Stop a chain of binds copying the whole bound name at every level

[lahma]

Fixes #4129. Base: 513b0b7.

Function.SetFunctionName composed step 4 of
SetFunctionName with a CLR string concatenation:

name = prefix + " " + name;

string + JsValue flattens whatever it is handed, so binding an already-bound function materialized
"bound bound … f" afresh at every level and left that copy in that level's own _nameDescriptor. A
chain of N binds therefore retained Σ 6·i characters — about 30 GB at a depth of 100,000, which is what
took the 7 GB Linux runners down mid-test in #4078's run.

The prefixed name is now a JsString.Concat node over the level below: O(1) to build, flattened once if
something ever reads the text. The three prefixes the engine ever passes (bound, get, set) are
cached with their separating space, so the common case concatenates two values it already holds.

The bind path never forces a flatten

Checked level by level, because one forced flatten per level would have kept the whole thing quadratic:

• SetFunctionName's own guard, UnwrapJsValue(nameDescriptor) != JsString.Empty — a fresh BindFunction
  has no name descriptor at all, so the guard short-circuits before the comparison; and JsString.Equals
  compares Length first, which every representation answers without materializing.
• FunctionPrototype.Bind's targetName.IsString() — an InternalTypes flag read.
• new PropertyDescriptor(name, PropertyFlag.Configurable) — stores the value, nothing else.
• oi.Get(CommonProperties.Name) at the next level — hands the same JsValue back.
• JsString.Concat reads both lengths, and RopeString.Length is a field.

BindFunction.IsConstructor (BoundTargetFunction.IsConstructor, a walk down the chain per read) is
not reached during bind: BoundFunctionCreate only reads the target's [[Prototype]], and the
length/name copies never ask. It stays O(depth) per read — new f() on a deep chain pays it — but
that is not on the path this issue is about, and the measurement below confirms nothing quadratic is left.

Measured

One engine per row, on this branch and on its base, Stopwatch around a single Evaluate plus
MemoryLimitConstraint.AllocatedBytes for the allocation; net10.0, Release, Windows. Not a BenchmarkDotNet
run — it is the shape of the issue's own measurement, three orders of magnitude apart:

depth	allocated before	after	elapsed before	after
10,000	575 MB	3 MB	307 ms	116 ms
30,000	5,160 MB	9 MB	1,156 ms	44 ms
100,000	~57 GB (not run)	33 MB	37.3 s (#4129)	255 ms

Allocation before: 9.0× for 3× the depth. After: 3.0×. The 100,000 row was not run unfixed — this box has
32 GB, and the issue already measured it.

The regression test

Jint.Tests/Runtime/BoundFunctionNameTests.cs builds the 100,000-deep chain, then asserts the name
(600,006 characters, compared against 'bound '.repeat(100000) + 'target' built in script), f.length,
and that a bound function taken from the chain still answers when called.

The wall clock is not the assertion — nothing here asserts a duration. The wedge is an allocation
ceiling of 768 MB (LimitMemory), against a healthy run's 33 MB: a per-level copy trips it inside the
first few thousand levels, so the quadratic is reported as a failed test in under a second instead of as
an exhausted machine. Raising that ceiling by an order of magnitude would still catch it.

Against the unfixed tree it fails on every framework —
MemoryLimitExceededException : Script has allocated 805392952 but is limited to 805306368 at 400 ms
(net8.0), 429 ms (net10.0), 677 ms (net472). Fixed, it passes at 298 ms / 353 ms / 502 ms.

Six [TestCase] rows beside it pin the text itself — bound f, bound bound bound f, the trailing-space
bound of an anonymous target, get x, set x, get [Symbol.iterator] — and they pass identically on
both trees, which is the point: the characters do not change. JsString.Concat copies below its deferral
threshold and produces the same text above it.

Verification

• dotnet build -c Release: 0 errors, 0 C# warnings.
• Jint.Tests: net8.0 12,593 (0 failed, 5 skipped), net10.0 12,593 (0 failed, 5 skipped), net472 8,676
  (0 failed, 4 skipped); 33,862 combined.
• Jint.Tests.PublicInterface: 10,454 total, 0 failed, 63 skipped.
• Both again with JINT_HOST_CONTRACT_VERIFICATION=1: 33,862 / 0 failed and 10,454 / 0 failed.
• Jint.Tests.Test262: 102,720 total, 102,611 passed, 0 failed, 109 skipped.

One thing deliberately left alone

ObjectInstance.SetFunctionName carries the same prefix + " " + name line. Nothing reaches its prefix
branch today — every prefixed call site (FunctionPrototype.Bind, ClassDefinition,
JintObjectExpression, ShadowRealm.CopyNameAndLength) has a Function receiver and binds to the
override above — and ObjectInstance.cs has other work in flight, so it is untouched here.

🤖 Generated with Claude Code