Use realm cells for global reads

Lewin671 · Lewin671 · commit e73773d44813 · 2026-07-17T16:22:36.000-07:00
diff --git a/crates/qjs-runtime/src/bytecode/compiler_assign.rs b/crates/qjs-runtime/src/bytecode/compiler_assign.rs
@@ -177,11 +177,12 @@ impl Compiler {
         else {
             return self.compile_member_compound_assign(target, op, value);
         };
-        let slot = self.resolve_local_slot(name);
-        let resolved_with_object_slot = self.resolve_with_identifier_target(name, slot);
+        let store_slot = self.resolve_local_slot(name);
+        let load_slot = self.resolve_identifier_load_slot(name);
+        let resolved_with_object_slot = self.resolve_with_identifier_target(name, store_slot);
         match op {
             AssignmentOp::LogicalAndAssign => {
-                self.emit_load_identifier(name, slot, resolved_with_object_slot);
+                self.emit_load_identifier(name, load_slot, resolved_with_object_slot);
                 let end_jump = self.emit(Op::JumpIfFalse(usize::MAX));
                 self.emit(Op::Pop);
                 // `f &&= <anon>` names the anonymous value after the target
@@ -192,12 +193,12 @@ impl Compiler {
                     self.compile_named_expr(value, name)?;
                 }
                 self.emit(Op::Dup);
-                self.emit_store_identifier(name, slot, resolved_with_object_slot);
+                self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
                 let end = self.code.len();
                 self.patch_jump(end_jump, end);
             }
             AssignmentOp::LogicalOrAssign => {
-                self.emit_load_identifier(name, slot, resolved_with_object_slot);
+                self.emit_load_identifier(name, load_slot, resolved_with_object_slot);
                 let end_jump = self.emit(Op::JumpIfTrue(usize::MAX));
                 self.emit(Op::Pop);
                 if *parenthesized {
@@ -206,12 +207,12 @@ impl Compiler {
                     self.compile_named_expr(value, name)?;
                 }
                 self.emit(Op::Dup);
-                self.emit_store_identifier(name, slot, resolved_with_object_slot);
+                self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
                 let end = self.code.len();
                 self.patch_jump(end_jump, end);
             }
             AssignmentOp::NullishAssign => {
-                self.emit_load_identifier(name, slot, resolved_with_object_slot);
+                self.emit_load_identifier(name, load_slot, resolved_with_object_slot);
                 let end_jump = self.emit(Op::JumpIfNotNullish(usize::MAX));
                 self.emit(Op::Pop);
                 if *parenthesized {
@@ -220,7 +221,7 @@ impl Compiler {
                     self.compile_named_expr(value, name)?;
                 }
                 self.emit(Op::Dup);
-                self.emit_store_identifier(name, slot, resolved_with_object_slot);
+                self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
                 let end = self.code.len();
                 self.patch_jump(end_jump, end);
             }
@@ -229,7 +230,7 @@ impl Compiler {
                     && !self.inside_with()
                     && let Expr::Literal(Literal::String { value, .. }) = value
                 {
-                    if let Some(slot) = slot {
+                    if let Some(slot) = store_slot {
                         self.emit(Op::AppendStringLiteralLocal {
                             slot,
                             value: value.clone(),
@@ -243,11 +244,11 @@ impl Compiler {
                     }
                     return Ok(());
                 }
-                self.emit_load_identifier(name, slot, resolved_with_object_slot);
+                self.emit_load_identifier(name, load_slot, resolved_with_object_slot);
                 self.compile_expr(value)?;
                 self.emit(Op::Binary(assignment_binary_op(op)?));
                 self.emit(Op::Dup);
-                self.emit_store_identifier(name, slot, resolved_with_object_slot);
