jit: inline the receiver type's __getattr__ hook for a missing attribute

`descroperation.py:242-245` reaches the hook only after the descriptor
protocol has raised, so a hooked access cost one opaque residual holding the
whole `object_getattr_miss` walk — the `__dict__` / `__doc__` / `__class__`
special names, the metaclass loops, the terminal miss — and then a fresh
interpreter frame for the hook, on every iteration.  Every other user dunder
already has a resolver into `try_walker_inline_resolved_user_call`
(`__getitem__`, `__add__`, `__hash__`, `__index__`, `property.__get__`,
`__eq__`); `__getattr__` had none.

`mapdict::getattr_hook_fast_path` is the miss twin of `load_attr_fast_path`:
it answers with the type's version tag and the instance map, which are what
make "the name resolves nowhere and `__getattr__` is this one" a constant of
the trace.  `try_walker_inline_getattr_hook` emits those pins through
`walker_guard_mapdict_instance_shape` and enters the hook.  All three
spellings `get_and_call_function` binds are folded — a plain `Function` leads
with the receiver, a `classmethod` with the class, a `staticmethod` with
nothing; a custom-descriptor hook stays on the residual.  The name argument is
an interned immortal block, the shape `pyopcode.py LOAD_ATTR` passes
(`co_names_w[oparg]`, one object per code object).

Per-access cost at N=600000, dynasm: plain hook 0.346s -> 0.088s, classmethod
0.410s -> 0.080s, staticmethod 0.347s -> 0.076s, each from one residual to
none (an existing attribute reads 0.074s).  synth/getattr_hook_binding moves
48.6x -> 7.4x (dynasm), 10.4x (cranelift), 8.7x (wasm); its ceiling goes
90 -> 25.

`extra_tests/parity_tests/getattr_hook_inline_deopt.py` breaks each pin in
turn mid-loop — a store that puts the name on the instance, a reassigned
`__getattr__`, a class attribute that shadows the hook — and covers a raising
hook, an inherited classmethod hook's bound class, and a hook that installs
the attribute itself.

Assisted-by: Claude

Author: youknowone

pyre/bench/synth/getattr_hook_binding.py

@@ -1,8 +1,14 @@
-# pyre-check: max-pypy-ratio=90
+# pyre-check: max-pypy-ratio=25
 # objspace.py:710 get_and_call_function: a __getattr__ (or __getattribute__)
 # defined as a classmethod or staticmethod must be bound through __get__ before
 # being called, exactly like any other special method, so it receives the
 # arguments the descriptor protocol gives it.
+#
+# Each of the three accesses below used to cost one opaque residual holding the
+# whole `object_getattr_miss` walk plus a fresh frame for the hook. Inlining
+# the hook against the version-tag and map pins that make the miss constant
+# dropped the ratio from 48.6x/59.5x (dynasm/wasm) to 7.4x/10.4x/8.7x
+# (dynasm/cranelift/wasm); the bound is twice the slowest of those, rounded up.
 
 
 class ClassmethodGetattr:

pyre/extra_tests/parity_tests/getattr_hook_inline_deopt.py

@@ -0,0 +1,165 @@
+# CPython-suite gap: the suite exercises __getattr__ semantics but never runs a
+# hooked access hot enough to be compiled, so nothing covers the compiled form.
+# parity-tests reason: this targets the pyre-specific guards a compiled
+# __getattr__ hook rests on.
+
+"""A compiled `__getattr__` hook answers to the two pins that admitted it.
+
+`objspace.py:710 get_and_call_function` reaches the hook only after the
+attribute resolves nowhere, so the compiled form pins the receiver's type
+version tag (the type keeps lacking the name, and keeps this hook) and the
+instance map (the receiver keeps lacking the name).  Each loop below runs long
+enough to be compiled and then invalidates exactly one of those pins mid-loop:
+the values recorded before and after must differ at the iteration the pin was
+broken, which is what proves the guard deopts rather than the compiled answer
+being reused.
+
+The AttributeError case is here for the same reason: a hook that raises for an
+unknown name is an ordinary outcome of an inlined body, not a shape the fold may
+quietly turn into a returned value.
+"""
+
+N = 40000
+SWAP = N // 2
+
+
+class Instance:
+    def __getattr__(self, name):
+        return "hook:" + name
+
+
+class Hooked:
+    @classmethod
+    def __getattr__(cls, name):
+        return "cm:%s:%s" % (cls.__name__, name)
+
+
+class Static:
+    @staticmethod
+    def __getattr__(name):
+        return "sm:" + name
+
+
+class Raiser:
+    def __getattr__(self, name):
+        if name == "absent":
+            raise AttributeError("no " + name)
+        return "ok:" + name
+
+
+class Installer:
+    def __getattr__(self, name):
+        # The hook itself gives the instance the attribute, so every later
+        # access must read the instance rather than hook again.
+        self.installed = "real"
+        return "hook:" + name
+
+
+def instance_shadow():
+    """A store during the loop puts the name on the instance."""
+    obj = Instance()
+    seen = []
+    i = 0
+    while i < N:
+        seen.append(obj.later)
+        if i == SWAP:
+            obj.later = "instance"
+        i += 1
+    assert seen[0] == "hook:later", seen[0]
+    assert seen[SWAP] == "hook:later", seen[SWAP]
+    assert seen[SWAP + 1] == "instance", seen[SWAP + 1]
+    assert seen[-1] == "instance", seen[-1]
+
+
+def hook_replaced():
+    """Reassigning `__getattr__` bumps the type's version tag."""
+
+    class Swapped(Hooked):
+        pass
+
+    obj = Swapped()
+    seen = []
+    i = 0
+    while i < N:
+        seen.append(obj.zed)
+        if i == SWAP:
+            Swapped.__getattr__ = classmethod(lambda cls, name: "replaced")
+        i += 1
+    assert seen[0] == "cm:Swapped:zed", seen[0]
+    assert seen[SWAP + 1] == "replaced", seen[SWAP + 1]
+
+
+def name_shadowed_on_type():
+    """A class attribute added during the loop wins over the hook."""
+
+    class Shadowed(Static):
+        pass
+
+    obj = Shadowed()
+    seen = []
+    i = 0
+    while i < N:
+        seen.append(obj.zed)
+        if i == SWAP:
+            Shadowed.zed = "class"
+        i += 1
+    assert seen[0] == "sm:zed", seen[0]
+    assert seen[SWAP + 1] == "class", seen[SWAP + 1]
+
+
+def bound_argument_follows_the_receiver_type():
+    """A classmethod hook binds the receiver's own class, not the base."""
+
+    class Sub(Hooked):
+        pass
+
+    base = Hooked()
+    sub = Sub()
+    i = 0
+    while i < N:
+        assert base.q == "cm:Hooked:q"
+        assert sub.q == "cm:Sub:q"
+        i += 1
+
+
+def hook_raises():
+    """An AttributeError out of the hook reaches the caller every iteration."""
+    obj = Raiser()
+    hits = 0
+    misses = 0
+    i = 0
+    while i < N:
+        hits += len(obj.present)
+        try:
+            obj.absent
+        except AttributeError as exc:
+            assert str(exc) == "no absent", exc
+            misses += 1
+        i += 1
+    assert hits == N * len("ok:present"), hits
+    assert misses == N, misses
+
+
+def hook_installs_the_attribute():
+    obj = Installer()
+    seen = []
+    i = 0
+    while i < N:
+        seen.append(obj.installed)
+        i += 1
+    assert seen[0] == "hook:installed", seen[0]
+    assert seen[1] == "real", seen[1]
+    assert seen[-1] == "real", seen[-1]
+
+
+def main():
+    instance_shadow()
+    hook_replaced()
+    name_shadowed_on_type()
+    bound_argument_follows_the_receiver_type()
+    hook_raises()
+    hook_installs_the_attribute()
+    print("OK")
+
+
+main()

pyre/pyre-interpreter/src/objspace/std/mapdict.rs

@@ -1748,6 +1748,73 @@ pub unsafe fn load_attr_fast_path(
     Some((w_type, version_tag, map, p.storageindex))
 }
 
