Extend the member-call fast path to primitive string receivers - #2717
Merged
Merged
Conversation
Calls like str.slice(...) / str.charCodeAt(i) previously always fell to the Reference slow path, re-resolving the method through Engine.GetValue -> TryHandleStringValue on every call (profiles show StringInstance.GetOwnProperty 4.4% + TryHandleStringValue 3.1% on dromaeo-object-string and Engine.GetValue 8.4% on string-base64, all from JintCallExpression). GetCalleeForCall now resolves the method for a JsString receiver directly from the realm's %String.prototype%, caching the descriptor per AST node under the same holder-identity + _propertiesVersion guard as the existing prototype-method inline cache. In-place replacement (String.prototype.slice = fn) flows through the cached descriptor's live value; defineProperty/delete bump the version and re-resolve. Safety rails: - Build-time denylist keeps names that can be OWN properties of a boxed string out of the lane: `length` and any name whose ToNumber coercion is a non-negative int32 (StringInstance.GetOwnProperty coerces the name, so "0", "01", "0x1", "1e1", " 1", "-0" and "" all address characters). Denied names keep the unchanged Reference slow path, so own-property shadowing of prototype plants is preserved. - Accessor-backed slots are never cached: they fall to the Reference path so getter side effects run exactly once even when the result is non-callable. - The receiver is never boxed or materialized (no ToString/Length touch), keeping lazy CustomString implementations intact; `this` is the primitive itself, matching Reference.ThisValue on the slow path. - A miss on the direct prototype (method absent or found deeper, e.g. Object.prototype.hasOwnProperty) falls back to the Reference path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lahma
enabled auto-merge (squash)
July 21, 2026 10:00
This was referenced Jul 21, 2026
This was referenced Jul 22, 2026
legrab
added a commit
to legrab/pocok
that referenced
this pull request
Jul 29, 2026
Updated [Jint](https://github.com/sebastienros/jint) from 4.13.0 to 4.14.0. <details> <summary>Release notes</summary> _Sourced from [Jint's releases](https://github.com/sebastienros/jint/releases)._ ## 4.14.0 Jint 4.14.0 is an **interop-focused performance release**: CLR arrays now cross into script as live views instead of copies, recently wrapped host objects reuse their wrappers, single-candidate interop method calls dispatch through compiled invokers, and `JSON.parse` interns repeated keys and values. Host collection traversal is **10.9× faster** than 4.13.0. **Two interop defaults changed in this release** — read the first two highlights if you pass CLR arrays to scripts or rely on per-crossing conversion behavior; everything else needs no code changes to benefit. ### Highlights **CLR arrays are live views by default (behavior change).** `Options.Interop.ArrayConversion` now defaults to `ArrayConversionMode.LiveView` (#2721, #2728, #2735): a single-rank `T[]` crossing into script becomes a live, fixed-size view over the underlying array — the way wrapped `List<T>` already behaves — instead of being copied into a new JS array on every read. Writes go through in both directions, and arrays exposed through read-only-declared members (e.g. `IReadOnlyList<T>`) produce read-only views. Iteration, `Array.prototype` methods, JSON serialization, index-key enumeration (`Object.keys` / `for..in` yield `"0"`..`"n-1"`) and `undefined` for out-of-range reads all behave array-like, but `Array.isArray` returns `false`, and because CLR arrays are fixed-size, resizing operations (`push`/`pop`/`length` writes) throw a `TypeError` like integer-indexed exotic objects do — `shift`/`splice` may move elements before their length change throws, as for typed arrays. Set `Options.Interop.ArrayConversion = ArrayConversionMode.Copy` to restore the 4.13 behavior. **Recently wrapped CLR objects reuse their wrappers (behavior change).