ata-validator 1.42.0 → 1.44.0

package/lib/levenshtein.js

@@ -1,7 +1,14 @@
 'use strict';
 
-// Bounded Levenshtein. Returns Infinity if distance > maxDistance.
-// Single-row DP. O(n*m) worst case but typical strings are <30 chars.
+// Bounded Levenshtein. Returns Infinity if distance > maxDistance (or, past
+// the bound, possibly some number greater than it; callers compare).
+//
+// Only the cells within the bound of the diagonal are computed: a path
+// through any other cell already costs more than the bound. A typo hint asks
+// with a bound of one or two and compares the missing name with every key
+// present, so a row is five cells instead of the whole key. Without a bound
+// the band is the whole row.
+//
 // Two rows of scratch, reused across calls. The function is not recursive
 // and the library is single-threaded, so nothing else is using them; growing
 // them once beats allocating two arrays on every comparison, which the
@@ -10,42 +17,47 @@ let scratchA = new Int32Array(64);
 let scratchB = new Int32Array(64);
 
 function levenshtein (a, b, maxDistance) {
-  const max = maxDistance == null ? Infinity : maxDistance;
   if (a === b) return 0;
-  if (Math.abs(a.length - b.length) > max) return Infinity;
-  if (a.length === 0) return b.length;
-  if (b.length === 0) return a.length;
-  if (scratchA.length < b.length + 1) {
-    scratchA = new Int32Array(b.length + 1);
-    scratchB = new Int32Array(b.length + 1);
+  const n = a.length;
+  const m = b.length;
+  const max = maxDistance == null || maxDistance > n + m ? n + m : maxDistance;
+  if (Math.abs(n - m) > max) return Infinity;
+  if (n === 0) return m;
+  if (m === 0) return n;
+  const big = max + 1;
+  if (scratchA.length < m + 2) {
+    scratchA = new Int32Array(m + 2);
+    scratchB = new Int32Array(m + 2);
   }
   let prev = scratchA;
   let curr = scratchB;
-  const bn = b.length;
-  for (let j = 0; j <= bn; j++) prev[j] = j;
-  for (let i = 1; i <= a.length; i++) {
-    curr[0] = i;
-    let rowMin = i;
+  for (let j = 0; j <= m; j++) prev[j] = j <= max ? j : big;
+  for (let i = 1; i <= n; i++) {
+    const lo = i - max > 1 ? i - max : 1;
+    const hi = i + max < m ? i + max : m;
+    curr[lo - 1] = lo === 1 ? i : big;
+    let rowMin = curr[lo - 1];
     // charCodeAt rather than indexing: reading a character by index allocates
     // a one-character string, and this is the innermost loop.
     const ca = a.charCodeAt(i - 1);
-    for (let j = 1; j <= bn; j++) {
-      const cost = ca === b.charCodeAt(j - 1) ? 0 : 1;
-      let m = prev[j - 1] + cost;
+    for (let j = lo; j <= hi; j++) {
+      let v = prev[j - 1] + (ca === b.charCodeAt(j - 1) ? 0 : 1);
       const del = curr[j - 1] + 1;
-      if (del < m) m = del;
+      if (del < v) v = del;
       const ins = prev[j] + 1;
-      if (ins < m) m = ins;
-      curr[j] = m;
-      if (m < rowMin) rowMin = m;
+      if (ins < v) v = ins;
+      if (v > big) v = big;
+      curr[j] = v;
+      if (v < rowMin) rowMin = v;
     }
+    if (hi < m) curr[hi + 1] = big;
     if (rowMin > max) return Infinity;
     // A destructured swap builds an array per row; a temporary does not.
     const t = prev;
     prev = curr;
     curr = t;
   }
-  return prev[bn];
+  return prev[m] > max ? Infinity : prev[m];
 }
 
 module.exports = { levenshtein };

