fix(runtime): enforce the three shape rules the single property-read path needs (synthetic class ids aliased live ShapeIds)

crates/perry-runtime/src/array/alloc.rs

@@ -46,6 +46,10 @@ pub extern "C" fn js_array_alloc(capacity: u32) -> *mut ArrayHeader {
     unsafe {
         // Initialize header
         (*ptr).length = 0;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "ArrayHeader::capacity",
+            actual_capacity,
+        );
         (*ptr).capacity = actual_capacity;
         // HOLE-initialize the whole capacity so the unused [length, capacity)
         // slack never holds stale arena bits that the whole-heap from-space
@@ -88,6 +92,10 @@ pub(crate) fn js_array_alloc_named_props_reserved(
     ) as *mut ArrayHeader;
     unsafe {
         (*ptr).length = 0;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "ArrayHeader::capacity",
+            actual_capacity,
+        );
         (*ptr).capacity = actual_capacity;
         let front = ptr.add(1) as *mut u64;
         // GC_STORE_AUDIT(INIT): the header word is an INT32 box on a
@@ -129,6 +137,10 @@ pub(crate) fn js_array_alloc_pointer_elements(capacity: u32) -> *mut ArrayHeader
 
     unsafe {
         (*ptr).length = 0;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "ArrayHeader::capacity",
+            actual_capacity,
+        );
         (*ptr).capacity = actual_capacity;
         // Arena slots can be reused after a raw-f64 array. The all-pointer
         // layout owns the same header, so clear numeric representation flags
@@ -173,6 +185,10 @@ pub extern "C" fn js_array_alloc_with_length(capacity: u32) -> *mut ArrayHeader
 
     unsafe {
         (*ptr).length = capacity; // Set length = requested capacity
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "ArrayHeader::capacity",
+            actual_capacity,
+        );
         (*ptr).capacity = actual_capacity;
         let elements_ptr = crate::array::array_elements_ptr(ptr as *const ArrayHeader) as *mut u64;
         for i in 0..capacity as usize {

crates/perry-runtime/src/array/push_pop.rs

@@ -195,6 +195,10 @@ pub extern "C" fn js_array_grow(arr: *mut ArrayHeader, min_capacity: u32) -> *mu
         let arr = arr_handle.get_raw_mut_ptr::<ArrayHeader>();
         let shifted = array_front_offset(arr) != reserve;
         (*new_ptr).length = (*arr).length;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "ArrayHeader::capacity (grow)",
+            new_capacity,
+        );
         (*new_ptr).capacity = new_capacity;
         // GC_STORE_AUDIT(BARRIERED): growth normalizes the logical backing
         // range, transfers its layout, and replays its write barriers below.

crates/perry-runtime/src/buffer/header.rs

@@ -989,6 +989,10 @@ pub fn buffer_alloc(capacity: u32) -> *mut BufferHeader {
         let header = (ptr as *mut u8).sub(crate::gc::GC_HEADER_SIZE) as *mut crate::gc::GcHeader;
         (*header).gc_flags |= crate::gc::GC_FLAG_TENURED;
         (*ptr).length = 0;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "BufferHeader::capacity",
+            capacity,
+        );
         (*ptr).capacity = capacity;
     }
     register_buffer(ptr);

crates/perry-runtime/src/gc/tests/alloc.rs

@@ -644,6 +644,7 @@ fn alloc_malloc_kind_test_object(obj_type: u8) -> *mut u8 {
                     ptr as *mut crate::promise::Promise,
                     crate::promise::Promise {
                         native_pinned: 0,
+                        _shape_word_pad: [0; 6],
                         state: crate::promise::PromiseState::Pending,
                         value: 0.0,
                         reason: 0.0,

