perf: function objects point to a static JsFunctionInfo; delete the closure-body registry

changelog.d/11637-perry-ffi-0.6-typed-js-bodies.md

@@ -3,13 +3,15 @@ function object runs is `body(callee, this, a0, ...)`; its Rust type is
 defined once, in perry-abi (`js_body_fn_ty!`, `JsBody0`..`JsBody16`,
 `JsThis`), and shared by the runtime and perry-ffi.
 
-- `perry_ffi::alloc_closure`, `register_closure_arity` and the new
-  `register_closure_rest` take a typed body (`F: JsBody<ClosureHeader>`)
-  instead of a `*const u8`. A body with the wrong signature — no receiver, a
-  wrong parameter type, a bare pointer — is a compile error on every
-  platform. Migrate with a cast to the body's type:
-  `alloc_closure(my_body as perry_ffi::JsBody1, captures)`, where `my_body`
-  is `extern "C" fn(*const RawClosureHeader, JsThis, f64) -> f64`.
+- `perry_ffi::alloc_closure(info, captures)` takes the body's
+  `&'static JsFunctionInfo`, built by `perry_ffi::js_function_info!(body, n)`
+  from the body's typed pointer (`JsBody0`..`JsBody16`) instead of a
+  `*const u8`. A body with the wrong signature — no receiver, a wrong
+  parameter type, a bare pointer — is a compile error on every platform.
+  `register_closure_arity` is removed: the parameter count comes from the
+  body's type, and other facts are builder calls on the info
+  (`js_function_info!(body, 1; with_rest(0))`). `my_body` is
+  `extern "C" fn(*const RawClosureHeader, JsThis, f64) -> f64`.
 - Calls into JS take the receiver after the function, `JsThis::UNDEFINED`
   for a plain call: `JsClosure::call0..4(this, ...)`, the new
   `JsClosure::call_slice(this, &args)` and `perry_ffi::call_value(func,
@@ -21,8 +23,8 @@ defined once, in perry-abi (`js_body_fn_ty!`, `JsBody0`..`JsBody16`,
   which is published before it (`scripts/publish_perry_ffi.sh`).
 - `scripts/check_js_body_call_funnel.py` refuses an `extern` declaration of a
   call entry without the receiver (a stale declaration compiles and passes
-  garbage as `this`), a closure registrar declared outside the runtime,
-  stdlib and perry-ffi, and a perry-ffi registration function taking a
+  garbage as `this`), a closure allocator declared outside the runtime,
+  stdlib and perry-ffi, and a perry-ffi `alloc_closure` taking a
   `*const u8`. It found stale entry declarations in perry-stdlib, the UI
   crates and the runtime's own geisterhand registry.
 - Every in-tree perry-ffi user (the `perry-ext-*` crates, the UI crates,

changelog.d/11654-fn-info-closure-body-registry.md

@@ -0,0 +1,37 @@
+**A function object points to its body's static `JsFunctionInfo`; the
+closure-body registry is gone.** Every fact a caller needs about a body —
+its code address, the parameter count a caller pads to, the rest kind and
+its fixed prefix, `.length` and its declared fallback, the arrow / strict /
+async / generator / built-in bits, and the compiler-private trusted-direct
+and versioned-loop clones — is one immutable record per body (perry-abi
+`JsFunctionInfo`), and the function object's header word at +8 points to it.
+A fact is one load from the object; nothing is looked up by code address.
+
+- Codegen emits each body's info as a constant next to the body
+  (`@<body>$info`), and every allocation names the info. A module declares
+  another module's info `external` instead of copying it, so a body has one
+  info and one singleton function object.
+- Runtime natives and perry-ffi addons define the info as a `static` from
+  the body's typed pointer: `fn_info!(body, n; ...)` in the runtime and
+  stdlib, `perry_ffi::js_function_info!(body, n; ...)` in addons. The
+  parameter count comes from the body's type; a body of any other signature
+  does not compile.
+- Deleted: `CLOSURE_BODY_REGISTRY`, `TRUSTED_TARGETS`, `DISPATCH_RECENT`, the
+  twelve `js_register_closure_*` entries (arity, rest, rest-and-arguments,
+  synthetic arguments, length, arrow, strict, async, generator, async
+  generator, trusted direct, versioned loop) with their ~885 references, and
+  every module-init registration call codegen emitted for them. A class
+  constructor's rest position travels with its class constructor flags.
+- perry-ffi 0.6: `alloc_closure(info, captures)` takes
+  `&'static JsFunctionInfo`; `register_closure_arity` and
+  `register_closure_rest` are removed (the facts are builder calls on the
+  info: `with_rest(n)`, `with_length(n)`, ...).
+- `ClosureHeader::code()` proves the cell is a live function object before it
+  loads through the info, so comparing an arbitrary receiver's code against a
+  known body stays a compare (it used to read the raw word at +8).
+- `scripts/check_js_body_call_funnel.py` refuses a closure allocator handed
+  a raw code pointer, an allocator declaration whose first parameter is not
+  `*const JsFunctionInfo`, and any `js_register_closure_*` name or deleted
+  code-keyed table anywhere in the crates.
+- `test-files/test_gap_fn_info_facts.ts` reads each info field through
+  generic calls (the function travels as a value), against node.