package/lib/native-positions.js

@@ -0,0 +1,100 @@
+'use strict';
+
+// The entries buildTargetedPositionMap gives, found by the native addon where
+// it can: simdjson indexes the document's structure once and walks that
+// index to each pointer, where the script walk reads every character. On a
+// 5 MB log with the error near its end that is 3.1 ms against 8.3. Only for
+// a large ASCII string, where the addon's UTF-8 byte offsets are the string's
+// indexes, and only when every wanted pointer is found; otherwise null, and
+// the caller builds the map in script as before.
+const NATIVE_MIN = 32 * 1024;
+let _native;
+function nativeTargeted (text, wanted) {
+  if (typeof text !== 'string' || text.length < NATIVE_MIN) return null;
+  if (_native === undefined) {
+    try { _native = require('./native-load')(); } catch { _native = null; }
+    if (_native && typeof _native.locatePointers !== 'function') _native = null;
+  }
+  if (_native === null || typeof Buffer === 'undefined' || Buffer.byteLength(text, 'utf8') !== text.length) return null;
+  const ptrs = Array.from(wanted);
+  let found;
+  try { found = _native.locatePointers(text, ptrs); } catch { return null; }
+  const offs = [];
+  for (let k = 0; k < ptrs.length; k++) {
+    if (!(found[2 * k] >= 0)) return null;
+    offs.push(found[2 * k]);
+  }
+  // Line starts for the offsets that are asked about, in one forward pass.
+  const needed = [];
+  for (let k = 0; k < ptrs.length; k++) {
+    needed.push(offs[k]);
+    const ks = keyStartBefore(text, offs[k]);
+    if (ks >= 0) needed.push(ks);
+  }
+  const lineOf = lineFinder(text, needed);
+  const map = Object.create(null);
+  for (let k = 0; k < ptrs.length; k++) {
+    const off = offs[k];
+    const at = lineOf(off);
+    const entry = { byteOffset: off, length: found[2 * k + 1], line: at.line, col: off - at.start + 1, text: at.text };
+    const ks = keyStartBefore(text, off);
+    if (ks >= 0 && ptrs[k] !== '') {
+      const kat = lineOf(ks);
+      entry.keyOffset = ks;
+      entry.keyLength = keyEndAfter(text, ks) - ks + 1;
+      entry.keyLine = kat.line;
+      entry.keyCol = ks - kat.start + 1;
+    }
+    map[ptrs[k]] = entry;
+  }
+  return map;
+}
+
+// The opening quote of the member name before a value at `off`, or -1 where
+// the value is an array element or the root.
+function keyStartBefore (text, off) {
+  let j = off - 1;
+  while (j >= 0) { const c = text.charCodeAt(j); if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) j--; else break; }
+  if (j < 0 || text.charCodeAt(j) !== 0x3a) return -1;
+  j--;
+  while (j >= 0) { const c = text.charCodeAt(j); if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) j--; else break; }
+  if (j < 0 || text.charCodeAt(j) !== 0x22) return -1;
+  // Back to the quote that opens the name: one not preceded by an odd run of
+  // backslashes.
+  for (let q = j - 1; q >= 0; q--) {
+    if (text.charCodeAt(q) !== 0x22) continue;
+    let b = q - 1;
+    while (b >= 0 && text.charCodeAt(b) === 0x5c) b--;
+    if (((q - 1 - b) & 1) === 0) return q;
+  }
+  return -1;
+}
+function keyEndAfter (text, start) {
+  let q = start + 1;
+  for (;;) {
+    const c = text.charCodeAt(q);
+    if (c === 0x5c) { q += 2; continue; }
+    if (c === 0x22 || q >= text.length) return q;
+    q++;
+  }
+}
+// Line number, line start and line text for any of `offsets`, from one pass.
+function lineFinder (text, offsets) {
+  const sorted = Array.from(new Set(offsets)).sort((a, b) => a - b);
+  const info = new Map();
+  let line = 1, start = 0, s = 0;
+  while (s < sorted.length) {
+    const nl = text.indexOf('\n', start);
+    const end = nl === -1 ? text.length : nl;
+    while (s < sorted.length && sorted[s] <= end) {
+      info.set(sorted[s], { line, start, text: text.slice(start, end) });
+      s++;
+    }
+    if (nl === -1) break;
+    line++;
+    start = nl + 1;
+  }
+  return (off) => info.get(off);
+}
+
+module.exports = { nativeTargeted };

