ata-validator 1.50.0 → 1.52.0

package/lib/js-compiler.js

@@ -36,7 +36,7 @@ function uqSources () {
 // that would have written them.
 const SHARED_RT = {
   _deqHoisted: ['_deq'], _peHoisted: ['_pe'],
-  _own_PN: ['_PN', '_OP', '_gp'], _own_hop: ['_hop'], _own_h: ['_h'], _own_ok: ['_ok'], _own_hall: ['_hall'],
+  _own_PN: ['_PN', '_OP', '_gp'], _own_hop: ['_hop'], _own_h: ['_h'], _own_ok: ['_ok'], _own_hall: ['_hall'], _own_nk: ['_nk'],
 }
 let _rt = null
 function sharedRt () { return _rt || (_rt = require('./combined-runtime')) }
@@ -96,8 +96,8 @@ function apMembershipCheck (ctx, names, v) {
     }
   }
   // With nothing declared every key is additional; `if()` would not parse.
-  if (names.length === 0) return `for(var _k in ${v})return false`
-  return `for(var _k in ${v})if(${names.map((k) => `_k!==${JSON.stringify(k)}`).join('&&')})return false`
+  if (names.length === 0) return `for(var _k in ${v})if(${ownFail(ctx, v)})return false`
+  return `for(var _k in ${v})if(${names.map((k) => `_k!==${JSON.stringify(k)}`).join('&&')}&&${ownFail(ctx, v)})return false`
 }
 
 function emitDeq(ctx) {
@@ -907,8 +907,9 @@ const OWN_HELPER_CODE = {
   _h: 'function _h(o,k){return _hop.call(o,k)}',
   _ok: 'function _ok(o,k){return (_PN?o.__proto__:_gp(o))===_OP||_hop.call(o,k)}',
   _hall: 'function _hall(o,ks){for(let i=0;i<ks.length;i++)if(!_hop.call(o,ks[i]))return false;return true}',
+  _nk: 'function _nk(o,n){return (_PN?o.__proto__:_gp(o))===_OP||Object.keys(o).length!==n}',
 }
-const OWN_HELPER_DEPS = { _h: ['_hop'], _ok: ['_PN', '_hop'], _hall: ['_hop'] }
+const OWN_HELPER_DEPS = { _h: ['_hop'], _ok: ['_PN', '_hop'], _hall: ['_hop'], _nk: ['_PN'] }
 function useOwnHelper (ctx, name) {
   for (const dep of OWN_HELPER_DEPS[name] || []) useOwnHelper(ctx, dep)
   hoistOnce(ctx, '_own' + name, OWN_HELPER_CODE[name])
@@ -1208,6 +1209,17 @@ function propFnCandidate (prop, ctx) {
 // inline after all": an empty body (the inline path then asserts it the
 // usual way) or one that calls the recursive entry, which is out of scope
 // in the preamble.
+// Generates a body that will become a function of its own in the preamble.
+// The ordinary-object flags withPlain declared belong to the function being
+// written now and are out of scope there; a hoisted body takes the same
+// parameter names (`d`, `_av`, `_ov`) and would otherwise read a flag the
+// enclosing node declared for a value of that name.
+function genIsolated (ctx, run) {
+  const outerPlain = ctx.plainOf
+  ctx.plainOf = undefined
+  try { return run() } finally { ctx.plainOf = outerPlain }
+}
+
 function emitPropFn (prop, ctx) {
   const bodyLines = []
   const outerDeferred = ctx.deferredChecks
@@ -1216,7 +1228,7 @@ function emitPropFn (prop, ctx) {
   ctx.plainReuse = undefined
   const outerBytes = ctx.fnBytes
   ctx.fnBytes = 0
-  try { genCode(prop, 'd', bodyLines, ctx) } finally { ctx.plainReuse = outerReuse; ctx.fnBytes = outerBytes }
+  try { genIsolated(ctx, () => genCode(prop, 'd', bodyLines, ctx)) } finally { ctx.plainReuse = outerReuse; ctx.fnBytes = outerBytes }
   if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
   ctx.deferredChecks = outerDeferred
   if (bodyLines.length === 0 || bodyLines.some((l) => /\b_validate\b/.test(l))) return null
@@ -1341,6 +1353,54 @@ function sharedDefNames (root, defs) {
 // known trade: on that shape the shared function costs 27 ns a call.
 const SHARED_DEF_MIN_CHARS = 120
 
