Flush the property cache for a prototype, not for every property

`js_prop_cache_invalidate` bumps a runtime-wide generation counter, so
every entry in the shape-keyed property cache dies at once. It was called
unconditionally on entry to `add_property`. Every object literal field,
every constructor field and every expando therefore threw away the whole
cache: an ExpressX request does that twenty-odd times, and every field
read in between paid a miss and a refill.

Only a prototype's new property can make a live entry wrong. An entry
answers "a receiver of shape S finds this at depth d, slot k", and it is
only ever filled from a property that was found. Adding to an ordinary
object changes that object's own shape, so an entry keyed on the old one
stops matching it, and no other object's layout moved. Adding to a
prototype can shadow something a site already found further down the
chain, which is the one case a live entry is still matched and wrong.
Resize, compact, in-place shape update, prototype reassignment and a
freed shape's address all keep their own invalidation at their own site.

The gate needs `is_prototype` to mean what it says, and it did not.
Upstream sets it only in `JS_SetPrototypeInternal`, because upstream uses
it to track `Array.prototype` rather than to answer "is anyone
inheriting from me" -- so `Foo.prototype` and every builtin prototype had
it false. It is now set in `js_new_shape_nohash`, the one funnel every
shape creation passes through, which flags an object the moment a shape
names it as a prototype. That necessarily precedes any cached entry whose
chain includes it, because an entry is only filled from a receiver that
was actually walked.

Worth: twelve warm reads sharing a loop with one four-field literal go
150.9 to 128.0 ns an iteration, which is 25.7 ns of flush interference
down to 5.6. On ExpressX, 0.1 to 1.8% across seven request shapes. On
benchmarks/wintertc, nothing. The last two are the honest part: ExpressX
reads few fields twice on the same shape, and none of the wintertc
workloads is a warm read set. It is kept for being strictly less work,
not for those two rows.

tests/fixtures/prop_cache_shadow.mjs guards it: warm sites, then an own
property shadowing an inherited one, a nearer prototype shadowing a
further one, `Object.prototype` gaining and losing one, a constructor
prototype's method replaced and then shadowed, `setPrototypeOf` under a
warm site, an accessor redefined as data, delete-and-regrow, and 500
iterations of ordinary object churn that must disturb none of it. Node
runs the same file and agrees. Deleting the `is_prototype` line makes it
fail on the `Foo.prototype` case, which is the negative control. All 53
files in third_party/quickjs/tests behave identically either way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: nanofuxion

CMakeLists.txt

@@ -236,6 +236,13 @@ if(BUILD_TESTING AND SXN_BUILD_TESTS)
   # expected value is Node's, bar the one i32 wrap that is SX's by definition.
   add_test(NAME sxn-struct-sroa COMMAND sxn ${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/struct_sroa.sx)
   set_tests_properties(sxn-struct-sroa PROPERTIES FAIL_REGULAR_EXPRESSION "FAIL")
+  # The property cache is flushed when a prototype gains a property, and not
+  # when an ordinary object does. This is the second half: a warm call site
+  # that has already found a property, and then something that should shadow
+  # or move it. Every answer is Node's, and `node tests/fixtures/
+  # prop_cache_shadow.mjs` runs the same file.
+  add_test(NAME sxn-prop-cache-shadow COMMAND sxn ${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/prop_cache_shadow.mjs)
+  set_tests_properties(sxn-prop-cache-shadow PROPERTIES FAIL_REGULAR_EXPRESSION "FAIL")
   # Reference cycles are invisible to refcounting and reclaimable only by the
   # cycle collector, which runs only on allocation. Sxn.gc() is the explicit
   # ask; this asserts a burst of 100k cyclic closures comes back.

spec/IMPLEMENTATION.md

@@ -375,6 +375,61 @@ emitter by a byte. Nothing emitted it -- it is selected only for an unchecked
 checked -- so it had never mattered, and briefly making the path live is what
 surfaced it. It stays dead; the declaration is now honest.
 
