@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_runtime/src/lib.rs

@@ -11,23 +11,77 @@ use tishlang_builtins::helpers::make_error_value;
 
 pub use tishlang_builtins::symbol::symbol_object;
 pub use tishlang_core::ObjectMap;
+// `ObjectData`/`PropMap` are the concrete object representation. Re-exported so the
+// native codegen can build an object literal's `PropMap` directly (pre-sized, single
+// pass) instead of materializing an intermediate `AHashMap` and rebuilding from it.
+pub use tishlang_core::{ObjectData, PropMap};
 pub use tishlang_core::Value;
 pub use tishlang_core::ArcStr;
 /// Used by native codegen for `f()` / `obj()` dispatch (`Value::Function` or `__call` on objects).
-pub use tishlang_core::value_call;
+/// Wraps `tishlang_core::value_call` with a pending-throw suppression check (#381): while a thrown
+/// value is unwinding toward its checkpoint, calling anything would run side effects JS semantics
+/// say must not happen after a throw (e.g. `console.log(f(x))` printing the NaN sentinel a tripped
+/// recursion guard unwound with). One thread-local read on a path already dominated by boxing.
+pub fn value_call(callee: &Value, args: &[Value]) -> Value {
+    if has_pending_throw() {
+        return Value::Null;
+    }
+    tishlang_core::value_call(callee, args)
+}
 /// JS ToInt32/ToUint32 for the emitted bitwise/shift code (modulo 2³², NaN/±Infinity → 0).
 pub use tishlang_core::{
     to_int32, to_int32_value, to_number_value, to_uint32, to_uint32_value,
 };
+/// ECMAScript `Number::toString`, appended straight into a buffer — for in-place string building
+/// (`s += n`) in emitted code, so a number append needs no throwaway `String`.
+pub use tishlang_core::js_number_to_string_into;
+
+/// Append `v`'s JS string-concatenation form directly to `buf` (no intermediate `String` for the
+/// common scalar cases). Used by emitted `s += rhs` / `s = s + rhs` so a string-builder loop stays
+/// allocation-light. Numbers go through `js_number_to_string_into` (JS-correct, ryu-backed), so a
+/// concatenated float matches Node (`String(1e21)` → `"1e+21"`), which the old `n.to_string()`
+/// Display path did not.
+#[inline]
+pub fn push_value_str(buf: &mut String, v: &Value) {
+    match v {
+        Value::String(s) => buf.push_str(s),
+        Value::Number(n) => js_number_to_string_into(buf, *n),
+        Value::Bool(b) => buf.push_str(if *b { "true" } else { "false" }),
+        Value::Null => buf.push_str("null"),
+        other => buf.push_str(&other.to_js_string()),
+    }
+}
 // Re-export the shared-mutable wrapper so the Rust code emitted by
 // `tishlang_compile::codegen` can write `VmRef::new(...)` without needing
 // a direct dependency on `tishlang_core` from the generated crate.
 pub use tishlang_core::{VmReadGuard, VmRef, VmWriteGuard};
 
+/// #218 — read a captured `VmRef` cell's value, releasing the lock guard BEFORE returning.
+///
+/// Generated native code reads captured cells in *expression position* (e.g. `current.dim +
+/// current.fg` lowers to two reads of `current` inside one `+`). The old inline form
+/// `(*cell.borrow()).clone()` puts the `borrow()` guard in a *temporary*, whose lifetime extends to
+/// the end of the enclosing statement — so two reads of the SAME cell in one expression hold two
+/// guards at once. Under the `send-values` build a `VmRef` is an `Arc<Mutex<T>>` and `borrow()` is a
+/// non-reentrant `Mutex::lock()`, so that second lock self-deadlocks (the process sleeps at 0% CPU).
+/// Cloning inside this fn drops the guard at the `return`, so repeated reads of one cell lock
+/// strictly sequentially. Behaviour is identical to `(*cell.borrow()).clone()` otherwise.
+#[inline]
+pub fn vm_read<T: Clone>(cell: &VmRef<T>) -> T {
+    (*cell.borrow()).clone()
+}
+
 /// `for…of` iterable normalization for the native backend: a JS iterator object (one with a
 /// callable `next()` returning `{ value, done }`, e.g. a `Map`/`Set` `.values()` result) is
 /// drained into a `Value::Array`; arrays, strings, and everything else pass through unchanged.
 pub fn normalize_for_of(v: Value) -> Value {
+    // A packed `NumberArray` (e.g. a module-const f64 array) must box to a plain `Value::Array` so the
+    // single-variant `if let Value::Array` in the spread / for-of codegen binds — otherwise it spreads
+    // to zero elements.
+    if let Value::NumberArray(arr) = &v {
+        let items: Vec<Value> = arr.borrow().iter().map(|n| Value::Number(*n)).collect();
+        return Value::Array(VmRef::new(items));
+    }
     match tishlang_core::drain_iterator(&v) {
         Some(items) => Value::Array(VmRef::new(items)),
         None => v,
@@ -53,8 +107,8 @@ pub use tishlang_builtins::typedarrays::{
 };
 pub use tishlang_builtins::date::date_constructor_value as tish_date_constructor;
 pub use tishlang_builtins::collections::{
-    collection_size, map_constructor_value as tish_map_constructor,
-    set_constructor_value as tish_set_constructor,
+    collection_size, map_constructor_value as tish_map_constructor, map_get,
+    map_has, map_set, map_values, set_constructor_value as tish_set_constructor,
 };
 
