Perf: add a baseline native-code tier for hot bytecode functions

[chrisbbreuer]

Parent: #44
Related: #46, #47, #48

Motivation

After operand-stack, property-IC, and numeric remainder fast paths, the arithmetic profile attributes about 94% of samples to the bytecode runChunk dispatch loop. The accepted matrix still shows multi-fold JSC leads across arithmetic, properties, arrays, and recursive calls. A baseline native-code tier is the logical path to eliminate per-opcode dispatch while retaining the interpreter as the semantic fallback.

Backward compatibility is not a constraint; correctness, GC safety, and deterministic fallback are.

Scope

• hotness counters and deterministic tier-up policy for plain bytecode functions;
• a minimal baseline code generator for supported numeric/local/control-flow opcodes;
• calls, returns, stack checks, exceptions, and GC safepoints with explicit runtime stubs;
• monomorphic property IC loads/stores with shape guards and safe fallback;
• executable-memory ownership with W^X transitions and teardown;
• architecture/OS capability detection with a complete interpreter fallback;
• incremental opcode coverage driven by the fair JSC matrix, not benchmark-specific source recognition.

Acceptance criteria

• Document native frame layout, Value representation, calling convention, safepoint/root map, exception transfer, and invalidation rules before implementation.
• Add differential tests that run every supported compiled function through both baseline native code and the bytecode VM and compare values, throws, side effects, and GC reachability.
• Never execute stale IC assumptions: guard shapes/prototypes and fall back or invalidate on mutation.
• Preserve precise GC, stack limits, closures/upvalues, arguments, direct eval, generators/async fallback, and no-GIL ownership rules.
• Keep unsupported opcodes/functions on the bytecode VM without observable semantic differences.
• Pass focused semantic, GC, no-GIL, and suppression-free TSan validation.
• Produce symbolized profiles showing dispatch removal on arithmetic/properties/arrays/recursion.
• Beat JSC in every directly comparable benchmark row, together with workload-specific work in Perf: beat JSC on arithmetic and property-access kernels #46-Perf: beat JSC on recursive and general function-call throughput #48.
• Document build/runtime support and expose a deterministic disable switch for validation.

[chrisbbreuer]

Design contract landed in 2ddb592 (docs: design baseline native tier (#52)).

It fixes the tier state/publication model, stable entry ABI, exact side-exit state, first numeric/local/control subset, safepoint/step/GC obligations, W^X policy, shared-chunk ownership, and differential/performance gates before executable code is added.

[chrisbbreuer]

Executable-memory foundation landed in 3e69e9c (feat(jit): add executable code memory (#52)).

Implemented Darwin AArch64/x86-64 MAP_JIT allocation, thread-local write protection, instruction-cache invalidation, immutable publication, an executing native smoke test, and an unsupported-target fallback compile check. Focused ReleaseFast tests: 3/3 passed.

[chrisbbreuer]

Race-safe per-chunk tier claims landed in fb3734d (feat(jit): add race-safe tier claims (#52)).

A chunk now owns atomic cold/compiling/ready/rejected state and entry hotness. Contending entrants never wait; exactly one compiler claims the chunk and unsupported compilation is cached. ReleaseFast focused tests passed 4/4, including an 8-thread claim race; x86-64 Linux compile-only fallback also passed.

[chrisbbreuer]

First real bytecode-to-native tier landed in 2a88b8a (feat(jit): tier constant bytecode functions (#52)).

Primitive constant-return chunks now lower through the architecture-neutral selector and AArch64 entry backend after three entries. The VM preserves exact executed-bytecode step counts, falls back at 1024-step termination/GIL/GC checkpoint boundaries, rejects embedded GC pointers, caches unsupported chunks, and works through both direct execution and the heap activation trampoline.

Validation: focused ReleaseFast native integration passed; constant compiler test passed; the complete 88-group quick JSC comparison matrix passed with stable cross-engine checksums. No 616-sample publication run was spent because this correctness slice does not yet cover the benchmark kernels.