VM: quicken monomorphic Number arithmetic sites

[chrisbbreuer]

Parents: #498, #461
Related: #481, #493, #659

Problem

Ordinary bytecode already computes Number/Number binary operations inline, but every execution still merges instruction-local optimizer profile atomics, rechecks the full operand-kind decision, and enters one large generic opcode switch. A stable numeric site never publishes a VM-owned specialized dispatch state, while the generated quickening inventory therefore correctly keeps arithmetic-dispatch unsupported. On restricted hosts this cost remains permanent because no native tier can replace the site.

Scope

• Freeze explicit single-context no-JIT/required-bytecode benchmark and attribution modes; native publication must remain provably zero.
• Add representative stable Number arithmetic rows covering add/subtract/multiply/divide/remainder/power, relational/equality, bitwise, and shifts, plus BigInt, string-concatenation, object-coercion, exceptional, and Number-to-polymorphic controls.
• Add one instruction-indexed, race-free adaptive arithmetic state table owned by each immutable Chunk. Stable Number sites may publish a Number-specialized state after a bounded observation threshold; unsupported/polymorphic sites publish an explicit generic state.
• Preserve bytecode immutability. A specialized miss must execute the exact ordinary operation once, record the changed operand kinds, and dequicken without replaying coercions or effects.
• Preserve Number edge cases, BigInt mixing errors, ToPrimitive ordering, string concatenation, Symbol errors, shifts, NaN/signed zero/infinity, debugger/step/watchdog accounting, exception/finally resumption, moving GC, OOM, and optimizer guard correctness.
• Keep metadata bounded at one compact atomic state per instruction and expose exact hit/miss/dequickening counters for tests and attribution.

No-workaround rules

No source/workload recognizer, benchmark-only branch, disabled profiling globally, mutable bytecode rewriting under shared execution, assumed Number inputs, skipped coercions, cached results, hidden warmup, executable mappings in no-JIT mode, or tree-walker callback presented as quickening. No stacks, queues, jobs, Promise, microtask, Worker-lifecycle, or Map/Set iterator changes.

Acceptance

• Benchmark-first rows preserve exact checksums, bytecode admission, opcode counts, and allocation replay with native publication zero.
• Stable Number sites quicken after the declared threshold; polymorphic/unsupported sites remain generic and one miss dequickens exactly once without effect replay.
• Forced tree-walker, ordinary VM, quickening-off, and quickening-on results match across every operator/control, including exceptions, steps, debugger, OOM, and termination.
• Per-site state publication is race-free under no-GIL/TSan, bounded under attacker-sized bytecode, and reset by Chunk teardown.
• Full units, focused TSan/threadfuzz, relevant arithmetic/coercion Test262, docs/inventory gates, and exact before -> after accounting pass.
• Exact-parent no-JIT evidence demonstrates reduced dispatch/profile work without regressing polymorphic controls or claiming native-tier throughput.

[chrisbbreuer]

Benchmark-first foundation landed in 7d69d613 (bench(vm): add no-jit arithmetic witnesses (#734)).

What is now frozen:

• explicit single_no_jit and attribution_no_jit modes create a GC-enabled Context with native tiers disabled and required-bytecode admission;
• stable Number, stable BigInt, Number/string/BigInt/object polymorphic, and observable coercion/exception rows at 100 and 10,000 jobs;
• exact quick/full checksums: Number 606036 / 5236590351, BigInt 5412345 / 630334997, polymorphic 29422 / 28806122, coercion 101766 / 10176362;
• full-work VM dispatch baselines: 3,020,460 / 900,541 / 1,180,600 / 810,659 respectively;
• every full row has 28 VM entries, nonzero compiler admissions, zero tree-walker entries, zero baseline/optimizer publications, and zero generated-code bytes;
• two consecutive attribution replays per row produced identical admission and Context-backing/GC-cell allocation inventories.

Local gates: comparison runner build; complete benchmark-comparison harness; V20 manifest validation; 33/33 structural rejection tests; 50-page docs render with pinned output manifest; 277-file offline link audit; all eight checksum replays and all four attribution contracts.

This is structural benchmark evidence only. The host is on battery with a competing Home build, so no timing was retained and no performance claim is being made. I am leaving the acceptance box open until the implementation exact-parent A/B proves the intended dispatch/profile reduction while preserving the controls.

[chrisbbreuer]

Implementation landed in 7006c058 (perf(vm): quicken monomorphic Number sites (#734)).

Implemented contract:

• one byte-sized acquire/release QuickBinaryState per immutable instruction, arena-owned by the Chunk;
• Number publication after exactly eight Number/Number observations;
• terminal generic publication after any dynamic observation;
• specialized misses record changed operand kinds, atomically dequicken once, and invoke the canonical operation exactly once with no prior coercion;
• exact Context-owned Number hit, miss, and dequickening attribution, with a test-only quickening-off differential and no production disable option.

