Avoid empty direct-call upvalue allocations

Author: Lewin671

crates/qjs-runtime/src/bytecode/ir.rs

@@ -695,6 +695,10 @@ pub struct Bytecode {
     local_slots: HashMap<String, usize>,
     parameter_slots: Vec<usize>,
     received_upvalue_slots: Vec<usize>,
+    /// Whether direct-call frame setup may need per-local upvalue storage for
+    /// an outer capture or sloppy global fallback. Module imports are tracked
+    /// by `CallEnv` and checked separately at call time.
+    has_direct_local_upvalue_routes: bool,
     global_names: Vec<String>,
     global_lexical_names: Vec<String>,
     sloppy_global_assignment_names: Vec<String>,
@@ -783,11 +787,15 @@ impl Bytecode {
             .enumerate()
             .filter_map(|(slot, local)| local.is_received_upvalue().then_some(slot))
             .collect();
+        let has_direct_local_upvalue_routes = locals
+            .iter()
+            .any(|local| local.is_received_upvalue() || local.sloppy_global_fallback);
         let mut bytecode = Self {
             constants,
             local_slots: collect_local_slots(&locals),
             parameter_slots,
             received_upvalue_slots,
+            has_direct_local_upvalue_routes,
             locals,
             global_names: collect_global_names(&code),
             global_lexical_names,
@@ -971,6 +979,10 @@ impl Bytecode {
         &self.received_upvalue_slots
     }
 
+    pub(super) fn has_direct_local_upvalue_routes(&self) -> bool {
+        self.has_direct_local_upvalue_routes
+    }
+
     pub(crate) fn local_name_at(&self, slot: usize) -> Option<&str> {
         self.locals.get(slot).map(|local| local.name.as_str())
     }

crates/qjs-runtime/src/bytecode/vm.rs

@@ -320,6 +320,14 @@ impl<'a> Vm<'a> {
         upvalues: &[Upvalue],
         env: &CallEnv,
     ) -> Vec<Option<Upvalue>> {
+        // Most direct leaf calls have no captured, module, or sloppy-global
+        // cells. An empty vector represents the all-None state for those
+        // frames and avoids allocating one pointer-sized entry per local on
+        // every call. Direct-call eligibility excludes operations that can
+        // create cells later (closures, eval, and with).
+        if !bytecode.has_direct_local_upvalue_routes() && !env.has_module_imports() {
+            return Vec::new();
+        }
         let mut next_received = 0;
         bytecode
             .locals
@@ -1505,3 +1513,80 @@ impl<'a> Vm<'a> {
         references_name.then(|| name.to_owned())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::bytecode::ir::Local;
+
+    fn local(name: &str, from_env: bool) -> Local {
+        Local {
+            name: name.to_owned(),
+            hoisted: false,
+            hoisted_function: false,
+            parameter: false,
+            catch_binding: false,
+            mutable: true,
+            from_env,
+            sloppy_global_fallback: false,
+        }
+    }
+
+    fn empty_env() -> CallEnv {
+        CallEnv::new(new_realm(HashMap::new()))
+    }
+
+    #[test]
+    fn direct_cell_free_frame_uses_empty_upvalue_storage() {
+        let bytecode = Bytecode::new(Vec::new(), vec![local("value", false)], Vec::new());
+        let env = empty_env();
+
+        let local_upvalues = Vm::initial_direct_local_upvalues(&bytecode, &[], &env);
+
+        assert!(local_upvalues.is_empty());
+        assert_eq!(
+            Vm::initial_authoritative_slots(&bytecode, &local_upvalues, &env),
+            1
+        );
+    }
+
+    #[test]
+    fn direct_captured_frame_keeps_received_upvalue_storage() {
+        let bytecode = Bytecode::new(Vec::new(), vec![local("captured", true)], Vec::new());
+        let env = empty_env();
+        let captured = Upvalue::new(Value::Number(42.0));
+
+        let local_upvalues =
+            Vm::initial_direct_local_upvalues(&bytecode, std::slice::from_ref(&captured), &env);
+
+        assert_eq!(local_upvalues.len(), 1);
+        assert!(
+            local_upvalues[0]
+                .as_ref()
+                .is_some_and(|upvalue| upvalue.ptr_eq(&captured))
+        );
+    }
+
+    #[test]
+    fn direct_module_frame_keeps_import_cell_storage() {
+        let bytecode = Bytecode::new(Vec::new(), vec![local("imported", false)], Vec::new());
+        let mut env = empty_env();
+        let exports = DynamicBindings::new();
+        exports.insert("exported".to_owned(), Value::Number(7.0));
+        env.set_module_import(
+            "imported".to_owned(),
+            exports.clone(),
+            "exported".to_owned(),
+        );
+
+        let local_upvalues = Vm::initial_direct_local_upvalues(&bytecode, &[], &env);
+
+        assert_eq!(local_upvalues.len(), 1);
+        assert!(
+            local_upvalues[0]
+                .as_ref()
+                .zip(exports.cell("exported").as_ref())
+                .is_some_and(|(local, exported)| local.ptr_eq(exported))
+        );
+    }
+}