crates/perry-abi/src/lib.rs

@@ -31,12 +31,12 @@ pub const AGENT_PTR_STACK_LIMIT: usize = 2;
 pub const HOT_TLS_AGENT_PTRS_OFFSET: usize = 128;
 
 /// `closure::ClosureHeader` (LP64): the u32 capture count at 0, the ShapeId
-/// at 4 (the same word as `ObjectHeader`), the code pointer at 8, the shaped
-/// own-property record at 16, captures from 24. ILP32 targets shrink the two
-/// pointers: code pointer at 8, props at 12, captures from 16 (derived in
-/// `perry-codegen/src/target_layout.rs`).
+/// at 4 (the same word as `ObjectHeader`), the function's
+/// [`JsFunctionInfo`] pointer at 8, the shaped own-property record at 16,
+/// captures from 24. ILP32 targets shrink the two pointers: info at 8, props
+/// at 12, captures from 16 (derived in `perry-codegen/src/target_layout.rs`).
 pub const CLOSURE_SHAPE_OFFSET: usize = 4;
-pub const CLOSURE_FUNC_PTR_OFFSET: usize = 8;
+pub const CLOSURE_INFO_OFFSET: usize = 8;
 pub const CLOSURE_PROPS_OFFSET: usize = 16;
 pub const CLOSURE_HEADER_SIZE: usize = 24;
 
@@ -128,7 +128,7 @@ macro_rules! js_body_fn_ty {
 }
 
 /// A JS body with a statically known JS arity: implemented for exactly the
-/// [`js_body_fn_ty!`] pointer types (`JsBody0<C>` .. `JsBody16<C>`), so an API
+/// [`js_body_fn_ty!`] pointer types (`JsBody0<C>` .. `JsBody32<C>`), so an API
 /// taking `impl JsBody<C>` refuses any other signature — a bare `*const u8`,
 /// a body without the receiver, a wrong argument type — at compile time.
 ///
@@ -142,6 +142,21 @@ pub unsafe trait JsBody<C>: Copy {
     fn code(self) -> *const u8;
 }
 
+/// [`js_body_fn_ty!`] with the `C-unwind` calling convention, for the few
+/// runtime bodies a JS exception must be able to unwind through (the same
+/// register ABI).
+#[macro_export]
+macro_rules! js_body_unwind_fn_ty {
+    (@f64 $x:tt) => { f64 };
+    ($callee:ty; $($x:tt),* $(,)?) => {
+        unsafe extern "C-unwind" fn(
+            *const $callee,
+            $crate::JsThis
+            $(, $crate::js_body_unwind_fn_ty!(@f64 $x))*
+        ) -> f64
+    };
+}
+
 macro_rules! js_body_types {
     ($($alias:ident = $n:literal [$($x:tt),*];)*) => {$(
         #[doc = concat!("A JS body declaring ", stringify!($n), " JS parameters.")]
@@ -157,6 +172,41 @@ macro_rules! js_body_types {
     )*};
 }
 
