shapes: true field representations and one birth shape (step 5 P2b–P2d, T1)

changelog.d/11674-shape-class-birth-f64.md

@@ -0,0 +1 @@
+- Charter step 5 (T1): a class whose constructor prologue writes every `number` field from a parameter before anything can read it (the #7510 "declared at allocation" proof) is now born with a shape whose representation is `F64` for exactly those fields. Codegen makes the decision once (`typed_shape::class_birth_rep_in`) and passes the word to the module-init mint (`js_object_shape_id_for_class_keys{,_live}` and `js_gc_typed_shape_id_for_keys` take a trailing `rep: u64`); the inline allocation and the runtime stamped allocator birth-fill those lanes with `+0.0` instead of `undefined`; the class-field store precheck finite-tests every value bound for an `F64` birth lane, so a non-Number or non-finite value takes the checked, generalizing path. The rep is part of a birth shape's static-id content (`static_shape_ids::BirthShape::rep`; `js_object_shape_id_for_class_keys_static` takes it too), so an importing module's all-`Any` stub never adopts an `F64` birth id. `PERRY_FIELD_REPR_VERIFY` gains the reverse typed-layout cross-check: a compiled birth id that declares an `F64` lane may not leave any raw-f64 slot of its intact layout `Any`.

changelog.d/11674-shape-field-rep-class-instances.md

@@ -0,0 +1,5 @@
+Class instances can now keep a Number-only field in its unboxed form too. The
+restriction that kept every class instance on the boxed representation is
+gone: every class-field fast path already matches the instance by its exact
+shape, and a shape that marks a field Number-only sends other values through
+the checked path.

changelog.d/11674-shape-field-rep-delete-no-release.md

@@ -0,0 +1,3 @@
+Deleting a property from an object whose Number-only fields are stored
+unboxed no longer runs an extra release step first; the delete already moves
+the object to a general shape before it shifts any value.

changelog.d/11674-shape-field-rep-inline-store-check.md

@@ -0,0 +1,8 @@
+Every compiled fast path that stores into an object's field now respects the
+field's recorded representation: when a shape says a slot holds a Number, the
+inline store and the inline property-add accept only a plain double there and
+send anything else (an object, a string, an integer box, NaN, Infinity) to the
+runtime, which re-describes the field before storing. Deleting a property
+drops the representation before it moves values between slots. A new
+`field-rep-assert` runtime feature (always on in debug builds) checks at every
+collection that each such slot holds a double.

changelog.d/11674-shape-field-rep-key-add-convergence.md

@@ -0,0 +1,4 @@
+When a property is sometimes added with a non-number value, objects built the
+same way now settle on one shape for it instead of splitting between a
+number-only shape and a general one, so code that reads or writes that
+property keeps one fast path.

changelog.d/11674-shape-field-rep-key-add-one-publish.md

@@ -0,0 +1,4 @@
+A property add now publishes its field representation in the same shape
+publish that installs the key (or the grown slot bound), instead of minting an
+all-`Any` shape first and the representation-carrying one after it. Shape
+mints on tsc return to their pre-P2b count (14,345 vs 14,335; P2b had 19,438).

changelog.d/11674-shape-field-rep-key-add.md

@@ -0,0 +1,8 @@
+Adding a property now records its field representation in the shape: a key-add
+of a Number into an inline slot gives the new shape an `F64` lane, any other
+value (or an overflow slot) an `Any` lane, and the predecessor's lanes carry.
+The transition cache needs no new key bit: a cached edge serves a value only
+when its target's lane admits it (an `F64` lane refuses a non-Number, a target
+with a deprecated lane never serves, so new objects converge on the normalized
+shape). The by-name cache-hit writers and `js_object_set_field` now store
+through the checked funnel, so an `F64` slot always holds a canonical double.

changelog.d/11674-shape-field-rep-region-store.md

@@ -0,0 +1 @@
+- Charter step 5: a loop region's bare store runs no field-representation check, so the region now tells the runtime which keys it may store a value not proven a canonical double into (`js_region_loop_prime` / `js_region_loop_pack` take a trailing `boxed_mask`), and the pack refuses a word whose shape has a non-`Any` lane at such a key (census route `rt_rloop_refuse_f64_stored`); the static supplier (`static_region_slots`) refuses the same keys against the birth rep. A proven double still stores bare into any lane.