+                self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
             }
         }
         Ok(())
@@ -262,19 +263,20 @@ impl Compiler {
         let AssignmentTarget::Identifier { name, .. } = target else {
             return self.compile_member_update(target, op, prefix);
         };
-        let slot = self.resolve_local_slot(name);
-        let resolved_with_object_slot = self.resolve_with_identifier_target(name, slot);
-        self.emit_load_identifier(name, slot, resolved_with_object_slot);
+        let store_slot = self.resolve_local_slot(name);
+        let load_slot = self.resolve_identifier_load_slot(name);
+        let resolved_with_object_slot = self.resolve_with_identifier_target(name, store_slot);
+        self.emit_load_identifier(name, load_slot, resolved_with_object_slot);
         self.emit(Op::ToNumeric);
         if !prefix {
             self.emit(Op::Dup);
         }
         self.emit(Op::Update(op));
         if prefix {
             self.emit(Op::Dup);
-            self.emit_store_identifier(name, slot, resolved_with_object_slot);
+            self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
         } else {
-            self.emit_store_identifier(name, slot, resolved_with_object_slot);
+            self.emit_store_identifier(name, store_slot, resolved_with_object_slot);
         }
         Ok(())
     }
@@ -742,14 +744,15 @@ impl Compiler {
     pub(super) fn compile_typeof(&mut self, argument: &Expr) -> Result<(), RuntimeError> {
         match argument {
             Expr::Identifier { name, .. } => {
-                let slot = self.resolve_local_slot(name);
-                if self.identifier_needs_with_resolution(slot) {
+                let reference_slot = self.resolve_local_slot(name);
+                let load_slot = self.resolve_identifier_load_slot(name);
+                if self.identifier_needs_with_resolution(reference_slot) {
                     self.emit(Op::TypeofIdentWith {
                         name: name.clone(),
-                        slot,
+                        slot: load_slot,
                     });
                     return Ok(());
-                } else if let Some(slot) = slot {
+                } else if let Some(slot) = load_slot {
                     self.emit(Op::LoadLocal(slot));
                 } else {
                     self.emit(Op::TypeofGlobal(name.clone()));
diff --git a/crates/qjs-runtime/src/bytecode/compiler_expr.rs b/crates/qjs-runtime/src/bytecode/compiler_expr.rs
@@ -413,14 +413,15 @@ impl Compiler {
         match expr {
             Expr::Literal(literal) => self.compile_literal(literal),
             Expr::Identifier { name, .. } => {
-                let slot = self.resolve_local_slot(name);
-                if self.identifier_needs_with_resolution(slot) {
+                let reference_slot = self.resolve_local_slot(name);
+                let load_slot = self.resolve_identifier_load_slot(name);
+                if self.identifier_needs_with_resolution(reference_slot) {
                     self.emit(Op::LoadIdentWith {
                         name: name.clone(),
-                        slot,
+                        slot: load_slot,
                         is_strict: self.strict,
                     });
-                } else if let Some(slot) = slot {
+                } else if let Some(slot) = load_slot {
                     self.emit(Op::LoadLocal(slot));
                 } else {
                     self.emit(Op::LoadGlobal(name.clone()));
diff --git a/crates/qjs-runtime/src/bytecode/compiler_lexical.rs b/crates/qjs-runtime/src/bytecode/compiler_lexical.rs
@@ -97,6 +97,19 @@ impl Compiler {
             .filter(|slot| !self.locals[*slot].sloppy_global_fallback)
     }
 
+    /// Resolves an identifier read to an indexed binding when the binding is
+    /// known at compile time. Global `var`/function writes deliberately keep
+    /// using the global operations so descriptor and strictness checks remain
+    /// centralized, while reads can use the shared realm cell installed for
+    /// their otherwise vestigial local slot.
