Skip to content

Let a function's own let/const live in its fixed slots - #2887

Merged
lahma merged 1 commit into
sebastienros:mainfrom
lahma:perf/fixed-slot-lexical-bindings
Aug 2, 2026
Merged

Let a function's own let/const live in its fixed slots#2887
lahma merged 1 commit into
sebastienros:mainfrom
lahma:perf/fixed-slot-lexical-bindings

Conversation

@lahma

@lahma lahma commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

JintFunctionDefinition.BuildState qualified a function for the fixed-slot instantiation lane only when its lexical binding count was zero. So a single top-level let or const in a function body disqualified it — from CanUseFastFDI, and therefore from SupportsRegisterCall and the register-argument lane added in #2874. Functions written in modern JavaScript missed a lane that the var-style shapes in older code hit.

What was actually in the way

Less than it looked. UseFixedSlots has always admitted lexical slots, and FunctionDeclarationInstantiation's general arm has always written correct TDZ/const bindings into them. The gate existed solely because the fast arm filled the entire non-parameter region with one uniform undefined/mutable binding, which is right for var and wrong for let/const.

So no representation change was needed — no new field on Binding, no sentinel, no widening. State gains a Binding[] template covering the whole non-parameter region (var entries undefined/mutable, lexical entries uninitialized/TDZ with per-declaration mutability), built in BuildState alongside the slot names so the two orders cannot drift. Both fill sites become one unconditional copy loop — deliberately no branch, so functions that already qualified see one code path, not a test. JintBlockStatement.BlockState.SlotTemplates is the in-repo precedent for the technique.

The template holds no JsValue, so it is safe on the cross-engine-shared State.

Results

Paired A/B against main, both orderings, on a shared benchmark base so both sides run identical benchmark code. Each row judged against its own build-to-build variance, with a 1% absolute floor.

row r1 r2 mean own var
LexicalSlotCallBenchmark.LetConstLocals −9.49% −21.52% −15.50% 10.0% win
ClosureCallBenchmarks.ParamLocalCall −3.51% −2.18% −2.85% 2.5% win
LexicalSlotCallBenchmark.LetConstNoLocals +3.76% −10.17% −3.20% 7.5% noise
ClosureCallBenchmarks.SloppyEmptyClosureCall −5.55% +1.48% −2.03% 8.4% noise
ClosureCallBenchmarks.SloppyCapturedVarReadWrite +0.43% −1.89% −0.73% 6.2% noise
ClosureCallBenchmarks.CapturedVarReadWrite −1.93% +1.53% −0.20% 0.3% noise
RecursionBenchmark.Fib +3.17% −3.56% −0.20% 4.0% noise
RecursionBenchmark.Tak +2.00% −1.22% +0.39% 1.3% noise
LexicalSlotCallBenchmark.VarLocals (control) +2.38% −0.83% +0.78% 6.4% noise
ClosureCallBenchmarks.ManyLocalCall +1.86% +2.06% +1.96% 2.0% noise
RecursionBenchmark.DeepSum +4.58% −0.56% +2.01% 0.6% noise
ClosureCallBenchmarks.EmptyClosureCall −0.60% +4.92% +2.16% 2.3% noise

VarLocals is the deliberate control: a callee declaring only var, which qualified for the lane before and after, so it can only move if the change taxed the path that already qualified. It doesn't.

An earlier iteration of this change did tax that path — three closure rows regressed +2.4…+4.3%. The cause was not the fill: those callees are SupportsLeafCall, take ScriptFunction.CallLeaf, and never execute either FDI method. Removing the branch entirely (one uniform template rather than a conditional second arm) is what cleared it.

TDZ is the hazard, and it is tested as such

A wrong slot fill loses temporal-dead-zone semantics silently — happy-path tests still pass. 24 tests in Jint.Tests/Runtime/FixedSlotLexicalBindingTests.cs cover read-before-let/const → ReferenceError, typeof before let (vs typeof undeclared → "undefined"), let x; observable only after its declaration, destructuring const, const reassignment → TypeError in strict and sloppy, and — the load-bearing ones — slot reuse: the dead zone re-established on every call when the environment and its Binding[] are pooled into the next one, const-ness surviving that reuse, across recursive frames via RecursiveEnvPool, through the warmed register lane, and after a throw before the declaration. Plus async resume, TDZ across an await, generator resume, and a top-level using.

They were mutation-verified: deliberately building the template with JsValue.Undefined instead of the uninitialized sentinel fails 15 of 24; deliberately building const as mutable fails a further set. Both mutations were applied, confirmed, and reverted.