package/lib/rejections.js

@@ -133,13 +133,18 @@ Object.defineProperty(RichRejection.prototype, 'errors', {
 // touches none of it. The JSON text is held here rather than read back off the
 // validator, so the result does not depend on what the instance does next.
 class LazyJsonRejection {
-  constructor(result, jsonStr, self, enrich) {
+  // `parsed`, when given, is the document the inner path parsed from
+  // `jsonStr` and validated, after defaults, coercion and removal: reading the
+  // errors uses it instead of parsing the text again, which on a 5 MB
+  // document was a third of what reading them cost.
+  constructor(result, jsonStr, self, enrich, parsed) {
     this.valid = false;
     this._result = result;
     this._jsonStr = jsonStr;
     this._self = self;
     this._enrich = enrich;
     this._cached = null;
+    this._parsed = parsed;
   }
   toJSON() {
     return { valid: false, errors: this.errors };
@@ -159,12 +164,14 @@ Object.defineProperty(LazyJsonRejection.prototype, 'errors', {
 
     // The enrich pass plucks `received` from the value tree and the suggestion
     // engine (required-typo, format hints, coercion nudges) walks it too.
-    let parsedData;
-    try { parsedData = JSON.parse(jsonStr); } catch { parsedData = undefined; }
-    // What was checked is the document after defaults, coercion and removal,
-    // so `received` has to come from that, as it does for validate(). A
-    // default that failed its own schema has no value in the text at all.
-    if (parsedData !== undefined && self._preprocess) self._preprocess(parsedData);
+    let parsedData = this._parsed;
+    if (parsedData === undefined) {
+      try { parsedData = JSON.parse(jsonStr); } catch { parsedData = undefined; }
+      // What was checked is the document after defaults, coercion and removal,
+      // so `received` has to come from that, as it does for validate(). A
+      // default that failed its own schema has no value in the text at all.
+      if (parsedData !== undefined && self._preprocess) self._preprocess(parsedData);
+    }
 
     // Errors the inner path already enriched carry a `received` key: enrich()
     // always sets one, even when there is no value to show. `code` is not a

package/lib/scan-compiler.js

@@ -90,6 +90,22 @@ const BASE_CHANGING = new Set(['$id', '$anchor', '$dynamicAnchor', '$dynamicRef'
 // it. Sized for a node per declared property of a large generated schema,
 // not just for hand-written ones.
 const MAX_NODES = 8192;
+// See the size checks in compileScanner. One function past 64 KB is what V8's
+// Maglev tier aborted on: SchemaStore scanners of 0.5 to 1 MB, single
+// functions before references became calls. The total bounds the memory a
+// scanner takes.
+const MAX_FUNCTION_SOURCE = 64 * 1024;
+const MAX_SOURCE = 2 * 1024 * 1024;
+// A reference target is expanded at each reference while its expansions
+// together are at most this much source, and called otherwise.
+const INLINE_REF_MAX = 4096;
+// An object member whose scan is more than this much source is moved into a
+// function of its own (emitMember).
+const SPLIT_MIN = 4 * 1024;
+// The member source an object keeps inline before the rest move out.
+const SPLIT_OBJECT = 16 * 1024;
+// Declared names at least this long on average find a key's end with indexOf.
+const INDEX_KEY_MIN_AVG = 10;
 
 // Each position in a tuple emits its own branch inside the element loop, so a
 // long one is both a lot of source and a linear test per element.
@@ -155,9 +171,19 @@ function resolveLocalRef(root, ref) {
   if (ref === '#') return root;
   if (!ref.startsWith('#/')) decline('$ref:not-local');
   let node = root;
+  let first = true;
   for (const rawToken of ref.slice(2).split('/')) {
-    const token = decodeURIComponent(rawToken).split('~1').join('/').split('~0').join('~');
+    let token = decodeURIComponent(rawToken).split('~1').join('/').split('~0').join('~');
     if (node === null || typeof node !== 'object') decline('$ref:unresolved');
+    // Draft 7 schemas reach the scanner with `definitions` renamed to `$defs`
+    // (lib/draft7.js) and their references as written; the other engines
+    // read either name, and so does this. Without it no draft 7 schema that
+    // used a definition got a scanner.
+    if (first && node === root && !Array.isArray(node) && !Object.prototype.hasOwnProperty.call(node, token)) {
+      if (token === 'definitions' && Object.prototype.hasOwnProperty.call(node, '$defs')) token = '$defs';
+      else if (token === '$defs' && Object.prototype.hasOwnProperty.call(node, 'definitions')) token = 'definitions';
+    }
+    first = false;
     if (Array.isArray(node)) {
       if (!/^\d+$/.test(token)) decline('$ref:unresolved');
       node = node[Number(token)];
@@ -387,11 +413,45 @@ function spanHash(name) {
 // is a jump table.
 const HASH_DISPATCH_MIN = 48;
 
