From 9c72b1146bf6bc85a205c212705cc8bde1bbfbbd Mon Sep 17 00:00:00 2001
From: Marko Lahma <marko.lahma@gmail.com>
Date: Thu, 25 Jun 2026 21:49:01 +0300
Subject: [PATCH] Add write-side inline cache for obj.prop = value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reads of `obj.prop` already use a version-gated own-property inline cache in
JintMemberExpression.GetValue that skips the dictionary lookup on repeat reads.
Writes had no equivalent: every `obj.prop = value` rented a Reference, called
PutValue, re-hashed the property key, and did a dictionary lookup before the
in-place store.

Add TryAssignFast as the write-side counterpart, reusing the same cache slots.
When the receiver is a PlainObject whose shape is unchanged and the own property
is a live writable, non-accessor, non-custom data descriptor, the value is
written straight into the descriptor with no Reference rent, key hash, or lookup
— exactly the in-place store ObjectInstance.Set already performs (which by design
does not bump _propertiesVersion). The writability/data/custom flags are re-read
live on every store, because Object.defineProperty mutates them in place without
a version bump.

The fast path declines only at the eligibility gate (before evaluating anything);
once base and RHS are evaluated (each once, in spec order) it always completes the
assignment, falling back to PutValue rented from the already-resolved base+key for
absent / accessor / read-only / custom-value / non-PlainObject cases — so a
side-effecting base or RHS is never evaluated twice and prototype-setter,
CreateDataProperty, and strict read-only semantics are preserved.

Benchmarks (net10.0, AMD 5950X): ObjectAccess.UpdateObjectProperty -9.5..13%,
new WriteObjectProperty (pure write, write-miss population) -14%,
PropertyAlloc.Constructor1 -11%; allocations unchanged; no read-path or Test262
regressions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Jint.Benchmark/ObjectAccessBenchmark.cs       | 15 +++
 .../Expressions/JintAssignmentExpression.cs   | 12 ++-
 .../Expressions/JintMemberExpression.cs       | 92 +++++++++++++++++++
 3 files changed, 118 insertions(+), 1 deletion(-)

diff --git a/Jint.Benchmark/ObjectAccessBenchmark.cs b/Jint.Benchmark/ObjectAccessBenchmark.cs
index e3886c9fef..8fca1a8561 100644
--- a/Jint.Benchmark/ObjectAccessBenchmark.cs
+++ b/Jint.Benchmark/ObjectAccessBenchmark.cs
@@ -6,11 +6,19 @@ namespace Jint.Benchmark;
 public class ObjectAccessBenchmark
 {
     private readonly Prepared<Script> _script;
+    private readonly Prepared<Script> _writeOnlyScript;
 
     public ObjectAccessBenchmark()
     {
+        // Read-then-write of the same property: exercises both the member-read inline cache and the
+        // member-write inline cache on a stable object.
         const string Script = @"const summary = { res: 0 }; for (var i =0; i < 1_000_000; ++i){ summary.res = summary.res + 1; }";
         _script = Engine.PrepareScript(Script);
+
+        // Pure write of an existing property (the LHS node is never read), so the write-side inline cache
+        // can only warm up via write-miss population — then hit for the remaining iterations.
+        const string WriteOnlyScript = @"const summary = { res: 0 }; for (var i =0; i < 1_000_000; ++i){ summary.res = i; }";
+        _writeOnlyScript = Engine.PrepareScript(WriteOnlyScript);
     }
 
