[proggeramlug]

The shape becomes the one record of [[Prototype]]: for a null link (part 1) and for a function's link (part 2). This follows #13648, which made a callable's inherited read one OrdinaryGet.

Part 1: a null [[Prototype]] is the shape's identity, not a header bit

A null prototype was recorded twice. The shape's identity carried it, and so did OBJ_FLAG_NULL_PROTO, a header bit set at birth. The identity was derived from that bit, and about 20 readers tested the bit directly. The bit stuck across setPrototypeOf, a later null link never set it, and the declared-keys family require.cache (tagged null) was registered with its class's identity.

Now:

• A born-null birth publishes its first shape with the null identity.
• A family tagged null gets a null-kind layout word from the codegen and a null-kind identity from registration.
• A module namespace links to null through the prototype funnel.
• Every reader asks object_prototype_is_null / cell_prototype_is_null.
• The bit, its store-lane gates and its realm-image header bit are gone; 0x40 is free.

A null-chain store answers "nothing intercepts" without walking the chain. The JSON paths ask object_static_prototype_is_linked, so a null chain reads like the default chain. A property bag's holder slot, which holds its owner's [[Prototype]], is never given the bag's own null.

Bugs fixed on main (test test_gap_null_prototype_shape_authority, test_gap_null_prototype_require_cache):

• a thenable on a relinked Object.create(null) object was not followed;
• util.inspect called an object relinked to Object.prototype "null prototype", and missed setPrototypeOf(x, null);
• require.cache inherited Object.prototype's methods.

Part 2: a function's [[Prototype]] is its shape's identity

Object.setPrototypeOf(fn, p) moved the function to the shared FunctionDictionary shape and stored the link as a key in its state record. Now the function moves to the Function shape of its own keys, with the linked identity. That is the class-less rule an ordinary object takes; the prototype gets its stable serial first. The record holds the link only for a FunctionDictionary function.

The readers follow the one link:

• closure_static_prototype / object_static_prototype: a function answers from its own link, never from its bag's record;
• the layout probe;
• instanceof C, instanceof Function and @@hasInstance on the linked chain;
• constructor and the members of a null link.

Stores onto a bound function take the function store lane, which checks the chain. A function's base identity comes from its body kind, without a record read.

Bugs fixed on main (tests test_gap_function_link_on_shape, test_gap_function_first_inherited_read, test_gap_prototype_link_fast_paths):

• fn instanceof C and fn instanceof Function ignored the link;
• a function linked to null read toString / constructor from Function.prototype;
• @@hasInstance on the linked chain was ignored;
• a program's first fn.toString read answered undefined.

Verification (qb9)

• Gap subset (268 tests): part 1 = base + its 2 new tests; parts 1+2 = part 1 + its 3 new tests; identical after merging main.
• Unit tests:
  • cargo test -p perry-runtime --lib (RUST_TEST_THREADS=1): 6393/0, same as main.
  • perry-codegen realm 35/35, layout 119/119.
  • perry-abi: layouts_and_native_identity_are_pinned fails, as it does on main.
• Startup, irdiff with link pad (Ir):

witness	main → part 1	part 1 → part 2
hello	0	0
commander --help	−152,702	−29,646
commander	−152,732	−29,997
fastify inject	−244,884	−191,231
AWFY richards	−290,750	−78,270
binary_trees	−148,498	−24,761

• Synthetic, Ir per op on a callable class instance (part 1 → part 2):
  • inherited read: 1,933 → 1,638;
  • getter: 2,842 → 2,548;
  • call: 3,695 → 3,222;
  • store: 40,456 → 38,482;
  • ark.js: 4.04 G → 3.94 G.
• Sabotage: each new fast path broken on purpose must fail a gap test. 7 of 8 are caught. The eighth, the null-chain store answer matched to every link, is unreachable: every receiver form tried answers through its layout proof first.
• Supabase CLI --version/--help: still running; I'll post the results in a comment.

Draft: hold for review.

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[proggeramlug]

Head 7766f51 merges main, including #13546. In the instanceof Function conflict I took main's version. Its closure_static_prototype check reads the function's shape link on this branch, and it also walks a relinked class constructor's chain. I also updated the has_recorded_prototype doc for the new home of a function's link.

Verification of 7766f51 (qb9):

• Startup, irdiff main eea3ac6 → head (link pad, 6/6 converged), Ir:

witness	delta
hello	0
commander --help	−182,656
commander	−182,729
fastify inject	−436,087
AWFY richards	−369,032
binary_trees	−173,259

• Runtime lib (RUST_TEST_THREADS=1): 6393 passed, 0 failed.
• Gap subset (269 tests): head = main + 4 fixed tests (null_prototype_shape_authority, null_prototype_require_cache, function_link_on_shape, function_first_inherited_read). No other difference; the fix(runtime): instanceof and inherited getters on function objects #13546 test passes.
• Supabase CLI (callgrind, median of 3). Supabase needs fix(compile): pnpm isolated stores, wrong-target Node-API addons, static text imports #13477, so both arms are GPP2's fix(compile): pnpm isolated stores, wrong-target Node-API addons, static text imports #13477 tree; head adds this PR's two commits. Output is identical to node for both arms.

command	base	head	Δ
--version	7,003.86 M	6,964.62 M	−39.2 M (−0.56%)
--help	7,083.86 M	7,044.64 M	−39.2 M (−0.55%)