+// A small definition applied at many places is called with objects of many
+// shapes, one or two per place, and V8 gives a function's property reads up
+// to four shapes before it falls back to a generic lookup several times
+// slower: SchemaStore's detekt sends 72 shapes through one four-property rule
+// definition. Such a definition is emitted as several functions with the same
+// body, each serving at most SITES_PER_COPY references, so every copy stays
+// within four shapes. Only small bodies are copied, so the source grows by a
+// bounded amount; a large or rarely referenced definition keeps one function.
+const SITES_PER_COPY = 4
+const COPY_MIN_SITES = 16
+const COPY_MAX_BODY = 1500
+function sharedDefCopy (ctx, defName, fnName) {
+  const body = ctx.sharedDefBody && ctx.sharedDefBody.get(fnName)
+  if (body === undefined || body.length > COPY_MAX_BODY) return fnName
+  // Only a definition that reads properties gains: a string, a number or a
+  // wrapper around another reference has no shapes to keep apart, and more
+  // copies only mean more functions to warm up.
+  const def = ctx.rootDefs && ctx.rootDefs[defName]
+  if (def === null || typeof def !== 'object' || typeof def.properties !== 'object' || def.properties === null) return fnName
+  if (!ctx.sharedDefSites) ctx.sharedDefSites = new Map()
+  if (ctx.sharedDefSiteCounts === undefined) ctx.sharedDefSiteCounts = refCounts(ctx.rootSchema)
+  if ((ctx.sharedDefSiteCounts.get(defName) || 0) < COPY_MIN_SITES) return fnName
+  const site = ctx.sharedDefSites.get(fnName) || 0
+  ctx.sharedDefSites.set(fnName, site + 1)
+  const copy = Math.floor(site / SITES_PER_COPY)
+  if (copy === 0) return fnName
+  const name = `${fnName}_c${copy}`
+  if (site % SITES_PER_COPY === 0) hoist(ctx, `function ${name}(d){${body}\n  return true}`)
+  return name
+}
+
+// How many `$ref`s name each local definition, by name.
+function refCounts (root) {
+  const counts = new Map()
+  const seen = new WeakSet()
+  const walk = (node) => {
+    if (node === null || typeof node !== 'object' || seen.has(node)) return
+    seen.add(node)
+    if (typeof node.$ref === 'string') {
+      const m = /^#\/(?:\$defs|definitions)\/([^/]+)$/.exec(node.$ref)
+      if (m) counts.set(m[1], (counts.get(m[1]) || 0) + 1)
+    }
+    for (const v of Object.values(node)) walk(v)
+  }
+  walk(root)
+  return counts
+}
+
 function cyclicDefNames (defs) {
   const out = new Set()
   if (!defs || typeof defs !== 'object') return out
@@ -3419,7 +3479,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
       if (allRequired && propCount > 0) {
         // Adaptive: for-in for <=15 keys (V8 fast path), Object.keys for >15
         if (propCount <= 15) {
-          lines.push(`var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount})return false`)
+          lines.push(`var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount}&&${ownCountOff(ctx, v, propCount, plainFlag(ctx, v))})return false`)
         } else {
           lines.push(`if(Object.keys(${v}).length!==${propCount})return false`)
         }
@@ -3534,7 +3594,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   if (schema.additionalProperties === false && schema.properties && !schema.patternProperties && ctx.removeNodes && ctx.removeNodes.has(schema)) {
     const kv = `_rk${ctx.varCounter++}`
     const declared = Object.keys(schema.properties)
-    let loop = `for(var ${kv} in ${v})if(${declared.map((k) => `${kv}!==${JSON.stringify(k)}`).join('&&')})delete ${v}[${kv}]`
+    let loop = `${ownHead(ctx, v, kv, 'var')}if(${declared.map((k) => `${kv}!==${JSON.stringify(k)}`).join('&&')})delete ${v}[${kv}]`
     // When every declared property is required, the verdict has already
     // established they are all there, so a key count equal to the declared
     // count means nothing is extra and the deleting walk, which compares every
@@ -3542,7 +3602,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
     const req = new Set(schema.required || [])
     if (declared.length <= 15 && declared.every((k) => req.has(k))) {
       const n = `_rn${ctx.varCounter++}`
-      loop = `{var ${n}=0;for(var ${kv} in ${v})${n}++;if(${n}!==${declared.length}){${loop}}}`
+      loop = `{var ${n}=0;${ownHead(ctx, v, kv, 'var')}${n}++;if(${n}!==${declared.length}){${loop}}}`
     }
     _deferOrInline(ctx, lines, v, isObj ? loop : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${loop}}`)
   } else if (schema.additionalProperties === false && !schema.patternProperties) {
@@ -3559,7 +3619,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
     const allRequired = !!schema.required && declaredKeys.every((k) => req.has(k))
     const inner = allRequired
       ? (propCount <= 15
-          ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount})return false`
+          ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount}&&${ownCountOff(ctx, v, propCount, plainFlag(ctx, v))})return false`
           : `if(Object.keys(${v}).length!==${propCount})return false`)
       : apMembershipCheck(ctx, Object.keys(schema.properties || {}), v)
         _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
@@ -3590,8 +3650,8 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   // propertyNames: false rejects any key at all; true constrains nothing.
   if (schema.propertyNames === false) {
     lines.push(isObj
-      ? `for(const _k in ${v})return false`
-      : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){for(const _k in ${v})return false}`)
+      ? `${ownHead(ctx, v, `_k`, 'const')}return false`
+      : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${ownHead(ctx, v, `_k`, 'const')}return false}`)
   }
 