+    pub(super) fn resolve_identifier_load_slot(&self, name: &str) -> Option<usize> {
+        self.resolve_local_slot(name).or_else(|| {
+            (self.global_scope && self.global_hoisted.contains(name))
+                .then(|| self.local_slots.get(name).copied())
+                .flatten()
+        })
+    }
+
     pub(super) fn assignment_slot(&mut self, name: &str) -> usize {
         if let Some(slot) = self.resolve_local_slot(name) {
             return slot;
@@ -587,6 +600,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn global_var_reads_use_the_shared_slot_but_writes_stay_global() {
+        let script =
+            qjs_parser::parse_script("var value = 1; value; value *= 2; value++; typeof value;")
+                .expect("source should parse");
+        let bytecode =
+            super::super::compiler::compile_script(&script).expect("source should compile");
+        let value_slot = bytecode
+            .local_slot("value")
+            .expect("global var should retain an indexed slot");
+
+        assert!(
+            bytecode
+                .code
+                .iter()
+                .any(|op| matches!(op, Op::LoadLocal(slot) if *slot == value_slot))
+        );
+        assert!(
+            bytecode
+                .code
+                .iter()
+                .any(|op| matches!(op, Op::StoreGlobalSloppy(name) if name == "value"))
+        );
+        assert!(
+            !bytecode
+                .code
+                .iter()
+                .any(|op| matches!(op, Op::LoadGlobal(name) if name == "value"))
+        );
+    }
+
     #[test]
     fn direct_eval_var_capture_uses_the_name_to_cell_deopt_path() {
         let script = qjs_parser::parse_script("var value = 1; function read() { return value; }")
diff --git a/crates/qjs-runtime/src/bytecode/vm_bindings.rs b/crates/qjs-runtime/src/bytecode/vm_bindings.rs
@@ -264,6 +264,13 @@ impl Vm<'_> {
                 }
                 continue;
             }
+            if bytecode.global_scope
+                && local.hoisted
+                && let Some(upvalue) = env.realm_binding_cell(&local.name)
+            {
+                local_upvalues[slot] = Some(upvalue);
+                continue;
+            }
             if local.sloppy_global_fallback {
                 local_upvalues[slot] = env.realm_binding_cell(&local.name);
                 continue;
diff --git a/crates/qjs-runtime/src/bytecode/vm_string_append.rs b/crates/qjs-runtime/src/bytecode/vm_string_append.rs
@@ -102,9 +102,11 @@ impl Vm<'_> {
                     result.clone()
                 });
             if self.realm.borrow().contains_key(&local_meta.name) {
-                self.realm
-                    .borrow_mut()
-                    .insert(local_meta.name, result.clone());
+                // A top-level reader may already hold the realm binding's
+                // shared cell even when this older from-env frame still uses a
+                // compatibility slot. Route the mirror through CallEnv so the
+                // cell cannot retain the pre-append string.
+                self.env.insert_realm(local_meta.name, result.clone());
             }
         }
         Ok(result)
@@ -136,6 +138,9 @@ impl Vm<'_> {
                             result.clone()
                         });
                 }
+                // `Rc::make_mut` can detach the realm string from a cell's
+                // earlier clone. Refresh that cell after the in-place append.
+                self.env.insert_realm(name.to_owned(), result.clone());
                 self.write_through_module_live_binding(name, result.clone());
                 return Ok(result);
             }
diff --git a/crates/qjs-runtime/src/tests/global.rs b/crates/qjs-runtime/src/tests/global.rs
@@ -1255,6 +1255,39 @@ fn eval_script_runs_global_declaration_instantiation_checks() {
     );
 }
 
+#[test]
+fn top_level_global_var_slot_tracks_realm_mutations() {
+    assert_eq!(
+        eval("var slotBackedGlobal = 1; eval('slotBackedGlobal = 3'); slotBackedGlobal;"),
+        Ok(Value::Number(3.0))
+    );
+    assert_eq!(
+        eval(
+            "var slotBackedGlobal = 1; \
+             globalThis.slotBackedGlobal = 4; \
+             slotBackedGlobal;"
+        ),
+        Ok(Value::Number(4.0))
+    );
+    assert_eq!(
+        eval(
+            "var slotBackedGlobal = 1; \
+             Object.defineProperty(globalThis, 'slotBackedGlobal', { value: 5 }); \
+             slotBackedGlobal;"
+        ),
+        Ok(Value::Number(5.0))
+    );
+    assert_eq!(
+        eval(
+            "var slotBackedGlobal = ''; \
+             function appendToGlobal() { slotBackedGlobal += 'x'; } \
+             appendToGlobal(); \
+             slotBackedGlobal;"
+        ),
+        Ok(Value::String("x".to_owned().into()))
+    );
+}
+
 #[test]
 fn test262_build_string_host_helper_matches_regexp_utils_shape() {
     assert_eq!(
diff --git a/tasks/T018-broad-performance.md b/tasks/T018-broad-performance.md
@@ -2592,6 +2592,82 @@ SHA-256: `d1db2d4998b95ad988670acc4b31da7219d28f300824c5f4055629ce7e36b962`.
