perf: missing-property reads on functions are ~2,600× and Object.hasOwn/getPrototypeOf 40–90× slower than Node (Function.prototype re-resolved by name per call) #10497

Found by the package performance audit (real npm packages compiled from source, profiled against Node 26.5.1) and
re-measured on Perry 7661bc0 (v0.5.1589), Linux x64. Several hot object helpers look up an intrinsic prototype by
NAME on every call — builtin_prototype_value("Function") = a globalThis.Function lookup plus a
closure_get_dynamic_prop("prototype") — so axios's isBuffer(val) (val.constructor.isBuffer) costs ~38,000
instructions, Object.hasOwn(o, k) ~4,500 and Object.getPrototypeOf(o) ~8,000, where Node spends a few
nanoseconds.

Reproduction

bench.ts (22 lines):

// Reads on function values and Object.prototype helpers (axios utils: isBuffer, hasOwnProperty.call, isPlainObject)
const variant = process.argv[2] || "ctor_isBuffer"; const N = Number(process.argv[3] || "1000000");
const { hasOwnProperty } = Object.prototype; const { getPrototypeOf } = Object;
const objs: any[] = [{ a: 1, b: 2 }, { url: "/x", method: "get" }, { headers: { x: 1 } }, { a: 3 }];
const mono: any[] = [{ a: 1, b: 2 }, { a: 2, b: 3 }, { a: 3, b: 4 }, { a: 4, b: 5 }];
function plainFn() { return 1; }
const fns: any[] = [plainFn, function other() { return 2; }, plainFn, plainFn];
function isBuffer(val: any) { return val !== null && val !== undefined && val.constructor !== null && val.constructor !== undefined && typeof val.constructor.isBuffer === "function" && val.constructor.isBuffer(val); }
const V: Record<string, (n: number) => number> = {
  own_read_mono(n) { let s = 0; for (let i = 0; i < n; i++) s += mono[i & 3].a === 1 ? 1 : 0; return s; },
  ctor_eq_Object_mono(n) { let s = 0; for (let i = 0; i < n; i++) s += mono[i & 3].constructor === Object ? 1 : 0; return s; },
  ctor_eq_Object(n) { let s = 0; for (let i = 0; i < n; i++) s += objs[i & 3].constructor === Object ? 1 : 0; return s; },
  ctor_isBuffer(n) { let s = 0; for (let i = 0; i < n; i++) s += objs[i & 3].constructor.isBuffer === undefined ? 1 : 0; return s; },
  fn_missing_prop(n) { let s = 0; for (let i = 0; i < n; i++) s += fns[i & 3].isBuffer === undefined ? 1 : 0; return s; },
  axios_isBuffer(n) { let s = 0; for (let i = 0; i < n; i++) s += isBuffer(objs[i & 3]) ? 0 : 1; return s; },
  hasOwn_call(n) { let s = 0; for (let i = 0; i < n; i++) s += hasOwnProperty.call(objs[i & 3], "a") ? 1 : 0; return s; },
  hasOwn_static(n) { let s = 0; for (let i = 0; i < n; i++) s += Object.hasOwn(objs[i & 3], "a") ? 1 : 0; return s; },
  in_operator(n) { let s = 0; for (let i = 0; i < n; i++) s += ("a" in objs[i & 3]) ? 1 : 0; return s; },
  getProto_eq(n) { let s = 0; for (let i = 0; i < n; i++) s += getPrototypeOf(objs[i & 3]) === Object.prototype ? 1 : 0; return s; },
};
V[variant](N / 5 | 0); const t0 = performance.now(); const cs = V[variant](N);
console.log(`variant=${variant} checksum=${cs} ms=${(performance.now() - t0).toFixed(2)}`);

PERRY_NO_AUTO_OPTIMIZE=1 perry compile bench.ts -o bench
for v in own_read_mono ctor_eq_Object_mono fn_missing_prop ctor_isBuffer axios_isBuffer in_operator hasOwn_static hasOwn_call getProto_eq; do
  node bench.ts $v 1000000; ./bench $v 1000000; done

Measurements

Median of 3, shared host (loaded; instruction counts are the load-independent figure). N = 1,000,000; Perry
instructions per iteration = (whole-process instructions:u − 38 M startup) / 1.2 M.

Checksums identical. hasOwn_static does an own-key check on ordinary objects, yet 78 % of its time is spent proving
the receiver is not %Function.prototype%.

