runtime: a real elements store for class X extends Array (−12% on the wolf-ecs twins, gated off)

crates/perry-codegen/src/expr/index_get/inline_dyn_typed_array.rs

@@ -438,9 +438,90 @@ pub(super) fn lower_inline_dyn_typed_array_get(
     ctx.block()
         .cond_br(&header_ok, &object_brand_label, &object_miss_label);
 
+    // An elements-backed Array-subclass instance (`ObjectMeta.elements`,
+    // perry-runtime `array/subclass_elements.rs`): its indexed elements live
+    // in a real Array hanging off the meta record, so the read is the plain
+    // Array read on that inner array — no shape IC, no family token. A miss
+    // of this probe (no meta, no store) is the shape-carried form and keeps
+    // the IC below; an out-of-bounds index or a hole goes to the complete
+    // dispatcher (prototype chain).
+    let elem_meta_idx = ctx.new_block("arrlike.elem.meta");
+    let elem_store_idx = ctx.new_block("arrlike.elem.store");
+    let elem_bounds_idx = ctx.new_block("arrlike.elem.bounds");
+    let elem_load_idx = ctx.new_block("arrlike.elem.load");
+    let elem_value_idx = ctx.new_block("arrlike.elem.value");
+    let elem_meta_label = ctx.block_label(elem_meta_idx);
+    let elem_store_label = ctx.block_label(elem_store_idx);
+    let elem_bounds_label = ctx.block_label(elem_bounds_idx);
+    let elem_load_label = ctx.block_label(elem_load_idx);
+    let elem_value_label = ctx.block_label(elem_value_idx);
     ctx.current_block = object_brand_idx;
     ctx.block()
-        .cond_br(&is_array, &object_array_guard_label, &object_shape_label);
+        .cond_br(&is_array, &object_array_guard_label, &elem_meta_label);
+    ctx.current_block = elem_meta_idx;
+    let elem_meta_addr = ctx.block().add(I64, &object_raw, &meta_offset);
+    let elem_meta_slot_ptr = ctx.block().inttoptr(I64, &elem_meta_addr);
+    let elem_meta_loaded = ctx.block().load(
+        if meta_ptr_size == 4 { I32 } else { I64 },
+        &elem_meta_slot_ptr,
+    );
+    let elem_meta_i64 = if meta_ptr_size == 4 {
+        ctx.block().zext(I32, &elem_meta_loaded, I64)
+    } else {
+        elem_meta_loaded
+    };
+    let elem_has_meta = ctx.block().icmp_ne(I64, &elem_meta_i64, "0");
+    ctx.block()
+        .cond_br(&elem_has_meta, &elem_store_label, &object_shape_label);
+    ctx.current_block = elem_store_idx;
+    let elem_meta_ptr = ctx.block().inttoptr(I64, &elem_meta_i64);
+    // `ObjectMeta.elements` is word 12 (offset 96; pinned by a const assert
+    // in perry-runtime `object/mod.rs`).
+    let elem_store_slot_ptr = ctx.block().gep(I64, &elem_meta_ptr, &[(I64, "12")]);
+    let elem_store_i64 = ctx.block().load(I64, &elem_store_slot_ptr);
+    let elem_has_store = ctx.block().icmp_ne(I64, &elem_store_i64, "0");
+    ctx.block()
+        .cond_br(&elem_has_store, &elem_bounds_label, &object_shape_label);
+    ctx.current_block = elem_bounds_idx;
+    let elem_type_addr = ctx.block().sub(I64, &elem_store_i64, "8");
+    let elem_type_ptr = ctx.block().inttoptr(I64, &elem_type_addr);
+    let elem_type = ctx.block().load(I8, &elem_type_ptr);
+    let elem_is_array = ctx.block().icmp_eq(I8, &elem_type, "1");
+    let elem_flags_addr = ctx.block().sub(I64, &elem_store_i64, "7");
+    let elem_flags_ptr = ctx.block().inttoptr(I64, &elem_flags_addr);
+    let elem_flags = ctx.block().load(I8, &elem_flags_ptr);
+    let elem_fwd = ctx.block().and(I8, &elem_flags, "128");
+    let elem_not_fwd = ctx.block().icmp_eq(I8, &elem_fwd, "0");
+    let elem_store_ptr = ctx.block().inttoptr(I64, &elem_store_i64);
+    let elem_length = ctx.block().load(I32, &elem_store_ptr);
+    let elem_length_i64 = ctx.block().zext(I32, &elem_length, I64);
+    let elem_in_bounds = ctx.block().icmp_ult(I64, &object_idx_i64, &elem_length_i64);
+    let elem_ok = ctx.block().and(I1, &elem_is_array, &elem_not_fwd);
+    let elem_ok = ctx.block().and(I1, &elem_ok, &elem_in_bounds);
+    ctx.block()
+        .cond_br(&elem_ok, &elem_load_label, &object_miss_label);
+    ctx.current_block = elem_load_idx;
+    let elem_bytes = ctx.block().shl(I64, &object_idx_i64, "3");
+    let elem_elements_addr = ctx.block().add(I64, &elem_store_i64, "8");
+    let elem_addr = ctx.block().add(I64, &elem_elements_addr, &elem_bytes);
+    let elem_ptr = ctx.block().inttoptr(I64, &elem_addr);
+    let elem_raw = ctx.block().load(DOUBLE, &elem_ptr);
+    let elem_bits = ctx.block().bitcast_double_to_i64(&elem_raw);
+    let elem_is_hole = ctx
+        .block()
+        .icmp_eq(I64, &elem_bits, crate::nanbox::TAG_HOLE_I64);
+    ctx.block()
+        .cond_br(&elem_is_hole, &object_miss_label, &elem_value_label);
+    ctx.current_block = elem_value_idx;
+    let elem_value = if coerce_slow_to_number {
+        ctx.block()
+            .call(DOUBLE, "js_number_coerce", &[(DOUBLE, &elem_raw)])
+    } else {
+        elem_raw
+    };
+    let elem_end_label = ctx.block().label.clone();
+    ctx.block().br(&merge_label);
+    kind_incoming.push((elem_value, elem_end_label));
 