changelog.d/11674-shape-field-rep-store-check-fixture.md

@@ -0,0 +1,4 @@
+The field-representation store-check test now reaches the compiled store and
+property-add fast paths with a non-Number after they were primed on a Number
+field, and forces a collection after each case, so a fast path that skipped
+the check fails the test instead of passing unnoticed.

changelog.d/11674-shape-field-rep-verify-and-migrate.md

@@ -0,0 +1 @@
+- Charter step 5 (P2d): `PERRY_FIELD_REPR_VERIFY=1` checks the field-representation invariant at every object trace in a runtime built with `gc-instruments` (always on in debug and with `field-rep-assert`), plus a cross-check that an intact typed layout never calls an F64 lane a pointer slot; a binary without the feature aborts at startup when the knob is set. Every property-IC miss entry (generic get fast miss, put-value set and dynamic set misses, class-field get/set fast misses) now migrates a receiver whose shape has a deprecated lane before it learns anything from it.

changelog.d/11674-typed-recv-clone-shape-guard.md

@@ -0,0 +1 @@
+- A method call on a receiver whose class codegen proved (the `$typed_f64_recv` clone route in `try_lower_instance_method_call`) now runs the clone only while the receiver's (class id, ShapeId) pair is the class's own (`emit_class_field_read_precheck`, raw): an alias the object escaped to may store a non-Number into a field, which moves the object off its birth shape, and the clone reads its fields as raw doubles. Otherwise the call takes the generic target.

crates/perry-codegen/src/codegen/artifacts.rs

@@ -1002,6 +1002,7 @@ pub(super) fn emit_module_artifacts(c: ModuleArtifactsCtx<'_>) -> Result<()> {
         output_type,
         class_keys_init_data,
         class_header_image_inits,
+        &cross_module.class_birth_reps,
         class_ids,
         class_table,
         &hir.classes,

crates/perry-codegen/src/codegen/closure.rs

@@ -1120,6 +1120,7 @@ pub(super) fn compile_closure(
         class_field_counts: &cross_module.class_field_counts,
         class_init_chains: &cross_module.class_init_chains,
         class_header_image_globals: &cross_module.class_header_images,
+        class_birth_reps: &cross_module.class_birth_reps,
         imported_class_ctors: &cross_module.imported_class_ctors,
         func_signatures,
         func_synthetic_arguments,

crates/perry-codegen/src/codegen/entry.rs

@@ -709,6 +709,7 @@ pub(super) fn compile_module_entry(
             class_field_counts: &cross_module.class_field_counts,
             class_init_chains: &cross_module.class_init_chains,
             class_header_image_globals: &cross_module.class_header_images,
+            class_birth_reps: &cross_module.class_birth_reps,
             imported_class_ctors: &cross_module.imported_class_ctors,
             func_signatures,
             func_synthetic_arguments,
@@ -1571,6 +1572,7 @@ pub(super) fn compile_module_entry(
             class_field_counts: &cross_module.class_field_counts,
             class_init_chains: &cross_module.class_init_chains,
             class_header_image_globals: &cross_module.class_header_images,
+            class_birth_reps: &cross_module.class_birth_reps,
             imported_class_ctors: &cross_module.imported_class_ctors,
             func_signatures,
             func_synthetic_arguments,

crates/perry-codegen/src/codegen/function.rs

@@ -1247,6 +1247,7 @@ pub(super) fn compile_function(
         class_field_counts: &cross_module.class_field_counts,
         class_init_chains: &cross_module.class_init_chains,
         class_header_image_globals: &cross_module.class_header_images,
+        class_birth_reps: &cross_module.class_birth_reps,
         imported_class_ctors: &cross_module.imported_class_ctors,
         func_signatures,
         func_synthetic_arguments,

crates/perry-codegen/src/codegen/method.rs

@@ -601,6 +601,7 @@ pub(super) fn compile_method(
         class_field_counts: &cross_module.class_field_counts,
         class_init_chains: &cross_module.class_init_chains,
         class_header_image_globals: &cross_module.class_header_images,
+        class_birth_reps: &cross_module.class_birth_reps,
         imported_class_ctors: &cross_module.imported_class_ctors,
         func_signatures,
         func_synthetic_arguments,