+// The scan is first emitted as one function with every reference expanded
+// where it is used, which is the fastest form: a call per member measured
+// about twice the cost of csslintrc's scan, a small enum referenced thirty
+// times. Only when a function would pass MAX_FUNCTION_SOURCE is it emitted
+// again with large reference targets and large object members moved into
+// functions of their own, so the source grows with the schema rather than
+// with the number of references to it.
 function compileScanner(schema, options) {
   const opts = options || {};
+  const whole = build(schema, opts, false);
+  if (whole !== null || declineReason !== 'size') return finish(whole, opts);
+  return finish(build(schema, opts, true), opts);
+}
+
+function finish(built, opts) {
+  if (built === null) {
+    if (opts.onDecline) opts.onDecline(declineReason);
+    return null;
+  }
+  const { ctx, body } = built;
+  let fn;
+  try {
+    // eslint-disable-next-line no-new-func
+    fn = new Function('_h', '_r', ctx.subSource.join('\n') + '\nreturn function scan(s){\n' + body + '\n}')(ctx.helpers, require('./scan-runtime'));
+  } catch {
+    return null; // a runtime without code generation has no scanner, by design
+  }
+  return { scan: fn, source: body, helpers: ctx.helpers.length, functions: [body, ...ctx.subSource] };
+}
+
+function build(schema, opts, split) {
   const ctx = {
     uid: 0, helpers: [], userFormats: opts.userFormats || null,
     root: schema, refStack: [], nodes: 0,
+    // With `split`, reference targets map to null when expanded in place,
+    // else to the name of the function in subSource that scans one (see the
+    // $ref case in emitValue), and large members move out too (emitMember).
+    split, subs: new Map(), subSource: [], refCounts: split ? countRefs(schema) : null,
+    inlineBytes: new Map(),
   };
   declineReason = null;
   let body;
@@ -404,21 +464,19 @@ function compileScanner(schema, options) {
     out.push('if(i<len)return 0;');
     out.push('return 1;');
     body = out.join('\n');
+    // A function this large is a cost of its own, and V8's Maglev tier
+    // aborted the process compiling scanners of 500 KB and more (traefik,
+    // detekt from SchemaStore), in plain JavaScript, on Node 24 and 25, after
+    // about a hundred calls. Unsplit, past the bound the scan is emitted
+    // split; split, past either bound the schema has no scanner and the text
+    // path parses as it does without one.
+    if (body.length > MAX_FUNCTION_SOURCE || ctx.subSource.some((x) => x.length > MAX_FUNCTION_SOURCE)) decline('size');
+    if (body.length + ctx.subSource.reduce((n, x) => n + x.length, 0) > MAX_SOURCE) decline('size');
   } catch (e) {
-    if (e === DECLINE) {
-      if (opts.onDecline) opts.onDecline(declineReason);
-      return null;
-    }
+    if (e === DECLINE) return null;
     throw e;
   }
-  let fn;
-  try {
-    // eslint-disable-next-line no-new-func
-    fn = new Function('_h', '_r', 'return function scan(s){\n' + body + '\n}')(ctx.helpers, require('./scan-runtime'));
-  } catch {
-    return null; // a runtime without code generation has no scanner, by design
-  }
-  return { scan: fn, source: body, helpers: ctx.helpers.length };
+  return { ctx, body };
 }
 