Verification

Jint.Tests 4709/0/4 (net10.0) · 4628/0/4 (net472) · Jint.Tests.PublicInterface 1240/0/9 · 1239/0/9 · Jint.Tests.CommonScripts 28/0 both TFMs · Jint.Tests.SourceGenerators 51/0 · Jint.Tests.Test262 99650 / 0 / 158 — exactly baseline · dotnet build -c Release 0 warnings.

Test262 is the gate that matters here: TDZ, const reassignment, closures over let in loops, and let in switch/blocks are all densely covered, and this change routes far more functions through slotted lexical storage.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G24ppn8iSgjo1APp3YkzTK

@lahma @claude
Let a function's own let/const live in its fixed slots
fa76f37 
`JintFunctionDefinition.BuildState` already laid out a slot for every top-level
`let`/`const` binding — `UseFixedSlots` has covered them all along — but it then
refused the fast instantiation arm for any function that had one
(`CanUseFastFDI = lexicalBindingCount == 0`). The reason was in
`FunctionDeclarationInstantiationFast`, which fills every non-parameter slot with
the same `undefined` binding: correct for a hoisted `var`, and wrong for a lexical
one, which must start in the temporal dead zone and, for `const`, immutable.

So a single top-level `let` disqualified a function from the fast arm and, through
`SupportsRegisterCall`, from the register-argument call lane — i.e. from most of
what recent call-path work bought, for the way essentially all modern JavaScript
is written, while `var`-style bodies kept it.

The slot representation could already express both facts; only the fast arm could
not produce them. `State` now carries a `LexicalSlotTemplate`, built beside the
slot names so the two orders cannot drift: one uninitialized `Binding` per lexical
slot, immutable for `const`. The fast arm stamps it over the lexical region after
filling the var region, which is byte for byte what the general arm already writes
into those same slots — a read before the declaration executes is still a
ReferenceError, and assigning a `const` is still a TypeError. Functions with no
lexical declarations carry a null template and keep their exact previous fill.

Those semantics fail silently when the fill is wrong — a TDZ slot pre-filled with
`undefined` passes every happy-path test — so `FixedSlotLexicalBindingTests` pins
them from both directions: read/typeof before declaration, `const` reassignment,
`let x;` visible only after its declaration, closure capture, shadowing, and that
the dead zone is re-established on every call despite the environment and its slot
array being pooled and handed to the next one. Breaking either half of the
template (value or mutability) fails 13 and 3 of them respectively.

Test262 unchanged at 99484/0/157.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G24ppn8iSgjo1APp3YkzTK
@lahma
lahma merged commit d3febd4 into sebastienros:main Aug 2, 2026
5 checks passed
@lahma
lahma deleted the perf/fixed-slot-lexical-bindings branch August 2, 2026 11:05
This was referenced Aug 14, 2026
Closed
Merged
Closed
Open
Open
Merged
Open
Merged
legrab added a commit to legrab/pocok that referenced this pull request Aug 18, 2026
@legrab
Bump Jint from 4.15.3 to 4.16.0 (#56)
ef20afa 
Updated [Jint](https://github.com/sebastienros/jint) from 4.15.3 to
4.16.0.

<details>
<summary>Release notes</summary>

_Sourced from [Jint's
releases](https://github.com/sebastienros/jint/releases)._

## 4.16.0

Jint 4.16.0 is a **correctness- and reliability-focused release**:
alongside asynchronous module loading, proper tail calls and four new
iterator built-ins, a pre-tag review swept the whole engine and fixed
what it found — including long-standing defects that predate this cycle.
**No option defaults changed.** Behaviour changes to note up front:
`JSON.stringify` and other machine-readable output now format
invariantly under every host culture — under Swedish or Finnish locales
on .NET 8+ it used to emit a Unicode minus sign no JSON parser accepts;
`JSON.parse` now rejects trailing commas as the grammar requires; bare
identifiers at global scope resolve through the global's prototype chain
per spec; `IModuleLoader.Resolve` is consulted once per (referrer,
specifier) pair, so a loader using it as a per-import access-control
checkpoint should move the check to `LoadModule`; and an inconsistent
sort comparator now finishes with an implementation-defined order on
every target framework instead of hanging (net462/netstandard) or
throwing a CLR exception at script (net8+).

### Highlights

**Proper tail calls (#​2975).** Strict-mode calls in tail position reuse
their frame, so `"use strict"` tail recursion runs in constant stack —
the first ES2015 PTC implementation among the .NET engines.

