Reuse a fixed-slot per-iteration environment in for-of/for-in

[lahma]

for (const x of arr) / for (const k in obj) previously paid per iteration: a fresh DeclarativeEnvironment, a List<Key> + Key[] from GetBoundNames inside BindingInstantiation, dictionary-backed bindings (HybridDictionary + nodes — the fresh environment has no slot layout), and a pooled-Reference round-trip through ResolveBinding + InitializeReferencedBinding.

The spec creates a fresh binding per iteration with no copy step (unlike for (let ...)), so when nothing can observe environment identity the loop now reuses one fixed-slot environment:

• Eligibility (static, computed once per handler): lexical head (let/const, 1–16 bound names), and EnvironmentEscapeAstVisitor proves nothing in the body — or in a destructuring pattern's default-value expressions — captures or escapes (closures, direct eval). using/await using heads stay on the existing path (they register per-iteration dispose resources).
• Per iteration: ResetSlots re-establishes TDZ from the templates, the single identifier binding initializes straight into its slot, destructuring initializes into slots by name via the existing ProcessPatterns path. The environment's stable identity also keeps the body's per-node slot caches hot.
• Pooling across loop entries on the handler instance with the Interlocked + engine-identity discipline of JintForStatement._cachedLoopEnv; parked (and reset) in the finally so the cached env never roots the completed loop's values.
• Suspendable contexts (generators/async) are excluded — a pooled environment must never round-trip through suspend/resume — and keep the existing per-iteration path unchanged.
• Rider: HeadEvaluation no longer allocates its TDZ environment when there are no TDZ names (var/assignment forms).

Measurements

BenchmarkDotNet default jobs, A/B vs main (with #2585) from separate worktrees:

case	main	PR	delta
IterationBenchmark.ForOfArray	38.77 ms / 59.83 MB	29.98 ms / 22.44 MB	−22.7% time / −62.5% alloc
IterationBenchmark.MapIteration	50.98 ms / 89.87 MB	42.16 ms / 50.96 MB	−17.3% / −43.3%
IterationBenchmark.SpreadArray	32.94 ms	33.08 ms	flat (no lexical head)
IterationBenchmark.Destructuring	46.38 ms	46.88 ms	within noise, alloc identical
DromaeoBenchmark.ObjectArray (4 cases)	—	—	flat to slightly better

Allocation census (fresh engine per iteration, for (const x of arr) over 1000 elements × 300 loops): 148.9 → 36.8 MB/iter (−75%), 52.9 → 35.2 ms/iter (−33%). The environment types (DeclarativeEnvironment, Key[], DictionaryNode[Binding], HybridDictionary, Reference) disappear from the profile entirely; what remains is iterator-protocol IteratorResult steps — a separate follow-up.

Verification

• Jint.Tests green (net10.0 + net472), Jint.Tests.PublicInterface green
• Full test262: 99,260 passed, 0 failed — run twice (pre- and post-rebase onto Probe own-property existence/enumerability without materializing descriptors #2585), covering for-of/for-in closures-in-body, destructuring with defaults, generators/async iteration, using heads, and labeled break/continue

🤖 Generated with Claude Code