 function emitValue(schema, ctx, out, depth) {
@@ -443,9 +501,51 @@ function emitValue(schema, ctx, out, depth) {
     const ref = schema.$ref;
     if (ctx.refStack.includes(ref)) decline('$ref:recursive');
     const target = resolveLocalRef(ctx.root, ref);
+    if (!ctx.split) {
+      ctx.refStack.push(ref);
+      emitValue(target, ctx, out, depth);
+      ctx.refStack.pop();
+      return;
+    }
+    // Split (see compileScanner): a target whose expansions add up to more
+    // than a little source is emitted once, as a function of its own, and
+    // called wherever it is referenced. Expanded at every reference, the
+    // source grows with the number of references rather than with the
+    // schema: SchemaStore's traefik and detekt reach the same definitions
+    // from hundreds of places, and their scanners came to 0.5 to 1 MB, which
+    // V8's Maglev tier aborted the process compiling.
+    const sub = ctx.subs.get(target);
+    if (sub !== undefined) {
+      if (sub === null) {
+        ctx.refStack.push(ref);
+        emitValue(target, ctx, out, depth);
+        ctx.refStack.pop();
+      } else {
+        emitSubCall(sub, ctx, out);
+      }
+      return;
+    }
+    const body = [];
     ctx.refStack.push(ref);
-    emitValue(target, ctx, out, depth);
+    emitValue(target, ctx, body, depth);
     ctx.refStack.pop();
+    const text = body.join('\n');
+    // Expanded in place only while all its expansions together stay small:
+    // a small definition referenced from hundreds of places is source in
+    // hundreds of places.
+    if (text.length * (ctx.refCounts.get(ref) || 1) <= INLINE_REF_MAX) {
+      ctx.subs.set(target, null);
+      for (const line of body) out.push(line);
+      return;
+    }
+    const name = '_s' + (ctx.subSource.length + ctx.subs.size + ctx.uid++);
+    ctx.subs.set(target, name);
+    // The emitted scan of a value starts with `i` at its first character and
+    // `c` holding it, and ends with `i` past it; it answers 0 (invalid) or -1
+    // (bail) by returning. Here it returns the new position instead, which is
+    // at least 1, so the three cannot be confused.
+    ctx.subSource.push('function ' + name + '(s,i){var len=s.length,c=s.charCodeAt(i);\n' + text + '\nreturn i;}');
+    emitSubCall(name, ctx, out);
     return;
   }
 
@@ -478,6 +578,12 @@ function emitValue(schema, ctx, out, depth) {
   // present, not that it lists anything.
   let compositeAllowed = true;
   let compositeDelegate = null;
+  // The kinds the listed values have. A value of any other kind equals none
+  // of them, so its branch is left out and the value falls to the final
+  // `return 0`: csslintrc's `enum: [2, true, false]` used to scan strings
+  // only to reject them, at thirty references, and the dead branches alone
+  // pushed its scan past the size bound into calls.
+  let listedKinds = null;
   if (has('const') || has('enum')) {
     compositeAllowed = false;
     const listed = [];
@@ -486,6 +592,7 @@ function emitValue(schema, ctx, out, depth) {
       if (!Array.isArray(schema.enum)) decline('enum:not-array');
       for (const v of schema.enum) listed.push(v);
     }
+    listedKinds = new Set(listed.map((v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v)));
     // An object or an array can only be compared as a whole. The scan steps
     // over that one subtree, parses its own text, and hands it to the check
     // the validator itself runs, so the document around it is still never
@@ -508,7 +615,7 @@ function emitValue(schema, ctx, out, depth) {
       + 'if(!' + compositeDelegate + '(_cv' + k + '))return 0;'
       + 'i=_ce' + k + ';c=s.charCodeAt(i);'];
   };
-  if (allows(types, 'object')) {
+  if (allows(types, 'object') && (listedKinds === null || listedKinds.has('object'))) {
     if (compositeDelegate) branches.push(['c===123', compositeBranch()]);
     else if (!compositeAllowed) branches.push(['c===123', ['return 0;']]);
     else {
@@ -517,7 +624,7 @@ function emitValue(schema, ctx, out, depth) {
       branches.push(['c===123', b]);
     }
   }
-  if (allows(types, 'array')) {
+  if (allows(types, 'array') && (listedKinds === null || listedKinds.has('array'))) {
     if (compositeDelegate) branches.push(['c===91', compositeBranch()]);
     else if (!compositeAllowed) branches.push(['c===91', ['return 0;']]);
     else {
@@ -526,22 +633,22 @@ function emitValue(schema, ctx, out, depth) {
       branches.push(['c===91', b]);
     }
   }
-  if (allows(types, 'string')) {
+  if (allows(types, 'string') && (listedKinds === null || listedKinds.has('string'))) {
     const b = [];
     emitString(schema, ctx, b);
     branches.push(['c===34', b]);
   }
-  if (allows(types, 'number')) {
+  if (allows(types, 'number') && (listedKinds === null || listedKinds.has('number'))) {
     const b = [];
     emitNumber(schema, ctx, b, types);
     branches.push(['c===45||(c>=48&&c<=57)', b]);
   }
-  if (allows(types, 'boolean')) {
+  if (allows(types, 'boolean') && (listedKinds === null || listedKinds.has('boolean'))) {
     const b = [];
     emitLiteral(schema, ctx, b, 'boolean');
     branches.push(['c===116||c===102', b]);
   }
-  if (allows(types, 'null')) {
+  if (allows(types, 'null') && (listedKinds === null || listedKinds.has('null'))) {
     const b = [];
     emitLiteral(schema, ctx, b, 'null');
     branches.push(['c===110', b]);
@@ -558,6 +665,42 @@ function emitValue(schema, ctx, out, depth) {
   out.push(parts.join('\n'));
 }
 