+### The property cache was flushed by every property anyone added
+
+`js_prop_cache_invalidate` bumps a runtime-wide generation counter, which
+invalidates every entry in the shape-keyed property cache at once. It was
+called unconditionally on entry to `add_property` -- so every object literal
+field, every constructor field and every expando threw away the whole cache.
+An ExpressX request builds a 13-property response, adds eight properties to a
+native `Request` and builds an outcome object, so it did that twenty-odd
+times, and every field read between them paid a miss and a refill.
+
+Only a prototype's new property can make a live entry wrong. The cache answers
+"a receiver of shape S finds this at depth d, slot k", and it is only ever
+filled from a property that was *found*. Adding to an ordinary object changes
+that object's own shape, so an entry keyed on the old one stops matching it
+and nothing else moved. Adding to a prototype can shadow something a site
+already found further down the chain, and that is the one case where a live
+entry is still matched and is wrong. Every other way a property can move --
+resize, compact, in-place shape update, prototype reassignment, a freed
+shape's address -- already invalidates at its own site.
+
+That gate needed one other change to be sound. `is_prototype` was set only in
+`JS_SetPrototypeInternal`, which leaves it false for `Foo.prototype` and for
+every builtin prototype: upstream uses the flag only to track
+`Array.prototype`, not to answer "is anyone inheriting from me". It is now set
+in `js_new_shape_nohash`, the single funnel every shape creation passes
+through, so an object is flagged the moment a shape names it as a prototype --
+which necessarily precedes any cached entry whose chain includes it, because
+an entry is only filled from a receiver that was actually walked.
+
+`tests/fixtures/prop_cache_shadow.mjs` is the guard: warm call sites, then own
+properties shadowing inherited ones, a nearer prototype shadowing a further
+one, `Object.prototype` gaining and losing a property, a constructor
+prototype's method replaced and then shadowed, `setPrototypeOf` under a warm
+site, an accessor redefined as data, and 500 iterations of ordinary object
+churn that must disturb none of it. Node runs the same file and agrees.
+Removing the `is_prototype` line makes it fail on the `Foo.prototype` case,
+which is the one upstream leaves unflagged.
+
+Worth, measured three ways:
+
+| | flush every add | gated |
+|---|---|---|
+| 12 warm reads beside one 4-field literal | 150.9 ns | 128.0 |
+| ExpressX, per request, seven shapes | -- | 0.1 to 1.8% |
+| `benchmarks/wintertc` throughput | -- | unmoved |
+
+The first row is the shape the cache exists for and the interference is
+mostly gone: 25.7 ns of it per iteration against 5.6. The other two are the
+honest part. ExpressX reads few fields twice on the same shape -- a fresh
+`Request` and a fresh response object per request -- so most of its reads
+would miss anyway, and the wintertc workloads are Buffer, TextEncoder,
+EventEmitter and JSON, none of which is a warm read set. The change is kept
+because it is strictly less work for the same answer, not because those two
+rows moved.
+
 ### A JIT is ruled out by platform, not by effort
 
 iOS does not grant W^X/JIT entitlements to third-party apps, so a

spec/PERFORMANCE.md

@@ -64,6 +64,16 @@ tagged `arcsx:` in `third_party/quickjs`), roughly in order of payoff:
   pass allocated 7-8 blocks; recycling them is what took Buffer 83->36 ms
   and TextEncoder 65->23.5 ms in a single change, and cut the pause
   benchmark's total time from 1.1 s to 0.41 s.
+- **The property cache, flushed only by a prototype.** Adding a property to
+  any object at all used to invalidate every entry in the shape-keyed
+  property cache, so an object literal beside a warm read set threw the reads
+  away on every iteration. Only a prototype's new property can shadow
+  something a call site already found, so only that invalidates now. Twelve
+  warm reads sharing a loop with one four-field literal go 150.9 -> 128.0 ns
+  an iteration; the interference the flush caused was 25.7 ns of that and is
+  now 5.6. The rows in this document do not move -- none of these workloads
+  is a warm read set -- and `spec/IMPLEMENTATION.md` has the soundness
+  argument and the fixture that guards it.
 - **Pinned core-type shapes.** QuickJS interns the empty shape behind
   `new Foo()` in a runtime-wide table, but nothing holds a reference to it,
   so a loop that allocates and drops one object per iteration destroys the

