Actually one can be clever about this.  yes one has to check for inst var assignment.  But for at:put: one can fold the check into other activities.  For example, in my VisualWorks implementation the write-protect bit was put very close to and more significant than the size field in the object header.

An at:put: has to extract the size of the array for the bounds check.  The size field might indicate an overflow size (for large arrays their size doesn't fit in the header size field and requires an additional word in front of the header to store the actual size.  The overflow is indicated by the size field being at its maximum value or somethign similar).

So in at:put: code masks off the size field and the write-protect bit so that when the check is made for an overflow size a write-protected object appears to have an overflow size.  So the check for write-protect is done only in the arm that fetches the overflow size.  This makes the test free for most array accesses since most arrays are small enough to not need an overflow size (at least in VW).

I don't understand this.  Can you explain the write-barrier tricks and the send optimization that eliminates them?

I think per-object write-protection is very useful.  Its very useful for read-only literals, OODBs, proxies (distributed objects), debugging, etc.  Amongst Smalltalks I think VisualAge had it first and I did it for VW round about 2002.  I did it again for Squeak at Cadence.  In both the VW and Squeak cases the performance degradation was less than 5% for standard benchmarks.  Its cheap enough not to be noticed and there's lots more fat in the Squeak VM one can cut to more than regain performance.

So unlike, say, named primitives for the core primitives, this is something I am in favour of.  It is a cost well worth paying for the added functionality.