     // Ordinary Array: the receiver tag and forwarding state were checked in
     // the predecessor.  Reject descriptors or any process-wide prototype

crates/perry-codegen/src/expr/index_get_claim_tests.rs

@@ -409,6 +409,18 @@ fn any_typed_dynamic_key_takes_the_numeric_tiers_when_it_is_an_array_index() {
         ir.contains("tav.get.brand") && ir.contains("arrlike.ic.family_token"),
         "an integer key must reach the inline typed-array and dense-subclass tiers:\n{ir}"
     );
+    // The elements-backed subclass probe sits ahead of the shape IC: meta
+    // word → `ObjectMeta.elements` (word 12) → inner-array bounds → slot.
+    let store = super::class_field_barrier_tests::block_body(&ir, "arrlike.elem.store.")
+        .expect("the elements-store probe block exists");
+    assert!(
+        store.contains("getelementptr i64, ptr %") && store.contains(", i64 12"),
+        "the probe must load ObjectMeta.elements at word 12:\n{store}"
+    );
+    assert!(
+        ir.contains("arrlike.elem.bounds") && ir.contains("arrlike.elem.load"),
+        "the probe must bounds-check and load from the inner array:\n{ir}"
+    );
     assert!(
         ir.contains("call double @js_array_get_index_or_string("),
         "non-index keys must keep the complete key route:\n{ir}"