 // Re-export array methods from tishlang_builtins
@@ -65,9 +119,10 @@ pub use tishlang_builtins::array::{
     for_each as array_for_each, includes as array_includes_impl, index_of as array_index_of_impl,
     join as array_join_impl, map as array_map, pop as array_pop, push as array_push_impl,
     fill as array_fill, reduce as array_reduce, reverse as array_reverse, shift as array_shift,
-    shuffle as array_shuffle, slice as array_slice_impl, some as array_some,
-    sort_default as array_sort_default, sort_numeric_asc as array_sort_numeric_asc,
-    sort_numeric_desc as array_sort_numeric_desc,
+    shuffle as array_shuffle, slice as array_slice_impl, snapshot_values as array_snapshot_values,
+    as_f64_snapshot as array_as_f64_snapshot, some as array_some,
+    sort_by_keys as array_sort_by_keys, sort_default as array_sort_default,
+    sort_numeric_asc as array_sort_numeric_asc, sort_numeric_desc as array_sort_numeric_desc,
     sort_with_comparator as array_sort_with_comparator, splice as array_splice_impl,
     unshift as array_unshift_impl,
 };
@@ -195,6 +250,126 @@ pub fn value_at(recv: &Value, idx: &Value) -> Value {
 pub fn string_char_code_at(s: &Value, idx: &Value) -> Value {
     string_char_code_at_impl(s, idx)
 }
+
+// ── #317: typed-`String` (RustType::String) receiver fast paths ───────────────────────────────
+//
+// When native codegen knows the receiver of `s.charCodeAt(i)` / `s.charAt(i)` / `s.at(i)` / `s[i]`
+// / `s.length` is a Rust `String` local (the `TISH_NATIVE_OPT` default), it can BORROW the string
+// (`s.as_str()`) instead of deep-cloning it into a fresh `Value::String(ArcStr)` on every call. The
+// boxed path's `s.clone().into()` is an O(n) copy of the whole string per call — O(n²) in a strided
+// scan loop. These `&str` entry points eliminate that per-call copy.
+//
+// Indexing is by Unicode SCALAR (code point), byte-identical to `s.chars().nth(i)` /
+// `s.chars().count()` — the same semantics as the boxed builtins (`tishlang_builtins::string`).
+// `chars().nth(idx)` is O(idx) per call (acceptable: the win is removing the O(n) copy), versus the
+// boxed cursor cache's O(1)-for-ASCII; correctness is identical either way.
+
+#[inline]
+fn idx_as_usize(idx: &Value) -> usize {
+    match idx {
+        Value::Number(n) => *n as usize,
+        _ => 0,
+    }
+}
+
+/// `&str` charCodeAt — code point at `idx` as f64; OOB → NaN. Mirrors `string::char_code_at`.
+#[inline]
+pub fn str_char_code_at(s: &str, idx: &Value) -> Value {
+    match s.chars().nth(idx_as_usize(idx)) {
+        Some(c) => Value::Number(c as u32 as f64),
+        None => Value::Number(f64::NAN),
+    }
+}
+
+/// `&str` charAt — 1-char string at `idx`; OOB → `""`. Mirrors `string::char_at`.
+#[inline]
+pub fn str_char_at(s: &str, idx: &Value) -> Value {
+    match s.chars().nth(idx_as_usize(idx)) {
+        Some(c) => Value::String(c.to_string().into()),
+        None => Value::String("".into()),
+    }
+}
+
+/// `&str` String.prototype.at — negative `idx` counts from the end; OOB → null. Mirrors `string::at`.
+#[inline]
+pub fn str_at(s: &str, idx: &Value) -> Value {
+    let i = match idx {
+        Value::Number(n) => *n as i64,
+        _ => 0,
+    };
+    let resolved = if i < 0 {
+        s.chars().count() as i64 + i
+    } else {
+        i
+    };
+    if resolved >= 0 {
+        if let Some(c) = s.chars().nth(resolved as usize) {
+            return Value::String(c.to_string().into());
+        }
+    }
+    Value::Null
+}
+
+// ── O(1) char-slice forms: the loop-hoisted scan path ─────────────────────────────────────────
+//
+// `str_char_code_at` & friends index a `&str` via `chars().nth(i)` = O(i), so a strided scan
+// (`for i in 0..s.length { s.charCodeAt(i) }`) is O(n²). When native codegen proves the String is
+// loop-invariant it collects it ONCE into a `Vec<char>` and routes per-iteration accesses here, so
+// each index is O(1) (scan → O(n)). Semantics are byte-identical to the `&str` forms: same
+// `idx_as_usize`, `chars.len()` == `s.chars().count()`, `chars.get(i)` == `s.chars().nth(i)`.
+
+/// O(1) char-slice `charCodeAt` — loop-hoisted [`str_char_code_at`]. OOB → NaN.
+#[inline]
+pub fn slice_char_code_at(chars: &[char], idx: &Value) -> Value {
+    match chars.get(idx_as_usize(idx)) {
+        Some(c) => Value::Number(*c as u32 as f64),
+        None => Value::Number(f64::NAN),
+    }
+}
+
+/// O(1) char-slice `charAt` — loop-hoisted [`str_char_at`]. OOB → `""`.
+#[inline]
+pub fn slice_char_at(chars: &[char], idx: &Value) -> Value {
+    match chars.get(idx_as_usize(idx)) {
+        Some(c) => Value::String(c.to_string().into()),
+        None => Value::String("".into()),
+    }
+}
+
+/// O(1) char-slice `at` (negative-index aware) — loop-hoisted [`str_at`]. OOB → null.
+#[inline]
+pub fn slice_at(chars: &[char], idx: &Value) -> Value {
+    let i = match idx {
+        Value::Number(n) => *n as i64,
+        _ => 0,
+    };
+    let resolved = if i < 0 { chars.len() as i64 + i } else { i };
+    if resolved >= 0 {
+        if let Some(c) = chars.get(resolved as usize) {
+            return Value::String(c.to_string().into());
+        }
+    }
+    Value::Null
+}
+
+/// `&str` `s[i]` — char at a non-negative integer `idx`; non-int / negative / OOB → null.
+/// Mirrors the `Value::String` arm of [`get_index`].
+#[inline]
+pub fn str_index(s: &str, idx: &Value) -> Value {
+    match idx {
+        Value::Number(n) if *n >= 0.0 && n.fract() == 0.0 => match s.chars().nth(*n as usize) {
+            Some(c) => Value::String(c.to_string().into()),
+            None => Value::Null,
+        },
+        _ => Value::Null,
+    }
+}
+
+/// `&str` `.length` — Unicode scalar (code point) count as f64. Mirrors `string::char_count`.
+#[inline]
+pub fn str_char_count(s: &str) -> f64 {
+    s.chars().count() as f64
+}
 pub fn string_repeat(s: &Value, count: &Value) -> Value {
     string_repeat_impl(s, count)
 }
@@ -233,69 +408,72 @@ pub mod ops {
     use tishlang_core::Value;
 