Impact

Audit profiles, v0.5.1587:

• axios 1.19.0 (2,000 GETs against a local server): ≈ 20 % of Perry CPU — property reads on function values through
  the Function.prototype fallback 9.5 %, hasOwnProperty.call 4.7 %, isBuffer's val.constructor 5.6 %
  (io-group report). Hot upstream helpers: utils.isBuffer, utils.forEach, hasOwnProperty wrapper,
  isPlainObject (getPrototypeOf(val) === Object.prototype), mergeConfig.
• lodash calls hasOwnProperty.call(result, key) in groupBy/baseAssignValue and objectToString.call in its type
  checks (objects-group report; that dispatch cost is shared with the .call trampoline).

Mechanism

• is_function_prototype_object_value (crates/perry-runtime/src/object/global_this/ctor_thunks.rs:179) calls
  builtin_prototype_value("Function") (ctor_thunks.rs:184), which does
  js_get_global_this_builtin_value("Function") + closure_get_dynamic_prop(ctor, "prototype") (ctor_thunks.rs:188-199)
  on every call (verified). Its doc comment (ctor_thunks.rs:176-178) says it is "only consulted on slow paths", but
  js_object_has_own (crates/perry-runtime/src/object/object_ops/has_own.rs:66) calls it for every ordinary receiver
  (has_own.rs:351) (verified). Profile of hasOwn_static: is_function_prototype_object_value 78.5 % inclusive,
  js_get_global_this_builtin_value 59 % (verified).
• A missing property on a closure: get_field_ic_miss_impl → closure_get_dynamic_prop
  (crates/perry-runtime/src/closure/dynamic_props.rs:900) → function_prototype_fallback_target
  (dynamic_props.rs:1111, call site dynamic_props.rs:1062), which again runs builtin_prototype_value("Function")
  (dynamic_props.rs:1137), then walks Function.prototype → Object.prototype by name (verified). Profile of
  fn_missing_prop: closure_get_dynamic_prop 90 %, function_prototype_fallback_target 28 %,
  js_get_global_this_builtin_value 20 %, the rest the uncached prototype walk of perf: reads that resolve on the prototype chain (absent keys, inherited data) are 590–2,100× slower than Node (read IC caches own properties only) #10495.
• Object.getPrototypeOf(o) on a plain object: js_object_get_prototype_of
  (crates/perry-runtime/src/object/object_ops/prototype.rs:188) reaches constructor_dynamic_prototype
  (crates/perry-runtime/src/object/prototype_helpers.rs:3, call sites prototype.rs:622 and prototype.rs:767), which reads o.constructor
  by name and then closure_get_dynamic_prop(ctor, "prototype") (verified). Profile: constructor_dynamic_prototype
  58 % of getProto_eq.
• None of these reads is cached, so o.constructor.isBuffer pays the inherited constructor read, the Function.prototype
  re-resolution, and a full absent walk each time.

What fast looks like

Resolve %Function.prototype% (and %Object.prototype% for getPrototypeOf of an ordinary object) from a memoized,
GC-rooted intrinsic slot — the same treatment #7795 gave Object.prototype on the ordinary miss path — and let
getPrototypeOf of a plain object literal return the default prototype without a constructor round-trip. Targets:
hasOwn_static ≤ 300 instructions/iteration (within 3× of own_read_mono), getProto_eq ≤ 300, hasOwn_call ≤ 600;
with #10495's negative cache, fn_missing_prop and ctor_isBuffer ≤ 1,000 instructions/iteration (from 27,000–31,000).

Notes

• in_operator (180×) is included for reference; its cost is the absent-key walk of perf: reads that resolve on the prototype chain (absent keys, inherited data) are 590–2,100× slower than Node (read IC caches own properties only) #10495 (one of the four objects
  lacks a).
• Related: perf(runtime): gate the rare-subclass probes on the object property-miss path (asyncpipe 9.69x -> 1.76x node) #7795 (merged; memoized Object.prototype on the ordinary miss path — the pattern to reuse), in does not see inherited Function.prototype members ("call" in f is false) #10366 (open
  correctness: in does not see inherited Function.prototype members), Object.prototype has no own __proto__ accessor: hasOwnProperty/Object.hasOwn/getOwnPropertyNames/getOwnPropertyDescriptor/"__proto__" in {} all report it missing #10482 (open correctness: missing own
  __proto__ accessor on Object.prototype, touches the same helpers).
• Shares are from the v0.5.1587 audit profiles; ratios and instruction counts are re-measured on 7661bc0.