@scriptc/cli-darwin-x64 0.2.3 → 0.2.5

package/dist/lib/runtime-sources/src/scr_json.c

@@ -22,6 +22,7 @@
  *   serializers (and the error messages here).
  */
 #include "scr_runtime.h"
+#include "scr_key.h"
 
 static SCR_TL ScrDyn *scr_builtin_object_prototype;
 
@@ -159,7 +160,9 @@ void scr_jb_init(ScrJsonBuf *b) {
 }
 
 static void scr_jb_grow(ScrJsonBuf *b, size_t need) {
-  if (b->len + need <= b->cap) return;
+  if (need > SIZE_MAX - sizeof(ScrStr) - 1 - b->len) scr_json_oom();
+  size_t required = b->len + need;
+  if (required <= b->cap) return;
   if (!b->data) { /* first allocation: len == 0 */
     size_t cap = scr_jb_hint >= need ? scr_jb_hint : need;
     ScrStr *s = scr_str_alloc_raw(0, cap);
@@ -168,7 +171,13 @@ static void scr_jb_grow(ScrJsonBuf *b, size_t need) {
     return;
   }
   size_t cap = b->cap;
-  while (cap < b->len + need) cap *= 2;
+  while (cap < required) {
+    if (cap > (SIZE_MAX - sizeof(ScrStr) - 1) / 2) {
+      cap = required;
+      break;
+    }
+    cap *= 2;
+  }
   ScrStr *s = scr_str_regrow(SCR_JB_STR(b), cap);
   b->data = s->data;
   b->cap = cap;
@@ -186,7 +195,8 @@ void scr_jb_putc(ScrJsonBuf *b, char c) {
   b->data[b->len++] = c;
 }
 
-static void scr_jb_write(ScrJsonBuf *b, const char *s, size_t n) {
+void scr_jb_write(ScrJsonBuf *b, const char *s, size_t n) {
+  if (n == 0) return;
   scr_jb_grow(b, n);
   memcpy(b->data + b->len, s, n);
   b->len += n;
@@ -215,18 +225,45 @@ void scr_jb_put_f64(ScrJsonBuf *b, double v) {
   scr_jb_write(b, buf, n);
 }
 
-void scr_jb_put_json_str(ScrJsonBuf *b, const ScrStr *s) {
+/* Find the next quote, backslash or control byte. memcpy keeps the word
+ * loads unaligned-safe, and the length guard never reads past the input.
+ * The masks only decide whether to inspect a word byte by byte: borrow
+ * propagation may mark extra lanes, so it must not determine a byte index.
+ * High UTF-8 bytes are ordinary data, independent of host byte order. */
+static size_t scr_json_plain_bytes(const char *data, size_t len) {
+  const uint64_t ones = UINT64_C(0x0101010101010101);
+  const uint64_t high = UINT64_C(0x8080808080808080);
+  size_t i = 0;
+  while (len - i >= sizeof(uint64_t)) {
+    uint64_t word;
+    memcpy(&word, data + i, sizeof word);
+    uint64_t quotes = word ^ (ones * '"');
+    uint64_t slashes = word ^ (ones * '\\');
+    uint64_t special = ((quotes - ones) & ~quotes) |
+                       ((slashes - ones) & ~slashes) |
+                       ((word - ones * 0x20) & ~word);
+    if (special & high) break;
+    i += sizeof word;
+  }
+  while (i < len) {
+    unsigned char c = (unsigned char)data[i];
+    if (c < 0x20 || c == '"' || c == '\\') break;
+    i++;
+  }
+  return i;
+}
+
+static void scr_jb_put_json_span(ScrJsonBuf *b, const char *data, size_t len) {
   scr_jb_putc(b, '"');
   /* Bulk-copy runs of unescaped bytes (UTF-8 passes through verbatim,
    * like JS); escapes interrupt the run. */
-  size_t i = 0, run = 0;
-  while (i + run < s->len) {
-    unsigned char c = (unsigned char)s->data[i + run];
-    if (c != '"' && c != '\\' && c >= 0x20) {
-      run++;
-      continue;
-    }
-    scr_jb_write(b, s->data + i, run);
+  size_t i = 0;
+  while (i < len) {
+    size_t run = scr_json_plain_bytes(data + i, len - i);
+    scr_jb_write(b, data + i, run);
+    i += run;
+    if (i == len) break;
+    unsigned char c = (unsigned char)data[i++];
     switch (c) {
     case '"': scr_jb_puts(b, "\\\""); break;
     case '\\': scr_jb_puts(b, "\\\\"); break;
@@ -241,13 +278,14 @@ void scr_jb_put_json_str(ScrJsonBuf *b, const ScrStr *s) {
       scr_jb_puts(b, esc);
     }
     }
-    i += run + 1;
-    run = 0;
   }
-  scr_jb_write(b, s->data + i, run);
   scr_jb_putc(b, '"');
 }
 
