Perf(object): publish initialized data descriptors atomically

[chrisbbreuer]

Parents: #479, #532
Related: #662, #493

Problem

Fresh function and built-in initialization repeatedly publishes a data property with assignment-default attributes, releases property_lock, reacquires it, and then installs the final descriptor. The post-#662 cold Context profile retains Object.setOwnUnlocked, Object.setAttrUnlocked, installNativeProps, and setNativeWithData leaves along this exact path. Besides duplicate uncontended synchronization, a published object can transiently expose the wrong descriptor if initialization ever crosses a sharing boundary.

Scope

• Add one Object primitive that publishes a data value and its final attributes under one property_lock critical section.
• Prepare attribute metadata before release-publishing the Shape and restore the exact prior metadata on OOM.
• Preserve insertion order, existing low-level accessor/data coexistence, GC barriers, Shape convergence, backing ownership, and existing-data replacement semantics.
• Migrate function name/length, native method/static installation, constructor prototype, and other provably equivalent fresh data-descriptor initialization sites.
• Retain ordinary assignment and Object.defineProperty semantics unchanged.
• Measure the frozen Bench: publish cold context lifecycle phase and retention evidence #661 cold no-evaluation Context boundary against the exact first parent, with a warm representative Shape-transition control.

No-workaround rules

• No lock disabling, freshness guesses at shared call sites, default-attribute publication followed by repair, ignored OOM state, predictable hashing, benchmark-only fast path, pooling, or hidden warmup.
• No stacks, queues, jobs, Promise, microtask, Worker-lifecycle, or Map/Set iterator changes.

Acceptance

• Unit tests prove final descriptor identity, existing-data replacement, accessor/data coexistence, insertion order, one-lock publication, and exact OOM rollback.
• A no-GIL publication witness observes only absent or the complete final descriptor, never assignment-default attributes.
• Function and built-in descriptor Test262 surfaces have exact nonzero before -> after accounting with zero flips.
• Focused tests, full units, applicable TSan/threadfuzz, and docs/benchmark CI pass.
• Exact-parent cold lifecycle evidence identifies the affected phase/RSS/finalizers; the warm Shape control does not regress materially.

[chrisbbreuer]

Implementation pushed in 1605a118.

Object.setOwnWithAttr now installs attribute metadata before the Shape release store and restores the exact previous attribute entry if later Shape/slot preparation fails. The tracked setter returns prior metadata from its existing hash lookup, avoiding a second successful-path probe. Function name/length, native methods, intrinsic constructors/prototypes, error prototypes, realm globals, dynamic Function names, and raw JSON initialization use the one-lock transaction. Ordinary assignment, DefineOwnProperty, and accessor conversion are unchanged.

Correctness evidence:

• standalone Object/Shape: 84/84
• focused production: 3/3; focused TSan: 3/3, zero leaks
• focused frontend: 12/12
• final full suite: 1,753 passed / 1 platform skip / 0 failed / 0 leaked across 8 shards
• exact parent cb0200bc -> candidate Test262: Function 509, Object 3,411, JSON 165, function expressions 264, function statements 451; 4,800 -> 4,800, byte-identical transcripts, zero failures/flips

A three-pair diagnostic preserved checksum, all 2,529,000 cell finalizers per invocation, and neutral RSS while candidate create time/cycles were lower. It is not publication evidence. Remote CI, threadfuzz, and formal quiet-host cold/warm artifacts remain pending.

[chrisbbreuer]

A later descendant matrix that still contains 1605a11 completed enough relevant gates to add evidence without closing the comprehensive box: CI run 32485314750 passed all four ordinary unit shards, focused-engine-tests, Test262 parallel, docs, dependency audit, threadfuzz amplified/broad/verify, ReleaseSafe threadfuzz, TSan threadfuzz lifecycle, and TSan watchdog cleanup.

The run was superseded/cancelled and is not globally green. Its three observed failures are outside initialized-descriptor publication: the known #643 Map iterator TSan race, cve/mc-lock-stop-vs-park.js (expected 400, got 401), and semantics/oom-one-thread.js (heap-cap OOM). I am leaving the comprehensive TSan/threadfuzz/CI box open, as well as formal cold/warm evidence; no failing thread/lifecycle surface was changed.

[chrisbbreuer]

Same unblock path as #662: #643 fixed in 04d46c59 removes the TSan race; the remaining `mc-lock-stop-vs-park`/`oom-one-thread` corpus failures are tracked in #722. Cold/warm evidence collection remains pending a quiet reference-host window.

[chrisbbreuer]

Exact evidence preparation is complete without promoting battery diagnostics. Frozen parent cb0200bc and candidate 1605a118 comparison runners were rebuilt with Zig 0.17.0-dev.1441; SHA-256 identities are 24d5eaeb1e9df9165b44551f5d8950b900e679a3b04b5e829e7eb9983356f2fe and 03557939a8577ca816179c58834f95f8f29eab1374421ca2fcbda5ed30e89ff1. Embedded comparison/representative sources are byte-identical (7a1a5bef… / 94d9463c…). Both revisions return checksum 0 and exactly 20,232 finalized cells for an eight-context no-evaluation contract; the warm Shape-fanout control returns checksum 2 for one job. Retained seven-pair cold/warm collection remains queued until AC power and a competitor-free window; no timing from these probes is retained.

[chrisbbreuer]

Comprehensive integration is now green in main CI run 32923883777: 53 required jobs passed, the one nightly-only job was skipped as configured, and 0 jobs failed or were cancelled. This closes the focused/full unit, Test262, TSan/threadfuzz, docs, and benchmark integration box for the landed #663 implementation. Exact-parent cold lifecycle and warm Shape-control evidence remains open; the current host is AC/nominal but has an unrelated unit process and system indexing load, so no timing sample is being started or retained.