Shape hot constructors' instances (−22..36% Constructor allocation)

[lahma]

Summary

Extend the merged object-literal hidden classes (#2552) to constructor instances — new T(){ this.a; this.b; this.c }, the TreeNode / dromaeo-object-* pattern and the dominant object-creation shape in real JS. A hot constructor's this builds a shared hidden class instead of a per-object dictionary.

Avoiding the diverse-object pitfall (allocation-site feedback)

Naively shaping every this.x= regresses diverse one-off objects (each unique layout spawns a Shape + transition with no reuse). This PR gates shaping on a constructor proving hot:

• A constructor's first CtorShapePromoteThreshold (16) instances build dictionaries, so a constructor called once or twice — the overwhelming norm — never grows the shared per-prototype transition tree.
• Once hot, it is promoted: ScriptFunction.Construct starts each fresh this in shape-building mode (InternalTypes.ShapeBuilding), so this.x= / class fields transition an interned hidden class shared across instances.
• A megamorphic guard (Shape.MaxShapeProperties / MaxFanout) deopts object-as-hashmap growth.
• Object literals keep their merged behavior (deopt on a brand-new key — a one-off literal isn't a reused allocation site); Object.assign / spread / JSON.parse targets stay on the dictionary (they never enter shape mode).

Benchmarks (BenchmarkDotNet default job, vs merged main; allocation is deterministic)

PropertyAllocBenchmark / ObjectAccessBenchmark

Benchmark	Allocation	Gen0/1k	Time
Constructor3 (this.a=;this.b=;this.c=)	136.4 → 87.6 MB (−35.8%)	8500 → 5250	145.2 → 139.8 ms (−3.7%)
Constructor1 (this.value=)	85.2 → 66.8 MB (−21.5%)	5200 → 4167	parity
Literal3 / Literal8	unchanged (already shaped)	—	parity
UpdateObjectProperty / WriteObjectProperty	unchanged	—	parity

EngineComparison (Jint_ParsedScript, 19 scripts)

Allocation flat to slightly better — dromaeo-3d-cube −1.3% (its hot constructors now shape), everything else within ±1%. No regression.

Conformance & tests

• Test262: matches merged main run-for-run. (A few slow annexB RegExp-*-escape-BMP eval-loop tests intermittently time out under heavy concurrent load on a busy machine — identically with and without this change, confirmed via a clean-main control run; on a fresh machine both are 0-fail.)
• Jint.Tests: 3138 (net10.0) / 3076 (net472), 0 failures.
• Jint.Tests.PublicInterface: 79/79 — no public API change (all additions internal).

Design

• ScriptFunction: per-constructor feedback (_ctorShaped, _ctorSampleCount, threshold 16) + a cached prototype empty-shape root (avoids a per-construct lookup).
• JsObject.StartShapeBuilding (installs the empty root + a growable store, sets ShapeMode | ShapeBuilding); JsObject.TryShapeAdd (transition to the interned child + grow store + megamorphic caps).
• ObjectInstance.CreateDataProperty: a new key on a ShapeBuilding object transitions the shape; a plain shaped object (literal) deopts.
• Shape.MaxShapeProperties / MaxFanout / TransitionCount re-added for the guard.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RDS23QeSSNRkaUB2KL74U9