     #[inline]
-    pub fn add(left: &Value, right: &Value) -> Result<Value, Box<dyn std::error::Error>> {
+    // Arithmetic ops return a bare `Value` (not `Result`): they NEVER error — a non-number
+    // operand coerces to NaN, matching the VM's `eval_binop`. The former `Result<Value, Box<dyn
+    // Error>>` was vestigial and cost ~4× on the boxed path (memory-return + caller `.unwrap_or`;
+    // #201 measurement). Callers use the value directly (no suffix — see `ops_result_suffix`).
+    pub fn add(left: &Value, right: &Value) -> Value {
         match (left, right) {
-            (Value::Number(a), Value::Number(b)) => Ok(Value::Number(a + b)),
+            (Value::Number(a), Value::Number(b)) => Value::Number(a + b),
             (Value::String(a), Value::String(b)) => {
                 let mut s = String::with_capacity(a.len() + b.len());
                 s.push_str(a);
                 s.push_str(b);
-                Ok(Value::String(s.into()))
+                Value::String(s.into())
             }
             (Value::String(a), b) => {
                 let b_str = b.to_js_string();
                 let mut s = String::with_capacity(a.len() + b_str.len());
                 s.push_str(a);
                 s.push_str(&b_str);
-                Ok(Value::String(s.into()))
+                Value::String(s.into())
             }
             (a, Value::String(b)) => {
                 let a_str = a.to_js_string();
                 let mut s = String::with_capacity(a_str.len() + b.len());
                 s.push_str(&a_str);
                 s.push_str(b);
-                Ok(Value::String(s.into()))
+                Value::String(s.into())
             }
-            // Neither operand is a string here ⇒ numeric coercion, matching the VM's `eval_binop`
-            // (`as_number().unwrap_or(NaN)`): a null/bool/object operand (e.g. an out-of-bounds array
-            // read) coerces to NaN, so `number + null` is NaN — NOT an error that the codegen's
-            // `.unwrap_or(Value::Null)` would silently turn into `null` (the old rust-AOT divergence).
-            (a, b) => Ok(Value::Number(
+            // Neither operand is a string ⇒ numeric coercion, matching the VM's `eval_binop`
+            // (`as_number().unwrap_or(NaN)`): a null/bool/object operand (e.g. an out-of-bounds
+            // array read) coerces to NaN, so `number + null` is NaN. Never an error.
+            (a, b) => Value::Number(
                 a.as_number().unwrap_or(f64::NAN) + b.as_number().unwrap_or(f64::NAN),
-            )),
+            ),
         }
     }
 