**Asynchronous module loading (#​2872).** `IAsyncModuleLoader` and the
`AsyncModuleLoader` template let a host fetch module source over I/O
without blocking a thread; `Engine.Modules.StartImport` returns an
operation a game loop drives via `ProcessTasks()`, and `ImportAsync`
awaits without holding a thread. The spec's load phase now exists as
written, a warm-cache async loader keeps the blocking `Import` fully
synchronous, and the blocking drain wakes on a work-arrived signal
instead of polling. A module served over a transport keeps its whole url
as `Module.Location` so its own relative imports resolve, a deferred
namespace evaluates its module instead of exposing uninitialized
bindings, and an import abandoned by a global snapshot restore reports
itself faulted instead of polling forever.

**The process no longer dies for recoverable reasons.**
`Options.LimitRecursion` used to kill the host process for most useful
limits — the constraint fired, and the unwind itself overflowed the
stack; exception filters now let it unwind ~7× deeper. The new opt-in
`Options.Constraints.StackOverflowGuard` converts unbounded recursion —
reachable through eighteen distinct routes, `new`, accessors, coercions
and Proxy traps included — from a process kill into a catchable
`RangeError`, exempting strict tail calls, which grow no stack. And a
family of CLR exceptions that escaped `engine.Evaluate` past every
script `catch` are now proper JavaScript errors or correct results:
sorting with an inconsistent comparator, destructuring with a
function-valued default (`const { onChange = () => {} } = opts`),
`toLocaleString` outside `DateTime`'s range, typed-array
`defineProperty` without a value, `DataView` reads at 2³¹,
`String.replace` `$'` with a lying exec, and the first instant of year
10000.

**New built-ins.** `Iterator.prototype.join`, `chunks`, `windows` and
`includes`; `take`/`drop` now throw `RangeError` for a finite limit
above 2^53−1 per the updated proposals.
`Intl.Locale.prototype.getCollations` reports CLDR-cited collation data
that `Intl.Collator` accepts in full, a malformed `collation` option is
a `RangeError`, and `Intl.supportedValuesOf("collation")` derives from
the same lists so the three can never drift.

**Conformance, from a review that ran what the suite does not.** Two of
the fixed defects had test262 coverage only under the never-generated
`staging/` directory, and several had none at all: `parseInt` strips the
sign before testing for a hex prefix, so `parseInt("-0x10")` is −16; a
suspended `finally` no longer swallows a pending `break`/`continue`; a
Proxy (or exotic host object) as the global's prototype answers bare
identifiers through its `get` trap; `Date.prototype.toISOString` emits
the spec's six-digit expanded year and round-trips through `Date.parse`
in every spelling including year 0; iterator helpers close their
receiver exactly once and only when the spec says so, and carry their
own `@@​toStringTag`; `Map`/`Set` `size` is the prototype accessor the
spec defines rather than a phantom own property; a Proxy's
`defineProperty` trap receives the partial descriptor the caller wrote;
a string's `@@​iterator` is read once, with the primitive as receiver;
`Array.prototype.join` re-asks the array when a side effect fills a hole
mid-join; a direct eval reaches the enclosing function's `arguments` in
both modes; and `Temporal.Now` drops the methods the proposal removed.

**Embedder surface.** `OperationDeadlineConstraint` bounds a whole
multi-entry host operation; `ScriptPreparationOptions.StaticAnalysis`
trades prepare-time analysis for per-engine materialization on shared
graphs; `ModuleFactory.LocationOf` exposes the module-naming rule a host
must match; `Engine.Advanced.HostDefined` carries per-request state on a
pooled engine; the CLR exception behind an interop error is reachable
through `JintException.TryGetClrException` with opt-in
`ChainClrExceptions()`, and a host method's own `TargetException` is no
longer mistaken for a receiver mismatch; and a recursion-limit failure
propagates out of a module load instead of becoming a catchable
rejection.

**Performance, gated.** Against v4.15.3 on idle hardware, medians of
three paired runs: `controlflow-recursive` **−15.6% time and −40.4%
allocation** (proper tail calls), `bitops-3bit-bits-in-byte` −8.9%,
`math-spectral-norm` −7.3%, `crypto-sha1` −6.9%, `3d-raytrace` −5.9%,
`math-cordic` −5.8%, with a broad −1–4% tail across the call- and
string-heavy rows; no row moved outside its own measured cross-run
envelope in the other direction, and allocation is flat within ±0.2%
suite-wide. Warmed `parseInt` call sites take the frameless fast-call
lane (−13% on the parse loop), joined by the `Number` predicates,
`String.prototype.indexOf`/`startsWith`/`endsWith`/`includes`/`at`/`substr`,
global `isNaN`/`isFinite` and `Array.isArray` (−3% to −19%) and the
`Map`/`Set` method family (`map.get` hit loop −13%); existence questions
on a wrapped dictionary answer from `ContainsKey`, taking `in` −33% with
−98% allocation and `Object.keys` −37%; resolving an inherited global no
longer allocates per miss (−99.99% on the read loop) and a global
created through an inherited write keeps the in-place store; JSON
replacer/reviver eligibility is decided once per document, built-in
callback dispatch once per loop, a call site's arguments reach an
interpreted callee in registers, and function-local `let`/`const` live
in fixed slots.

