perf(serializer): optimize polymorphic type resolution with multiple strategies

- Add sealed type optimization: skip polymorphic path entirely for sealed types (JIT-eliminated)
- Reorder type checks: verify inline cache before base type for batched data
- Implement double-pointer dereference for .NET 5.0+: read RuntimeTypeHandle.Value directly from object header to avoid expensive GetType() virtual call
- Apply sealed type optimization to both serializer and deserializer

Performance improvements:
- Sealed types: zero GetType() overhead
- Batched homogeneous data: inline cache hits after first item
- .NET 5.0+: no GetType() call for polymorphic serialization

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: JasonXuDeveloper

src/Nino.Core/NinoDeserializer.cs

@@ -174,6 +174,9 @@ public static class CachedDeserializer<T>
         // ReSharper disable once StaticMemberInGenericType
         private static readonly bool HasBaseType = NinoTypeMetadata.HasBaseType(typeof(T));
 
+        // ReSharper disable once StaticMemberInGenericType
+        private static readonly bool IsSealed = typeof(T).IsSealed || typeof(T).IsValueType;
+
         // ULTIMATE: JIT-eliminated constants for maximum performance
         // ReSharper disable once StaticMemberInGenericType
         internal static readonly bool IsSimpleType = !IsReferenceOrContainsReferences && !HasBaseType;
@@ -254,11 +257,12 @@ public static void Deserialize(out T value, ref Reader reader)
                 return;
             }
 
-            // OPTIMIZED: Direct deserialization with polymorphism support
-            // Common case first: no subtypes (Count == 1 means only base type registered)
-            if (SubTypeDeserializers.Count == 1)
+            // FAST PATH 2: JIT-eliminated branch for sealed types
+            // If T is sealed or a value type, it CANNOT have a different runtime type
+            // This completely eliminates polymorphic deserialization overhead
+            if (IsSealed || SubTypeDeserializers.Count == 1)
             {
-                // DIRECT DELEGATE: Generated code path - no null check needed
+                // DIRECT DELEGATE: Generated code path - no polymorphism possible
                 _deserializer(out value, ref reader);
             }
             else
@@ -278,11 +282,12 @@ public static void DeserializeRef(ref T value, ref Reader reader)
                 return;
             }
 
-            // OPTIMIZED: Direct deserialization with polymorphism support
-            // Common case first: no subtypes (Count == 1 means only base type registered)
-            if (SubTypeDeserializerRefs.Count == 1)
+            // FAST PATH 2: JIT-eliminated branch for sealed types
+            // If T is sealed or a value type, it CANNOT have a different runtime type
+            // This completely eliminates polymorphic deserialization overhead
+            if (IsSealed || SubTypeDeserializerRefs.Count == 1)
             {
-                // DIRECT DELEGATE: Generated code path - no null check needed
+                // DIRECT DELEGATE: Generated code path - no polymorphism possible
                 _deserializerRef(ref value, ref reader);
             }
             else

src/Nino.Core/NinoSerializer.cs

@@ -140,6 +140,7 @@ public static void SerializeBoxed(object value, ref Writer writer, Type type)
     }
 
     public delegate void SerializeDelegate<TVal>(TVal value, ref Writer writer);
+
     public delegate void SerializeDelegateBoxed(object value, ref Writer writer);
 
 
@@ -164,14 +165,17 @@ public static class CachedSerializer<T>
         // ReSharper disable once StaticMemberInGenericType
         internal static readonly bool HasBaseType = NinoTypeMetadata.HasBaseType(typeof(T));
 
+        // ReSharper disable once StaticMemberInGenericType
+        private static readonly bool IsSealed = typeof(T).IsSealed || typeof(T).IsValueType;
+
         // ULTIMATE: JIT-eliminated constant for maximum performance
         // ReSharper disable once StaticMemberInGenericType
         internal static readonly bool IsSimpleType = !IsReferenceOrContainsReferences && !HasBaseType;
 
         [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)] // Cold exception path
         private static void ThrowInvalidCast(Type actualType) =>
             throw new InvalidCastException($"Cannot cast {actualType?.FullName ?? "null"} to {typeof(T).FullName}");
-        
+
         public static void AddSubTypeSerializer<TSub>(SerializeDelegate<TSub> serializer)
         {
             if (typeof(TSub).IsValueType)
@@ -236,11 +240,12 @@ public static void Serialize(T val, ref Writer writer)
                 return;
             }
 
-            // OPTIMIZED: Direct serialization with polymorphism support
-            // Common case first: no subtypes
-            if (SubTypeSerializers.Count == 0)
+            // FAST PATH 2: JIT-eliminated branch for sealed types
+            // If T is sealed or a value type, it CANNOT have a different runtime type
+            // This completely eliminates the need for GetType() calls
+            if (IsSealed || SubTypeSerializers.Count == 0)
             {
-                // DIRECT DELEGATE: Generated code path - no null check needed
+                // DIRECT DELEGATE: Generated code path - no polymorphism possible
                 Serializer(val, ref writer);
             }
             else
@@ -250,31 +255,37 @@ public static void Serialize(T val, ref Writer writer)
         }
 
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
-        private static void SerializePolymorphic(T val, ref Writer writer)
+        private static unsafe void SerializePolymorphic(T val, ref Writer writer)
         {
             if (val == null)
             {
                 writer.Write(TypeCollector.Null);
                 return;
             }
 
-            // OPTIMIZATION: Use EqualityComparer's cached type handle when possible
-            // For reference types, GetType() is still needed but the inline cache minimizes calls
+            // Get type handle - optimized for .NET 5.0+ to avoid expensive GetType() call
+            // Read RuntimeTypeHandle.Value directly from object header via double pointer dereference
+#if NET5_0_OR_GREATER
+            // Object header at offset 0 contains a pointer to the type handle
+            // Double dereference: first * gets the pointer, second * gets the RuntimeTypeHandle.Value
+            IntPtr actualTypeHandle = **(IntPtr**)Unsafe.AsPointer(ref val);
+#else
+            // Fallback to GetType() for older runtimes
             IntPtr actualTypeHandle = val.GetType().TypeHandle.Value;
+#endif
 
-            // FAST PATH 1: Check if it's the base type first (most common case)
-            // This check is very cheap - just pointer comparison
-            if (actualTypeHandle == TypeHandle)
+            // FAST PATH 1: Inline cache hit (most common for homogeneous batches)
+            // Check this FIRST - single pointer comparison, very cheap
+            if (actualTypeHandle == _cachedTypeHandle)
             {
-                Serializer(val, ref writer);
+                _cachedSerializer(val, ref writer);
                 return;
             }
 
-            // FAST PATH 2: Inline cache hit (most common case for batched homogeneous data)
-            // Single comparison - avoids dictionary lookup
-            if (actualTypeHandle == _cachedTypeHandle)
+            // FAST PATH 2: Base type (common for non-polymorphic usage)
+            if (actualTypeHandle == TypeHandle)
             {
-                _cachedSerializer(val, ref writer);
+                Serializer(val, ref writer);
                 return;
             }