     #[inline]
-    pub fn sub(left: &Value, right: &Value) -> Result<Value, Box<dyn std::error::Error>> {
+    pub fn sub(left: &Value, right: &Value) -> Value {
         match (left, right) {
-            (Value::Number(a), Value::Number(b)) => Ok(Value::Number(a - b)),
+            (Value::Number(a), Value::Number(b)) => Value::Number(a - b),
             // VM-parity numeric coercion (null/non-number → NaN), see `add`.
-            (a, b) => Ok(Value::Number(
+            (a, b) => Value::Number(
                 a.as_number().unwrap_or(f64::NAN) - b.as_number().unwrap_or(f64::NAN),
-            )),
+            ),
         }
     }
 
     #[inline]
-    pub fn mul(left: &Value, right: &Value) -> Result<Value, Box<dyn std::error::Error>> {
+    pub fn mul(left: &Value, right: &Value) -> Value {
         match (left, right) {
-            (Value::Number(a), Value::Number(b)) => Ok(Value::Number(a * b)),
+            (Value::Number(a), Value::Number(b)) => Value::Number(a * b),
             // VM-parity numeric coercion (null/non-number → NaN), see `add`.
-            (a, b) => Ok(Value::Number(
+            (a, b) => Value::Number(
                 a.as_number().unwrap_or(f64::NAN) * b.as_number().unwrap_or(f64::NAN),
-            )),
+            ),
         }
     }
 
     #[inline]
-    pub fn div(left: &Value, right: &Value) -> Result<Value, Box<dyn std::error::Error>> {
+    pub fn div(left: &Value, right: &Value) -> Value {
         match (left, right) {
-            (Value::Number(a), Value::Number(b)) => Ok(Value::Number(a / b)),
+            (Value::Number(a), Value::Number(b)) => Value::Number(a / b),
             // VM-parity numeric coercion (null/non-number → NaN), see `add`.
-            (a, b) => Ok(Value::Number(
+            (a, b) => Value::Number(
                 a.as_number().unwrap_or(f64::NAN) / b.as_number().unwrap_or(f64::NAN),
-            )),
+            ),
         }
     }
 
@@ -341,13 +519,13 @@ pub mod ops {
     }
 
     #[inline]
-    pub fn modulo(left: &Value, right: &Value) -> Result<Value, Box<dyn std::error::Error>> {
+    pub fn modulo(left: &Value, right: &Value) -> Value {
         match (left, right) {
-            (Value::Number(a), Value::Number(b)) => Ok(Value::Number(a % b)),
+            (Value::Number(a), Value::Number(b)) => Value::Number(a % b),
             // VM-parity numeric coercion (null/non-number → NaN), see `add`.
-            (a, b) => Ok(Value::Number(
+            (a, b) => Value::Number(
                 a.as_number().unwrap_or(f64::NAN) % b.as_number().unwrap_or(f64::NAN),
-            )),
+            ),
         }
     }
 }
@@ -370,7 +548,12 @@ use tishlang_core::{json_parse as core_json_parse, json_stringify as core_json_s
 /// from the runtime keeps the generated source decoupled from
 /// `tishlang_core` — generated code only ever names `tishlang_runtime`.
 pub mod json {
+    pub use tishlang_core::json_parse;
     pub use tishlang_core::json_stringify_into as stringify_into;
+    /// JS-correct number→JSON writer (NaN/Inf→`null`, integer fast path, else the
+    /// ECMAScript `Number::toString`). Used by codegen-emitted per-struct serialisers
+    /// (#315) for `number` fields, so their output matches `json_stringify_into` exactly.
+    pub use tishlang_core::write_json_number;
     /// Append the JSON-escaped contents of `s` (without surrounding
     /// quotes) to `buf`. Used by typed-struct serialisers for `String`
     /// fields. Falls through to `tishlang_core::json_stringify_into`'s
@@ -431,14 +614,107 @@ impl fmt::Display for TishError {
 