**Breaking changes.**
`Int32Extensions`/`Int64Extensions`/`DoubleExtensions` — polyfill hosts
that leaked into the public API — are now internal; on
net462/netstandard2.0, code with `using Jint;` may have bound span
`Parse`/`TryParse` members through them. `JsonParser` rejects trailing
commas. `Number.parseInt.length`/`Number.parseFloat.length` report their
spec values. Post-construction mutation of an `Options` instance no
longer reaches an already-built engine, and `Options.Configure`
callbacks work again. `UnwrapIfPromise` reports a cancelled engine as
`ExecutionCanceledException` instead of a timeout. Time-zone matching is
ASCII-case-insensitive per ECMA-402.

On the [engine comparison
benchmarks](https://github.com/sebastienros/jint/blob/main/Jint.Benchmark/README.md),
Jint 4.16.0 is the fastest engine outright on 5 of 12 scripts — leading
`dromaeo-object-regexp-modern` over native V8 by 1.25× — in a
statistical tie for first on `interop-collection-traversal`, the fastest
managed engine on 10 of 12, the fastest interpreter on all 12, and
8.6×–11.2× ahead of ClearScript (native V8) on every interop row while
allocating 3.9×–12.4× less than the nearest managed competitor.

## What's Changed
* Run the repository's own host tests under Release-mode contract
verification by @​lahma in
sebastienros/jint#2866
* Update test262 suite and implement Iterator.prototype.join by @​lahma
in sebastienros/jint#2867
* Stop a closing iterator from swallowing the error that closed it by
@​lahma in sebastienros/jint#2868
* Give every benchmark row its own engine by @​lahma in
sebastienros/jint#2873
* Hand a call site's arguments to an interpreted callee in registers by
@​lahma in sebastienros/jint#2874
* Ask once per loop, not once per element, how to call a built-in's
callback by @​lahma in sebastienros/jint#2876
* Say which spec document to read for a feature by @​lahma in
sebastienros/jint#2882
* Run PR CI on every pull request, not only those targeting main by
@​lahma in sebastienros/jint#2883
* Update test262 suite and adopt the new take/drop RangeError by @​lahma
in sebastienros/jint#2877
* Implement Iterator Chunking by @​lahma in
sebastienros/jint#2878
* Say to write against the modern BCL and polyfill downwards by @​lahma
in sebastienros/jint#2884
* Implement Iterator Includes by @​lahma in
sebastienros/jint#2879
* Ask once per document, not once per key, how to call a JSON replacer
or reviver by @​lahma in sebastienros/jint#2885
* Use double.IsFinite instead of hand-rolled NaN and infinity pairs by
@​lahma in sebastienros/jint#2880
* Bump the testing group with 1 update by @​dependabot[bot] in
sebastienros/jint#2889
* Stop charging closures for per-engine lazy globals by @​lahma in
sebastienros/jint#2890
* Bump the analyzers group with 1 update by @​dependabot[bot] in
sebastienros/jint#2888
* Make the lazy-global re-arm on restore a contract instead of an
accident by @​lahma in sebastienros/jint#2892
* Let the amortized constraint cadence span top-level entries into the
engine by @​lahma in sebastienros/jint#2886
* Let a function's own let/const live in its fixed slots by @​lahma in
sebastienros/jint#2887
* Keep a host function in the engine's own realm after a second realm
exists by @​lahma in sebastienros/jint#2893
* Make an engine's principal realm [[HostDefined]] reachable by @​lahma
in sebastienros/jint#2891
* Carry a labelled break/continue target on the completion record by
@​lahma in sebastienros/jint#2894
* Make Array.prototype.sort stable on every target framework by @​lahma
in sebastienros/jint#2898
* Stop toSorted and %TypedArray%.sort hanging on an inconsistent
comparator by @​lahma in sebastienros/jint#2899
* Delete the evaluation context's dead completion channel by @​lahma in
sebastienros/jint#2895
* Stop shipping the numeric polyfill hosts as public API by @​lahma in
sebastienros/jint#2901
 ... (truncated)

Commits viewable in [compare
view](sebastienros/jint@v4.15.3...v4.16.0).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Jint&package-manager=nuget&previous-version=4.15.3&new-version=4.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
This was referenced Aug 19, 2026
Open
Open
Merged
Open
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lahma