crates/qjs-runtime/src/bytecode/vm_bindings.rs

@@ -386,7 +386,7 @@ impl Vm<'_> {
             .filter_map(|(slot, local)| {
                 (!bytecode.global_scope
                     && !local.sloppy_global_fallback
-                    && local_upvalues.get(slot).is_some_and(Option::is_none)
+                    && local_upvalues.get(slot).is_none_or(Option::is_none)
                     && env.slot_is_authoritative(&local.name))
                 .then_some(1_u128 << slot)
             })

crates/qjs-runtime/src/function/env.rs

@@ -605,6 +605,10 @@ impl CallEnv {
         self.module_imports.clone()
     }
 
+    pub(crate) fn has_module_imports(&self) -> bool {
+        !self.module_imports.is_empty()
+    }
+
     pub(crate) fn set_module_imports(&mut self, imports: ModuleImports) {
         self.module_imports = imports;
     }

tasks/T018-broad-performance.md

@@ -2003,6 +2003,54 @@ and `8c9b2f0ab3c8f98ec6009f8a01ba6a93e4c2238220fa00ddff3ce9f5e9046264`.
 These gains satisfy the no-overfitting regression boundary for this unit, but
 the external <=1.00x target and broad allocation <=1.00x target remain open.
 
+The thirty-seventh v2 unit follows a hotspot shared by the external
+`access-binary-trees` port and the broad call/allocation profiles. Direct leaf
+frames previously allocated a `Vec<Option<Upvalue>>` with one `None` entry per
+local on every call even when the compiled function had no received capture,
+sloppy-global route, or module import. Bytecode now caches whether either
+local route exists, `CallEnv` exposes whether module-import routes exist, and a
+cell-free direct frame represents the all-`None` upvalue table with an empty
+vector. Authoritative-slot setup treats a missing entry as `None`. The existing
+direct-call admission contract excludes closures, direct eval, and `with`, so
+no operation can create a cell later on this path. Captured and module-import
+unit tests prove that their identity-bearing cells still use full storage. The
+implementation has no workload ID, source path, iteration count, or checksum
+input.
+
+Against clean base binary SHA-256
+`0fd0b797227d3e82086d49a81817d6178990b174a1f70f44ad21a736f42cec41`,
+candidate binary SHA-256
+`af59c4e55c36f2dd739b2698b285f6bda059a32fa7bb00383c090632251f1957`
+reduced an eleven-block interleaved external-shaped binary-tree median from
+8.653387 s to 8.391495 s (0.969735x). The complete local three-role broad
+diagnostic preserved all 25 cases and 225 eligible exact-checksum samples at
+0.998932x candidate/base. Binding was 0.987920x, call 0.997499x, and allocation
+1.013692x; the latter remains below the unit's 2% material family threshold.
+The raw SHA-256 is
+`fd022895f0a7bc9197bc352274bea0cc0d9a28d352bbed11ea903b7f4cdb8ec8`.
+The strict analyzer rejected the intentionally receipt-less local binaries, so
+these remain regression diagnostics rather than a performance claim.
+
+Independent one-block full external A/B previews preserved identical coverage
+at 5/5 JetStream, 8/14 Kraken, and 23/26 SunSpider. Across all 36 common
+comparable cases, candidate/base was 0.998782x; five cases improved by more
+than 2%, 27 stayed within 2%, four moved between 2.05% and 5.12%, and none
+regressed by 25%. Suite candidate/base ratios were 0.994606x, 1.000293x, and
+0.999167x. Candidate/QuickJS-NG diagnostics remain far from completion at
+9.599757x, 5.766279x, and 8.740135x. An eleven-block interleaved rerun of the
+external source confirmed `access-binary-trees` at 0.969378x; three apparent
+regressions resolved to 0.988744x (`math-cordic`), 0.994895x (`crypto-md5`),
+and 1.000494x (`string-fasta`), while `date-format-tofte` retained a small
+1.021284x movement. Candidate raw/report SHA-256 are
+`ddda93bdf1a6953061728ab3112cc2215867aa8d4c39e5858d098d5563c307e9`
+and `864339bfe2f648024a63be730dce401a2a2812709a28f1be41ea24f63ffb8c9a`;
+base raw/report SHA-256 are
+`5f38ae170e09a785fefc6fa053712e4c5da64c7b13f28d3a0eac096fa1d53893`
+and `c3c049ecbccff7e082320ad9c88d38506e30edfa7c7dba51c807fbfec7cf0335`.
+These local results satisfy the unit's no-overfitting regression boundary but
+do not satisfy B4 or B5; the exact-SHA hosted broad and external artifacts
+remain authoritative.
+
 ## Historical Broad V1 Baseline
 
 The first complete baseline was recorded on 2026-07-15 at commit