 impl std::error::Error for TishError {}
 
+// #303 — the pending-throw slot lives in `tishlang_core` so the shared array builtins
+// (`tishlang_builtins::array`) can poll it without a `builtins -> runtime` dependency cycle, and so
+// the VM shares the same slot. Re-export the accessors so the Rust emitted by `tishlang_compile`
+// keeps calling `tishlang_runtime::{set,has,take}_pending_throw`. See `tishlang_core` for the docs.
+pub use tishlang_core::{has_pending_throw, set_pending_throw, take_pending_throw};
+
+// #381 — the recursion-guard plumbing for generated native code. The depth counter lives in
+// `tishlang_core` beside the pending-throw slot; the entry point generated code uses is the
+// wrapper below, which adds the stack-pressure check the counter alone can't provide.
+pub use tishlang_core::{stack_overflow_error, CallDepthGuard};
+
+/// #381 — enter a boxed user-fn call frame, or trip the recursion guard. Emitted at the top of
+/// every generated user-fn closure. Trips on EITHER limit: the counted ceiling
+/// (`TISH_MAX_CALL_DEPTH`, default 20000 — parity with the interp/VM guards) or real stack
+/// pressure ([`stack_low`]) — boxed native frames are large enough that 20000 of them can exceed
+/// the stack before the counter does (the VM sidesteps this with `stacker::maybe_grow`; generated
+/// code has no stack growth, so pressure must be its own trigger). On trip: parks the catchable
+/// `RangeError` and returns `None`; the closure returns its dummy `Value::Null` and the throw
+/// surfaces at the caller's pending-throw checkpoint.
+#[inline]
+pub fn enter_call_guarded() -> Option<CallDepthGuard> {
+    if stack_low() {
+        set_pending_throw(stack_overflow_error());
+        return None;
+    }
+    tishlang_core::enter_call_guarded()
+}
+
+#[cfg(not(target_family = "wasm"))]
+thread_local! {
+    // The current thread's bail floor for guarded self-recursive native fns: the stack address below
+    // which recursion must stop (real stack bottom + headroom margin). 0 = not yet initialized.
+    // Thread-local because every thread's stack occupies a different address range. #381
+    static STACK_FLOOR: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Headroom left below the deepest allowed recursion level (#381): must cover the levels emitted
+/// between two guard checks (the rotation window), the bail path, and building/raising the
+/// `RangeError`. Mirrors the VM JIT tier's margin (`RECUR_STACK_MARGIN`).
+#[cfg(not(target_family = "wasm"))]
+const RECUR_STACK_MARGIN: usize = 256 * 1024;
+
+/// #381 — is the current thread's stack nearly exhausted? Emitted by the native backend at the
+/// entry of self-recursive typed fns (every K-th rotation copy), so unbounded numeric recursion
+/// bails into a catchable `RangeError` instead of overflowing the stack (an uncatchable abort).
+/// One thread-local read + pointer compare after first init; the margin is capped at half the
+/// remaining stack so a first call on an already-deep stack can't false-trip (limit stays below SP).
+#[cfg(not(target_family = "wasm"))]
+#[inline]
+pub fn stack_low() -> bool {
+    let anchor = 0u8;
+    let sp = &anchor as *const u8 as usize;
+    STACK_FLOOR.with(|c| {
+        let mut floor = c.get();
+        if floor == 0 {
+            // `None` (unknown bounds) → floor 1: SP can never be below it, guard never trips —
+            // same do-no-harm fallback as the VM JIT tier.
+            floor = match stacker::remaining_stack() {
+                Some(rem) => {
+                    let margin = RECUR_STACK_MARGIN.min(rem / 2);
+                    sp.saturating_sub(rem).saturating_add(margin).max(1)
+                }
+                None => 1,
+            };
+            c.set(floor);
+        }
+        sp < floor
+    })
+}
+
+/// Wasm: the sandbox traps on overflow (contained by design), and `stacker` has no wasm support —
+/// the guard compiles to a constant `false` so the emitted check folds away.
+#[cfg(target_family = "wasm")]
+#[inline]
+pub fn stack_low() -> bool {
+    false
+}
+
+/// #381 — the bail path for a tripped typed-fn recursion guard: park the catchable `RangeError`
+/// and return the NaN sentinel the f64 frame unwinds with. Typed native fns are pure numeric
+/// (no side effects), so the NaN propagates harmlessly until the first `Value`/`Result` frame's
+/// pending-throw checkpoint raises the error.
+#[cold]
+#[inline(never)]
+pub fn recursion_tripped_f64() -> f64 {
+    set_pending_throw(stack_overflow_error());
+    f64::NAN
+}
+
 /// Function-boundary unwind: convert a completion that escaped a function body's `Result`-closure
-/// back into the function's `Value`. A `return v` yields `v`; an uncaught `throw` panics (matching
-/// the behavior of a throw with no enclosing `try`); any other error panics.
+/// back into the function's `Value`. A `return v` yields `v`; an uncaught `throw` is stored in the
+/// pending-throw slot and the fn escapes with a dummy `Value` so the throw keeps propagating to the
+/// caller's post-call check (#303); any other error panics.
 pub fn fn_unwind(e: Box<dyn std::error::Error>) -> Value {
     match e.downcast::<TishError>() {
         Ok(te) => match *te {
             TishError::Return(v) => v,
-            TishError::Throw(v) => panic!("uncaught throw: {}", v.to_display_string()),
+            TishError::Throw(v) => {
+                set_pending_throw(v);
+                Value::Null
+            }
         },
         Err(orig) => panic!("error in native Tish: {:?}", orig),
     }
@@ -696,6 +972,48 @@ pub fn process_exec(args: &[Value]) -> Value {
     }
 }
 