crates/perry-runtime/src/gc/tests/support.rs

@@ -75,6 +75,7 @@ pub(super) unsafe fn alloc_old_test_promise() -> *mut crate::promise::Promise {
         ptr,
         crate::promise::Promise {
             native_pinned: 0,
+            _shape_word_pad: [0; 6],
             state: crate::promise::PromiseState::Pending,
             value: 0.0,
             reason: 0.0,
@@ -806,6 +807,7 @@ pub(super) fn allocate_dead_malloc_churn_headers(per_type: usize) -> Vec<usize>
                 ptr,
                 crate::promise::Promise {
                     native_pinned: 0,
+                    _shape_word_pad: [0; 6],
                     state: crate::promise::PromiseState::Pending,
                     value: 0.0,
                     reason: 0.0,

crates/perry-runtime/src/hot_diag.rs

@@ -862,6 +862,8 @@ struct SiteStat {
     /// cache held the right answer in a way and the read came back to the miss
     /// handler regardless. See [`IcDiag::prime_in_ways`].
     prime_in_ways: u64,
+    /// Per-site hit count; see [`IcDiag::hits`].
+    hits: u64,
 }
 
 #[derive(Default)]
@@ -908,12 +910,66 @@ pub struct IcDiag {
     /// * `new_token` + not `in_ways` — a shape neither the MRU entry nor the
     ///   ways had (genuine polymorphism, or a first sighting).
     pub prime_in_ways: u64,
+    /// The HIT side of the property-get IC, so a hit rate can be quoted
+    /// instead of a miss count.
+    ///
+    /// Everything else in this group is recorded from the runtime miss
+    /// handler, because that is the only part of a property read the runtime
+    /// sees: a hit is served entirely by the emitted diamond and never calls
+    /// in. Counting hits therefore needs an emitted probe, which is what
+    /// [`js_ic_diag_note_hit`] is — one `#[cold]`-guarded call on the hit
+    /// edge, behind the same `PERRY_IC_DIAG` arming as the misses, so an
+    /// unarmed run pays one relaxed load.
+    ///
+    /// This matters for the single-path object-model work: a fast path that
+    /// stops being taken is correct-but-slow and invisible in program output.
+    /// `hits` next to `misses` is the only way to tell "the guard was removed
+    /// and reads now hit" from "the guard was removed and every read falls to
+    /// the miss handler, still producing the right answer".
+    pub hits: u64,
+    /// Hits served from the MRU packed word versus one of the four ways.
+    pub hits_in_ways: u64,
 }
 
 crate::perry_thread_local! {
     static IC_DIAG: RefCell<IcDiag> = RefCell::new(IcDiag::default());
 }
 
+/// Record one property-get IC HIT. See [`IcDiag::hits`].
+///
+/// Callers must gate on [`ic_on`] first — emitted code should load the
+/// arming byte and branch, never call unconditionally.
+pub fn ic_note_hit(site: usize, in_ways: bool) {
+    IC_DIAG.with(|d| {
+        let mut d = d.borrow_mut();
+        if d.started.is_none() {
+            d.started = Some(Instant::now());
+            d.last_dump = d.started;
+        }
+        d.hits += 1;
+        if in_ways {
+            d.hits_in_ways += 1;
+        }
+        let s = d.sites.entry(site).or_default();
+        s.hits += 1;
+    });
+}
+
+/// Emitted-code entry point for [`ic_note_hit`]: `site` is the per-site cache
+/// address the hit path already holds, `in_ways` is 0 for an MRU hit and 1 for
+/// a polymorphic-way hit.
+///
+/// Diagnostic only — nothing may branch on the counters, and the call must sit
+/// behind an `ic_on()` test in the emitted code so an unarmed run never
+/// reaches it.
+#[no_mangle]
+pub extern "C" fn js_ic_diag_note_hit(site: i64, in_ways: i32) {
+    if !ic_on() {
+        return;
+    }
+    ic_note_hit(site as usize, in_ways != 0);
+}
+
 /// Record one `pic_prime_get`, splitting it by whether the token the site is
 /// being primed with is one it already held — in the MRU entry (`same`) or in
 /// one of the ways (`in_ways`). See [`IcDiag::prime_same_token`] and
@@ -997,10 +1053,19 @@ impl IcDiag {
         use std::fmt::Write as _;
         let mut out = String::with_capacity(4096);
         let secs = self.started.map_or(0.0, |t| t.elapsed().as_secs_f64());
+        let reads = self.hits + self.misses;
         let _ = write!(
             out,
-            "[ic-diag] t={secs:.1}s misses={} sites={}",
+            "[ic-diag] t={secs:.1}s misses={} hits={} ({:.1} % of {reads} reads, \
+             {} via ways) sites={}",
             self.misses,
+            self.hits,
+            if reads == 0 {
+                0.0
+            } else {
+                100.0 * self.hits as f64 / reads as f64
+            },
+            self.hits_in_ways,
             self.sites.len()
         );
         for (i, name) in IC_REASON_NAMES.iter().enumerate() {
@@ -1034,7 +1099,7 @@ impl IcDiag {
         rows.sort_by_key(|s| std::cmp::Reverse(s.misses));
         let _ = writeln!(
             out,
-            "  misses   same/new/inways   fresh/armed/mega   key  reasons"
+            "  misses   hits   same/new/inways   fresh/armed/mega   key  reasons"
         );
         for s in rows.iter().take(40) {
             let mut reasons = String::new();
@@ -1047,8 +1112,9 @@ impl IcDiag {
             }
             let _ = writeln!(
                 out,
-                "  {:6}  {:>8}/{}/{:<8}  {:>7}/{}/{:<8}  {:<24}{reasons}",
+                "  {:6}  {:6}  {:>8}/{}/{:<8}  {:>7}/{}/{:<8}  {:<24}{reasons}",
                 s.misses,
+                s.hits,
                 s.prime_same_token,
                 s.prime_new_token,
                 s.prime_in_ways,

