向V8专家求教：如何单态化从对象原型获取元信息

Hey, great work digging into V8's polymorphic limits and building a user-space polymorphism solution—this is exactly the kind of deep optimization needed to make structured JS code run efficiently despite V8's constraints. Let’s break down why your current approaches hit megamorphism, and how to fix it.

Why Your Current Code Deoptimizes #

V8’s inline caches (ICs) rely on object shapes (hidden classes) to optimize property access. When you call Object.getPrototypeOf(obj) for your 5 classes, each returned prototype has a unique shape (each has its own constructor reference and unique Symbol.iterator implementation). Accessing properties on these 5 distinct shapes triggers megamorphism once you exceed V8’s 4-shape limit, killing any optimized code.

Feasible Fixes to Keep Access Monomorphic #

1. Use a Uniform, Shared VTable Object on Prototypes #

The trick is to ensure that when you access metadata from the prototype, you’re always interacting with objects of the exact same shape. Use a private Symbol to attach a vtable object to each subclass prototype, and enforce that every vtable has identical keys (even if some values are default implementations).

const VTABLE = Symbol('vtable');

class HasVTable {
  static initVTable(vtableConfig) {
    // Ensure all vtables have the same structure
    this.prototype[VTABLE] = {
      name: vtableConfig.name,
      iterator: vtableConfig.iterator || function* () {}
    };
  }
}

class Class1 extends HasVTable {}
Class1.initVTable({
  name: 'Class1',
  iterator: function* () { yield 'Class1'; }
});

class Class2 extends HasVTable {}
Class2.initVTable({
  name: 'Class2',
  iterator: function* () { yield 'Class2'; }
});

// Repeat for Class3-Class5 with matching vtable structure

function access(obj) {
  const vtable = Object.getPrototypeOf(obj)[VTABLE];
  // This access stays monomorphic: all vtables share the same shape
  console.log(vtable.name);
  let res;
  for (res of vtable.iterator()) break;
  console.log(res);
}

%OptimizeFunctionOnNextCall(access);
access(new Class1);
access(new Class2);
access(new Class3);
access(new Class4);
access(new Class5);

V8 will recognize that every VTABLE property points to an object with the same shape, so the property access remains monomorphic—no deoptimization, even with 5+ subclasses.

2. Attach VTable Directly to Instances (Uniform Instance Shape) #

If you prefer avoiding prototype access entirely, attach the vtable directly to each instance as a non-enumerable property. Ensure all instances have this property, so they share a compatible hidden class:

const VTABLE = Symbol('vtable');

class HasVTable {
  constructor(vtable) {
    // Lock the property to avoid shape changes
    Object.defineProperty(this, VTABLE, {
      value: vtable,
      writable: false,
      enumerable: false,
      configurable: false
    });
  }
}

class Class1 extends HasVTable {
  constructor() {
    super({
      name: 'Class1',
      iterator: function* () { yield 'Class1'; }
    });
  }
}

// Repeat for Class2-Class5

function access(obj) {
  const vtable = obj[VTABLE];
  console.log(vtable.name);
  let res;
  for (res of vtable.iterator()) break;
  console.log(res);
}

%OptimizeFunctionOnNextCall(access);
access(new Class1);
access(new Class2);
access(new Class3);
access(new Class4);
access(new Class5);

Since every instance has the VTABLE property with the same configuration, V8 treats all instances as part of the same shape family, keeping access monomorphic.

Critical Rules to Avoid Deoptimization #

• Never modify vtable shapes at runtime: Don’t add/remove keys from vtable objects after initialization—this breaks shape consistency.
• Enforce uniform vtable structure: Every subclass’s vtable must have the exact same keys (same names, same types like strings/Symbols).
• Use Symbols for vtable keys: This avoids conflicts with user code and maintains the same IC efficiency as string keys.

V8’s 4-shape limit is a deliberate tradeoff between compilation speed and runtime performance, so it’s unlikely to change anytime soon. These user-space vtable approaches are the best way to work around it while keeping your structured code fast.

内容的提问来源于stack exchange，提问作者CanonicEpicure