@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_core/src/value.rs

@@ -383,6 +383,177 @@ pub enum Value {
 #[cfg(target_pointer_width = "64")]
 const _: () = assert!(std::mem::size_of::<Value>() == 24);
 
+// ─────────────────────────────────────────────────────────────────────────────
+// #201 Stage A — representation abstraction (behavior-preserving, zero perf effect).
+//
+// `Value` is an enum today. To eventually swap it for a NaN-boxed `struct Value(u64)`
+// (#201 Stage C) WITHOUT thousands of simultaneous edits, call sites should go through
+// this abstraction instead of matching the enum directly:
+//   * construct via the named constructors (`Value::number`, `::boolean`, `::string`, …),
+//   * inspect via `v.unpack()` (a borrowed view) or the `as_*` / `tag` accessors.
+// Once sites are migrated, the representation changes behind these method bodies and the
+// call sites are untouched. Stage B (the 24→16 size-shrink) is intentionally SKIPPED — it
+// was tried and regressed dispatch ~8-10% (see the size-guard note above); only Stage C's
+// branch-free tag test can pay off. This layer is pure enabling: no behavior, no perf.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Cheap type discriminant for a [`Value`]. `match v.tag()` will lower to a branch-free
+/// tag test once `Value` is NaN-boxed (#201). Variant order/values are not part of any ABI.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum ValueTag {
+    Number,
+    String,
+    Bool,
+    Null,
+    Array,
+    NumberArray,
+    Object,
+    Symbol,
+    Function,
+    #[cfg(feature = "regex")]
+    RegExp,
+    Promise,
+    Opaque,
+}
+
+/// Borrowed view of a [`Value`]'s payload, mirroring the enum variants. Lets call sites
+/// write `match v.unpack() { ValueRef::Number(n) => … }` instead of matching the enum
+/// directly, so the underlying representation can change (#201) without touching the match
+/// sites. Zero-cost — each arm borrows the existing payload in place.
+pub enum ValueRef<'a> {
+    Number(f64),
+    String(&'a arcstr::ArcStr),
+    Bool(bool),
+    Null,
+    Array(&'a VmRef<Vec<Value>>),
+    NumberArray(&'a VmRef<Vec<f64>>),
+    Object(&'a VmRef<ObjectData>),
+    Symbol(&'a Arc<TishSymbol>),
+    Function(&'a NativeFn),
+    #[cfg(feature = "regex")]
+    RegExp(&'a VmRef<TishRegExp>),
+    Promise(&'a Arc<dyn TishPromise>),
+    Opaque(&'a Arc<dyn TishOpaque>),
+}
+
+impl Value {
+    /// Named constructor for a number (#201 abstraction). Prefer over `Value::Number(n)`.
+    #[inline]
+    pub fn number(n: f64) -> Self {
+        Value::Number(n)
+    }
+
+    /// Named constructor for a boolean (#201 abstraction). Prefer over `Value::Bool(b)`.
+    #[inline]
+    pub fn boolean(b: bool) -> Self {
+        Value::Bool(b)
+    }
+
+    /// Named constructor for a string (#201 abstraction). Accepts anything that converts
+    /// into the interned `ArcStr` (`&str`, `String`, `ArcStr`).
+    #[inline]
+    pub fn string(s: impl Into<arcstr::ArcStr>) -> Self {
+        Value::String(s.into())
+    }
+
+    /// Named constructor for null (#201 abstraction). Prefer over `Value::Null`.
+    #[inline]
+    pub fn null() -> Self {
+        Value::Null
+    }
+
+    /// Borrowed view of the payload — the migration target for `match v { … }`.