crates/perry-runtime/src/map.rs

@@ -1572,6 +1572,7 @@ pub extern "C" fn js_map_alloc(capacity: u32) -> *mut MapHeader {
 
         // Initialize header
         (*ptr).size = 0;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word("MapHeader::capacity", cap);
         (*ptr).capacity = cap;
         // GC_STORE_AUDIT(INIT): map entries buffer is external storage; element stores are barriered separately.
         (*ptr).entries = entries;
@@ -2048,6 +2049,10 @@ unsafe fn ensure_capacity(map: *mut MapHeader) -> bool {
 
     // GC_STORE_AUDIT(INIT): map external buffer pointer moves; live entry slots are dirtied by caller.
     (*map).entries = new_entries;
+    crate::object::shape_rule3::debug_assert_not_shape_id_word(
+        "MapHeader::capacity (grow)",
+        new_capacity,
+    );
     (*map).capacity = new_capacity;
     MAP_REGISTRY.with(|registry| {
         let mut registry = registry.borrow_mut();

crates/perry-runtime/src/native_arena.rs

@@ -323,6 +323,10 @@ pub extern "C" fn js_native_arena_view(
             crate::gc::GC_TYPE_NATIVE_TYPED_VIEW,
         ) as *mut NativeTypedViewHeader;
         (*view).length = length as u32;
+        crate::object::shape_rule3::debug_assert_not_shape_id_word(
+            "NativeTypedViewHeader::capacity",
+            length as u32,
+        );
         (*view).capacity = length as u32;
         (*view).kind = kind;
         (*view).elem_size = elem_size as u8;

crates/perry-runtime/src/object/array_object_ops.rs

@@ -678,12 +678,11 @@ pub(crate) unsafe fn define_array_property(
         }
 
         // Redefining an index that was previously an accessor back to a data
-        // property: drop the stale accessor entry.
-        crate::state::state()
-            .descriptors
-            .accessor_descriptors
-            .borrow_mut()
-            .remove(&(obj as usize, key_name.to_string()));
+        // property: drop the stale accessor entry. Through the funnel, so the
+        // owner index and (for a shaped receiver) the ShapeId follow — a raw
+        // table `remove` leaves `accessor_descriptor_keys_for_obj` reporting
+        // the key and every shape-keyed cache still claiming an accessor.
+        clear_accessor_descriptor(obj as usize, key_name);
         // [[DefineOwnProperty]] writes the slot directly — clear any stale
         // attrs first so the extend helper's [[Set]]-side writability check
         // (added for ordinary `arr[i] = v` writes) can't reject this store.
@@ -862,11 +861,7 @@ pub(crate) unsafe fn define_array_property(
     // Redefining a former accessor back to a data property drops the stale
     // accessor entry (the non-configurable case already threw above).
     if cur_accessor.is_some() {
-        crate::state::state()
-            .descriptors
-            .accessor_descriptors
-            .borrow_mut()
-            .remove(&(obj as usize, key_name.to_string()));
+        clear_accessor_descriptor(obj as usize, key_name);
     }
 