+// How many times each `$ref` string occurs in the schema, for the expand or
+// call decision. Schema positions and other values alike: a string that is not
+// a reference is never looked up.
+function countRefs(root) {
+  const counts = new Map();
+  const seen = new Set();
+  const walk = (n) => {
+    if (n === null || typeof n !== 'object' || seen.has(n)) return;
+    seen.add(n);
+    if (Array.isArray(n)) { for (const x of n) walk(x); return; }
+    if (typeof n.$ref === 'string') counts.set(n.$ref, (counts.get(n.$ref) || 0) + 1);
+    for (const k of Object.keys(n)) walk(n[k]);
+  };
+  walk(root);
+  return counts;
+}
+
+// A name with no character a JSON string would have to escape, so its raw
+// text in a document is the name itself.
+function plainName(name) {
+  for (let k = 0; k < name.length; k++) {
+    const c = name.charCodeAt(k);
+    if (c < 32 || c === 34 || c === 92) return false;
+  }
+  return true;
+}
+
+// A call answers invalid with the literal `return 0;`, as inline code does:
+// an object member rewrites that text into its own failure path, which goes on
+// scanning (a later duplicate key can replace the value), and a different
+// spelling would end the whole scan instead.
+function emitSubCall(name, ctx, out) {
+  const r = '_rq' + (ctx.uid++);
+  out.push('{var ' + r + '=' + name + '(s,i);if(' + r + '===-1)return -1;if(' + r + '===0)return 0;i=' + r + ';c=s.charCodeAt(i);}');
+}
+
 // Any JSON value, validated as JSON and stepped over.
 function emitSkip(out) {
   out.push('{var _j=_r.skipValue(s,i);if(_j===-2)return -1;if(_j<0)return 0;i=_j;c=s.charCodeAt(i);}');
@@ -749,8 +892,27 @@ function emitArray(schema, ctx, out, depth) {
 // the rule reaches nested objects: an inner object's own verdict is a value
 // failure at the level above it.
 function emitMember(sub, ctx, out, depth, objId) {
-  const lines = [];
+  let lines = [];
   emitValue(sub, ctx, lines, depth + 1);
+  // A large member value becomes a function of its own, so no one function
+  // grows with the whole schema: detekt nests hundreds of rule objects inline,
+  // no references involved. The value's code keeps its own labels and
+  // variables, so it moves as it is; the call answers invalid with
+  // `return 0;`, which the rewrite below turns into this member's failure.
+  // An object's members are judged together as well as one by one: thirty
+  // members just under SPLIT_MIN each would stay inline and add up to a
+  // function past the bound, so once the members kept inline in this object
+  // pass SPLIT_OBJECT, the rest move out whatever their size.
+  const size = lines.join('\n').length;
+  const kept = ctx.split ? (ctx.inlineBytes.get(objId) || 0) : 0;
+  if (ctx.split && (size > SPLIT_MIN || kept + size > SPLIT_OBJECT)) {
+    const name = '_s' + (ctx.subSource.length + ctx.subs.size + ctx.uid++);
+    ctx.subSource.push('function ' + name + '(s,i){var len=s.length,c=s.charCodeAt(i);\n' + lines.join('\n') + '\nreturn i;}');
+    lines = [];
+    emitSubCall(name, ctx, lines);
+  } else if (ctx.split) {
+    ctx.inlineBytes.set(objId, kept + size);
+  }
   const body = lines.join('\n');
   if (!body.includes('return 0;')) { out.push(body); return; }
   const label = '_mb' + (ctx.uid++);
@@ -828,10 +990,32 @@ function emitObject(schema, ctx, out, depth) {