tests/fixtures/prop_cache_shadow.mjs

@@ -0,0 +1,143 @@
+// The property cache is invalidated when a prototype gains a property, and
+// not when an ordinary object does. These are the shapes where the second
+// half could go wrong: a site that has already cached where it found a
+// property, and then something adds one that should shadow it, or moves it.
+//
+// Every answer here is the language's, and none of them depends on a cache.
+
+let failures = 0;
+function check(name, actual, expected) {
+  if (!Object.is(actual, expected)) {
+    console.log("FAIL", name, "expected", expected, "got", actual);
+    failures += 1;
+  }
+}
+// One call site per case, so each has its own cache entry, and each is warmed
+// before the mutation it is meant to notice.
+const warm = (f, x, n) => { for (let i = 0; i < n; i++) f(x); };
+
+// --- a new own property shadows an inherited one -------------------------
+{
+  const proto = { m: "proto" };
+  const o = Object.create(proto);
+  const read = (x) => x.m;
+  warm(read, o, 200);
+  check("inherited before", read(o), "proto");
+  o.m = "own";
+  check("own shadows inherited", read(o), "own");
+}
+
+// --- a nearer prototype shadows a further one ----------------------------
+{
+  const far = { m: "far" };
+  const near = Object.create(far);
+  const o = Object.create(near);
+  const read = (x) => x.m;
+  warm(read, o, 200);
+  check("found at depth 2", read(o), "far");
+  near.m = "near";
+  check("depth 1 shadows depth 2", read(o), "near");
+}
+
+// --- Object.prototype, reached from a plain object -----------------------
+{
+  const o = { a: 1 };
+  const read = (x) => x.zz_probe;
+  check("absent before", read(o), undefined);
+  warm(read, o, 200);
+  Object.prototype.zz_probe = "proto";
+  check("added to Object.prototype", read(o), "proto");
+  const mid = { zz_probe: "own" };
+  check("own beats Object.prototype", read(mid), "own");
+  delete Object.prototype.zz_probe;
+  check("deleted again", read(o), undefined);
+}
+
+// --- a constructor prototype gaining a method ----------------------------
+{
+  function Foo() { this.a = 1; }
+  Foo.prototype.m = function () { return "one"; };
+  const f = new Foo();
+  const call = (x) => x.m();
+  warm(call, f, 200);
+  check("prototype method", call(f), "one");
+  Foo.prototype.m = function () { return "two"; };
+  check("replaced on the prototype", call(f), "two");
+  f.m = function () { return "own"; };
+  check("own method shadows it", call(f), "own");
+}
+
+// --- a fresh object assigned as a prototype after the site is warm -------
+{
+  function Bar() {}
+  const b = new Bar();
+  const read = (x) => x.k;
+  Object.prototype.k = "object";
+  warm(read, b, 200);
+  check("from Object.prototype", read(b), "object");
+  Bar.prototype.k = "bar";
+  check("Bar.prototype shadows it", read(b), "bar");
+  delete Object.prototype.k;
+  check("still Bar's", read(b), "bar");
+}
+
+// --- setPrototypeOf under a warm site ------------------------------------
+{
+  const a = { m: "a" }, c = { m: "c" };
+  const o = Object.create(a);
+  const read = (x) => x.m;
+  warm(read, o, 200);
+  check("through a", read(o), "a");
+  Object.setPrototypeOf(o, c);
+  check("through c", read(o), "c");
+}
+
+// --- ordinary objects growing, which must not disturb anything ----------
+{
+  const proto = { m: "proto" };
+  const read = (x) => x.m;
+  const first = Object.create(proto);
+  warm(read, first, 200);
+  let last = null;
+  for (let i = 0; i < 500; i++) {
+    // Each of these adds four properties to an ordinary object, which is
+    // what used to flush the cache 2000 times over this loop.
+    const churn = { w: i, x: i, y: i, z: i };
+    if (churn.w !== i) { failures += 1; }
+    last = Object.create(proto);
+    last.own = i;
+    if (read(last) !== "proto") { failures += 1; }
+  }
+  check("still found through the prototype", read(first), "proto");
+  check("and on the last one built", read(last), "proto");
+  proto.m = "changed";
+  check("changing the prototype is still seen", read(first), "changed");
+}
+
+// --- accessors and non-writables on a prototype --------------------------
+{
+  const proto = {};
+  Object.defineProperty(proto, "g", { get() { return "getter"; }, configurable: true });
+  const o = Object.create(proto);
+  const read = (x) => x.g;
+  warm(read, o, 200);
+  check("inherited getter", read(o), "getter");
+  Object.defineProperty(proto, "g", { value: "data", configurable: true });
+  check("redefined as data", read(o), "data");
+}
+
+// --- delete, resize and compaction --------------------------------------
+{
+  const o = {};
+  for (let i = 0; i < 40; i++) o["p" + i] = i;
+  const read = (x) => x.p39;
+  warm(read, o, 200);
+  check("last property", read(o), 39);
+  for (let i = 0; i < 39; i++) delete o["p" + i];
+  check("survives 39 deletes", read(o), 39);
+  for (let i = 0; i < 40; i++) o["q" + i] = i;
+  check("survives regrowth", read(o), 39);
+}
+
+if (failures !== 0) throw new Error(failures + " property-cache checks failed");
+console.log("property cache: all checks passed");