+void scr_jb_put_json_str(ScrJsonBuf *b, const ScrStr *s) {
+  scr_jb_put_json_span(b, s->data, s->len);
+}
+
 ScrStr *scr_jb_finish(ScrJsonBuf *b) {
   free(b->seen);
   b->seen = NULL;
@@ -413,11 +451,110 @@ void scr_dyn_from_leave(void) {
  * strict alloc/free balance.
  */
 static SCR_TL ScrDyn *scr_builtin_array_prototype;
+
+/* Property names are immutable and often repeated across simultaneously live
+ * objects. Entries own references to their bytes; this fixed weak table owns
+ * none. Collisions only reduce sharing, and the final release removes a weak
+ * entry before freeing storage. Long keys bypass lookup entirely. */
+#define SCR_DYN_KEY_SHARE_SLOTS 256
+#define SCR_DYN_KEY_SHARE_LENGTH 64
+typedef struct {
+  size_t rc;
+  char bytes[];
+} ScrDynKey;
+typedef struct {
+  ScrDynKey *key;
+  size_t length;
+} ScrDynKeySlot;
+static SCR_TL ScrDynKeySlot scr_dyn_keys[SCR_DYN_KEY_SHARE_SLOTS];
+#ifdef SCR_RC_AUDIT
+static SCR_TL long scr_live_dyn_keys;
+long scr_dyn_key_live_count(void) { return scr_live_dyn_keys; }
+#endif
+
+static size_t scr_dyn_key_slot(const char *key, size_t length) {
+  size_t hash = length;
+  for (size_t i = 0; i < length; i++) hash = hash * 31 + (unsigned char)key[i];
+  return hash % SCR_DYN_KEY_SHARE_SLOTS;
+}
+
+static char *scr_dyn_key_copy(const char *key, size_t length) {
+  ScrDynKeySlot *slot = length <= SCR_DYN_KEY_SHARE_LENGTH
+    ? &scr_dyn_keys[scr_dyn_key_slot(key, length)] : NULL;
+  if (slot && slot->key && slot->length == length &&
+      !memcmp(slot->key->bytes, key, length)) {
+    slot->key->rc++;
+    return slot->key->bytes;
+  }
+  if (length > SIZE_MAX - sizeof(ScrDynKey) - 1) scr_json_oom();
+  ScrDynKey *owned = malloc(sizeof *owned + length + 1);
+  if (!owned) scr_json_oom();
+#ifdef SCR_RC_AUDIT
+  scr_live_dyn_keys++;
+#endif
+  owned->rc = 1;
+  memcpy(owned->bytes, key, length);
+  owned->bytes[length] = '\0';
+  if (slot) *slot = (ScrDynKeySlot){owned, length};
+  return owned->bytes;
+}
+
+static void scr_dyn_key_release(char *key, size_t length) {
+  if (!key) return;
+  ScrDynKey *owned = (ScrDynKey *)(key - offsetof(ScrDynKey, bytes));
+  if (--owned->rc) return;
+  if (length <= SCR_DYN_KEY_SHARE_LENGTH) {
+    ScrDynKeySlot *slot = &scr_dyn_keys[scr_dyn_key_slot(key, length)];
+    if (slot->key == owned) slot->key = NULL;
+  }
+#ifdef SCR_RC_AUDIT
+  scr_live_dyn_keys--;
+#endif
+  free(owned);
+}
+
 #ifndef SCR_RC_AUDIT
 static SCR_TL ScrDyn *scr_dyn_free_arr, *scr_dyn_free_obj, *scr_dyn_free_misc;
 static SCR_TL size_t scr_dyn_free_count;
 #define SCR_DYN_FREE_MAX 8192
+/* Recycled small objects may retain key bytes, but never values or an
+ * unbounded document's keys. This budget applies across the whole pool. */
+static SCR_TL size_t scr_dyn_cached_key_bytes;
+#define SCR_DYN_KEY_CACHE_MAX ((size_t)64 * 1024)
+#define SCR_DYN_KEY_CACHE_SLOTS 16
+#define SCR_DYN_KEY_CACHE_LENGTH 64
+#endif
+
+static void scr_dyn_obj_drop_keys(ScrDyn *d, bool cache) {
+  for (size_t i = 0; i < d->v.obj.cap; i++) {
+    ScrDynEntry *entry = &d->v.obj.entries[i];
+    if (!entry->key) continue;
+#ifndef SCR_RC_AUDIT
+    if (cache && d->v.obj.cap <= SCR_DYN_KEY_CACHE_SLOTS &&
+        entry->key_len <= SCR_DYN_KEY_CACHE_LENGTH &&
+        sizeof(ScrDynKey) + entry->key_len + 1 <= SCR_DYN_KEY_CACHE_MAX - scr_dyn_cached_key_bytes) {
+      scr_dyn_cached_key_bytes += sizeof(ScrDynKey) + entry->key_len + 1;
+      continue;
+    }
+#else
+    (void)cache;
 #endif
+    scr_dyn_key_release(entry->key, entry->key_len);
+    entry->key = NULL;
+    entry->key_len = 0;
+  }
+}
+
+/* Primitive kinds cannot acquire properties or change kind while live, so
+ * an object property edge to one cannot participate in a cycle. Keep its RC edge
+ * out of trial deletion and release it in collected teardown instead. Other
+ * owners may still trace the same primitive through the uniform header ABI;
+ * our untraced reference keeps it alive until that teardown releases it.
+ * Entry metadata snapshots this decision during trace, before any white node
+ * can be freed. Teardown must never inspect the child's kind again. */
+static bool scr_dyn_member_is_traced(const ScrDyn *value) {
+  return value && value->kind > SCR_DYN_STR && value->kind != SCR_DYN_UNDEF;
+}
 
 /* Checked objects and functions can close over one another. All heap dyn
  * nodes carry a collector header so a captured unknown value has one uniform
@@ -425,19 +562,21 @@ static SCR_TL size_t scr_dyn_free_count;
  * capsules keep their conservative ownership edges. */
 void scr_dyn_trace_v(void *ptr, ScrTraceVisit visit, void *ctx) {
   ScrDyn *d = ptr;
-  visit(d->prototype, ctx);
-  visit(d->symbol_properties, ctx);
-  visit(d->symbol_keys, ctx);
+  if (d->prototype) visit(d->prototype, ctx);
+  if (d->symbol_properties) visit(d->symbol_properties, ctx);
+  if (d->symbol_keys) visit(d->symbol_keys, ctx);
   switch (d->kind) {
   case SCR_DYN_ARR:
     for (size_t i = 0; i < d->v.arr.len; i++) visit(d->v.arr.items[i], ctx);
-    visit(d->v.arr.properties, ctx);
+    if (d->v.arr.properties) visit(d->v.arr.properties, ctx);
     break;
   case SCR_DYN_OBJ:
     for (size_t i = 0; i < d->v.obj.len; i++) {
-      visit(d->v.obj.entries[i].value, ctx);
-      visit(d->v.obj.entries[i].getter, ctx);
-      visit(d->v.obj.entries[i].setter, ctx);
+      ScrDynEntry *entry = &d->v.obj.entries[i];
+      entry->value_traced = scr_dyn_member_is_traced(entry->value);
+      if (entry->value_traced) visit(entry->value, ctx);
+      if (entry->getter) visit(entry->getter, ctx);
+      if (entry->setter) visit(entry->setter, ctx);
     }
     break;
   case SCR_DYN_FUNC: visit(d->v.fn.clo, ctx); break;
@@ -539,6 +678,12 @@ static ScrDyn *scr_dyn_alloc(ScrDynKind kind) {
       d->v.arr.presence = NULL;
     } else if (kind == SCR_DYN_OBJ) {
       d->v.obj.len = 0; /* cap/entries preserved */
+      if (d->v.obj.cap <= SCR_DYN_KEY_CACHE_SLOTS) {
+        for (size_t i = 0; i < d->v.obj.cap; i++) {
+          ScrDynEntry *entry = &d->v.obj.entries[i];
+          if (entry->key) scr_dyn_cached_key_bytes -= sizeof(ScrDynKey) + entry->key_len + 1;
+        }
+      }
       d->v.obj.source_identity = NULL;
       d->v.obj.source_access = NULL;
     } else {
@@ -565,6 +710,10 @@ static void scr_dyn_handle_release(void *h, ScrDynHandleTag tag);
 static bool scr_dyn_to_primitive_result_is_object(const ScrDyn *d);
 
