — times within noise, allocations byte-identical (±0.01 KB). Two new Verify snapshots cover the Factory emissions.

Verification

• Jint.Tests green (net10.0 + net472), Jint.Tests.PublicInterface green, Jint.Tests.SourceGenerators 32/32
• Full test262: 99,260 passed, 0 failed (function-prototype property attributes, thrower semantics, %ThrowTypeError% identity)
• Live-engine checks: thrower getter identity across arguments/caller, TypeError on access, own-key enumeration order, deopt via Function.prototype.x = 1 with post-deopt thrower materialization

🤖 Generated with Claude Code