crates/perry-codegen/src/expr/property_get/composed_ics.rs

@@ -223,7 +223,54 @@ pub(super) fn emit_array_subclass_length_ic(
     let forwarded = ctx.block().and(I8, &gc_flags, "128");
     let not_forwarded = ctx.block().icmp_eq(I8, &forwarded, "0");
     let header_ok = ctx.block().and(I1, &is_object, &not_forwarded);
-    ctx.block().cond_br(&header_ok, &shape_label, &miss_label);
+    let meta_ptr_size: u64 = if crate::target_layout::target_is_ilp32(ctx.target_triple) {
+        4
+    } else {
+        8
+    };
+    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
+        - meta_ptr_size)
+        .to_string();
+    // An elements-backed Array-subclass instance (`ObjectMeta.elements`):
+    // `length` is the inner Array's length word — no shape IC. A probe miss
+    // (no meta, no store) is the shape-carried form and keeps the IC below.
+    let elem_meta_idx = ctx.new_block("plen.elem.meta");
+    let elem_store_idx = ctx.new_block("plen.elem.store");
+    let elem_length_idx = ctx.new_block("plen.elem.length");
+    let elem_meta_label = ctx.block_label(elem_meta_idx);
+    let elem_store_label = ctx.block_label(elem_store_idx);
+    let elem_length_label = ctx.block_label(elem_length_idx);
+    ctx.block()
+        .cond_br(&header_ok, &elem_meta_label, &miss_label);
+    ctx.current_block = elem_meta_idx;
+    let elem_meta_addr = ctx.block().add(I64, recv_handle, &meta_offset);
+    let elem_meta_slot_ptr = ctx.block().inttoptr(I64, &elem_meta_addr);
+    let elem_meta_loaded = ctx.block().load(
+        if meta_ptr_size == 4 { I32 } else { I64 },
+        &elem_meta_slot_ptr,
+    );
+    let elem_meta_i64 = if meta_ptr_size == 4 {
+        ctx.block().zext(I32, &elem_meta_loaded, I64)
+    } else {
+        elem_meta_loaded
+    };
+    let elem_has_meta = ctx.block().icmp_ne(I64, &elem_meta_i64, "0");
+    ctx.block()
+        .cond_br(&elem_has_meta, &elem_store_label, &shape_label);
+    ctx.current_block = elem_store_idx;
+    let elem_meta_ptr = ctx.block().inttoptr(I64, &elem_meta_i64);
+    // `ObjectMeta.elements` is word 12 (offset 96; const-asserted in the runtime).
+    let elem_store_slot_ptr = ctx.block().gep(I64, &elem_meta_ptr, &[(I64, "12")]);
+    let elem_store_i64 = ctx.block().load(I64, &elem_store_slot_ptr);
+    let elem_has_store = ctx.block().icmp_ne(I64, &elem_store_i64, "0");
+    ctx.block()
+        .cond_br(&elem_has_store, &elem_length_label, &shape_label);
+    ctx.current_block = elem_length_idx;
+    let elem_store_ptr = ctx.block().inttoptr(I64, &elem_store_i64);
+    let elem_length_i32 = ctx.block().load(I32, &elem_store_ptr);
+    let elem_length = ctx.block().uitofp(I32, &elem_length_i32, DOUBLE);
+    let elem_end = ctx.block().label.clone();
+    ctx.block().br(&merge_label);
 
     ctx.current_block = shape_idx;
     let object_ptr = ctx.block().inttoptr(I64, recv_handle);
@@ -252,15 +299,6 @@ pub(super) fn emit_array_subclass_length_ic(
     let exact_match = ctx.block().icmp_eq(I64, &live_key, &cached_key);
     ctx.block().cond_br(&exact_match, &slot_label, &miss_label);
 
-    let meta_ptr_size: u64 = if crate::target_layout::target_is_ilp32(ctx.target_triple) {
-        4
-    } else {
-        8
-    };
-    let meta_offset = (crate::target_layout::object_header_size_bytes(ctx.target_triple)
-        - meta_ptr_size)
-        .to_string();
-
     ctx.current_block = family_meta_idx;
     let family_meta_addr = ctx.block().add(I64, recv_handle, &meta_offset);
     let family_meta_slot_ptr = ctx.block().inttoptr(I64, &family_meta_addr);
@@ -358,6 +396,7 @@ pub(super) fn emit_array_subclass_length_ic(
     let length = ctx.block().phi(
         DOUBLE,
         &[
+            (&elem_length, &elem_end),
             (&inline_length, &inline_end),
             (&spilled_length, &spill_end),
             (&miss_length, &miss_end),

crates/perry-codegen/src/expr/property_get/tests.rs

@@ -860,3 +860,26 @@ fn generic_non_size_read_has_no_collection_layout_load() {
         "only `.size` may grow the native collection fast path:\n{ir}"
     );
 }
+
+/// The object-backed `.length` tier probes the elements-backed subclass store
+/// first: meta word → `ObjectMeta.elements` (word 12) → the inner Array's
+/// `length` word — and only then the shape/family IC.
+#[test]
+fn the_length_tier_probes_the_elements_store_before_the_shape_ic() {
+    let ir = emit_guarded_length_read();
+    assert!(
+        ir.contains("plen.elem.meta") && ir.contains("plen.elem.length"),
+        "the elements probe must exist:\n{ir}"
+    );
+    let store = super::super::class_field_barrier_tests::block_body(&ir, "plen.elem.store.")
+        .expect("the elements-store probe block exists");
+    assert!(
+        store.contains("getelementptr i64, ptr %") && store.contains(", i64 12"),
+        "the probe must load ObjectMeta.elements at word 12:\n{store}"
+    );
+    // A miss of the probe keeps the shape IC.
+    assert!(
+        store.contains("plen.ic.shape"),
+        "a missing store must fall through to the shape IC:\n{store}"
+    );
+}