 static void scr_dyn_dispose(ScrDyn *d, bool collected) {
+  if (d->kind == SCR_DYN_OBJ) {
+    free(d->v.obj.index);
+    d->v.obj.index = NULL;
+  }
   if (!collected) scr_dyn_release(d->prototype);
   if (!collected) scr_dyn_release(d->symbol_properties);
   if (!collected) scr_dyn_release(d->symbol_keys);
@@ -592,12 +741,15 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
     break;
   case SCR_DYN_OBJ:
     for (size_t i = 0; i < d->v.obj.len; i++) {
-      free(d->v.obj.entries[i].key);
+      ScrDyn *value = d->v.obj.entries[i].value;
+      if (!collected || !d->v.obj.entries[i].value_traced) scr_dyn_release(value);
       if (!collected) {
-        scr_dyn_release(d->v.obj.entries[i].value);
         scr_dyn_release(d->v.obj.entries[i].getter);
         scr_dyn_release(d->v.obj.entries[i].setter);
       }
+      d->v.obj.entries[i].value = NULL;
+      d->v.obj.entries[i].getter = NULL;
+      d->v.obj.entries[i].setter = NULL;
     }
     if (d->v.obj.source_identity) {
       d->v.obj.source_access(d->v.obj.source_identity, false);
@@ -646,6 +798,7 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
 #endif
 #ifndef SCR_RC_AUDIT
   if (!collected && scr_dyn_free_count < SCR_DYN_FREE_MAX) {
+    if (d->kind == SCR_DYN_OBJ) scr_dyn_obj_drop_keys(d, true);
     /* Pooled blocks retain their headers and count toward the bounded
      * allocated heap, but never remain in a candidate buffer. */
     scr_weak_dispose(d);
@@ -659,7 +812,10 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
   }
 #endif
   if (d->kind == SCR_DYN_ARR) free(d->v.arr.items);
-  else if (d->kind == SCR_DYN_OBJ) free(d->v.obj.entries);
+  else if (d->kind == SCR_DYN_OBJ) {
+    scr_dyn_obj_drop_keys(d, false);
+    free(d->v.obj.entries);
+  }
   scr_cyc_free(d);
 }
 
@@ -678,25 +834,95 @@ void scr_dyn_release(ScrDyn *d) {
   scr_dyn_dispose(d, false);
 }
 
+/* Small objects retain their compact linear representation. A wide object
+ * owns a bucket index of entry positions; entries remain insertion ordered.
+ * No key/value ownership lives here, and callbacks never retain its slots. */
+#define SCR_DYN_OBJECT_INDEX_MIN 32
+typedef struct ScrDynObjectIndex {
+  size_t buckets;
+  size_t slots[]; /* zero is empty; occupied slots store entry + 1 */
+} ScrDynObjectIndex;
+
+static void scr_dyn_index_insert(ScrDynObjectIndex *index, const ScrDynEntry *entry, size_t position) {
+  size_t slot = scr_key_hash(entry->key, entry->key_len) & (index->buckets - 1);
+  while (index->slots[slot]) slot = (slot + 1) & (index->buckets - 1);
+  index->slots[slot] = position + 1;
+}
+
+/* Keep index allocation/probing outside compact object insertion and reads. */
+static __attribute__((noinline)) void scr_dyn_index_append(ScrDyn *object) {
+  size_t count = object->v.obj.len;
+  ScrDynObjectIndex *index = object->v.obj.index;
+  if (!index || count > index->buckets / 2) {
+    size_t buckets = index ? index->buckets : 64;
+    while (count > buckets / 2) {
+      if (buckets > (SIZE_MAX - sizeof *index) / sizeof(size_t) / 2) scr_json_oom();
+      buckets *= 2;
+    }
+    free(index);
+    index = calloc(1, sizeof *index + buckets * sizeof(size_t));
+    if (!index) scr_json_oom();
+    index->buckets = buckets;
+    object->v.obj.index = index;
+    for (size_t i = 0; i < count; i++) scr_dyn_index_insert(index, &object->v.obj.entries[i], i);
+  } else {
+    scr_dyn_index_insert(index, &object->v.obj.entries[count - 1], count - 1);
+  }
+}
+
+/* A checked hint avoids repeating a linear walk for recurring property
+ * names. Slots store indices only, never object/key pointers. Every hit
+ * checks the current entry, so different shapes, deletion and reordering
+ * need no invalidation and collisions fall back to the ordinary search. */
+#define SCR_DYN_PROPERTY_HINTS 64
+static SCR_TL size_t scr_dyn_property_hints[SCR_DYN_PROPERTY_HINTS];
+
+static ScrDynEntry *scr_dyn_find_linear_entry(const ScrDyn *object, const char *key, size_t length) {
+  for (size_t i = 0; i < object->v.obj.len; i++) {
+    ScrDynEntry *entry = &object->v.obj.entries[i];
+    if (entry->key_len == length && !memcmp(entry->key, key, length)) return entry;
+  }
+  return NULL;
+}
+
+static __attribute__((noinline)) ScrDynEntry *scr_dyn_find_indexed_entry(
+    const ScrDyn *object, const char *key, size_t length) {
+  const ScrDynObjectIndex *index = object->v.obj.index;
+  size_t slot = scr_key_hash(key, length) & (index->buckets - 1);
+  while (index->slots[slot]) {
+    ScrDynEntry *entry = &object->v.obj.entries[index->slots[slot] - 1];
+    if (entry->key_len == length && !memcmp(entry->key, key, length)) return entry;
+    slot = (slot + 1) & (index->buckets - 1);
+  }
+  return NULL;
+}
+
+static ScrDynEntry *scr_dyn_find_entry(const ScrDyn *object, const char *key, size_t length) {
+  if (object->kind != SCR_DYN_OBJ) return NULL;
+  if (object->v.obj.index) return scr_dyn_find_indexed_entry(object, key, length);
+  size_t slot = (length + (length ? (unsigned char)key[0] * 7u : 0)) % SCR_DYN_PROPERTY_HINTS;
+  size_t hint = scr_dyn_property_hints[slot];
+  if (hint < object->v.obj.len) {
+    ScrDynEntry *entry = &object->v.obj.entries[hint];
+    if (entry->key_len == length && !memcmp(entry->key, key, length)) return entry;
+  }
+  ScrDynEntry *entry = scr_dyn_find_linear_entry(object, key, length);
+  if (entry) scr_dyn_property_hints[slot] = (size_t)(entry - object->v.obj.entries);
+  return entry;
+}
+
 ScrDyn *scr_dyn_obj_get(const ScrDyn *d, const char *key, size_t key_len) {
   if (d->kind == SCR_DYN_PROXY) {
     scr_dyn_proxy_unsupported("raw object inspection");
     return NULL;
   }
-  if (d->kind != SCR_DYN_OBJ) return NULL;
-  for (size_t i = 0; i < d->v.obj.len; i++) {
-    const ScrDynEntry *e = &d->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) return e->value;
-  }
-  return NULL;
+  ScrDynEntry *entry = scr_dyn_find_entry(d, key, key_len);
+  return entry ? entry->value : NULL;
 }
 