+/// `process.execFile(program, [args])` — run a program directly, WITHOUT a shell (no `sh -c`). Each
+/// argument is passed to the program verbatim, so shell metacharacters in untrusted argument data are
+/// never interpreted — the safe counterpart to `exec` when arguments derive from input (#384). Returns
+/// the exit code, like `exec`.
+#[cfg(feature = "process")]
+pub fn process_exec_file(args: &[Value]) -> Value {
+    use std::process::Command;
+    let program = args
+        .first()
+        .map(|v| v.to_display_string())
+        .unwrap_or_default();
+    if program.is_empty() {
+        return Value::Number(0.0);
+    }
+    let argv: Vec<String> = match args.get(1) {
+        Some(Value::Array(a)) => a.borrow().iter().map(|v| v.to_display_string()).collect(),
+        _ => Vec::new(),
+    };
+    match Command::new(&program).args(&argv).status() {
+        Ok(status) => Value::Number(status.code().unwrap_or(1) as f64),
+        Err(_) => Value::Number(1.0),
+    }
+}
+
+#[cfg(all(test, feature = "process", unix))]
+mod execfile_tests_384 {
+    use super::process_exec_file;
+    use tishlang_core::{Value, VmRef};
+
+    #[test]
+    fn execfile_runs_without_shell_and_returns_exit_code() {
+        // Runs the program directly (no `sh -c`); `true`/`false`/`echo` exist on unix.
+        assert!(matches!(process_exec_file(&[Value::String("true".into())]), Value::Number(n) if n == 0.0));
+        assert!(matches!(process_exec_file(&[Value::String("false".into())]), Value::Number(n) if n == 1.0));
+        // args are passed verbatim as a Value::Array.
+        let args = Value::Array(VmRef::new(vec![Value::String("ok".into())]));
+        assert!(matches!(process_exec_file(&[Value::String("echo".into()), args]), Value::Number(n) if n == 0.0));
+        // empty program is a no-op returning 0, matching `exec`.
+        assert!(matches!(process_exec_file(&[]), Value::Number(n) if n == 0.0));
+    }
+}
+
 #[cfg(feature = "fs")]
 pub fn read_file(args: &[Value]) -> Value {
     let path = args
@@ -791,6 +1109,92 @@ pub fn mkdir(args: &[Value]) -> Value {
 
 use std::sync::Arc;
 
