`JSONTransitionCache` for `JSON.parse` Structure transitions

Component: JSC runtime | 1e80c1e

JSC represents object shapes as Structures; adding each property triggers a Structure transition, and JSON.parse builds objects property-by-property, transitioning through many Structures per object. A prior "single transition" optimization doesn't help when parsing starts from the shared empty-object Structure, which fans out to many destinations. This commit adds JSONTransitionCache, a hash-indexed 256-entry primary plus 64-entry secondary table of from→to Structure pairs that lets JSON.parse skip the transition-table lookup.

Significance

Speeds up JSON.parse for many objects sharing a key shape without changing observable semantics, but adds a persistent, GC-visible cache keyed on Structure identity in a very hot parsing path. Entries store only from/to Structures (never the property name — only a hash of from-StructureID plus key length, first and last char, re-verified against the destination's recorded transition name). Entries carry no write barriers and are normally unmarked; visitAggregate() marks every entry while a parse is in progress, and reconcileAtGCEnd() wipes the whole cache at each GC end when no parse runs. Both decisions happen while the mutator is stopped, so the cache never observes an inconsistent parse state.

Audit directions

Narrow: the no-write-barrier + mark-during-parse scheme assumes visitAggregate() marks every live entry whenever a parse can be in flight — audit the parse-in-progress flag's coverage against all JSON.parse re-entry points. Wider: any GC-visible cache holding raw Structure pointers without write barriers relies on a stop-the-world wipe; review similar transition/IC caches for the same marking-vs-wipe contract. The tell: a cache of cell pointers with no WriteBarrier<> wrapper.

---