 bool scr_dyn_obj_enumerable(const ScrDyn *d, const char *key, size_t key_len) {
-  for (size_t i = 0; i < d->v.obj.len; i++) {
-    const ScrDynEntry *e = &d->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) return e->enumerable;
-  }
-  return false;
+  ScrDynEntry *entry = scr_dyn_find_entry(d, key, key_len);
+  return entry && entry->enumerable;
 }
 
 static const ScrDyn *scr_dyn_property_owner(const ScrDyn *object, const char *key, size_t length);
@@ -983,29 +1209,27 @@ ScrDyn *scr_dyn_arr_named_get(const ScrDyn *d, const ScrStr *key) {
   return value;
 }
 
-/* Takes ownership of key (malloc'd) and value. Duplicate keys: the LATER
- * value wins (like JS JSON.parse) — the old value is released and the new
- * key buffer freed (the surviving entry keeps its original, equal key). */
-static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *value) {
-  for (size_t i = 0; i < obj->v.obj.len; i++) {
-    ScrDynEntry *e = &obj->v.obj.entries[i];
-    if (e->key_len == key_len && memcmp(e->key, key, key_len) == 0) {
-      if (e->accessor || !e->writable) {
-        free(key);
-        scr_dyn_release(value);
-        static const char message[] = "Cannot assign to read only property";
-        scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
-        return;
-      }
-      ScrDyn *old = e->value;
-      e->value = value;
-      scr_dyn_release(old);
-      free(key);
+/* Borrows key and takes ownership of value. Duplicate keys retain their
+ * original spelling/storage and insertion position; the later value wins.
+ * A recycled entry can reuse equal key bytes without a malloc/free pair. */
+static void scr_dyn_obj_put(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value) {
+  /* Construction usually appends an absent name. Avoid a read hint that
+   * repeats comparisons on compact objects; wide objects use their index. */
+  ScrDynEntry *existing = obj->v.obj.index ? scr_dyn_find_entry(obj, key, key_len)
+                                          : scr_dyn_find_linear_entry(obj, key, key_len);
+  if (existing) {
+    if (existing->accessor || !existing->writable) {
+      scr_dyn_release(value);
+      static const char message[] = "Cannot assign to read only property";
+      scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
       return;
     }
+    ScrDyn *old = existing->value;
+    existing->value = value;
+    scr_dyn_release(old);
+    return;
   }
   if (obj->non_extensible) {
-    free(key);
     scr_dyn_release(value);
     static const char message[] = "Cannot add property, object is not extensible";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -1015,11 +1239,16 @@ static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *valu
     size_t cap = obj->v.obj.cap ? obj->v.obj.cap * 2 : 4;
     ScrDynEntry *entries = realloc(obj->v.obj.entries, cap * sizeof *entries);
     if (!entries) scr_json_oom();
+    memset(entries + obj->v.obj.cap, 0, (cap - obj->v.obj.cap) * sizeof *entries);
     obj->v.obj.entries = entries;
     obj->v.obj.cap = cap;
   }
   ScrDynEntry *e = &obj->v.obj.entries[obj->v.obj.len++];
-  e->key = key;
+  if (!e->key || e->key_len != key_len || memcmp(e->key, key, key_len)) {
+    char *owned = scr_dyn_key_copy(key, key_len);
+    scr_dyn_key_release(e->key, e->key_len);
+    e->key = owned;
+  }
   e->key_len = key_len;
   e->value = value;
   e->getter = NULL;
@@ -1028,6 +1257,7 @@ static void scr_dyn_obj_put(ScrDyn *obj, char *key, size_t key_len, ScrDyn *valu
   e->writable = true;
   e->enumerable = true;
   e->configurable = true;
+  if (obj->v.obj.len >= SCR_DYN_OBJECT_INDEX_MIN) scr_dyn_index_append(obj);
 }
 
 /* ── dyn construction (compiler-emitted converters & overflow reads) ───── */
@@ -1039,12 +1269,20 @@ ScrDyn *scr_dyn_undefined(void) {
   return &undef;
 }
 
-ScrDyn *scr_dyn_new_null(void) { return scr_dyn_alloc(SCR_DYN_NULL); }
+/* Primitive nodes have no mutable properties or observable box identity.
+ * As with undefined, SIZE_MAX keeps them out of RC and cycle bookkeeping;
+ * callers retain the ordinary owned-result and ownership-transfer contracts. */
+ScrDyn *scr_dyn_new_null(void) {
+  static ScrDyn value = { .rc = SIZE_MAX, .kind = SCR_DYN_NULL };
+  return &value;
+}
 