     // Write the value: an explicit `value` wins; a NEW property with no value

crates/perry-runtime/src/object/class_meta_registry.rs

@@ -454,6 +454,12 @@ mod dense_parent_tests {
     /// cached store plan in the program.
     #[test]
     fn re_registering_the_same_edge_flushes_nothing() {
+        // The epoch this asserts on is PROCESS-global, so any other test
+        // thread installing a descriptor or registering a class inside the
+        // window below moves it and fails this test for reasons that have
+        // nothing to do with re-registration. Serialize against the tests
+        // that do (they all take this lock).
+        let _lock = crate::gc::global_side_table_test_lock();
         const CHILD: u32 = 60_020;
         const PARENT: u32 = 60_021;
         crate::object::class_registry::register_class(CHILD, PARENT);

crates/perry-runtime/src/object/class_registry.rs

@@ -105,14 +105,16 @@ pub use state::{
 
 // ── prototype_objects.rs ────────────────────────────────────────────────────
 pub(crate) use prototype_objects::{
-    class_prototype_object, ensure_function_prototype_object, function_class_id,
-    function_value_for_class_id, proto_chain_symbol_slot, resolve_proto_chain_field,
-    resolve_proto_chain_field_with_receiver, resolve_proto_chain_symbol,
-    synthetic_class_prototype_object,
+    alloc_synthetic_class_id, class_prototype_object, ensure_function_prototype_object,
+    function_class_id, function_value_for_class_id, proto_chain_symbol_slot,
+    resolve_proto_chain_field, resolve_proto_chain_field_with_receiver, resolve_proto_chain_symbol,
+    synthetic_class_prototype_object, SYNTHETIC_CLASS_ID_BASE,
 };
 pub use prototype_objects::{
     js_set_function_prototype, js_set_prototype_property, NEXT_SYNTHETIC_CLASS_ID,
 };
+#[cfg(test)]
+pub(crate) use prototype_objects::{test_alloc_synthetic_class_id, SYNTHETIC_CLASS_ID_END};
 
 // ── class_meta.rs ───────────────────────────────────────────────────────────
 #[cfg(test)]

crates/perry-runtime/src/object/class_registry/gc_roots.rs

@@ -718,7 +718,10 @@ pub(crate) fn test_clear_class_side_table_roots() {
     // it lives in the calling thread's class image (`object/class_image.rs`)
     // rather than a `per_test_global!`, where a clear from a guard on another
     // libtest thread would be the #7672 hazard this helper exists to avoid.
-    NEXT_SYNTHETIC_CLASS_ID.store(0x8000_0000, std::sync::atomic::Ordering::Relaxed);
+    NEXT_SYNTHETIC_CLASS_ID.store(
+        super::prototype_objects::SYNTHETIC_CLASS_ID_BASE,
+        std::sync::atomic::Ordering::Relaxed,
+    );
 }
 
 #[cfg(test)]

crates/perry-runtime/src/object/class_registry/prototype_methods.rs

@@ -523,7 +523,7 @@ pub(crate) fn synthetic_class_id_for_function(func_value: f64) -> u32 {
     if let Some(existing) = existing {
         return existing;
     }
-    let new_cid = NEXT_SYNTHETIC_CLASS_ID.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let new_cid = super::prototype_objects::alloc_synthetic_class_id();
     FUNCTION_CLASS_IDS.with(|table| {
         let mut write = table.write().unwrap();
         if write.is_none() {