** The new `Options.Interop.CacheRecentObjectWrappers` defaults to `true` (#2734): a small bounded ring (8 entries, keyed by reference identity and exposed type) reuses wrappers for host objects that repeatedly cross into script. Wrapper identity becomes stable (`host.Obj === host.Obj`), script-attached state (freeze, `defineProperty`, expandos) survives crossings, and the per-crossing wrapper allocation disappears. Under `Copy` array conversion this also means repeated reads of the same CLR array reuse the first `JsArray` snapshot while it stays cached — CLR-side mutations are not re-copied; set the option to `false` for the pre-4.14 fresh-snapshot-per-crossing behavior. `Engine.Dispose()` releases the ring. **Interop fast lanes.** Single-candidate method calls run through a compiled invoker that binds and invokes without argument arrays or boxing (#2733), with per-parameter binding flags precomputed (#2719). Resolved `ObjectWrapper` members get a per-call-site inline cache (#2722) and the member-call fast path covers primitive string receivers (#2717). Array-like wrapper creation is a cached factory call with lazily materialized `length` (#2730), primitive elements convert without boxing on both indexed reads and `Array.prototype` iteration (#2731, #2735), the wrapper identity caches cover CLR arrays (#2716), and implicitly implemented interface methods are deduplicated in member resolution (#2711). **JSON.** `JSON.parse` interns property keys and string values within a parse, parses numbers off the span with an exactly-rounded fast path and scans string content in bulk (#2718, #2725, #2732) — the `json-parse-modern` comparison row is 6% faster with 23% less allocation than 4.13.0. Parsing is also aligned with the JSON grammar (#2738): malformed numbers like `-09` and `1.` are now rejected as in V8, while raw U+2028/U+2029 in strings and escaped control characters in keys — both valid JSON — are now accepted. **Strings.** Chained `slice`/`substring` and `split` segments stay zero-copy views (#2720), whole-string `substring`/`substr` return the receiver, and mismatched-length comparisons no longer materialize views (#2740). **Execution constraints at host boundaries.** Timeouts and cancellation are re-checked when control returns from host CLR code, so detection latency is bounded by one host call instead of a statement-count window, without adding per-statement cost — gated on execution depth so host-side reads of wrapped objects on an idle engine never observe a stale timer (#2713, #2714, #2715). Execution-context depth stays balanced when constraint exceptions unwind generator/async frames, and a host callback that re-enters the engine no longer resets the outer script's budget (#2736). **Correctness (including a pre-release review).** A review of everything since 4.13.0 fixed: spurious TDZ when a for-header reads a name the loop body shadows (#2709) and stale closure captures from destructuring defaults in for-loop headers (#2739); the compiled-invoker lane now defers to custom `ITypeConverter`s and preserves reflection exception types (#2737); and the new wrapper defaults were hardened — declared-type contracts for arrays (an `IReadOnlyList<T>`-typed member no longer yields a writable view), a static type-mapper poisoning crash, `Engine.Dispose` releasing the wrapper caches, and JS-array `in`/enumeration/out-of-range semantics on array views (#2735). Closure reads memoize slot-cache chain reachability (#2726). On the [engine comparison benchmarks](https://github.com/sebastienros/jint/blob/main/Jint.Benchmark/README.md), Jint 4.14.0 beats ClearScript (native V8) by 7.1×–9.1× on every script ↔ host interop row — host collection traversal went from last to second among all engines at 15,597 → 1,433 µs with 99% less allocation — while remaining the fastest managed engine on 10 of 12 pure-JS scripts and the fastest interpreter on all 12, and now leading `array-stress` and `dromaeo-object-array`, rows V8 narrowly led at 4.13.0. ## What's Changed * Refresh EngineComparison benchmarks for 4.13.0 by @lahma in sebastienros/jint#2704 * Fix spurious TDZ when a for-header reads a name the loop body shadows by @svenrog in sebastienros/jint#2709 * Bump the testing group with 1 update by @dependabot[bot] in sebastienros/jint#2710 * Add tests for using modules from script code run via Evaluate by @lahma in sebastienros/jint#2712 * Deduplicate implicitly implemented interface methods in member resolution by @lahma in sebastienros/jint#2711 * Re-check amortized constraints at interpreter/host-code boundaries by @lahma in sebastienros/jint#2713 * Add ClearScript V8 to engine comparison benchmarks, trim suite, add script-to-host interop suite by @viceice in sebastienros/jint#1775 * Gate host-boundary constraint checks on active evaluation and harden coverage by @lahma in sebastienros/jint#2714 * Key the host-boundary constraint gate on execution depth and close remaining lanes by @lahma in sebastienros/jint#2715 * Cover CLR arrays with the interop identity caches by @lahma in sebastienros/jint#2716 * Extend the member-call fast path to primitive string receivers by @lahma in sebastienros/jint#2717 * Intern object property keys within a single JSON parse by @lahma in sebastienros/jint#2718 * Precompute per-parameter interop binding flags by @lahma in sebastienros/jint#2719 * Keep slice-of-slice and split segments zero-copy by @lahma in sebastienros/jint#2720 * Add opt-in ClrArrayConversion.LiveView interop mode for CLR arrays by @lahma in sebastienros/jint#2721 * Cache resolved ObjectWrapper members per member-expression node by @lahma in sebastienros/jint#2722 * Refresh engine comparison README after the V8-gap campaign by @lahma in sebastienros/jint#2723 * Bulk string scanning and a simple-number fast path for JSON.parse by @lahma in sebastienros/jint#2725 * Memoize slot-cache chain reachability for closure reads by @lahma in sebastienros/jint#2726 * Refresh engine comparison tables after the second campaign round by @lahma in sebastienros/jint#2727 * Default Interop.ArrayConversion to LiveView for 4.14 by @lahma in sebastienros/jint#2728 * Cache array-like wrapper factories and materialize length lazily by @lahma in sebastienros/jint#2730 * Convert primitive array-like wrapper elements without boxing by @lahma in sebastienros/jint#2731 * Add a compiled-invoker fast lane for single-candidate interop method calls by @lahma in sebastienros/jint#2733 * Intern JSON.parse string values and parse numbers off the span by @lahma in sebastienros/jint#2732 * Default Interop.CacheRecentObjectWrappers to true for 4.14 by @lahma in sebastienros/jint#2734 * Harden LiveView array wrappers and interop wrapper caches for 4.14 by @lahma in sebastienros/jint#2735 * Keep execution-context depth balanced under raw constraint exceptions by @lahma in sebastienros/jint#2736 ... (truncated) Commits viewable in [compare view](sebastienros/jint@v4.13.0...v4.14.0). </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
This was referenced Jul 29, 2026
This was referenced Aug 7, 2026
This was referenced Aug 14, 2026
This was referenced Aug 24, 2026
This was referenced Sep 1, 2026
This was referenced Sep 9, 2026
This was referenced Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the V8-gap performance campaign (#1775 follow-up). CPU profiles of the two string comparison rows showed the callee method for
str.slice(...)-style calls being re-resolved on every invocation (StringInstance.GetOwnProperty+Engine.TryHandleStringValue≈ 7.5% on object-string,Engine.GetValue(Reference)8.4% on base64 — all driven fromJintCallExpression).Change
JintMemberExpression.GetCalleeForCall— which already serves object receivers from the member IC — gains a string-receiver lane: the method is resolved fromString.prototypeand the descriptor is cached per AST node under the same holder-identity +_propertiesVersionguard as the existing prototype-method cache (caching the descriptor, not the callable, keeps in-placeString.prototype.slice = fnreplacement honored — its value is read fresh per call).thisis the primitive itself, matching the slow path's this-binding exactly.Safety rails:
lengthand any name that Jint'sStringInstance.GetOwnPropertywould treat as an own index property — the check mirrors the runtimeToNumbercoercion exactly ("0x1","1e1"," 1","01","-0"all denied), so prototype-planted functions can never shadow own character properties through the cache.RavenApiUsageTests.CanInheritCustomStringstays green.Numbers (default BDN job, same-base A/B vs main)
Gates
Jint.Tests 3658/3595 (net10/net472), PublicInterface 114/114 both TFMs, Test262 99,431 passed / 0 failed. New tests cover loop correctness, mid-loop prototype method replacement (assignment, defineProperty, delete),
lengthsemantics, and index-shaped prototype plants.🤖 Generated with Claude Code