crates/perry-codegen/src/codegen/method_static.rs

@@ -276,6 +276,7 @@ pub(in crate::codegen) fn compile_static_method(
         class_field_counts: &cross_module.class_field_counts,
         class_init_chains: &cross_module.class_init_chains,
         class_header_image_globals: &cross_module.class_header_images,
+        class_birth_reps: &cross_module.class_birth_reps,
         imported_class_ctors: &cross_module.imported_class_ctors,
         func_signatures,
         func_synthetic_arguments,

crates/perry-codegen/src/codegen/mod.rs

@@ -251,6 +251,7 @@ mod static_shape_ids;
 pub use static_shape_ids::{
     assign_static_shape_ids, decode_static_seed, encode_static_seed, take_module_static_seeds,
     BirthProto, BirthShape, DefinedClassShape, ModuleBirth, ProgramClassShapeIds, TypedMasks,
+    STATIC_SEED_FORMAT,
 };
 pub(crate) use static_shape_ids::{
     static_region_slots, static_shape_id_for_foreign_global, static_shape_id_for_keys_global,
@@ -2443,12 +2444,34 @@ fn compile_module_impl(
         inits.retain(|_, (class_id, _, _)| *class_id != u32::MAX);
         inits
     };
+    // Charter step 5, T1: each class's birth rep (`typed_shape::class_birth_rep_in`),
+    // keyed like the header-image inits by keys global. Two names sharing a
+    // keys global that disagree get `Any` (0): every consumer reads this map,
+    // so they still agree with each other.
+    let class_birth_reps_map: std::collections::HashMap<String, u64> = {
+        let mut reps: std::collections::HashMap<String, u64> = std::collections::HashMap::new();
+        for (class_name, keys_global) in &class_keys_globals_map {
+            let rep = crate::typed_shape::class_birth_rep_in(
+                &class_table,
+                &class_keys_globals_map,
+                &class_init_chains_map,
+                imported_stub_names.contains(class_name.as_str()),
+                class_name,
+            );
+            let entry = reps.entry(keys_global.clone()).or_insert(rep);
+            if *entry != rep {
+                *entry = 0;
+            }
+        }
+        reps
+    };
     if let Some(births) = births {
         *births = static_shape_ids::module_births(
             &module_prefix,
             &class_keys_init_data,
             defined_class_keys_len,
             &class_header_image_inits,
+            &class_birth_reps_map,
             &class_ids,
         );
         return Ok(Vec::new());
@@ -2457,6 +2480,7 @@ fn compile_module_impl(
         &module_prefix,
         &class_keys_init_data,
         &class_header_image_inits,
+        &class_birth_reps_map,
         &class_ids,
         &opts.static_shape_ids,
         &opts.program_class_shape_ids,
@@ -2568,6 +2592,7 @@ fn compile_module_impl(
         class_field_counts: class_field_counts_map,
         class_init_chains: class_init_chains_map,
         class_header_images: class_header_images_map,
+        class_birth_reps: class_birth_reps_map,
         imported_class_ctors: opts
             .imported_classes
             .iter()

crates/perry-codegen/src/codegen/opts.rs

@@ -988,6 +988,10 @@ pub(crate) struct CrossModuleCtx {
     /// both come from `target_layout::inline_alloc_gc_packed`, but a header
     /// word is not something to trust by argument.
     pub class_header_images: std::collections::HashMap<String, (String, u64, u32)>,
+    /// Keys global -> the class's birth rep word (charter step 5, T1;
+    /// `typed_shape::class_birth_rep_in`): what module init mints and what
+    /// every inline allocation and class-field store of the class obeys.
+    pub class_birth_reps: std::collections::HashMap<String, u64>,
     /// Imported class constructor function names. Maps class_name →
     /// full constructor symbol (e.g. "Editor" → "hone_editor_...__Editor_constructor").
     /// Populated from `opts.imported_classes`.