 ScrDyn *scr_dyn_new_bool(bool b) {
-  ScrDyn *d = scr_dyn_alloc(SCR_DYN_BOOL);
-  d->v.b = b;
-  return d;
+  static ScrDyn values[2] = {
+    { .rc = SIZE_MAX, .kind = SCR_DYN_BOOL, .v.b = false },
+    { .rc = SIZE_MAX, .kind = SCR_DYN_BOOL, .v.b = true },
+  };
+  return &values[b ? 1 : 0];
 }
 
 ScrDyn *scr_dyn_new_bigint(ScrBigInt *value) {
@@ -1080,6 +1318,22 @@ ScrDyn *scr_dyn_symbol_get(const ScrDyn *value, const ScrStr *key) {
 }
 
 ScrDyn *scr_dyn_new_num(double n) {
+  /* Small integers are immutable primitives, just like the boolean and null
+   * singletons. Initialize only touched slots; the table neither grows nor
+   * owns heap references. Preserve negative zero as a distinct payload. */
+  if (n >= -128 && n <= 255) {
+    int value = (int)n;
+    if ((double)value == n && (value != 0 || !signbit(n))) {
+      static SCR_TL ScrDyn values[384];
+      ScrDyn *cached = &values[value + 128];
+      if (cached->rc == 0) {
+        cached->rc = SIZE_MAX;
+        cached->kind = SCR_DYN_NUM;
+        cached->v.num = n;
+      }
+      return cached;
+    }
+  }
   ScrDyn *d = scr_dyn_alloc(SCR_DYN_NUM);
   d->v.num = n;
   return d;
@@ -2819,14 +3073,10 @@ static void scr_dyn_handle_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value) {
   scr_throw_error(SCR_ERR_ERROR, scr_jb_finish(&b));
 }
 
-/* Public obj insertion: COPIES the key bytes (the internal put takes a
- * malloc'd buffer), owns the value, later duplicate keys win. */
+/* Public obj insertion copies a new key only when needed, owns the value,
+ * and preserves the existing entry for duplicate keys. */
 void scr_dyn_obj_set(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value) {
-  char *copy = malloc(key_len + 1);
-  if (!copy) scr_json_oom();
-  memcpy(copy, key, key_len);
-  copy[key_len] = '\0';
-  scr_dyn_obj_put(obj, copy, key_len, value);
+  scr_dyn_obj_put(obj, key, key_len, value);
 }
 
 static ScrStr *scr_dyn_property_key(const ScrDyn *key) {
@@ -2834,12 +3084,7 @@ static ScrStr *scr_dyn_property_key(const ScrDyn *key) {
 }
 
 static ScrDynEntry *scr_dyn_entry(ScrDyn *obj, const ScrStr *key) {
-  if (obj->kind != SCR_DYN_OBJ) return NULL;
-  for (size_t i = 0; i < obj->v.obj.len; i++) {
-    ScrDynEntry *entry = &obj->v.obj.entries[i];
-    if (entry->key_len == key->len && memcmp(entry->key, key->data, key->len) == 0) return entry;
-  }
-  return NULL;
+  return scr_dyn_find_entry(obj, key->data, key->len);
 }
 
 static bool scr_dyn_property_same_value(const ScrDyn *a, const ScrDyn *b) {
@@ -3022,6 +3267,7 @@ typedef struct {
   unsigned kind; /* 0: array, 1: string, 2: Map, 3: Set */
   unsigned selection; /* 0: values, 1: keys, 2: entries */
   bool array_like;
+  bool step_done; /* completion of the last compiler-consumed step */
   double limit;
 } ScrNativeIterator;
 
@@ -3063,21 +3309,18 @@ static void scr_native_iterator_release(void *ptr) {
   free(iterator);
 }
 
-static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
+/* Produce an owned value without allocating the protocol result. The
+ * compiler uses this only after checking the captured next function; public
+ * next() calls still receive a fresh, independently mutable result object. */
+static ScrDyn *scr_native_iterator_value(ScrNativeIterator *iterator, bool *done_out) {
   ScrDyn *source = iterator->source;
-  if (source && iterator->kind == 4) {
-    ScrDyn *result = scr_dyn_handle_ops_of(source)->iter_step(source->v.handle.ptr, &iterator->index, iterator->selection);
-    if (!result) return NULL;
-    if (scr_dyn_truthy(scr_dyn_obj_get(result, "done", 4))) {
-      iterator->source = NULL;
-      scr_dyn_release(source);
-    }
-    return result;
-  }
+  /* An inherited indexed getter can advance this same iterator recursively.
+   * Keep the source alive even if that nested call exhausts the iterator. */
+  if (source) scr_dyn_retain(source);
   /* Native array capsules retain the live array, so refresh its view at each
    * step rather than iterating a snapshot taken when the iterator opened. */
   ScrDyn *view = source && source->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(source) : NULL;
-  if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+  if (scr_exc_pending()) { scr_dyn_release(view); scr_dyn_release(source); return NULL; }
   ScrDyn *items = view ? view : source;
   ScrMap *map = source && (iterator->kind == 2 || iterator->kind == 3) ? source->v.handle.ptr : NULL;
   if (map) while (iterator->index < scr_map_iter_count(map) && !scr_map_iter_live(map, iterator->index)) iterator->index++;
@@ -3123,6 +3366,24 @@ static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
     scr_str_release(point);
   }
   scr_dyn_release(view);
+  scr_dyn_release(source);
+  *done_out = done;
+  return value;
+}
+
+static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
+  ScrDyn *source = iterator->source;
+  if (source && iterator->kind == 4) {
+    ScrDyn *result = scr_dyn_handle_ops_of(source)->iter_step(source->v.handle.ptr, &iterator->index, iterator->selection);
+    if (!result) return NULL;
+    if (scr_dyn_truthy(scr_dyn_obj_get(result, "done", 4))) {
+      iterator->source = NULL;
+      scr_dyn_release(source);
+    }
+    return result;
+  }
+  bool done;
+  ScrDyn *value = scr_native_iterator_value(iterator, &done);
   if (!value) return NULL;
   ScrDyn *result = scr_dyn_new_obj();
   scr_dyn_obj_set(result, "value", 5, value);
@@ -3172,6 +3433,28 @@ static ScrDyn *scr_native_handle_iterator_next_call(ScrClosure *closure, ScrDyn
   return scr_native_iterator_next_checked(4);
 }
 