+/// The miss twin of [`load_attr_fast_path`]: return the ingredients for
+/// inlining the receiver type's `__getattr__` hook when `name` resolves
+/// nowhere.
+///
+/// `baseobjspace::instance_getattr_hook_or_err` is the tail this stands in for
+/// (`descroperation.py:242-245`): once the descriptor protocol has produced an
+/// AttributeError, the type's `__getattr__` is looked up and called with the
+/// receiver and the name. Reaching that tail is what the two returned pins
+/// prove, and both are guards the caller owes:
+///
+///   * `version_tag` — the class lookup stays constant, so `name` keeps
+///     resolving to nothing on the type and `__getattr__` keeps resolving to
+///     the returned hook;
+///   * `map` — the instance shape stays constant, so `name` keeps being absent
+///     from this receiver's own storage.
+///
+/// Together they make the whole `object_getattr_miss` walk a compile-time
+/// answer, which is the work the fold removes; the hook itself is what the
+/// caller then inlines.
+///
+/// Returns `None` for every shape those two guards cannot cover: a non-mapdict
+/// receiver, a custom `__getattribute__`, an uncacheable `version_tag`, a name
+/// the type or the instance actually owns, or a type with no `__getattr__`.
+///
+/// # Safety
+/// `w_obj` must be a live object.
+pub unsafe fn getattr_hook_fast_path(
+    w_obj: PyObjectRef,
+    name: &str,
+) -> Option<(PyObjectRef, u64, MapRef, PyObjectRef)> {
+    // mapdict.py:1495 `if map is not None:` — also filters non-instances.
+    let map = unsafe { mapdict_map_or_null(w_obj) };
+    if map.is_null() {
+        return None;
+    }
+    // mapdict.py:1496 `w_type = map.terminator.w_cls`.
+    let w_type = unsafe { (*(*map).terminator()).as_terminator() }.w_cls;
+    if w_type.is_null() {
+        return None;
+    }
+    // mapdict.py:1497-1499 — a custom `__getattribute__` runs its own lookup,
+    // which neither pin describes.
+    if unsafe { crate::baseobjspace::getattribute_if_not_from_object(w_type) }.is_some() {
+        return None;
+    }
+    // mapdict.py:1500-1501 `version_tag = w_type.version_tag(); if is not None:`.
+    let version_tag = unsafe { crate::baseobjspace::w_type_version_tag(w_type) };
+    if version_tag == 0 {
+        return None;
+    }
+    // The miss itself. A type-level hit is refused before the map is consulted:
+    // `classify_attr` reads a `__slots__` member under the `"slot"` name rather
+    // than its own, so a descriptor found here says nothing about what
+    // `find_map_attr(name)` below would answer.
+    if unsafe { crate::baseobjspace::lookup_in_type_where(w_type, name) }.is_some() {
+        return None;
+    }
+    // `classify_attr(w_type, None, false)` answers `(DICT, false)` — the
+    // no-descriptor arm (mapdict.py:1509-1510) — so this is the same
+    // `find_map_attr` call the hit path makes, read for its absence.
+    if unsafe { find_map_attr(map, Wtf8::new(name), DICT) }.is_some() {
+        return None;
+    }
+    let w_getattr = unsafe { crate::baseobjspace::lookup_in_type_where(w_type, "__getattr__") }?;
+    Some((w_type, version_tag, map, w_getattr))
+}
+
 /// The [`load_attr_fast_path`] twin for a receiver that keeps its attributes in
 /// a `newdict(instance=True)` dictionary rather than in header mapdict storage
 /// (`mapdict.py:1299-1303 make_instance_dict`). It applies the same