 This unit improves a class-heavy external program while preserving both other
 external suites and the internal regression guard; B4 and B5 remain active.
 
+The exact-SHA hosted workflows for
+`eaf64f20f4790681a38dfbc382696eb52330ed2e` then completed successfully. CI
+run `29617126163` passed comparison, Test262 subset, and full-check jobs.
+Coverage run `29617310831` retained 42,671 Rust passes, one failure, zero
+timeouts, and one actionable gap; its burndown and comparison-case SHA-256
+values are
+`0a9594104963a6815964c986c5779d09088d4a88761688f9fa9c476ef762a900`
+and `3ba9a1a20f4cd430f9f33471ca97652a67a12602740b26453f2e06fd63a58329`.
+
+Performance Preview run `29617126173` retained 25/25 broad cases, all 225/225
+eligible measurements, and all 75 engine/case linearity pairs. The hosted
+runner's 1.007516x candidate/base result was inconclusive; candidate/QuickJS-NG
+was 0.366549x overall, but allocation still failed B4 at 2.822703x. The other
+family ratios were 0.615636x array, 0.173452x binding, 0.087795x builtin,
+0.528594x call, 0.188521x control, 0.170350x property, and 0.521216x string.
+Hosted broad raw/report SHA-256 are
+`48ecceb438c6359b17346f048e99305ebde22d46a4c53a1c361d6644e33ec467`
+and `c76237ea82ad301bbb51c99929da9ec91accaade2238e3e2d2c8a53e7c2f15a4`.
+
+The same exact-SHA artifact retained comparable coverage at 5/5 JetStream,
+7/14 Kraken, and 23/26 SunSpider, but qjs-rust lost every comparable case.
+Suite diagnostic ratios remained far from B5 at 10.625742x, 6.170478x, and
+11.060351x QuickJS-NG. Hosted external raw/report SHA-256 are
+`33e631640f11669044b630bc663e7d7849ef60a85f6077cabf853d020cc1c848`
+and `59bd814501b7b4f0cf40c4be3f96b291bd44f075b84484a40026658861421f6f`.
+The target JetStream class-field raytrace duration nevertheless fell from
+10,044,283,046 ns at the exact base artifact to 8,697,197,004 ns here, a
+0.865886x cross-artifact ratio, while its candidate/QuickJS-NG ratio improved
+from 16.940592x to 14.608166x. This confirms that the mechanism generalized to
+the independent external workload; it does not mask the much larger remaining
+engine-wide deficit. The external results, rather than internal-only wins,
+therefore continue to drive the next structural bottlenecks. B4 and B5 remain
+active.
+
+The forty-seventh v2 unit follows a fresh external bitops profile into the
+general global-binding read path. A declared top-level `var` or function
+previously re-hashed its source name and consulted the realm/global object on
+every read even though declaration instantiation already provided a stable
+shared realm cell. Such reads now use the declaration's indexed slot backed by
+that cell. Writes remain on the complete global path so writable descriptors,
+strict/sloppy behavior, `with`, direct eval, global-object mutations, and
+accessor/deletion deoptimization keep their existing checks. The same change
+made every top-level declaration install its realm cell at frame entry. It also
+closed two older string-append paths that mutated the realm value table
+directly: both now refresh an existing shared cell after copy-on-write. Focused
+tests prove the read opcode/write opcode split and visibility after direct
+eval, global-object assignment, `Object.defineProperty`, and a nested string
+append. No workload name, source path, iteration count, checksum, or expected
+benchmark value appears in the implementation.