+/// Per-site polymorphic inline cache for `obj.<literal key>` reads in generated native code (#179).
+///
+/// The native backend otherwise pays a full dynamic lookup (RefCell/Mutex borrow + linear key scan)
+/// for every member read, even at sites that only ever see a few object shapes. `PropMap` already
+/// tracks a hidden-class [`ShapeId`] per object and exposes slot-indexed access, so once a
+/// `(shape, slot)` pair is observed at a site, a later object of the same shape resolves the property
+/// with one integer compare + a direct slot load instead of a key scan.
+///
+/// Each of the 8 entries packs `(shape: u32) << 32 | (slot: u32)` into a single `AtomicU64`, so the
+/// pair is read and written atomically — no torn `(shape, slot)` under concurrent access (e.g. an
+/// HTTP handler shared across worker threads). A 9th distinct shape evicts an entry round-robin. An
+/// empty entry is `0`; a real object never has `EMPTY_SHAPE` (0), so `0` can't be a false hit.
+pub struct PropIC {
+    entries: [std::sync::atomic::AtomicU64; 8],
+    next: std::sync::atomic::AtomicU32,
+}
+
+impl PropIC {
+    #[allow(clippy::declare_interior_mutable_const)] // each `static IC: PropIC = PropIC::new()` site needs its own cell
+    pub const fn new() -> Self {
+        use std::sync::atomic::{AtomicU32, AtomicU64};
+        PropIC {
+            entries: [
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+                AtomicU64::new(0),
+            ],
+            next: AtomicU32::new(0),
+        }
+    }
+}
+
+impl Default for PropIC {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Cached `obj.key` read — see [`PropIC`]. Behaviour is identical to [`get_prop`]: only objects with
+/// a stable hidden class (non-empty, non-dictionary) take the cached fast path; empty/dictionary
+/// objects, non-objects, and the special `size` key all fall through to `get_prop` (the borrow is
+/// released first, so the fallback's re-borrow can't self-deadlock the send-values `Mutex`). The
+/// caller (codegen) never emits this for the `size` key, but the fallback covers it regardless.
+#[inline]
+pub fn get_prop_ic(obj: &Value, key: &str, ic: &PropIC) -> Value {
+    use std::sync::atomic::Ordering;
+    if key != "size" {
+        if let Value::Object(map) = obj {
+            // Scope the borrow so it is released before the `get_prop` fallback below.
+            {
+                let b = map.borrow();
+                let shape = b.strings.shape();
+                if shape != tishlang_core::EMPTY_SHAPE && shape != tishlang_core::DICT_SHAPE {
+                    let shape_hi = (shape as u64) << 32;
+                    // Fast path: a cached entry whose shape matches gives the slot directly.
+                    for e in ic.entries.iter() {
+                        let packed = e.load(Ordering::Relaxed);
+                        if packed >> 32 == shape as u64 {
+                            if let Some(v) = b.strings.value_at_index((packed & 0xFFFF_FFFF) as usize)
+                            {
+                                return v.clone();
+                            }
+                        }
+                    }
+                    // Miss: resolve once, fill an entry round-robin with the packed (shape, slot).
+                    return match b.strings.get_with_index(key) {
+                        Some((v, i)) => {
+                            let k = (ic.next.fetch_add(1, Ordering::Relaxed) % 8) as usize;
+                            ic.entries[k].store(shape_hi | i as u64, Ordering::Relaxed);
+                            v.clone()
+                        }
+                        None => Value::Null,
+                    };
+                }
+                // empty / dictionary object → fall through (borrow dropped here)
+            }
+        }
+    }
+    get_prop(obj, key)
+}
+
 #[inline]
 pub fn get_prop(obj: &Value, key: impl AsRef<str>) -> Value {
     let key = key.as_ref();
@@ -832,7 +1236,7 @@ pub fn get_prop(obj: &Value, key: impl AsRef<str>) -> Value {
         }
         Value::String(s) => {
             if key == "length" {
-                Value::Number(s.chars().count() as f64)
+                Value::Number(tishlang_builtins::string::char_count(s) as f64)
             } else {
                 Value::Null
             }
@@ -885,6 +1289,15 @@ pub fn get_prop(obj: &Value, key: impl AsRef<str>) -> Value {
             }
             _ => Value::Null,
         },
+        // Reading a property of the nullish value is a JS TypeError. PARK a catchable throw (#425)
+        // and return the null sentinel; it surfaces at the next pending-throw checkpoint. This is the