+    #[inline]
+    pub fn unpack(&self) -> ValueRef<'_> {
+        match self {
+            Value::Number(n) => ValueRef::Number(*n),
+            Value::String(s) => ValueRef::String(s),
+            Value::Bool(b) => ValueRef::Bool(*b),
+            Value::Null => ValueRef::Null,
+            Value::Array(a) => ValueRef::Array(a),
+            Value::NumberArray(a) => ValueRef::NumberArray(a),
+            Value::Object(o) => ValueRef::Object(o),
+            Value::Symbol(s) => ValueRef::Symbol(s),
+            Value::Function(f) => ValueRef::Function(f),
+            #[cfg(feature = "regex")]
+            Value::RegExp(r) => ValueRef::RegExp(r),
+            Value::Promise(p) => ValueRef::Promise(p),
+            Value::Opaque(o) => ValueRef::Opaque(o),
+        }
+    }
+
+    /// The value's type discriminant (#201 abstraction) — for cheap type checks.
+    #[inline]
+    pub fn tag(&self) -> ValueTag {
+        match self {
+            Value::Number(_) => ValueTag::Number,
+            Value::String(_) => ValueTag::String,
+            Value::Bool(_) => ValueTag::Bool,
+            Value::Null => ValueTag::Null,
+            Value::Array(_) => ValueTag::Array,
+            Value::NumberArray(_) => ValueTag::NumberArray,
+            Value::Object(_) => ValueTag::Object,
+            Value::Symbol(_) => ValueTag::Symbol,
+            Value::Function(_) => ValueTag::Function,
+            #[cfg(feature = "regex")]
+            Value::RegExp(_) => ValueTag::RegExp,
+            Value::Promise(_) => ValueTag::Promise,
+            Value::Opaque(_) => ValueTag::Opaque,
+        }
+    }
+
+    /// Extract the boolean payload, if this is a `Bool`.
+    #[inline]
+    pub fn as_bool(&self) -> Option<bool> {
+        match self {
+            Value::Bool(b) => Some(*b),
+            _ => None,
+        }
+    }
+
+    /// Borrow the string payload as `&str`, if this is a `String`.
+    #[inline]
+    pub fn as_str(&self) -> Option<&str> {
+        match self {
+            Value::String(s) => Some(s.as_str()),
+            _ => None,
+        }
+    }
+
+    /// Borrow the object payload, if this is an `Object`.
+    #[inline]
+    pub fn as_object(&self) -> Option<&VmRef<ObjectData>> {
+        match self {
+            Value::Object(o) => Some(o),
+            _ => None,
+        }
+    }
+
+    /// Borrow the array payload, if this is an `Array`.
+    #[inline]
+    pub fn as_array(&self) -> Option<&VmRef<Vec<Value>>> {
+        match self {
+            Value::Array(a) => Some(a),
+            _ => None,
+        }
+    }
+
+    /// Borrow the packed-number-array payload, if this is a `NumberArray`.
+    #[inline]
+    pub fn as_number_array(&self) -> Option<&VmRef<Vec<f64>>> {
+        match self {
+            Value::NumberArray(a) => Some(a),
+            _ => None,
+        }
+    }
+
+    /// True if this is `Null`.
+    #[inline]
+    pub fn is_null(&self) -> bool {
+        matches!(self, Value::Null)
+    }
+}
+
 /// Number of properties kept inline (no heap hashmap) before promoting to a map.
 const PROPMAP_INLINE: usize = 8;
 
@@ -591,6 +762,37 @@ impl PropMap {
             m.reserve(additional);
         }
     }
+
+    /// Merge every entry of `other` into `self`, in `other`'s insertion order.
+    ///
+    /// Existing keys are overwritten (last write wins), so this preserves JS object-spread
+    /// semantics: `{ ...a, ...b }` lets `b` override `a`. The work is pre-sized — if the merge
+    /// would push the result past the inline threshold we promote to an `IndexMap` once, with the
+    /// final capacity, instead of growing/rehashing one key at a time. The native codegen calls
+    /// this for every `{ ...src }` spread, replacing the old "rebuild via AHashMap" path.
+    pub fn merge_from(&mut self, other: &PropMap) {
+        let incoming = other.len();
+        if incoming == 0 {
+            return;
+        }
+        // If the combined worst-case size escapes inline storage, promote once up front so the
+        // per-key inserts below never reallocate or re-promote.