+bool scr_dyn_iterator_can_step(const ScrDyn *iterator, const ScrDyn *next) {
+  if (iterator->kind != SCR_DYN_HANDLE || iterator->v.handle.tag != SCR_DYNH_ITERATOR) return false;
+  unsigned kind = ((ScrNativeIterator *)iterator->v.handle.ptr)->kind;
+  if (kind > 3) return false;
+  size_t index = kind == 3 ? 8 : kind == 2 ? 7 : kind == 1 ? 5 : 0;
+  return next == scr_iterator_functions[index];
+}
+
+ScrDyn *scr_dyn_iterator_step(const ScrDyn *value) {
+  ScrNativeIterator *iterator = value->v.handle.ptr;
+  bool done = false;
+  ScrDyn *item = scr_native_iterator_value(iterator, &done);
+  /* Publish after getters finish, so recursive steps cannot overwrite this
+   * step's completion. No user code runs between step and step_done. */
+  iterator->step_done = done;
+  return item;
+}
+
+bool scr_dyn_iterator_step_done(const ScrDyn *value) {
+  return ((ScrNativeIterator *)value->v.handle.ptr)->step_done;
+}
+
 static ScrDyn *scr_native_iterator_get(void *ptr, const char *key, size_t len) {
   if (len != 4 || memcmp(key, "next", 4)) return NULL;
   unsigned kind = ((ScrNativeIterator *)ptr)->kind;
@@ -5475,10 +5758,7 @@ void scr_jb_put_dyn(ScrJsonBuf *b, const ScrDyn *d) {
       if (e->value->kind == SCR_DYN_JSVAL && scr_dyn_isl_typeof_is(e->value, "function")) continue; /* engine functions drop too */
       if (!first) scr_jb_putc(b, ',');
       first = false;
-      /* Keys escape exactly like string values (put_json_str quotes). */
-      ScrStr *k = scr_str_new(e->key, e->key_len);
-      scr_jb_put_json_str(b, k);
-      scr_str_release(k);
+      scr_jb_put_json_span(b, e->key, e->key_len);
       scr_jb_putc(b, ':');
       scr_jb_put_dyn(b, e->value);
     }
@@ -5639,8 +5919,10 @@ static int32_t scr_json_hex4(ScrJsonP *p) {
  * slow path would produce) and returns -1. */
 static int scr_json_string_span(ScrJsonP *p, const char **span,
                                  size_t *span_len) {
-  size_t i = p->pos + 1;
-  while (i < p->len) {
+  *span = p->s + p->pos + 1;
+  *span_len = scr_json_plain_bytes(*span, p->len - p->pos - 1);
+  size_t i = p->pos + 1 + *span_len;
+  if (i < p->len) {
     unsigned char c = (unsigned char)p->s[i];
     if (c == '"') {
       *span = p->s + p->pos + 1;
@@ -5653,7 +5935,6 @@ static int scr_json_string_span(ScrJsonP *p, const char **span,
       scr_json_throw_pos("Bad control character in string literal", i);
       return -1;
     }
-    i++;
   }
   scr_json_throw_pos("Unterminated string", p->pos);
   return -1;
@@ -5661,11 +5942,13 @@ static int scr_json_string_span(ScrJsonP *p, const char **span,
 
 /* Slow path: parses the string literal at p->pos (the opening quote),
  * decoding escapes, into a +1 ScrStr. NULL on error (thrown). */
-static ScrStr *scr_json_string_slow(ScrJsonP *p) {
+static ScrStr *scr_json_string_slow(ScrJsonP *p, size_t prefix) {
   size_t open = p->pos;
   p->pos++; /* opening quote */
   ScrJsonBuf b;
   scr_jb_init(&b);
+  scr_jb_write(&b, p->s + p->pos, prefix);
+  p->pos += prefix;
   for (;;) {
     if (p->pos >= p->len) {
       scr_jb_dispose(&b);
@@ -5683,8 +5966,9 @@ static ScrStr *scr_json_string_slow(ScrJsonP *p) {
       return NULL;
     }
     if (c != '\\') {
-      scr_jb_putc(&b, (char)c); /* raw UTF-8 passes through */
-      p->pos++;
+      size_t run = scr_json_plain_bytes(p->s + p->pos, p->len - p->pos);
+      scr_jb_write(&b, p->s + p->pos, run);
+      p->pos += run;
       continue;
     }
     p->pos++; /* backslash */
@@ -5759,7 +6043,7 @@ static ScrStr *scr_json_string_scr(ScrJsonP *p) {
   int r = scr_json_string_span(p, &span, &span_len);
   if (r < 0) return NULL;
   if (r > 0) return scr_str_new(span, span_len);
-  return scr_json_string_slow(p);
+  return scr_json_string_slow(p, span_len);
 }
 
 static ScrDyn *scr_json_value(ScrJsonP *p);
@@ -5838,20 +6122,17 @@ static ScrDyn *scr_json_number(ScrJsonP *p) {
     }
     exp10 += eneg ? -ev : ev;
   }
-  ScrDyn *d = scr_dyn_alloc(SCR_DYN_NUM);
   if (precise && exp10 >= -22 && exp10 <= 22) {
     double v = (double)mant; /* exact: mant < 10^15 < 2^53 */
     if (exp10 > 0) v *= scr_json_pow10[exp10];
     else if (exp10 < 0) v /= scr_json_pow10[-exp10];
-    d->v.num = neg ? -v : v;
-    return d;
+    return scr_dyn_new_num(neg ? -v : v);
   }
   /* The validated span re-parses with strtod (correctly rounded, and the
    * grammar above is a strict subset of what strtod accepts). The ScrStr
    * data is NUL-terminated, and strtod stops at the first non-number char,
    * so parsing from `start` reads exactly the validated token. */
-  d->v.num = strtod(p->s + start, NULL);
-  return d;
+  return scr_dyn_new_num(strtod(p->s + start, NULL));
 }
 