+        // ONLY receiver that throws — a number/bool/function with no such property reads back `null`
+        // (JS `undefined`), matching the VM/interpreter/node. Free for valid reads: `Object` is matched
+        // first, so this cold arm never runs on the hot path.
+        Value::Null => {
+            tishlang_core::set_pending_throw(tishlang_core::cannot_read_property_error(key));
+            Value::Null
+        }
         _ => Value::Null,
     }
 }
@@ -910,11 +1323,11 @@ pub fn get_index(obj: &Value, index: &Value) -> Value {
         // `str[i]` returns the character at index `i` (issue #17) — matches the VM /
         // interpreter; out-of-bounds / negative / non-integer indices yield null.
         Value::String(s) => match index {
-            Value::Number(n) if *n >= 0.0 && n.fract() == 0.0 => s
-                .chars()
-                .nth(*n as usize)
-                .map(|c| Value::String(c.to_string().into()))
-                .unwrap_or(Value::Null),
+            Value::Number(n) if *n >= 0.0 && n.fract() == 0.0 => {
+                tishlang_builtins::string::nth_char(s, *n as usize)
+                    .map(|c| Value::String(c.to_string().into()))
+                    .unwrap_or(Value::Null)
+            }
             _ => Value::Null,
         },
         Value::Object(_) => tishlang_core::object_get(obj, index).unwrap_or(Value::Null),
@@ -925,6 +1338,16 @@ pub fn get_index(obj: &Value, index: &Value) -> Value {
             Value::String(k) => get_prop(obj, k.as_str()),
             _ => Value::Null,
         },
+        // Indexing the nullish value throws a catchable TypeError (#425), like `get_prop` above —
+        // parked and surfaced at the next checkpoint. Every other receiver reads back `null`.
+        Value::Null => {
+            let key = match index {
+                Value::String(s) => s.to_string(),
+                other => other.to_js_string(),
+            };
+            tishlang_core::set_pending_throw(tishlang_core::cannot_read_property_error(&key));
+            Value::Null
+        }
         _ => Value::Null,
     }
 }
@@ -1502,3 +1925,61 @@ pub fn string_search_regex(s: &Value, regexp: &Value) -> Value {
         _ => Value::Number(-1.0),
     }
 }
+
+#[cfg(test)]
+mod null_read_parking_tests_425 {
+    // Reading a property/index of the nullish value PARKS a catchable TypeError (#425) instead of
+    // silently reading back `null` — the native/runtime read paths. The throw surfaces at the caller's
+    // next pending-throw checkpoint. Every other receiver (number/bool/valid object/array) reads back
+    // a value with NO parked throw.
+    use super::{get_index, get_prop};
+    use tishlang_core::{has_pending_throw, take_pending_throw, Value, VmRef};
+
+    fn parked_name() -> Option<String> {
+        take_pending_throw().and_then(|v| {
+            if let Value::Object(o) = v {
+                if let Some(Value::String(s)) = o.borrow().strings.get("name") {
+                    return Some(s.to_string());
+                }
+            }
+            None
+        })
+    }
+
+    #[test]
+    fn get_prop_on_null_parks_type_error() {
+        let _ = take_pending_throw();
+        let r = get_prop(&Value::Null, "length");
+        assert!(matches!(r, Value::Null));
+        assert!(has_pending_throw());
+        assert_eq!(parked_name().as_deref(), Some("TypeError"));
+    }
+
+    #[test]
+    fn get_index_on_null_parks_type_error() {
+        let _ = take_pending_throw();
+        let r = get_index(&Value::Null, &Value::Number(0.0));
+        assert!(matches!(r, Value::Null));
+        assert!(has_pending_throw());
+        assert_eq!(parked_name().as_deref(), Some("TypeError"));
+    }
+
+    #[test]
+    fn valid_reads_do_not_park() {
+        let _ = take_pending_throw();
+        // object property, array index, and array length must NOT park a throw.
+        let obj = Value::object({
+            let mut m = tishlang_core::ObjectMap::default();
+            m.insert(std::sync::Arc::from("a"), Value::Number(42.0));
+            m
+        });
+        assert!(matches!(get_prop(&obj, "a"), Value::Number(n) if n == 42.0));
+        assert!(!has_pending_throw(), "valid property read must not park");
+        let arr = Value::Array(VmRef::new(vec![Value::Number(7.0)]));
+        assert!(matches!(get_index(&arr, &Value::Number(0.0)), Value::Number(n) if n == 7.0));
+        assert!(!has_pending_throw(), "valid index read must not park");
+        // a MISSING object property reads back null WITHOUT parking (JS `undefined`, not a throw).
+        assert!(matches!(get_prop(&obj, "missing"), Value::Null));
+        assert!(!has_pending_throw(), "missing property must not park");
+    }
+}