+        if self.map.is_none() && self.inline.len() + incoming > PROPMAP_INLINE {
+            let mut m: IndexMap<Arc<str>, Value, ahash::RandomState> = IndexMap::with_capacity_and_hasher(
+                self.inline.len() + incoming,
+                ahash::RandomState::default(),
+            );
+            for (k, v) in self.inline.drain(..) {
+                m.insert(k, v);
+            }
+            self.map = Some(Box::new(m));
+        } else if let Some(m) = &mut self.map {
+            m.reserve(incoming);
+        }
+        for (k, v) in other.iter() {
+            self.insert(Arc::clone(k), v.clone());
+        }
+    }
 }
 
 impl FromIterator<(Arc<str>, Value)> for PropMap {
@@ -860,6 +1062,13 @@ pub fn to_uint32_value(v: &Value) -> u32 {
 }
 
 /// Invoke a callable [`Value`]: [`Value::Function`], or an object exposing `__call` (e.g. `Symbol`).
+///
+/// Calling a NON-callable (e.g. a method on `null` whose read returned `null`, or any non-function
+/// value) is a JS `TypeError`. In the native/runtime path this used to `panic!` — an UNCATCHABLE
+/// process abort (#381 class). It now PARKS a catchable `TypeError` and returns the `null` sentinel;
+/// the throw surfaces at the caller's next pending-throw checkpoint (statement boundary in emitted
+/// native code, or the `has_pending_throw()` polls in the shared builtins), so `try { null.foo() }
+/// catch (e) { … }` recovers instead of aborting — matching the VM/interpreter/node.
 pub fn value_call(callee: &Value, args: &[Value]) -> Value {
     match callee {
         Value::Function(f) => f.call(args),
@@ -868,15 +1077,19 @@ pub fn value_call(callee: &Value, args: &[Value]) -> Value {
             if let Some(inner) = inner {
                 return value_call(&inner, args);
             }
-            panic!(
-                "Not a function: tried to call {:?} as a function (e.g. method on Null when read failed)",
-                callee
-            );
+            crate::set_pending_throw(crate::not_a_function_error(format!(
+                "{} is not a function",
+                callee.to_display_string()
+            )));
+            Value::Null
+        }
+        _ => {
+            crate::set_pending_throw(crate::not_a_function_error(format!(
+                "{} is not a function",
+                callee.to_display_string()
+            )));
+            Value::Null
         }
-        _ => panic!(
-            "Not a function: tried to call {:?} as a function (e.g. method on Null when read failed)",
-            callee
-        ),
     }
 }
 
@@ -967,26 +1180,75 @@ pub fn js_number_to_string_into(out: &mut String, value: f64) {
         return;
     }
 
+    // Fast path for exact integers within ±2^53 (the f64 "safe integer" range). ECMAScript ToString
+    // renders any such integer in plain decimal (no sign-exponent — magnitude < 1e21 ⇒ `point <= 21`
+    // in the general algorithm below), which `itoa` emits directly, bypassing the `format!("{:e}")`
+    // round-trip + intermediate `String`/`char`-filter/`"0".repeat()`. This is the dominant case for
+    // tally/counter/index loops (e.g. map keys like `"w" + (n % 1000)`). Bit-identical to the general
+    // path for every integer it accepts: each such value is exactly representable in both f64 and i64,
+    // so `value as i64` is exact (no saturation — `±2^53` is well inside i64), and the decimal form is
+    // the same digits the general path would emit. Larger integers (where f64 can't represent
+    // consecutive values) fall through to the general path unchanged.
+    const MAX_SAFE_INT: f64 = 9_007_199_254_740_992.0; // 2^53
+    if value.fract() == 0.0 && value.abs() <= MAX_SAFE_INT {
+        let mut buf = itoa::Buffer::new();
+        out.push_str(buf.format(value as i64));
+        return;
+    }
+
     let negative = value < 0.0;
-    // Shortest round-trip digits + base-10 exponent, e.g. "6.022e23" → ("6022", 23).