Full 10,000-job attribution replay:

• Number: checksum 5236590351, 28 VM entries, 3020460 dispatches, 919643 quick hits, 0 misses, 0 dequickenings;
• BigInt control: checksum 630334997, 28 VM entries, 900541 dispatches, 79982 quick hits, 0 misses, 0 dequickenings;
• polymorphic control: checksum 28806122, 28 VM entries, 1180600 dispatches, 164905 quick hits, 0 misses, 0 dequickenings;
• coercion/exception control: checksum 10176362, 28 VM entries, 810659 dispatches, 157437 quick hits, 0 misses, 0 dequickenings.

Every row retains zero tree-walker entries, baseline/optimizer publications, and generated-code bytes. vm_quick_kernel_hits exactly equals the Context quick-hit count. Before to after Chunk backing changes are 24 / 36 / 24 / 24 bytes across the four rows; all checksums, admissions, dispatches, and GC-cell inventories remain exact.

Semantic and concurrency evidence:

• tree-walker vs required VM quickening-off vs quickening-on matches every arithmetic, comparison, bitwise, shift, and in operator, plus signed zero, NaN/infinity, BigInt mixing, string concatenation, Symbol failure, and observable coercion;
• on/off VM dispatch counts are exact, and three deliberately specialized dynamic misses produce exactly three misses and three dequickenings;
• 802 -> 802 Test262 passes across 21 relevant expression subtrees, 0 flips;
• full Debug units: 1870 passed, 1 skipped, 0 failed/leaked;
• full TSan units: 1868 passed, 2 skipped, 0 failed/leaked; the added all-operator differential also passes focused TSan;
• default and TSan threadfuzz: 400 seeded programs each, 0 failures;
• benchmark harness, V21 manifest, 39/39 fail-closed matrix mutations, quickening inventory/self-test, 277-file link audit, and 50-page docs manifest all pass.

No timing claim is being made. The host became AC-powered, but a user-owned Zig build and system indexing saturated it, so exact-parent order-balanced timing was not retained. I am keeping #734 open only for that quiet-reference A/B and will not publish a throughput result from contaminated samples.

[chrisbbreuer]

The audited collection path is now ready in a6e83039:

• tools/exact-parent-regression.ts now preserves the frozen single_no_jit mode identity and has a structural argument-contract test.
• representative matrix V22 hash-inherits every V21 scored row/profile and re-pins only that collector change.
• zig build benchmark-comparison-test passed all 32 steps and 4 tests; matrix structural tests remain 39/39.
• flips 0 Test262 cases (tooling/docs only).

The actual 7006c058 versus exact parent 7d69d613 measurement remains open. I rejected collection on the current host because it is drawing from battery and a separate conformance process is consuming CPU; those conditions violate the issue's quiet-reference AC acceptance boundary. No contaminated ratio will be published.

[chrisbbreuer]

Frozen binary preparation is now complete for the remaining exact-parent run:

• parent 7d69d613abb29a7fd7220150afbe844fd5bfb738: cb13e5f888e6f461d975d5a4287e581bfec9f94c1f6d41f926fadfb9c9f2238d
• candidate 7006c058e7348598627b5d230a70910d9b0a4a04: 4c1d5d929c9388bf5d1a5b5e714caf9f12386b50b1f15db7ab2f5ad9bcd1b693
• Zig: 0.17.0-dev.1441+d5181a9c9, ReleaseFast
• arithmetic source is byte-identical on both sides: 970e58bec6ab9978335e6f908219bf23154c9ec9ff96ccefc6a94f2917d77fa8
• the frozen 100-job single_no_jit stable-Number contract returns checksum 606036 on both binaries.

Those checksum probes are validation only: the host is still on battery and a persistent BunPress development server is active, so their elapsed/counter values are discarded. Seven-pair quiet-reference AC collection for the stable Number row and the BigInt/polymorphic/coercion controls remains pending; no performance ratio is claimed here.

[chrisbbreuer]

CI follow-up landed in 8b00e5bc (docs(site): refresh BunPress output manifest (#734)).

The first V22 push's docs-link step passed, but docs:build correctly rejected the stale BunPress 0.2.13 output manifest after the owner-maintained renderer advanced to 0.2.14. I rendered the same current docs with both revisions before accepting the change:

• all 50 HTML pages differ only by the upstream code-block foreground/alignment CSS fix;
• the search index retains the exact same 366-entry multiset, now deterministically ordered;
• the regenerated manifest covers 54 outputs;
• the checked BunPress 0.2.14 build succeeds with 50 pages.

Flips 0 Test262 cases. The exact-parent performance collection remains separately gated on quiet AC power.

[chrisbbreuer]

CI follow-up landed in eee03429: the dependency inventory now classifies docs/.data/representative-benchmark-matrix-v22.json as an audited caller of tools/exact-parent-regression.ts.

The exact failing gate now passes locally: zig build dependency-audit reports 16 classified dependency edges, 0 migration targets, and 62 classified repository tools. Flips 0 Test262 cases.