       hashById = '_h[' + (ctx.helpers.length - 1) + ']';
     }
   }
-  emitStringSpan(ctx, out, kn, false, hashById !== null);
-  // A key written with an escape decodes to a name the raw span does not show,
-  // so the dispatch below would read it as a different property.
-  out.push('if(_x' + kn + ')return -1;');
+  // A key's end is found with indexOf, which is native, where the character
+  // loop below costs three compares a character: on csslintrc's 35 keys of
+  // twenty-odd characters the loop was most of the scan and made it slower
+  // than parsing. Every declared name is plain text, so a key that compares
+  // equal to one, character by character, is that name as written, and a
+  // key that does not is checked for an escape or a control character before
+  // it is read as additional. Either one bails, and so does a span that ends
+  // on a backslash, since that quote may be escaped: the parser decides what
+  // the key really is.
+  // indexOf costs about the same whatever the key's length, the loop about a
+  // nanosecond a character: on short keys the loop wins (problem-object's
+  // `type`, `title`, `status` measured 10 to 15 percent slower by indexOf),
+  // and from ten characters indexOf wins by 40 percent and more, so the
+  // choice follows the declared names' average length.
+  const indexKey = !useHash && names.length > 0 && names.every(plainName)
+    && names.reduce((n, x) => n + x.length, 0) >= INDEX_KEY_MIN_AVG * names.length;
+  if (indexKey) {
+    // A quote with a backslash before it may be escaped, and then the key
+    // goes on past it: bail before reading what follows as the colon.
+    out.push('var _p' + kn + '=++i,_e' + kn + '=s.indexOf(\'"\',i);if(_e' + kn + '<0)return 0;if(s.charCodeAt(_e' + kn + '-1)===92)return -1;i=_e' + kn + ';c=s.charCodeAt(++i);');
+  } else {
+    emitStringSpan(ctx, out, kn, false, hashById !== null);
+    // A key written with an escape decodes to a name the raw span does not
+    // show, so the dispatch below would read it as a different property.
+    out.push('if(_x' + kn + ')return -1;');
+  }
   out.push(WS);
   out.push('if(c!==58)return 0;');
   out.push('c=s.charCodeAt(++i);');
@@ -958,6 +1142,7 @@ function emitObject(schema, ctx, out, depth) {
     additional.push(lines.join('\n').split('return 0;').join('return -1;'));
   }
 
+  if (indexKey) additional.unshift('if(!_r.plainKey(s,_p' + kn + ',_e' + kn + '))return -1;');
   out.push('switch(_kl' + kn + '){');
   for (const [len, group] of byLen) {
     out.push('case ' + len + ':{');

package/lib/scan-runtime.js

@@ -155,4 +155,16 @@ function span(s, p, e, escaped) {
   return JSON.parse(s.slice(p - 1, e + 1));
 }
 
-module.exports = { hex4, skipValue, skipString, skipNumber, span, MALFORMED, TOO_DEEP, MAX_SKIP_DEPTH };
+// Whether the raw text of a key between `p` and `e` is its name as written:
+// no escape, no control character. A scanner that found the key's end with
+// indexOf calls this for a name it did not recognise; one it recognised was
+// compared character by character against a name that has neither.
+function plainKey(s, p, e) {
+  for (let k = p; k < e; k++) {
+    const c = s.charCodeAt(k);
+    if (c < 32 || c === 92) return false;
+  }
+  return true;
+}
+
+module.exports = { hex4, skipValue, skipString, skipNumber, span, plainKey, MALFORMED, TOO_DEEP, MAX_SKIP_DEPTH };