-    let sci = format!("{:e}", value.abs());
-    let (mantissa, exp_str) = sci
-        .split_once('e')
-        .expect("LowerExp formatting always contains 'e'");
-    let exp: i32 = exp_str
-        .parse()
-        .expect("LowerExp exponent is a valid integer");
-    let digits: String = mantissa.chars().filter(|&c| c != '.').collect();
+    // Shortest round-trip digits via ryu, then reassembled into ECMAScript `Number::toString` form.
+    // ryu writes the shortest correctly-rounded digits straight into a stack buffer with none of the
+    // `core::fmt` `{:e}` Formatter machinery the previous version paid per call (profiled as ~40% of
+    // JSON.stringify self-time on numeric payloads). number→string is the JSON / template-literal /
+    // logging / `+=` primitive, so this is a broad win. The shortest round-trip digit *sequence* is
+    // unique, so ryu emits the same digits as the old `{:e}` path → output stays byte-identical.
+    let mut ryu_buf = ryu::Buffer::new();
+    // Finite & non-zero here (NaN / ±∞ / ±0 handled above), so `format_finite` is safe and cheaper.
+    let s = ryu_buf.format_finite(value.abs());
+
+    // Parse ryu's `<int>[.<frac>][e<exp>]` into significant digits + ECMAScript decimal point.
+    // `point` = ECMAScript's `n`: value = digits × 10^(point − k), with `k` = significant-digit count.
+    let (mant, exp) = match s.as_bytes().iter().position(|&c| c == b'e' || c == b'E') {
+        Some(i) => (&s[..i], s[i + 1..].parse::<i32>().expect("ryu exponent")),
+        None => (s, 0i32),
+    };
+    let (int_part, frac_part) = match mant.as_bytes().iter().position(|&c| c == b'.') {
+        Some(i) => (&mant[..i], &mant[i + 1..]),
+        None => (mant, ""),
+    };
+    let frac_len = frac_part.len() as i32;
+    // Raw digit run = int_part ++ frac_part (ryu's mantissa, ≤ ~18 chars for an f64).
+    let mut digits_buf = [0u8; 32];
+    let mut n = 0usize;
+    for &c in int_part.as_bytes().iter().chain(frac_part.as_bytes()) {
+        digits_buf[n] = c;
+        n += 1;
+    }
+    // Strip leading zeros (e.g. ryu "0.1" → raw "01" → "1") …
+    let mut lead = 0usize;
+    while lead + 1 < n && digits_buf[lead] == b'0' {
+        lead += 1;
+    }
+    // … and trailing zeros (defensive — shortest form has none — folded back via `trail`).
+    let mut end = n;
+    while end - 1 > lead && digits_buf[end - 1] == b'0' {
+        end -= 1;
+    }
+    let trail = (n - end) as i32;
+    let digits = std::str::from_utf8(&digits_buf[lead..end]).expect("ascii digits");
     let k = digits.len() as i32; // significant digit count (≤ 17 for an f64)
-    let point = exp + 1; // ECMAScript's `n`: value = digits × 10^(point − k)
+    let point = k + exp - frac_len + trail;
 
     if negative {
         out.push('-');
     }
     if k <= point && point <= 21 {
         // Integer, zero-padded: digits then (point − k) trailing zeros.
-        out.push_str(&digits);
-        out.push_str(&"0".repeat((point - k) as usize));
+        out.push_str(digits);
+        for _ in 0..(point - k) {
+            out.push('0');
+        }
     } else if 0 < point && point <= 21 {
         // Decimal point inside the digit string.
         out.push_str(&digits[..point as usize]);
@@ -995,8 +1257,10 @@ pub fn js_number_to_string_into(out: &mut String, value: f64) {
     } else if -6 < point && point <= 0 {
         // Leading-zero fraction: "0." then (−point) zeros then the digits.
         out.push_str("0.");
-        out.push_str(&"0".repeat((-point) as usize));
-        out.push_str(&digits);
+        for _ in 0..(-point) {
+            out.push('0');
+        }
+        out.push_str(digits);
     } else {
         // Exponential: first digit, optional `.rest`, then `e±E`.