     [Benchmark]
@@ -19,4 +27,11 @@ public void UpdateObjectProperty()
         var engine = new Engine();
         engine.Evaluate(_script);
     }
+
+    [Benchmark]
+    public void WriteObjectProperty()
+    {
+        var engine = new Engine();
+        engine.Evaluate(_writeOnlyScript);
+    }
 }
diff --git a/Jint/Runtime/Interpreter/Expressions/JintAssignmentExpression.cs b/Jint/Runtime/Interpreter/Expressions/JintAssignmentExpression.cs
index 6861034950..65eef69678 100644
--- a/Jint/Runtime/Interpreter/Expressions/JintAssignmentExpression.cs
+++ b/Jint/Runtime/Interpreter/Expressions/JintAssignmentExpression.cs
@@ -563,8 +563,18 @@ protected override object EvaluateInternal(EvaluationContext context)
         // https://262.ecma-international.org/5.1/#sec-11.13.1
         private JsValue SetValue(EvaluationContext context)
         {
-            // slower version
             var engine = context.Engine;
+
+            // Write-side inline cache for `obj.prop = rhs` (mirrors JintMemberExpression.GetValue's read cache):
+            // resolves base+rhs once and stores straight into a live writable data descriptor, otherwise completes
+            // through PutValue. Only declines (returns false) before evaluating anything, so the slow path stays sound.
+            if (_left is JintMemberExpression memberLeft
+                && memberLeft.TryAssignFast(context, _right, out var fastResult))
+            {
+                return fastResult;
+            }
+
+            // slower version
             var lref = _left.Evaluate(context) as Reference;
             if (lref is null)
             {
diff --git a/Jint/Runtime/Interpreter/Expressions/JintMemberExpression.cs b/Jint/Runtime/Interpreter/Expressions/JintMemberExpression.cs
index 3d27315997..cbe98f1201 100644
--- a/Jint/Runtime/Interpreter/Expressions/JintMemberExpression.cs
+++ b/Jint/Runtime/Interpreter/Expressions/JintMemberExpression.cs
@@ -435,4 +435,96 @@ internal JsValue GetCalleeForCall(EvaluationContext context, out JsValue thisObj
         thisObject = JsValue.Undefined;
         return JsValue.Undefined;
     }
+
+    /// <summary>
+    /// Write-side counterpart of <see cref="GetValue"/>'s inline cache for <c>obj.prop = rhs</c>. Reuses the
+    /// same version-gated own-property cache slots: when the receiver is a <see cref="InternalTypes.PlainObject"/>
+    /// whose shape is unchanged and the own property is a <em>live</em> writable, non-accessor, non-custom data
+    /// descriptor, the new value is written straight into the descriptor (no Reference rent, no property-key hash,
+    /// no dictionary lookup) — exactly the in-place store <see cref="ObjectInstance.Set(JsValue,JsValue,JsValue)"/>
+    /// performs, which by design does not bump <c>_propertiesVersion</c>.
+    /// <para>
+    /// The method returns <c>false</c> only from the eligibility gate, having evaluated nothing, so the caller's
+    /// unchanged slow path runs. Once the base and right-hand side have been evaluated (each exactly once, in spec
+    /// order) it always completes the assignment and returns <c>true</c>: either the in-place store, or — for an
+    /// absent / accessor / read-only / custom-value property, or a non-<see cref="ObjectInstance"/> base — a
+    /// fallback through <see cref="Engine.PutValue"/> rented from the already-resolved base+key (so a side-effecting
+    /// base or RHS is never evaluated twice and prototype-setter / CreateDataProperty / strict read-only semantics
+    /// are preserved).
+    /// </para>
+    /// </summary>
+    internal bool TryAssignFast(EvaluationContext context, JintExpression right, out JsValue result)
+    {
+        var engine = context.Engine;
+
+        // Same eligibility as GetValue's primary fast path, plus the computed-read path's Suspendable==null gate:
+        // a static string-named, non-optional, non-short-circuiting, non-super property write with no custom
+        // resolver, in a context where neither operand can suspend (so no generator/async bookkeeping is needed).
+        if (_propertyExpression is not null
+            || _determinedProperty is not JsString determinedProperty
+            || _memberExpression.Optional
+            || _objectExpressionCanShortCircuit
+            || engine._customResolver
+            || _objectExpression is JintSuperExpression
+            || engine.ExecutionContext.Suspendable is not null)
+        {
+            result = JsValue.Undefined;
+            return false;
+        }
+
+        // Evaluate base, then RHS — each exactly once, preserving base→key→rhs spec order. A null/undefined base
+        // is simply not a PlainObject and flows to the fallback, where PutValue→ToObject throws after the RHS.
+        var baseValue = _objectExpression.GetValue(context);
+        var rval = right.GetValue(context);
+
+        context.LastSyntaxElement = _expression;
+
+        if (baseValue is ObjectInstance baseObject
+            && (baseObject._type & InternalTypes.PlainObject) != InternalTypes.Empty)
+        {
+            PropertyDescriptor? descriptor;
+            if (ReferenceEquals(baseObject, _cachedReadObject)
+                && baseObject._propertiesVersion == _cachedReadVersion
+                && _cachedReadDescriptor is not null)
+            {
+                descriptor = _cachedReadDescriptor;
+            }
+            else
+            {
+                var ownDescriptor = baseObject.GetOwnProperty(determinedProperty);
+                if (ReferenceEquals(ownDescriptor, PropertyDescriptor.Undefined))
+                {
+                    // Absent own property: inherited-setter / CreateDataProperty semantics — handled by fallback.
+                    _cachedReadObject = null;
+                    _cachedReadDescriptor = null;
+                    descriptor = null;
+                }
+                else
+                {
+                    _cachedReadObject = baseObject;
+                    _cachedReadVersion = baseObject._propertiesVersion;
+                    _cachedReadDescriptor = ownDescriptor;
+                    descriptor = ownDescriptor;
+                }
+            }
+
+            // Re-read the flags live every store: Object.defineProperty flips Writable in place on the same
+            // descriptor without bumping the version, so the writability decision must never be cached. The mask
+            // must equal exactly Writable — i.e. writable, not an accessor (NonData), not custom-valued.
+            if (descriptor is not null
+                && (descriptor._flags & (PropertyFlag.NonData | PropertyFlag.CustomJsValue | PropertyFlag.Writable)) == PropertyFlag.Writable)
+            {
+                descriptor._value = rval;
+                result = rval;
+                return true;
+            }
+        }
+
+        // Fallback: complete via the normal pipeline from the already-resolved base + key (no re-evaluation).
+        var reference = engine._referencePool.Rent(baseValue, determinedProperty, StrictModeScope.IsStrictModeCode, thisValue: null);
+        engine.PutValue(reference, rval);
+        engine._referencePool.Return(reference);
+        result = rval;
+        return true;
+    }
 }