+macro_rules! js_body_unwind_types {
+    ($($alias:ident = $n:literal [$($x:tt),*];)*) => {$(
+        #[doc = concat!("A `C-unwind` JS body declaring ", stringify!($n), " JS parameters.")]
+        pub type $alias<C> = js_body_unwind_fn_ty!(C; $($x),*);
+        // SAFETY: the pointer type is a JS body type by construction.
+        unsafe impl<C> JsBody<C> for $alias<C> {
+            const ARITY: u32 = $n;
+            #[inline(always)]
+            fn code(self) -> *const u8 {
+                self as *const u8
+            }
+        }
+    )*};
+}
+
+js_body_unwind_types! {
+    JsBodyUnwind0 = 0 [];
+    JsBodyUnwind1 = 1 [a];
+    JsBodyUnwind2 = 2 [a, a];
+    JsBodyUnwind3 = 3 [a, a, a];
+    JsBodyUnwind4 = 4 [a, a, a, a];
+    JsBodyUnwind5 = 5 [a, a, a, a, a];
+    JsBodyUnwind6 = 6 [a, a, a, a, a, a];
+    JsBodyUnwind7 = 7 [a, a, a, a, a, a, a];
+    JsBodyUnwind8 = 8 [a, a, a, a, a, a, a, a];
+    JsBodyUnwind9 = 9 [a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind10 = 10 [a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind11 = 11 [a, a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind12 = 12 [a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind13 = 13 [a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind14 = 14 [a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind15 = 15 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBodyUnwind16 = 16 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+}
+
 js_body_types! {
     JsBody0 = 0 [];
     JsBody1 = 1 [a];
@@ -175,6 +225,215 @@ js_body_types! {
     JsBody14 = 14 [a, a, a, a, a, a, a, a, a, a, a, a, a, a];
     JsBody15 = 15 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
     JsBody16 = 16 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody17 = 17 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody18 = 18 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody19 = 19 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody20 = 20 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody21 = 21 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody22 = 22 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody23 = 23 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody24 = 24 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody25 = 25 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody26 = 26 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody27 = 27 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody28 = 28 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody29 = 29 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody30 = 30 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody31 = 31 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+    JsBody32 = 32 [a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a];
+}
+
+/// Everything a function object's BODY determines, in one static, immutable
+/// record per body (the SharedFunctionInfo model): the code address and the
+/// facts every caller of the body needs. A function object points to its
+/// body's info from its header ([`CLOSURE_INFO_OFFSET`]); nothing is ever
+/// looked up by code address. Codegen emits one as a constant next to each
+/// body; runtime natives and perry-ffi addons declare one as a `static`
+/// ([`JsFunctionInfo::of`]), so the parameter count comes from the body's
+/// type.
+///
+/// Layout (LP64, pinned by `JS_FUNCTION_INFO_*` below; codegen emits it as
+/// `{ ptr, i16, i16, i32, i32, i32, ptr, i64, ptr, i32, i16, i16, i64 }`).
+#[repr(C)]
+#[derive(Debug, Clone, Copy)]
+pub struct JsFunctionInfo {
+    /// The body's code address (a function-table index on wasm32).
+    pub code: *const u8,
+    /// JS `f64` parameters the body declares after the callee and receiver —
+    /// a rest body's rest array included. A caller passing fewer pads with
+    /// `undefined` to this count.
+    pub params: u16,
+    /// Fixed parameters before the rest parameter (valid with `FN_REST_*`).
+    pub rest_fixed: u16,
+    /// `FN_*` bits.
+    pub flags: u32,
+    /// ECMAScript `.length` (valid with [`FN_HAS_LENGTH`]).
+    pub length: u32,
+    /// Captures the trusted direct-call clone was compiled for.
+    pub trusted_captures: u32,
+    /// A compiler-private direct-call clone of an arrow body that may use
+    /// compiler-proven capture invariants (null when none).
+    pub trusted_code: *const u8,
+    /// The trusted clone's boxed-capture mask.
+    pub trusted_boxed_mask: u64,
+    /// A compiler-private versioned-loop callback clone (null when none).
+    pub versioned_code: *const u8,
+    /// Captures the versioned-loop clone was compiled for.
+    pub versioned_captures: u32,
+    /// The JS-visible declared parameter count (valid with
+    /// [`FN_HAS_DECLARED`]): what `.length` falls back to. It can differ
+    /// from `params`, the ABI width a caller pads to.
+    pub declared: u16,
+    /// Padding (zero). Private, so an info can only be built through
+    /// [`JsFunctionInfo::of`] (typed) or the `unsafe`
+    /// [`JsFunctionInfo::from_code`].
+    reserved: u16,
+    /// The versioned-loop clone's boxed-capture mask.
+    pub versioned_boxed_mask: u64,
+}
+
+// SAFETY: immutable after construction; the pointers are code addresses.
+unsafe impl Sync for JsFunctionInfo {}