         let e = point - 1;
@@ -1007,13 +1271,22 @@ pub fn js_number_to_string_into(out: &mut String, value: f64) {
         }
         out.push('e');
         out.push(if e >= 0 { '+' } else { '-' });
-        out.push_str(&e.abs().to_string());
+        let mut ib = itoa::Buffer::new();
+        out.push_str(ib.format(e.abs()));
     }
 }
 
 impl Value {
     /// Convert value to display string (for console output).
     pub fn to_display_string(&self) -> String {
+        self.to_display_string_guarded(&mut Vec::new())
+    }
+
+    /// Cycle-safe recursive form (#381): `ancestors` holds the current path's container-cell pointers,
+    /// so a self-referential array/object (`a.self = a`) renders `[Circular]` instead of recursing
+    /// forever and wedging the thread. Ancestor-only (not all-visited), so a shared DAG node still
+    /// renders in full.
+    fn to_display_string_guarded(&self, ancestors: &mut Vec<*const ()>) -> String {
         match self {
             // Inspect form keeps the sign of negative zero (`console.log(-0)` → `-0`), unlike the
             // ECMAScript ToString used by `to_js_string`. See `js_number_to_string`. (#247)
@@ -1023,8 +1296,17 @@ impl Value {
             Value::Bool(b) => b.to_string(),
             Value::Null => "null".to_string(),
             Value::Array(arr) => {
-                let inner: Vec<String> =
-                    arr.borrow().iter().map(|v| v.to_display_string()).collect();
+                let ptr = arr.as_ptr();
+                if ancestors.contains(&ptr) {
+                    return "[Circular]".to_string();
+                }
+                ancestors.push(ptr);
+                let inner: Vec<String> = arr
+                    .borrow()
+                    .iter()
+                    .map(|v| v.to_display_string_guarded(ancestors))
+                    .collect();
+                ancestors.pop();
                 format!("[{}]", inner.join(", "))
             }
             Value::NumberArray(arr) => {
@@ -1036,12 +1318,18 @@ impl Value {
                 format!("[{}]", inner.join(", "))
             }
             Value::Object(obj) => {
+                let ptr = obj.as_ptr();
+                if ancestors.contains(&ptr) {
+                    return "[Circular]".to_string();
+                }
+                ancestors.push(ptr);
                 let inner: Vec<String> = obj
                     .borrow()
                     .strings
                     .iter()
-                    .map(|(k, v)| format!("{}: {}", k.as_ref(), v.to_display_string()))
+                    .map(|(k, v)| format!("{}: {}", k.as_ref(), v.to_display_string_guarded(ancestors)))
                     .collect();
+                ancestors.pop();
                 format!("{{{}}}", inner.join(", "))
             }
             Value::Symbol(s) => {
@@ -1071,16 +1359,32 @@ impl Value {
     /// renders as `"null"` here (matching `String(null)`); `join` itself maps `null`/`undefined`
     /// elements to `""` *before* calling this, per the spec.
     pub fn to_js_string(&self) -> String {
+        self.to_js_string_guarded(&mut Vec::new())
+    }
+
+    /// Cycle-safe `ToString` (#381): only arrays recurse here (objects render `[object Object]`), so a
+    /// cyclic array via `"" + a` would otherwise hang. A back-reference joins as `""` — matching V8's
+    /// `Array.prototype.join`, where a self-referential element contributes the empty string.
+    fn to_js_string_guarded(&self, ancestors: &mut Vec<*const ()>) -> String {
         match self {
-            Value::Array(arr) => arr
-                .borrow()
-                .iter()
-                .map(|v| match v {
-                    Value::Null => String::new(),
-                    other => other.to_js_string(),
-                })
-                .collect::<Vec<_>>()
-                .join(","),
+            Value::Array(arr) => {
+                let ptr = arr.as_ptr();
+                if ancestors.contains(&ptr) {
+                    return String::new();
+                }
+                ancestors.push(ptr);
+                let s = arr
+                    .borrow()
+                    .iter()
+                    .map(|v| match v {
+                        Value::Null => String::new(),
+                        other => other.to_js_string_guarded(ancestors),
+                    })
+                    .collect::<Vec<_>>()
+                    .join(",");
+                ancestors.pop();
+                s
+            }
             Value::NumberArray(arr) => arr
                 .borrow()
                 .iter()
@@ -1354,6 +1658,46 @@ impl Value {
     }
 }
 
+#[cfg(test)]
+mod value_abstraction_tests {
+    // #201 Stage A — the abstraction must exactly mirror the enum it will replace.