third_party/quickjs/quickjs.c

@@ -1270,9 +1270,12 @@ struct JSShape {
    - A hit requires an exact (pc, shape) match *and* a matching global
      generation stamp, so a stale entry can never be used.
    - `gen` is bumped by js_prop_cache_invalidate() at every point that can
-     change where a property lives: adding, deleting, resizing, compacting,
-     in-place shape updates, prototype changes, and shape frees (the last
-     also rules out a freed shape's address being reused by a new one).
+     change where a property lives: deleting, resizing, compacting, in-place
+     shape updates, prototype changes, shape frees (which also rules out a
+     freed shape's address being reused by a new one), and adding a property
+     to an object that is somebody's prototype. Adding to an ordinary object
+     needs no bump: its own shape changes, so an entry keyed on the old shape
+     stops matching it, and nothing else moved. See add_property.
    - Only the *location* is cached, never a value, so ordinary writes to an
      existing slot need no invalidation: the value is always read fresh.
    Walking `depth` prototypes from a live receiver is safe because
@@ -6758,8 +6761,20 @@ static inline JSShape *js_new_shape_nohash(JSContext *ctx, JSObject *proto,
     sh = get_shape_from_alloc(sh_alloc, hash_size);
     JS_REF_COUNT(sh) = 1;
     add_gc_object(rt, &sh->header, JS_GC_OBJ_TYPE_SHAPE);
-    if (proto)
+    if (proto) {
         js_dup(JS_MKPTR(JS_TAG_OBJECT, proto));
+        /* arcsx: every shape creation passes through here, so this is where
+           an object becomes reachable as somebody's prototype. Upstream sets
+           is_prototype only in JS_SetPrototypeInternal, which leaves it false
+           for `Foo.prototype` and for every builtin prototype -- fine while
+           the flag only tracked Array.prototype, but add_property now uses it
+           to decide whether a property being added can shadow one a call site
+           has already cached deeper in a chain. Flagged here, the answer is
+           always yes when it might be: a cached entry can only name a chain
+           that some real receiver walked, and creating that receiver's shape
+           ran this line first. */
+        proto->is_prototype = true;
+    }
     sh->proto = proto;
     /* prop_hash_mask must be set before prop_hash_end(sh) is used, as the hash
        location depends on it in the merged-header layout. */
@@ -11518,10 +11533,26 @@ JSValue JS_GetPropertyStr(JSContext *ctx, JSValueConst this_obj,
 static JSProperty *add_property(JSContext *ctx,
                                 JSObject *p, JSAtom prop, int prop_flags)
 {
-    js_prop_cache_invalidate(ctx->rt); /* arcsx: shape gains a property */
     JSShape *sh, *new_sh;
 
     if (unlikely(p->is_prototype)) {
+        /* arcsx: only a prototype's new property can invalidate a cached
+           lookup. The cache answers "a receiver of shape S finds this at
+           depth d, slot k", and it is only ever filled from a property that
+           was found. Adding to an ordinary object changes that object's own
+           shape, so an entry keyed on the old one stops matching it and no
+           other object's layout moved; adding to a prototype can shadow
+           something a site already found further down the chain, which is the
+           one case a live entry could still be matched and be wrong. Every
+           other way a property can move -- resize, compact, in-place shape
+           update, prototype reassignment, a freed shape's address -- keeps
+           its own invalidation at its own site.
+
+           This is the difference between flushing the runtime's whole
+           property cache on every object literal, constructor field and
+           expando, and flushing it when a prototype gains a method.
+           spec/PERFORMANCE.md has what it was worth. */
+        js_prop_cache_invalidate(ctx->rt);
         /* track addition of small integer properties to
            Array.prototype and Object.prototype */
         if (unlikely((p == JS_VALUE_GET_OBJ(ctx->class_proto[JS_CLASS_ARRAY]) ||