[core] ppsc and ppsc-hybrid js rewriters with proxy elision

[velzie]

Adds two new JS rewriters next to the existing one, picked with a new jsRewriter flag. The default becomes ppsc-hybrid.

jsRewriter	What it does
dpsc	The current rewrite. Every member access whose key could name location/parent/top/eval goes through $sj_ accessors on Object.prototype.
ppsc	Rewrites only references to the window and document, which the runtime answers with a Proxy. Member accesses are left alone.
ppsc-hybrid (default)	ppsc, but a static read of an unsafe name (x.top, this.location) goes through dpsc's accessor instead, so the proxy is only needed where the object is used as a value (a computed key, or being passed on).

ppscWrapThis (off by default) also rebinds an unsafe this to a $t wrapped once per function.

Proxy elision (Rust, rewriter/js/src/ppsc/elide.rs)

An oxc_semantic pass proves which references are only used in ways the proxy would answer identically, and leaves those pointing at the real object:

• Tracked values: globals, and locals holding them (var d = document, UMD factory params, IIFE params, var self = this). Each is classified by every use it has.
• Unsafe locals: stay wrapped. Their safe uses are pointed back at the global when it provably still holds it, or else at a twin local (d$scramjet$r = $unwrap(d)) kept in step with every write.

On 29 real sites this took proxy traps from 1.04M to 549k (−47%) with ppsc-hybrid and $t off.

Runtime

• Proxies: window and document proxies in client/global.ts.
• Unproxy layer: client/shared/unproxy.ts, driven by tables generated from @webref/idl (./cv core:gen-unproxy), puts natives right when they're handed a proxy or return a real window/document.
  • Receiver fix: a proxy receiver is swapped for the real object once, in the slot dispatch (fixReceiver).
  • Bare patches: members that need only that are patched with no layer (Patch).
  • No reflection hooks: descriptor reads and defines go straight through, and the global proxy declares no descriptor traps. An extracted native location getter called on the proxy throws rather than leaks. The proper stand-ins come with the reflection work, and when that lands global.ts should go back to _Proxy.
• $wrap: caches the values it compares against. It also hands back proxies for the pretend parent/top, which fixes a GTM while (w !== w.parent) hang on Discord.

Testing

• cargo test -p native --release: rewrite_tests, google and the new elide_diff. elide_diff runs each case in a boa realm twice (as written against proxies, and rewritten against real objects) and fails on any difference or real-location leak. It passes on the hand-written cases and on 20k generated programs in every asserted configuration.
• native verify: 0 parse failures over a 351 MB real-site corpus in all three modes. Rewrite cost is 9.4 / 19.5 / 19.1 ms/MB (dpsc / ppsc / ppsc-hybrid).
• Leak probe: 50/50 checks pass on this branch through the harness, including descriptor reads and defines on the window and document, and postMessage source identity.
• Location writes: 12 navigation cases stay inside the proxy under all three rewriters with stamp and lazystamp: var location, destructuring, loop heads, and plain location =. This includes a fix to $tryset, which since d9af2d0 navigated the real Location in every mode.
• Runway, against a clean develop build (fast mode):
  • postmessage: 24 failures against develop's 25, with the same unexpected set.
  • location: 20 failures against develop's 27. This branch's unexpected set is a subset of develop's.
  • event: 19 failures, the same as develop.
  • function: 18 failures, the same as develop. One differs: functionctor-scope fails because new Function("return this")() returns the real window, which is expected with ppscWrapThis off. In exchange, rv23-destructure-location-var-in-function now passes.

Benchmarks (tools/BENCHMARKS.md)

The harness now takes ?flags={...}, so every tool compares chromium/dpsc/ppsc/ppsc-hybrid on one build: benchmark-octane.mjs, benchmark-ops.mjs, benchmark-sites.mjs, capture-script-corpus.mjs, plus SCRAMJET_FLAGS for benchmark-speedometer.mjs.

Octane in Chromium (median of 3):

	chromium	dpsc	ppsc	ppsc-hybrid
Score	106908	71918	85849	95934
Mandreel	103324	18405	101759	104577
zlib	151904	67918	110416	107616
Gameboy	195598	120565	198206	193182

Splay is bimodal in every scramjet mode and swings the total ±10%. See the README for the full tables.

Speedometer 3.1 (clean 18-suite subset) is within noise across modes: dpsc 17.3 / 17.0 / 16.1, ppsc 17.2, ppsc-hybrid 16.7 / 15.5 (±0.6–0.95). ppsc-hybrid came in slightly under dpsc in both paired runs.

Real sites, total script ms over 32: chromium 40103, dpsc 108950, ppsc-hybrid 101144. Three errors show up only under ppsc-hybrid:

• Canva: MouseEvent rejects view: window, probably an inherited UIEventInit member missing from the tables.
• Walmart: undefined is not iterable, with its script time roughly tripled.
• Linear: getReader on undefined.

These are listed in tools/BENCHMARKS.md and still need fixing.

Known costs that ppsc adds, from benchmark-ops:

• el.ownerDocument hands back the document proxy: 16 → 100ns, hit by jQuery-style el.ownerDocument === doc checks.
• Native calls on the document pay the receiver fix: getElementById 27 → 47ns.
• event.target (and currentTarget, relatedTarget, composedPath()) goes through an attribute trap so the window and document come back as proxies: 6.6 → 69ns per read.

Known open: a child frame reached by name (window.myframe, bare myframe, document.myframe) is handed out as its real window under ppsc. Keeping the proxy for every name a window might not have would give up most of the elision, so this is left as it is. window["0"] is handled.

tools/slot-proxy-to-function.md is a separate note on replacing the slot apply proxies with plain functions, the next step for that call overhead.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CuZEvxaYZC8a1Ezv4Jnvn9