+    use super::{Value, ValueRef, ValueTag};
+
+    #[test]
+    fn named_ctors_report_the_right_tag() {
+        assert_eq!(Value::number(1.5).tag(), ValueTag::Number);
+        assert_eq!(Value::boolean(true).tag(), ValueTag::Bool);
+        assert_eq!(Value::string("hi").tag(), ValueTag::String);
+        assert_eq!(Value::null().tag(), ValueTag::Null);
+        assert_eq!(Value::array(vec![]).tag(), ValueTag::Array);
+        assert_eq!(Value::empty_object().tag(), ValueTag::Object);
+    }
+
+    #[test]
+    fn unpack_roundtrips_each_variant() {
+        assert!(matches!(Value::number(3.0).unpack(), ValueRef::Number(n) if n == 3.0));
+        assert!(matches!(Value::boolean(false).unpack(), ValueRef::Bool(false)));
+        assert!(matches!(Value::string("x").unpack(), ValueRef::String(s) if s.as_str() == "x"));
+        assert!(matches!(Value::null().unpack(), ValueRef::Null));
+        assert!(matches!(Value::array(vec![]).unpack(), ValueRef::Array(_)));
+        assert!(matches!(Value::empty_object().unpack(), ValueRef::Object(_)));
+    }
+
+    #[test]
+    fn accessors_extract_or_none() {
+        assert_eq!(Value::number(2.0).as_number(), Some(2.0));
+        assert_eq!(Value::boolean(true).as_bool(), Some(true));
+        assert_eq!(Value::string("abc").as_str(), Some("abc"));
+        assert!(Value::null().is_null());
+        // wrong-variant accessors return None
+        assert_eq!(Value::number(1.0).as_bool(), None);
+        assert_eq!(Value::null().as_str(), None);
+        assert!(!Value::number(0.0).is_null());
+        assert!(Value::array(vec![Value::number(1.0)]).as_array().is_some());
+        assert!(Value::number(1.0).as_array().is_none());
+    }
+}
+
 #[cfg(test)]
 mod number_to_string_tests {
     use super::js_number_to_string;
@@ -1371,6 +1715,14 @@ mod number_to_string_tests {
             (0.5, "0.5"),
             (-123.456, "-123.456"),
             (100000.0, "100000"),
+            (-1000.0, "-1000"),
+            // Integer fast-path boundary (±2^53): the largest safe integer takes the itoa path; the
+            // next decade up (still an exact f64 integer, but > 2^53) takes the general path. Both must
+            // match Node's `String(value)`.
+            (9007199254740992.0, "9007199254740992"), // 2^53
+            (9007199254740991.0, "9007199254740991"), // 2^53 - 1 (Number.MAX_SAFE_INTEGER)
+            (-9007199254740992.0, "-9007199254740992"),
+            (1e16, "10000000000000000"), // > 2^53, exact f64 integer → general path
             // Decimal/exponential boundary on the large side: 1e21 flips to exponential.
             (1e20, "100000000000000000000"),
             (1e21, "1e+21"),
@@ -1390,6 +1742,15 @@ mod number_to_string_tests {
             // Shortest round-trip mantissa (not full precision).
             (0.1, "0.1"),
             (0.1 + 0.2, "0.30000000000000004"),
+            // Shortest-representation ties → ECMAScript rounds the final digit to EVEN (spec: "if
+            // there are two such possible values, choose the one that is even"). These large-magnitude
+            // fractionals each have two equally-short round-tripping decimals; Node/V8 emit the even
+            // one. Verified against Node's `String(value)`. (The prior `{:e}`-based path rounded the
+            // other way — ryu does ties-to-even, matching the spec.)
