[Flewp]

Summary

Startup and runtime performance fixes for the 250829098.0.15 line, plus two upstream correctness backports. No bytecode-format or JSI changes, so existing hermesc output and RN integration are unaffected.

VM performance (AJ Palkovic):

• Dictionary re-class limit. Deleting or redefining a property on a dictionary switched it to no-cache mode from the second change on. React Native's lazy globals redefine the global object 13 times at startup, so every read of Object, Array, Math and similar missed the property cache. Allows up to 15 cacheable re-classings first.
• String → SymbolID cache. obj[key] with a non-interned key string re-hashed it on every access. Adds a 256-entry direct-mapped cache, cleared at GC start and before symbols are freed.
• Object spread clone. {...src} into a fresh object shares the source's hidden class and copies slots in bulk, when the source is a plain object of default-flag, string-keyed data properties with the same prototype.
• JSON.parse fast paths. Reuses existing add-transitions for keys, appends array elements directly, and lexes ASCII input in place.
• Build knobs. The Android release CMake build type, heap mode and extra compile/link flags become configurable.

Defaults:

• The Android release AAR builds with CMAKE_BUILD_TYPE=Release (-O3) instead of MinSizeRel (-Os), overridable with -PhermesReleaseCmakeBuildType. iOS is unchanged (the Apple script still uses MinSizeRel).

Hardening (follow-up to review):

• Weak-reference read barrier on string → symbol cache hits.
• static_assert tying the re-class limit to its 4-bit counter.
• Removes a dead pinned local in parseArray.

Upstream backports (cherry-pick -x):

• 859499d4f22e19cb4bbb0973ae76309d7a9865fc: IdentifierHashTable growing indefinitely with deleted entries (facebook/hermes#2114).
• 2e1397b4f886711ebdc92accfdfc4fa22f5cef06: out-of-bounds dense store for array literals with more than 65535 elements (facebook/hermes#2238).

Base: 3e1261f2a7bc50ffe52f8354868e78e4e74bb0c8 (250829098.0.15-discord-4).

Testing

Local, macOS, Release builds of base and candidate:

• check-hermes (lit): the candidate fails nothing that base passes. The one failure on both, hermes/truncate-long-stack.js, is environmental: its final CHECK-NEXT: end matches the substring "end" inside the checkout path on the at global (...) line.
• Differential runs, base vs candidate, byte-identical output:
  • 20,000 generated JSON.parse inputs, including error messages;
  • JSON fast-path edge cases;
  • spread edge cases;
  • dictionary re-class;
  • string-cache GC stress;
  • an object-model fuzzer: 3,000 generated sources spread and Object.assigned (accessors, symbols, index-like keys, non-enumerable, frozen/sealed/non-extensible, dictionary-mode and null/foreign prototypes), 40 rounds of global-object redefinition and deletion, and JSON-derived computed keys with deletes across forced GCs.
• ASan + UBSan + handle-sanitizer Debug build (slow-debug asserts on). No sanitizer reports or assertion failures:
  • At -gc-sanitize-handles=1 (heap moved on every allocation): dictionary re-class and JSON fast-path cases.
  • At 0.05: spread clone and the object-model fuzzer.
  • At 0.002 with four random seeds each: the 20k-input JSON fuzz and the string-cache GC stress. The JSON fuzz output is byte-identical to the base Release build for every seed.

CI on this branch covers test262 and lit on macOS, Linux x64, Linux arm64 and ARMv7. The forced-JIT macOS job fails on the base branch as well.

Deferred review notes

1. The spread fast path walks the source class with forEachPropertyWhile, which may rebuild a property map that a later add-transition moved away. Repeated {...state, x} on the same class could allocate more than the slow path. Worth measuring, and worth caching an "all default flags" bit on the class.
2. The ASCII JSON lexer duplicates the UTF-16 scanner. Templating it over the code-unit type would keep one implementation.
3. JSON.parse encodes each value before knowing the fast path applies. On boxed-double builds this can allocate an unused BoxedDouble on the slow path. Reordering needs care, because encoding before taking raw pointers is what fixed the 32-bit GC hazard.
4. Three new declarations were inserted between existing doc comments and their declarations (HiddenClass.h, JSObject.h).
5. The new paths have differential tests but no lit tests yet.