Summary

Reads of obj.prop already use a version-gated own-property inline cache in JintMemberExpression.GetValue that skips the dictionary lookup on repeat reads. Writes had no equivalent: every obj.prop = value rented a Reference, called PutValue, re-hashed the property key, and did a dictionary lookup before the in-place store.

This PR adds the write-side counterpart, TryAssignFast, hooked into SimpleAssignmentExpression.SetValue. It reuses the same cache slots (_cachedReadObject / _cachedReadVersion / _cachedReadDescriptor), so a summary.res = summary.res + 1 site shares one cache between its read and its write. When the receiver is a PlainObject whose shape is unchanged and the own property is a live writable, non-accessor, non-custom data descriptor, the new value is written straight into the descriptor — no Reference rent, no key hash, no dictionary lookup — exactly the in-place store ObjectInstance.Set already performs (which by design does not bump _propertiesVersion).

How it stays correct

• The writability/data/custom flags are re-read live on every store via (_flags & (NonData | CustomJsValue | Writable)) == Writable, never cached as a decision. This is required because Object.defineProperty(obj, p, { writable: false }) flips the flag in place on the same descriptor object without bumping the version — only the live flag read catches it. Data↔accessor and get/set changes allocate a new descriptor via SetOwnProperty, which does bump the version → cache miss.
• The fast path declines only at the eligibility gate, before evaluating anything (gate: determined string-named property, non-optional, non-short-circuiting, no custom resolver, not super, and Suspendable is null). Once base and RHS are evaluated — each exactly once, in spec order — it always completes the assignment: either the in-place store, or a fallback through PutValue rented from the already-resolved base + key. So a side-effecting base or RHS is never evaluated twice, and absent / accessor / read-only / custom-value / non-PlainObject cases keep prototype-setter dispatch, CreateDataProperty, and the strict read-only TypeError.
• Scoped to SimpleAssignmentExpression only; compound (+=) / update (++) / discard paths are untouched.

Benchmarks

BenchmarkDotNet DefaultJob, net10.0, AMD Ryzen 9 5950X, .NET 10.0.9. Baseline vs. this branch measured back-to-back in the same session (only the two interpreter files reverted for the baseline). Literal3/Literal8 build via object literals — they don't touch the assignment path and serve as drift controls (here flat: +2.1% / −1.4%, opposite signs = noise, not drift).

• UpdateObjectProperty / WriteObjectProperty: steady-state writes lose the per-store Reference rent + ToObject + key hash + dictionary lookup. WriteObjectProperty (added here) is a pure write loop — its LHS node is never read — proving the write-miss population path warms the cache without any read.
• Constructor1/Constructor3 (new-property writes, where the fast path falls back): no regression, and in fact faster, because TryAssignFast's base resolution is leaner than the previous Evaluate → Reference → PutValue path even with the one extra GetOwnProperty miss-probe.
• Allocations are unchanged everywhere (the in-place store and the fallback are both allocation-free; the reported MB is the script's own JsNumber boxing).

Testing

• Jint.Tests and Jint.Tests.PublicInterface: all green.
• Jint.Tests.Test262: baseline-equal (the only failures are 4 pre-existing annexB/.../RegExp-*-escape-BMP cases that hit the 30 s timeout — identical with and without this change).
• Targeted checks confirm: in-place updates, new-property creation, accessor setters still run, sloppy read-only no-op, strict read-only TypeError, Object.defineProperty flipping writable true→false in place is honored, inherited prototype setters, frozen objects, and array element / length writes (non-PlainObject fallback).

🤖 Generated with Claude Code