+            (2181495296738027.3, "2181495296738027.2"),
+            (75251554695404.13, "75251554695404.12"),
+            (256006004960902.63, "256006004960902.62"),
+            (-18546578340962.313, "-18546578340962.312"),
             // Non-finite.
             (f64::INFINITY, "Infinity"),
             (f64::NEG_INFINITY, "-Infinity"),
@@ -1401,3 +1762,172 @@ mod number_to_string_tests {
     }
 }
 
+#[cfg(test)]
+mod cycle_coercion_tests_381 {
+    //! #381: string-coercing a cyclic array/object must terminate (was a silent thread hang),
+    //! matching Node — `console.log`/inspect renders `[Circular]`, `"" + a` renders the back-ref as
+    //! the empty string via `Array.prototype.join`.
+    use super::Value;
+    use crate::VmRef;
+
+    #[test]
+    fn display_string_cyclic_array_terminates() {
+        let a = Value::Array(VmRef::new(Vec::new()));
+        if let Value::Array(inner) = &a {
+            inner.borrow_mut().push(a.clone()); // a = [a]
+        }
+        assert_eq!(a.to_display_string(), "[[Circular]]");
+    }
+
+    #[test]
+    fn js_string_cyclic_array_terminates() {
+        let a = Value::Array(VmRef::new(Vec::new()));
+        if let Value::Array(inner) = &a {
+            inner.borrow_mut().push(a.clone());
+        }
+        // Node: `let a=[]; a.push(a); "" + a` === "" (the self-referential element joins as "").
+        assert_eq!(a.to_js_string(), "");
+    }
+
+    #[test]
+    fn display_string_cyclic_object_terminates() {
+        let o = Value::object_from_pairs([]);
+        if let Value::Object(inner) = &o {
+            inner.borrow_mut().strings.insert(std::sync::Arc::from("self"), o.clone());
+        }
+        assert_eq!(o.to_display_string(), "{self: [Circular]}");
+    }
+
+    #[test]
+    fn display_string_shared_dag_is_not_circular() {
+        let shared = Value::Array(VmRef::new(vec![Value::Number(1.0)]));
+        let root = Value::Array(VmRef::new(vec![shared.clone(), shared.clone()]));
+        assert_eq!(root.to_display_string(), "[[1], [1]]", "a shared node is a DAG, not a cycle");
+    }
+}
+
+#[cfg(test)]
+mod propmap_merge_tests {
+    use super::{PropMap, Value, PROPMAP_INLINE};
+    use std::sync::Arc;
+
+    fn pm(pairs: &[(&str, f64)]) -> PropMap {
+        let mut m = PropMap::default();
+        for (k, v) in pairs {
+            m.insert(Arc::from(*k), Value::Number(*v));
+        }
+        m
+    }
+
+    fn keys(m: &PropMap) -> Vec<String> {
+        m.keys().map(|k| k.to_string()).collect()
+    }
+
+    fn num(m: &PropMap, k: &str) -> Option<f64> {
+        match m.get(k) {
+            Some(Value::Number(n)) => Some(*n),
+            _ => None,
+        }
+    }
+
+    #[test]
+    fn merge_appends_new_keys_in_source_order() {
+        let mut dst = pm(&[("a", 1.0), ("b", 2.0)]);
+        dst.merge_from(&pm(&[("c", 3.0), ("d", 4.0)]));
+        assert_eq!(keys(&dst), ["a", "b", "c", "d"]);
+        assert_eq!(num(&dst, "c"), Some(3.0));
+    }
+
+    #[test]
+    fn merge_overwrites_existing_keys_without_reordering() {
+        // `{ ...{a,b,c}, b: 20 }` — later write wins, key keeps its original slot.