+
+/// `JsFunctionInfo::flags`: the body has a rest parameter bundling every JS
+/// argument from `rest_fixed` on (`...rest`).
+pub const FN_REST_USER: u32 = 1 << 0;
+/// The body takes a synthetic `arguments` array of every argument.
+pub const FN_REST_SYNTHETIC_ARGUMENTS: u32 = 1 << 1;
+/// The body takes both a `...rest` array and a synthetic `arguments` array.
+pub const FN_REST_USER_AND_ARGUMENTS: u32 = 1 << 2;
+/// Any rest kind.
+pub const FN_REST_MASK: u32 =
+    FN_REST_USER | FN_REST_SYNTHETIC_ARGUMENTS | FN_REST_USER_AND_ARGUMENTS;
+/// `length` is valid.
+pub const FN_HAS_LENGTH: u32 = 1 << 3;
+/// An arrow function: lexical `this`, not constructable.
+pub const FN_ARROW: u32 = 1 << 4;
+/// Strict-mode code (a primitive receiver is not boxed).
+pub const FN_STRICT: u32 = 1 << 5;
+/// An async function (async generators set it too).
+pub const FN_ASYNC: u32 = 1 << 6;
+/// A generator function (async generators set it too).
+pub const FN_GENERATOR: u32 = 1 << 7;
+/// An `async function*`.
+pub const FN_ASYNC_GENERATOR: u32 = 1 << 8;
+/// A built-in function kind without `[[Construct]]`.
+pub const FN_NON_CONSTRUCTOR: u32 = 1 << 9;
+/// A runtime-native built-in (its `[[Call]]` skips OrdinaryCallBindThis).
+pub const FN_BUILTIN: u32 = 1 << 10;
+/// `declared` is valid.
+pub const FN_HAS_DECLARED: u32 = 1 << 11;
+
+/// Byte offsets of the fields codegen emits and emitted code reads.
+pub const JS_FUNCTION_INFO_CODE_OFFSET: usize = 0;
+pub const JS_FUNCTION_INFO_PARAMS_OFFSET: usize = 8;
+pub const JS_FUNCTION_INFO_FLAGS_OFFSET: usize = 12;
+pub const JS_FUNCTION_INFO_SIZE: usize = 64;
+
+impl JsFunctionInfo {
+    /// The info of the body at `code` declaring `params` JS parameters, with
+    /// no other facts.
+    ///
+    /// # Safety
+    /// `code` is a JS body (`js_body_fn_ty!`) declaring exactly `params` JS
+    /// parameters — or one of the runtime's bound-value sentinels. Prefer
+    /// [`JsFunctionInfo::of`], which takes both from the body's type.
+    pub const unsafe fn from_code(code: *const u8, params: u16) -> Self {
+        JsFunctionInfo {
+            code,
+            params,
+            rest_fixed: 0,
+            flags: 0,
+            length: 0,
+            trusted_captures: 0,
+            trusted_code: core::ptr::null(),
+            trusted_boxed_mask: 0,
+            versioned_code: core::ptr::null(),
+            versioned_captures: 0,
+            declared: 0,
+            reserved: 0,
+            versioned_boxed_mask: 0,
+        }
+    }
+
+    /// The info of the typed body `body`: its code address and parameter
+    /// count both come from `body` itself —
+    /// `static INFO: JsFunctionInfo = JsFunctionInfo::of(body as JsBody2<C>);`
+    /// A body of any other signature does not compile.
+    pub const fn of<C, F: JsBody<C>>(body: F) -> Self {
+        // A `JsBody` is a function pointer: reinterpret it as its address.
+        union Code<F: Copy> {
+            body: F,
+            code: *const u8,
+        }
+        // SAFETY: `F` is a fn-pointer type (the trait is implemented for
+        // nothing else), the same size and bits as a code pointer.
+        let code = unsafe { Code { body }.code };
+        // SAFETY: `code` is `body`, a JS body of `F::ARITY` parameters.
+        unsafe { Self::from_code(code, F::ARITY as u16) }
+    }
+
+    /// With `FN_*` bits set.
+    pub const fn with_flags(mut self, flags: u32) -> Self {
+        self.flags |= flags;
+        self
+    }
+
+    /// With a JS-visible declared parameter count (`.length`'s fallback).
+    pub const fn with_declared(mut self, declared: u16) -> Self {
+        self.declared = declared;
+        self.flags |= FN_HAS_DECLARED;
+        self
+    }
+
+    /// With an ECMAScript `.length`.
+    pub const fn with_length(mut self, length: u32) -> Self {
+        self.length = length;
+        self.flags |= FN_HAS_LENGTH;
+        self
+    }
+
+    /// A `...rest` body with `fixed` parameters before the rest array.
+    pub const fn with_rest(mut self, fixed: u16) -> Self {
+        self.rest_fixed = fixed;
+        self.flags = (self.flags & !FN_REST_MASK) | FN_REST_USER;
+        self
+    }
+
+    /// A body of rest `kind` (one `FN_REST_*` bit) with `fixed` parameters
+    /// before its rest / `arguments` array.
+    pub const fn with_rest_kind(mut self, fixed: u16, kind: u32) -> Self {
+        self.rest_fixed = fixed;
+        self.flags = (self.flags & !FN_REST_MASK) | kind;
+        self
+    }
+
+    /// With a trusted direct-call clone of this arrow body, compiled for
+    /// `captures` captures with `boxed_mask` boxed ones.
+    pub const fn with_trusted_direct(
+        mut self,
+        code: *const u8,
+        captures: u32,
+        boxed_mask: u64,
+    ) -> Self {
+        self.trusted_code = code;
+        self.trusted_captures = captures;
+        self.trusted_boxed_mask = boxed_mask;
+        self
+    }
+
+    /// With a versioned-loop callback clone of this arrow body.
+    pub const fn with_versioned_loop(
+        mut self,
+        code: *const u8,
+        captures: u32,
+        boxed_mask: u64,
+    ) -> Self {
+        self.versioned_code = code;
+        self.versioned_captures = captures;
+        self.versioned_boxed_mask = boxed_mask;
+        self
+    }
 }
 