 static bool scr_json_lit(ScrJsonP *p, const char *word, size_t n) {
@@ -5918,10 +6199,12 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
       scr_json_throw_pos("Expected property name or '}'", p->pos);
       return NULL;
     }
-    /* Key: fast span path (no escapes) copies straight into the malloc'd
-     * key buffer; the slow path decodes into a ScrStr first. */
+    /* Keep the key borrowed until insertion determines whether it already
+     * exists or can reuse a recycled slot. Escaped keys own their decoded
+     * string until the value has been parsed and inserted. */
     size_t key_len = 0;
-    char *key;
+    const char *key;
+    ScrStr *decoded_key = NULL;
     {
       const char *span;
       size_t span_len;
@@ -5931,27 +6214,21 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
         return NULL;
       }
       if (r > 0) {
-        key = malloc(span_len + 1);
-        if (!key) scr_json_oom();
-        memcpy(key, span, span_len);
-        key[span_len] = '\0';
+        key = span;
         key_len = span_len;
       } else {
-        ScrStr *ks = scr_json_string_slow(p);
-        if (!ks) {
+        decoded_key = scr_json_string_slow(p, span_len);
+        if (!decoded_key) {
           scr_dyn_release(obj);
           return NULL;
         }
-        key = malloc(ks->len + 1);
-        if (!key) scr_json_oom();
-        memcpy(key, ks->data, ks->len + 1);
-        key_len = ks->len;
-        scr_str_release(ks);
+        key = decoded_key->data;
+        key_len = decoded_key->len;
       }
     }
     scr_json_ws(p);
     if (p->pos >= p->len || p->s[p->pos] != ':') {
-      free(key);
+      scr_str_release(decoded_key);
       scr_dyn_release(obj);
       if (p->pos >= p->len) scr_json_throw("Unexpected end of JSON input");
       else scr_json_throw_pos("Expected ':' after property name", p->pos);
@@ -5960,11 +6237,12 @@ static ScrDyn *scr_json_object(ScrJsonP *p) {
     p->pos++; /* ':' */
     ScrDyn *value = scr_json_value(p);
     if (!value) {
-      free(key);
+      scr_str_release(decoded_key);
       scr_dyn_release(obj);
       return NULL;
     }
     scr_dyn_obj_put(obj, key, key_len, value); /* later duplicate keys win */
+    scr_str_release(decoded_key);
     scr_json_ws(p);
     if (p->pos >= p->len) {
       scr_dyn_release(obj);
@@ -6013,19 +6291,15 @@ static ScrDyn *scr_json_value(ScrJsonP *p) {
   }
   if (c == 't') {
     if (!scr_json_lit(p, "true", 4)) return NULL;
-    ScrDyn *d = scr_dyn_alloc(SCR_DYN_BOOL);
-    d->v.b = true;
-    return d;
+    return scr_dyn_new_bool(true);
   }
   if (c == 'f') {
     if (!scr_json_lit(p, "false", 5)) return NULL;
-    ScrDyn *d = scr_dyn_alloc(SCR_DYN_BOOL);
-    d->v.b = false;
-    return d;
+    return scr_dyn_new_bool(false);
   }
   if (c == 'n') {
     if (!scr_json_lit(p, "null", 4)) return NULL;
-    return scr_dyn_alloc(SCR_DYN_NULL);
+    return scr_dyn_new_null();
   }
   if (c == '-' || (c >= '0' && c <= '9')) return scr_json_number(p);
   scr_json_throw_token(p);
@@ -6117,7 +6391,12 @@ static void scr_json_delete_member(ScrDyn *object, const ScrStr *key) {
     ScrDynEntry removed = *entry;
     memmove(entry, entry + 1, (object->v.obj.len - i - 1) * sizeof *entry);
     object->v.obj.len--;
-    free(removed.key);
+    free(object->v.obj.index);
+    object->v.obj.index = NULL;
+    /* The moved tail aliases a live entry; spare slots own only their own
+     * retained key bytes, never a second pointer to a surviving property. */
+    memset(&object->v.obj.entries[object->v.obj.len], 0, sizeof *entry);
+    scr_dyn_key_release(removed.key, removed.key_len);
     scr_dyn_release(removed.value);
     scr_dyn_release(removed.getter);
     scr_dyn_release(removed.setter);
@@ -6324,12 +6603,76 @@ static void scr_json_gap(ScrJsonBuf *buffer, const ScrStr *gap, size_t depth) {
   for (size_t i = 0; i < depth; i++) scr_jb_write(buffer, gap->data, gap->len);
 }
 
