Prototype-method inline cache for obj.method resolved on the direct prototype

[lahma]

Member reads and member-calls whose property lives on the receiver's direct prototype —
arr.push(...), date.getTime(), counter.inc() where inc is on the prototype — had no inline
cache. Only own properties were cached, so every such access fell through the own-property fast
paths and re-walked the prototype chain: a dictionary miss-probe on the receiver, then a full
recursive Get on the prototype (its own fast-path check + dictionary hit-probe + descriptor unwrap).

Add a monomorphic prototype-method cache to JintMemberExpression, shared by the read and
member-call sites (a member node serves one role and reads one property name). On a hit it returns
the cached prototype descriptor's value directly. Validity is correct-by-construction:

• same receiver instance (ReferenceEquals) — per-site monomorphic;
• receiver own-shape unchanged (_propertiesVersion) — no own property added that would shadow;
• direct prototype unchanged (GetPrototypeOf() ReferenceEquals the cached holder) — not re-pointed;
• holder own-shape unchanged (_propertiesVersion) — method not redefined or deleted.

The prototype is derived through the virtual GetPrototypeOf() (exactly as ObjectInstance.Get
walks it), so objects that shadow the _prototype field and override [[GetPrototypeOf]] — e.g.
custom interop instances — resolve to the correct prototype.

The populate path no longer re-probes the receiver's own property: the read/member-call fast paths
already established the own-miss (a shape-slot miss, or a GetOwnProperty that returned undefined),
and thread that through as ownMissConfirmed, so a never-hitting (polymorphic-by-identity) site does
one own-property probe per call instead of two.

Receivers and prototypes with a non-ordinary [[Get]] for named keys must never be bypassed. Add
InternalTypes.ExoticGet, set in the constructors of the ObjectInstance subclasses whose [[Get]]
resolves named keys specially — JsProxy, JsTypedArray, IteratorResult, ObjectWrapper
(and its ArrayLikeWrapper subclass, which inherits the flag), NamespaceReference, ModuleNamespace
— and skip the cache when either the receiver or its direct prototype carries it. ArrayInstance also
overrides Get, but only for integer indices and length (both of which it reports from
GetOwnProperty, so the populate path defers to the full Get there); it is ordinary for named keys
and intentionally stays unflagged, which is what keeps arr.push / arr.pop cacheable.
PrototypeMethodCacheTests includes a reflection tripwire that fails if a new Get override appears
unclassified, plus behavioural tests for shadowing, redefinition, deletion, prototype reassignment,
and accessor re-invocation after the cache is warm.

Benchmarks (default jobs, same machine, baseline upstream/main d6e3da8, same thermal window):

MethodCallBenchmark — the dedicated, multi-iteration signal:

Method	Baseline	Branch	Delta
ArrayPushPop (arr.push/pop loop)	246.4 ms	189.0 ms	-23.3%
UserPrototypeMethod (c.inc on proto)	343.0 ms	294.8 ms	-14.1%
MethodCallThis (guard)	291.8 ms	280.5 ms	-3.9%
MethodCallCaptured (guard)	297.2 ms	305.6 ms	+2.8%
FreeFunctionCall (guard)	337.0 ms	345.8 ms	+2.6%
Guards exercise own-method / free-function paths the cache never reaches; they sit in the
+/-3-4% run-to-run noise. Allocation is unchanged (this is a read-path speedup).

EngineComparison (Jint, prepared scripts; averaged over two same-window baseline/treatment pairings):
consistent wins on array/object-heavy scripts — array-stress -12.3%, dromaeo-object-array-modern
-9.7%. The remaining scripts fall within this machine's ~+/-3-4% process-to-process noise (their
deltas sign-flip across repeated pairings); dromaeo-object-string, which a redundant own-property
probe initially nudged ~+2%, is flat after the ownMissConfirmed change.

Test262: no new failures (Failed: 4 / Passed: 99256, identical to baseline d6e3da8; the 4 annexB
RegExp failures are pre-existing 65536-iteration eval + RegExp-compile loops that flaky-time-out
independent of this change). Jint.Tests (3145/0), Jint.Tests.PublicInterface, Jint.Tests.CommonScripts,
Jint.Tests.SourceGenerators all green.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01RDS23QeSSNRkaUB2KL74U9