 /// `js_closure_call{N}(callee, this, a0..aN-1)` calls a function object with
@@ -235,12 +494,16 @@ pub const JS_CALL_ENTRIES: [&str; JS_CLOSURE_CALL_MAX_ARGS + 1 + 4] = [
 /// reads (`perry-codegen/src/expr/method_site.rs`).
 pub const METHOD_SITE_WORD_OFFSET: usize = 0;
 pub const METHOD_SITE_SLOT_OFFSET: usize = 8;
-pub const METHOD_SITE_FUNC_OFFSET: usize = 16;
+/// The memoized body's `JsFunctionInfo` (identity: a closure hits when its
+/// info word equals this).
+pub const METHOD_SITE_INFO_OFFSET: usize = 16;
 pub const METHOD_SITE_CLOSURE_OFFSET: usize = 24;
 pub const METHOD_SITE_GEN_OFFSET: usize = 32;
+/// The memoized body's code address, the hit's call target.
+pub const METHOD_SITE_CODE_OFFSET: usize = 40;
 /// Entries per method site, and one entry's size.
 pub const METHOD_SITE_WAYS: usize = 2;
-pub const METHOD_SITE_ENTRY_SIZE: usize = 40;
+pub const METHOD_SITE_ENTRY_SIZE: usize = 48;
 /// A method site calls a body with its argument count padded by `undefined`
 /// up to this many extra arguments (never past 16), and admits bodies that
 /// declare up to that many parameters.