+/* These primitive values cannot invoke toJSON or mutate a containing frame.
+ * BigInts, functions and every reference kind keep the protocol walk. */
+static bool scr_json_plain_value(const ScrDyn *value) {
+  switch (value->kind) {
+  case SCR_DYN_NULL: case SCR_DYN_UNDEF: case SCR_DYN_SYMBOL:
+  case SCR_DYN_BOOL: case SCR_DYN_NUM: case SCR_DYN_STR: return true;
+  default: return false;
+  }
+}
+
+/* Prove the whole immediate container before writing any of it. Without a
+ * replacer or executable children, entries cannot change and borrowed names
+ * need neither a key snapshot nor repeated lookups. Numeric property names
+ * keep the ordinary sorted-key walk; sparse/accessor arrays keep Get. This
+ * proof is repeated per call, so later mutations never leave a stale fact. */
+static bool scr_json_plain_container(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_ARR) {
+    if (value->v.arr.presence || value->v.arr.properties) return false;
+    for (size_t i = 0; i < value->v.arr.len; i++)
+      if (!scr_json_plain_value(value->v.arr.items[i])) return false;
+    return true;
+  }
+  if (value->kind != SCR_DYN_OBJ) return false;
+  for (size_t i = 0; i < value->v.obj.len; i++) {
+    const ScrDynEntry *entry = &value->v.obj.entries[i];
+    if (!entry->enumerable) continue;
+    double index;
+    if (entry->accessor || !scr_json_plain_value(entry->value) ||
+        scr_dyn_key_is_index(entry->key, entry->key_len, &index)) return false;
+  }
+  return true;
+}
+
+static bool scr_json_plain_write(ScrJsonBuf *buffer, const ScrDyn *value,
+                                 const ScrStr *gap, size_t depth) {
+  bool array = value->kind == SCR_DYN_ARR;
+  size_t length = array ? value->v.arr.len : value->v.obj.len;
+  scr_jb_putc(buffer, array ? '[' : '{');
+  bool first = true;
+  for (size_t i = 0; i < length; i++) {
+    const ScrDynEntry *entry = array ? NULL : &value->v.obj.entries[i];
+    if (entry && !entry->enumerable) continue;
+    const ScrDyn *child = array ? value->v.arr.items[i] : entry->value;
+    bool omitted = scr_json_omitted(child);
+    if (!array && omitted) continue;
+    if (!omitted && !scr_json_callback_depth(depth + 1)) return false;
+    if (!first) scr_jb_putc(buffer, ',');
+    first = false;
+    scr_json_gap(buffer, gap, depth + 1);
+    if (entry) {
+      scr_jb_put_json_span(buffer, entry->key, entry->key_len);
+      scr_jb_putc(buffer, ':');
+      if (gap->len) scr_jb_putc(buffer, ' ');
+    }
+    if (omitted) scr_jb_puts(buffer, "null");
+    else scr_dyn_json_write(buffer, child);
+  }
+  if (!first) scr_json_gap(buffer, gap, depth);
+  scr_jb_putc(buffer, array ? ']' : '}');
+  return true;
+}
+
 static bool scr_json_replaced_write(ScrJsonBuf *buffer, const ScrDyn *value,
                                    const ScrDyn *replacer, const ScrStr *gap, size_t depth) {
   if (!scr_json_callback_depth(depth)) return false;
   ScrDyn *view = value->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(value) : NULL;
   const ScrDyn *observed = view ? view : value;
   if (scr_exc_pending()) { scr_dyn_release(view); return false; }
+  if (!view && replacer->kind == SCR_DYN_UNDEF && scr_json_plain_container(value))
+    return scr_json_plain_write(buffer, value, gap, depth);
   if (observed->kind != SCR_DYN_OBJ && observed->kind != SCR_DYN_ARR && observed->kind != SCR_DYN_BYTES) {
     /* Engine objects need an engine callback bridge, not an opaque JSON
      * splice: that would silently skip all their children. */
@@ -6820,9 +7163,8 @@ static ScrDyn *scr_dyn_obj_read_receiver(const ScrDyn *d, const char *key, size_
       continue;
     }
     if (current->kind != SCR_DYN_OBJ) continue;
-    for (size_t i = 0; i < current->v.obj.len; i++) {
-      ScrDynEntry *entry = &current->v.obj.entries[i];
-      if (entry->key_len != key_len || memcmp(entry->key, key, key_len) != 0) continue;
+    ScrDynEntry *entry = scr_dyn_find_entry(current, key, key_len);
+    if (entry) {
       if (!entry->accessor) return scr_dyn_retain(entry->value);
       if (!entry->getter) return scr_dyn_retain(scr_dyn_undefined());
       ScrDyn *getter = scr_dyn_retain(entry->getter);
@@ -7090,15 +7432,9 @@ bool scr_dyn_reflect_set(ScrDyn *target, ScrDyn *raw_key, ScrDyn *value, ScrDyn
 
 /* The array-index test (ECMA: a canonical numeric string < 2^32-1). */
 static bool scr_dyn_key_is_index(const char *key, size_t len, double *out) {
-  if (len == 0 || len > 10) return false;
-  if (key[0] == '0' && len > 1) return false;
-  double v = 0;
-  for (size_t i = 0; i < len; i++) {
-    if (key[i] < '0' || key[i] > '9') return false;
-    v = v * 10 + (key[i] - '0');
-  }
-  if (v > 4294967294.0) return false;
-  *out = v;
+  uint32_t index;
+  if (!scr_key_array_index(key, len, &index)) return false;
+  *out = index;
   return true;
 }
 
@@ -7116,34 +7452,31 @@ static ScrDyn *scr_dyn_objwalk_key(const char *key, size_t key_len) {
 ScrDyn *scr_dyn_obj_own_keys(const ScrDyn *v) {
   size_t n = v->v.obj.len;
   ScrDyn *keys = scr_dyn_new_arr();
-  bool *is_index = malloc(n ? n * sizeof *is_index : 1);
-  double *idx = malloc(n ? n * sizeof *idx : 1);
-  if (!is_index || !idx) scr_trap("scriptc: out of memory\n");
-  size_t index_count = 0;
+  ScrKeyIndex *indices = NULL;
+  size_t count = 0;
   for (size_t i = 0; i < n; i++) {
-    const ScrDynEntry *e = &v->v.obj.entries[i];
-    is_index[i] = scr_dyn_key_is_index(e->key, e->key_len, &idx[i]);
-    if (is_index[i]) index_count++;
-  }
-  double last = -1;
-  for (size_t done = 0; done < index_count; done++) {
-    size_t best = (size_t)-1;
-    for (size_t i = 0; i < n; i++) {
-      if (!is_index[i] || idx[i] <= last) continue;
-      if (best == (size_t)-1 || idx[i] < idx[best]) best = i;
-    }
-    if (best == (size_t)-1) break;
-    last = idx[best];
-    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(v->v.obj.entries[best].key,
-                                                v->v.obj.entries[best].key_len));
-  }
+    const ScrDynEntry *entry = &v->v.obj.entries[i];
+    uint32_t index;
+    if (!scr_key_array_index(entry->key, entry->key_len, &index)) continue;
+    if (!indices) {
+      if (n > SIZE_MAX / sizeof *indices) scr_json_oom();
+      indices = malloc(n * sizeof *indices);
+      if (!indices) scr_json_oom();
+    }
+    indices[count++] = (ScrKeyIndex){index, i};
+  }
+  scr_key_index_sort(indices, count);
+  for (size_t i = 0; i < count; i++) {
+    const ScrDynEntry *entry = &v->v.obj.entries[indices[i].entry];
+    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(entry->key, entry->key_len));
+  }
+  free(indices);
   for (size_t i = 0; i < n; i++) {
-    if (is_index[i]) continue;
-    scr_dyn_arr_push(keys, scr_dyn_objwalk_key(v->v.obj.entries[i].key,
-                                                v->v.obj.entries[i].key_len));
+    const ScrDynEntry *entry = &v->v.obj.entries[i];
+    uint32_t index;
+    if (!scr_key_array_index(entry->key, entry->key_len, &index))
+      scr_dyn_arr_push(keys, scr_dyn_objwalk_key(entry->key, entry->key_len));
   }
-  free(is_index);
-  free(idx);
   return keys;
 }