crates/perry-codegen/src/expr/this_super_call.rs

@@ -264,6 +264,44 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                 .filter(|class| class.extends_expr.is_none() && !class.heritage_lexically_shadowed)
                 .and_then(|class| class.extends_name.clone())
                 .filter(|parent| !ctx.classes.contains_key(parent.as_str()));
+            // `class X extends Array { constructor(...a) { super(...a) } }`:
+            // the Array parent has no registered constructor, so the spread
+            // form must run the same subclass init the direct `super(n)`
+            // form does (`lower_array_super_init`), handing it the
+            // materialized argument array's elements. Without this the
+            // instance had no `length` and no Array surface at all.
+            // Resolved the way the direct `super(n)` arm resolves its parent
+            // (`extends_name`, a lexically shadowed heritage excluded): the
+            // heritage of `class X extends Array` also carries `extends_expr`,
+            // which the `async_parent` filter above rejects.
+            let array_parent = ctx
+                .classes
+                .get(&current_class_name)
+                .filter(|class| !class.heritage_lexically_shadowed)
+                .and_then(|class| class.extends_name.as_deref())
+                .is_some_and(|parent| parent == "Array" && !ctx.classes.contains_key("Array"));
+            if array_parent {
+                let len_i32 = ctx.block().call(I32, "js_array_length", &[(I64, &arr)]);
+                let len = ctx.block().zext(I32, &len_i32, I64);
+                let elems_addr = ctx.block().add(I64, &arr, "8");
+                let elems_ptr = ctx.block().inttoptr(I64, &elems_addr);
+                let result = ctx.block().call(
+                    DOUBLE,
+                    "js_array_subclass_init_args",
+                    &[
+                        (DOUBLE, &this_box),
+                        (crate::types::PTR, &elems_ptr),
+                        (I64, &len),
+                    ],
+                );
+                bind_derived_this_after_super(ctx);
+                crate::lower_call::apply_field_initializers_recursive(
+                    ctx,
+                    &current_class_name,
+                    crate::lower_call::FieldInitMode::SelfOnly,
+                )?;
+                return Ok(result);
+            }
             if matches!(
                 async_parent.as_deref(),
                 Some("EventEmitterAsyncResource" | "AsyncLocalStorage" | "AsyncResource")

crates/perry-runtime/src/array/mod.rs

@@ -29,6 +29,7 @@ mod sort;
 mod species;
 mod splice_slice;
 mod subclass;
+pub(crate) mod subclass_elements;
 
 #[cfg(test)]
 mod collection_tag_tests;
@@ -41,6 +42,8 @@ mod spread_dense_tests;
 #[cfg(test)]
 mod strict_store_tests;
 #[cfg(test)]
+mod subclass_elements_tests;
+#[cfg(test)]
 mod subclass_tests;
 #[cfg(test)]
 mod tests;
@@ -184,11 +187,12 @@ pub(crate) use indexing_support::test_swap_array_index_fast_path_invalidated;
 // points, plus the Array-exotic `length` maintenance the generic OBJECT index
 // store needs for a `class X extends Array` receiver.
 pub(crate) use self::subclass::{
-    array_object_set_length, array_subclass_fast_index_get, array_subclass_fast_length,
-    array_subclass_fast_length_with_ic, array_subclass_named_prefix_token_for_slot,
-    array_subclass_tail_descriptors_are_plain, clear_array_subclass_named_prefix_token,
-    clear_packed_subclass_numeric_proof, is_array_subclass_class_id, is_array_subclass_value,
-    note_array_subclass_index_write, note_packed_subclass_spill_store,
+    array_object_set_length, array_subclass_fast_index_get, array_subclass_fast_index_set,
+    array_subclass_fast_length, array_subclass_fast_length_with_ic,
+    array_subclass_named_prefix_token_for_slot, array_subclass_tail_descriptors_are_plain,
+    clear_array_subclass_named_prefix_token, clear_packed_subclass_numeric_proof,
+    is_array_subclass_class_id, is_array_subclass_value, note_array_subclass_index_write,
+    note_packed_subclass_spill_store,
 };
 // Issue #1572 — flatten helpers reused by `node_stream::ns_iter_flat_map`
 // so an `async function*` mapper return is driven through the iterator