crates/perry-codegen/src/codegen/static_shape_ids.rs

@@ -54,20 +54,29 @@ pub struct BirthShape {
     pub live: u32,
     pub proto: BirthProto,
     pub typed: Option<TypedMasks>,
+    /// The birth representation word (charter step 5, T1;
+    /// `typed_shape::class_birth_rep_in`): `F64` lanes are shape identity at
+    /// runtime, so they are content here. A class born with an `F64` lane and
+    /// an importer's all-`Any` stub of the same keys are two contents, and
+    /// the stub never adopts the definer's id.
+    pub rep: u64,
 }
 
 impl BirthShape {
     /// A literal content without a typed layout: the runtime seed mints it
-    /// from its key names alone (`js_shape_seed_plain`). Class contents are
-    /// seeded by their class registration, typed ones by their typed install.
+    /// from its key names and its birth rep (`js_shape_seed_plain`), the
+    /// same facts the literal's own mint names, so the seed and a lazy mint
+    /// are one ShapeId. Class contents are seeded by their class
+    /// registration, typed ones by their typed install.
     pub fn is_seedable(&self) -> bool {
         self.proto == BirthProto::Literal && self.typed.is_none()
     }
 
     /// The facts the runtime mints for this content, without the masks: a
-    /// typed layout and a structural mint of the same class share them.
-    pub(crate) fn structure(&self) -> (&[u8], u32, u32, &BirthProto) {
-        (&self.keys, self.key_count, self.live, &self.proto)
+    /// typed layout and a structural mint of the same class share them. The
+    /// rep is a runtime fact, so it is part of them.
+    pub(crate) fn structure(&self) -> (&[u8], u32, u32, &BirthProto, u64) {
+        (&self.keys, self.key_count, self.live, &self.proto, self.rep)
     }
 
     /// A stable 64-bit FNV-1a over the content (never `RandomState`: the id
@@ -100,6 +109,12 @@ impl BirthShape {
                 }
             }
         }
+        // An all-`Any` rep adds nothing, so contents without an `F64` lane
+        // keep the ids they had before the rep was content.
+        if self.rep != 0 {
+            eat(&[3]);
+            eat(&self.rep.to_le_bytes());
+        }
         h
     }
 
@@ -298,6 +313,7 @@ pub(crate) fn class_birth(
     module_prefix: &str,
     entry: &ClassKeysInit,
     class_header_image_inits: &HashMap<String, (u32, u64, u32)>,
+    class_birth_reps: &HashMap<String, u64>,
     class_ids: &HashMap<String, u32>,
 ) -> ClassBirth {
     let (global_name, packed, field_count, raw_mask_words, pointer_mask_words) = entry;
@@ -344,6 +360,7 @@ pub(crate) fn class_birth(
             raw_f64_words: raw_mask_words.clone(),
             pointer_words: pointer_mask_words.clone(),
         }),
+        rep: class_birth_reps.get(global_name).copied().unwrap_or(0),
     });
     ClassBirth {
         class_id,
@@ -378,6 +395,7 @@ pub(crate) fn set_module_static_ids(
     module_prefix: &str,
     class_keys_init_data: &[ClassKeysInit],
     class_header_image_inits: &HashMap<String, (u32, u64, u32)>,
+    class_birth_reps: &HashMap<String, u64>,
     class_ids: &HashMap<String, u32>,
     assigned: &[(BirthShape, u32)],
     program: &ProgramClassShapeIds,
@@ -389,7 +407,13 @@ pub(crate) fn set_module_static_ids(
         class_keys_init_data
             .iter()
             .filter_map(|entry| {
-                let birth = class_birth(module_prefix, entry, class_header_image_inits, class_ids);
+                let birth = class_birth(
+                    module_prefix,
+                    entry,
+                    class_header_image_inits,
+                    class_birth_reps,
+                    class_ids,
+                );
                 let shape = birth.shape.as_ref()?;
                 let own = *by_content.get(shape)?;
                 let id = program.resolved_id(&entry.0, birth.class_id, shape, own);
@@ -420,21 +444,34 @@ pub fn take_module_static_seeds() -> Vec<(u32, BirthShape)> {
     MODULE_SEEDS.with(|s| std::mem::take(&mut *s.borrow_mut()).into_iter().collect())
 }
 
+/// The version of the seed sidecar's line format ([`encode_static_seed`]),
+/// part of the object-cache key: an entry written in another format is a
+/// miss, never a line this decoder reads as other facts (a pinned
+/// `PERRY_OBJECT_CACHE_BUILD_ID` keeps the build id across compilers).
+pub const STATIC_SEED_FORMAT: &str = "2";
+
 /// One seed as a line of the object cache's seed sidecar:
-/// `<id> <key_count> <live> <hex of the NUL-terminated key names>`.
+/// `<id> <key_count> <live> <hex of the NUL-terminated key names> <rep>`,
+/// the rep as `0x`-prefixed hex. Every field the seed mints from is in the
+/// line: a warm link seeds exactly the facts the cold one did.
 pub fn encode_static_seed(id: u32, shape: &BirthShape) -> String {
     let hex: String = shape.keys.iter().map(|b| format!("{b:02x}")).collect();
-    format!("{id} {} {} {hex}", shape.key_count, shape.live)
+    format!(
+        "{id} {} {} {hex} {:#x}",
+        shape.key_count, shape.live, shape.rep
+    )
 }
 