+        let mut dst = pm(&[("a", 1.0), ("b", 2.0), ("c", 3.0)]);
+        dst.merge_from(&pm(&[("b", 20.0), ("d", 4.0)]));
+        assert_eq!(keys(&dst), ["a", "b", "c", "d"]);
+        assert_eq!(num(&dst, "b"), Some(20.0));
+        assert_eq!(num(&dst, "d"), Some(4.0));
+    }
+
+    #[test]
+    fn merge_empty_source_is_noop() {
+        let mut dst = pm(&[("a", 1.0)]);
+        dst.merge_from(&PropMap::default());
+        assert_eq!(keys(&dst), ["a"]);
+    }
+
+    #[test]
+    fn merge_promotes_past_inline_threshold_preserving_order_and_overrides() {
+        // Combined unique key count exceeds the inline cap, forcing the IndexMap promotion path.
+        let mut dst = PropMap::default();
+        for i in 0..PROPMAP_INLINE {
+            dst.insert(Arc::from(format!("k{i}").as_str()), Value::Number(i as f64));
+        }
+        let mut src = PropMap::default();
+        // Overwrite one existing key and add several new ones to cross the threshold.
+        src.insert(Arc::from("k0"), Value::Number(100.0));
+        for i in PROPMAP_INLINE..(PROPMAP_INLINE + 5) {
+            src.insert(Arc::from(format!("k{i}").as_str()), Value::Number(i as f64));
+        }
+        dst.merge_from(&src);
+        assert_eq!(dst.len(), PROPMAP_INLINE + 5);
+        assert_eq!(num(&dst, "k0"), Some(100.0)); // override applied
+        assert_eq!(num(&dst, "k0").is_some(), keys(&dst).first().map(|k| k == "k0").unwrap());
+        // Original keys come first (insertion order), then the new ones.
+        let ks = keys(&dst);
+        assert_eq!(ks[0], "k0");
+        assert_eq!(ks[PROPMAP_INLINE], format!("k{PROPMAP_INLINE}"));
+        // Lookups remain correct after promotion.
+        for i in PROPMAP_INLINE..(PROPMAP_INLINE + 5) {
+            assert_eq!(num(&dst, &format!("k{i}")), Some(i as f64));
+        }
+    }
+
+    #[test]
+    fn merge_into_empty_matches_clone() {
+        let src = pm(&[("x", 7.0), ("y", 8.0)]);
+        let mut dst = PropMap::default();
+        dst.merge_from(&src);
+        assert_eq!(keys(&dst), keys(&src));
+        assert_eq!(num(&dst, "x"), Some(7.0));
+        assert_eq!(num(&dst, "y"), Some(8.0));
+    }
+}
+
+#[cfg(test)]
+mod value_call_non_function_tests {
+    // Calling a non-callable value PARKS a catchable `TypeError` (#381) instead of `panic!`-ing
+    // (an uncatchable process abort). The throw surfaces at the caller's next pending-throw
+    // checkpoint. These lock the no-panic contract at the primitive level.
+    use super::{value_call, Value};
+    use crate::{has_pending_throw, take_pending_throw};
+
+    fn parked_error_name(v: &Value) -> Option<String> {
+        if let Value::Object(o) = v {
+            if let Some(Value::String(s)) = o.borrow().strings.get("name") {
+                return Some(s.to_string());
+            }
+        }
+        None
+    }
+
+    #[test]
+    fn calling_null_parks_type_error_and_does_not_panic() {
+        let _ = take_pending_throw(); // clear any stale slot on this thread
+        let r = value_call(&Value::Null, &[]);
+        assert!(matches!(r, Value::Null), "returns the null sentinel, not a panic");
+        assert!(has_pending_throw(), "a throw must be parked");
+        let parked = take_pending_throw().expect("parked throw present");
+        assert_eq!(parked_error_name(&parked).as_deref(), Some("TypeError"));
+    }
+
+    #[test]
+    fn calling_a_number_parks_type_error() {
+        let _ = take_pending_throw();
+        let r = value_call(&Value::Number(5.0), &[]);
+        assert!(matches!(r, Value::Null));
+        assert!(has_pending_throw());
+        let parked = take_pending_throw().expect("parked throw present");
+        assert_eq!(parked_error_name(&parked).as_deref(), Some("TypeError"));
+    }
+}
+