+
+Against base binary SHA-256
+`d4d4930db2bb3e8939ae9228ea979dbe25c34d2bf17ddd5aad136d7b6c6d957d`,
+candidate binary SHA-256
+`989f3cd0c827db801b23ebf95ef8eea326c144a34e05313c1327ef2b24132926`
+improved alternating outer-wall probes of six independent SunSpider sources.
+Candidate/base medians were 0.804612x for `bitops-bitwise-and`, 0.979102x for
+`bitops-nsieve-bits`, 0.936710x for `3d-morph`, 0.963054x for
+`access-nsieve`, 0.994970x for `math-partial-sums`, and 0.994814x for
+`string-validate-input`. The 9-run probes were independently repeated with 21
+runs for the three closest or initially variable cases. These focused probes
+use the pinned upstream source and the external preview's raw CLI mode, but are
+development evidence rather than a complete suite claim; the exact-SHA hosted
+preview remains authoritative.
+
+The complete one-block three-role broad development diagnostic produced 1,473
+OK samples: 498 calibration, 225 startup, 75 warmup, 75/75 eligible
+measurements, and 600 linearity samples. Candidate/base was 0.987170x overall;
+family ratios ranged from 0.955193x call through 1.001039x property, and the
+worst individual candidate/base ratio was 1.011043x. Candidate/QuickJS-NG was
+0.192872x overall, but allocation still failed B4 at 1.136663x. The strict
+analyzer correctly rejected the receipt-less dirty development binaries, so
+this is regression evidence rather than a fixed-hardware claim. Broad raw
+SHA-256: `fc5533c3541b3fdc108c85e3744a2cd90b976e83bc19ef8e09188e3158dbfc33`.
+This unit improves several structurally different external programs while
+keeping the internal family guard neutral; B4 and B5 remain active.
+
 ## Historical Broad V1 Baseline
 
 The first complete baseline was recorded on 2026-07-15 at commit

Original file line number	Diff line number	Diff line change
`@@ -264,6 +264,13 @@ impl Vm<'_> {`
`264`	`264`	`}`
`265`	`265`	`continue;`
`266`	`266`	`}`
	`267`	`+ if bytecode.global_scope`
	`268`	`+ && local.hoisted`
	`269`	`+ && let Some(upvalue) = env.realm_binding_cell(&local.name)`
	`270`	`+ {`
	`271`	`+ local_upvalues[slot] = Some(upvalue);`
	`272`	`+ continue;`
	`273`	`+ }`
`267`	`274`	`if local.sloppy_global_fallback {`
`268`	`275`	`local_upvalues[slot] = env.realm_binding_cell(&local.name);`
`269`	`276`	`continue;`
Original file line number	Diff line number	Diff line change
`@@ -102,9 +102,11 @@ impl Vm<'_> {`
`102`	`102`	`result.clone()`
`103`	`103`	`});`
`104`	`104`	`if self.realm.borrow().contains_key(&local_meta.name) {`
`105`		`- self.realm`
`106`		`- .borrow_mut()`
`107`		`- .insert(local_meta.name, result.clone());`
	`105`	`+ // A top-level reader may already hold the realm binding's`
	`106`	`+ // shared cell even when this older from-env frame still uses a`
	`107`	`+ // compatibility slot. Route the mirror through CallEnv so the`
	`108`	`+ // cell cannot retain the pre-append string.`
	`109`	`+ self.env.insert_realm(local_meta.name, result.clone());`
`108`	`110`	`}`
`109`	`111`	`}`
`110`	`112`	`Ok(result)`
`@@ -136,6 +138,9 @@ impl Vm<'_> {`
`136`	`138`	`result.clone()`
`137`	`139`	`});`
`138`	`140`	`}`
	`141`	+ // `Rc::make_mut` can detach the realm string from a cell's
	`142`	`+ // earlier clone. Refresh that cell after the in-place append.`
	`143`	`+ self.env.insert_realm(name.to_owned(), result.clone());`
`139`	`144`	`self.write_through_module_live_binding(name, result.clone());`
`140`	`145`	`return Ok(result);`
`141`	`146`	`}`