-/// The inverse of [`encode_static_seed`]; `None` for a malformed line.
+/// The inverse of [`encode_static_seed`]; `None` for a malformed line
+/// (including a line of another format, which lacks the rep field).
 pub fn decode_static_seed(line: &str) -> Option<(u32, BirthShape)> {
     let mut it = line.split_ascii_whitespace();
     let id = it.next()?.parse().ok()?;
     let key_count = it.next()?.parse().ok()?;
     let live = it.next()?.parse().ok()?;
-    let hex = it.next().unwrap_or("");
-    if it.next().is_some() || hex.len() % 2 != 0 {
+    let hex = it.next()?;
+    let rep = u64::from_str_radix(it.next()?.strip_prefix("0x")?, 16).ok()?;
+    if it.next().is_some() || hex.is_empty() || hex.len() % 2 != 0 {
         return None;
     }
     let keys = (0..hex.len())
@@ -449,6 +486,7 @@ pub fn decode_static_seed(line: &str) -> Option<(u32, BirthShape)> {
             live,
             proto: BirthProto::Literal,
             typed: None,
+            rep,
         },
     ))
 }
@@ -474,9 +512,16 @@ pub(crate) fn static_shape_id_for_keys_global(keys_global: &str) -> Option<u32>
 /// data summary, no holes and generation 0, so the slots follow from the
 /// keys alone and this is the word the runtime would publish for the id.
 /// `None` (the region keeps its learned supplier alone) when a key is not an
-/// inline key of the birth shape. A returned id is a guard immediate: it
-/// joins the module's seed set like any other.
-pub(crate) fn static_region_slots(keys_global: &str, keys: &[String]) -> Option<(u32, Vec<u32>)> {
+/// inline key of the birth shape, or when a key in `boxed_mask` (a bare
+/// store of a value not proven a canonical double) sits on a non-`Any` lane
+/// of the birth rep: the runtime's pack refuses that word too (charter step
+/// 5). A returned id is a guard immediate: it joins the module's seed set
+/// like any other.
+pub(crate) fn static_region_slots(
+    keys_global: &str,
+    keys: &[String],
+    boxed_mask: u32,
+) -> Option<(u32, Vec<u32>)> {
     MODULE_STATIC_IDS.with(|m| {
         let m = m.borrow();
         let (id, shape) = m.get(keys_global)?;
@@ -496,6 +541,14 @@ pub(crate) fn static_region_slots(keys_global: &str, keys: &[String]) -> Option<
                 (at < 32).then_some(at as u32)
             })
             .collect::<Option<Vec<u32>>>()?;
+        let lane_is_any = |slot: u32| (shape.rep >> (2 * slot)) & 0b11 == 0;
+        if slots
+            .iter()
+            .enumerate()
+            .any(|(i, &slot)| boxed_mask & (1 << i) != 0 && !lane_is_any(slot))
+        {
+            return None;
+        }
         note_guard_id(*id, Some(shape));
         Some((*id, slots))
     })
@@ -535,13 +588,20 @@ pub(crate) fn module_births(
     class_keys_init_data: &[ClassKeysInit],
     defined_len: usize,
     class_header_image_inits: &HashMap<String, (u32, u64, u32)>,
+    class_birth_reps: &HashMap<String, u64>,
     class_ids: &HashMap<String, u32>,
 ) -> Vec<ModuleBirth> {
     class_keys_init_data
         .iter()
         .enumerate()
         .filter_map(|(i, entry)| {
-            let birth = class_birth(module_prefix, entry, class_header_image_inits, class_ids);
+            let birth = class_birth(
+                module_prefix,
+                entry,
+                class_header_image_inits,
+                class_birth_reps,
+                class_ids,
+            );
             Some(ModuleBirth {
                 keys_global: entry.0.clone(),
                 class_id: birth.class_id,