   // propertyNames — only emit if not already merged into patternProperties loop
@@ -3779,8 +3839,8 @@ function genAdditionalSchemaNode(schema, v, lines, ctx, knownType, isObj) {
   if (subLines.length > 0) {
     const body = subLines.join(';')
     const loop = skipCheck
-      ? `for(var ${kVar} in ${v}){if(${skipCheck})continue;const ${avVar}=${v}[${kVar}];${body}}`
-      : `for(var ${kVar} in ${v}){const ${avVar}=${v}[${kVar}];${body}}`
+      ? `${ownHead(ctx, v, kVar, 'var')}{if(${skipCheck})continue;const ${avVar}=${v}[${kVar}];${body}}`
+      : `${ownHead(ctx, v, kVar, 'var')}{const ${avVar}=${v}[${kVar}];${body}}`
     _deferOrInline(ctx, lines, v, isObj ? loop : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${loop}}`)
   }
 }
@@ -3804,10 +3864,10 @@ function genPropertyNamesNode(schema, v, lines, ctx, knownType, isObj) {
     const sub = []
     genCode(pn, '_pv', sub, ctx)
     if (sub.length === 0) return
-    lines.push(`${guard}{const _pnf${ki}=function(_pv){${sub.join(';')};return true};for(const _k${ki} in ${v}){if(!_pnf${ki}(_k${ki}))return false}}`)
+    lines.push(`${guard}{const _pnf${ki}=function(_pv){${sub.join(';')};return true};${ownHead(ctx, v, `_k${ki}`, 'const')}{if(!_pnf${ki}(_k${ki}))return false}}`)
     return
   }
-  lines.push(`${guard}{for(const _k${ki} in ${v}){`)
+  lines.push(`${guard}{${ownHead(ctx, v, `_k${ki}`, 'const')}{`)
   if (pn.minLength !== undefined) lines.push(`if(_k${ki}.length<${pn.minLength})return false`)
   if (pn.maxLength !== undefined) lines.push(`if(_k${ki}.length>${pn.maxLength})return false`)
   if (pn.pattern) {
@@ -3878,7 +3938,8 @@ function genAnyOfNode(schema, v, lines, ctx, knownType) {
       continue
     }
     const subLines = []
-    genCode(sub, '_av', subLines, ctx)
+    if (canHoist) genIsolated(ctx, () => genCode(sub, '_av', subLines, ctx))
+    else genCode(sub, '_av', subLines, ctx)
     const body = subLines.length === 0 ? 'return true' : `${subLines.join(';')};return true`
     if (/\b_validate\b/.test(body)) canHoist = false
     branchBodies.push(body)
@@ -3916,6 +3977,35 @@ function branchKey (sub, ctx) {
   return sub
 }
 
+// A oneOf whose branches each allow only their own properties, the way
+// Traefik's middlewares and many tagged unions are written: every branch is
+// `{ properties: {...}, additionalProperties: false }` (an object `type` and
+// annotations aside), and no property belongs to two branches. Then an
+// object passes a branch only if every key it has is that branch's, so its
+// first key names the one branch that can pass, and an object with no keys
+// passes all of them. Returns the branch index per property name, or null.
+const KEYED_BRANCH_KEYS = new Set(['properties', 'additionalProperties', 'type', 'title', 'description', '$comment'])
+function keyedBranches (branches) {
+  if (branches.length < 4) return null
+  const owner = new Map()
+  for (let i = 0; i < branches.length; i++) {
+    const b = branches[i]
+    if (typeof b !== 'object' || b === null || Array.isArray(b)) return null
+    for (const k of Object.keys(b)) if (!KEYED_BRANCH_KEYS.has(k)) return null
+    if (b.additionalProperties !== false) return null
+    if (b.type !== undefined && b.type !== 'object') return null
+    const props = b.properties
+    if (typeof props !== 'object' || props === null || Array.isArray(props)) return null
+    const names = Object.keys(props)
+    if (names.length === 0) return null
+    for (const n of names) {
+      if (owner.has(n)) return null
+      owner.set(n, i)
+    }
+  }
+  return owner
+}
+
 function genOneOfNode(schema, v, lines, ctx, knownType) {
   const fi = ctx.varCounter++
   const branchBodies = []
@@ -3939,7 +4029,8 @@ function genOneOfNode(schema, v, lines, ctx, knownType) {
       continue
     }
     const subLines = []
-    genCode(sub, '_ov', subLines, ctx)
+    if (canHoist) genIsolated(ctx, () => genCode(sub, '_ov', subLines, ctx))
+    else genCode(sub, '_ov', subLines, ctx)
     const body = subLines.length === 0 ? 'return true' : `${subLines.join(';')};return true`
     // _validate is the recursive entry — hoisting branches above it breaks scope.
     if (/\b_validate\b/.test(body)) canHoist = false
@@ -3955,6 +4046,17 @@ function genOneOfNode(schema, v, lines, ctx, knownType) {
       return name
     })
     const calls = names.map(n => `if(${n}(${v})){_oc${fi}++;if(_oc${fi}>1)return false}`).join(';')
+    const owner = keyedBranches(schema.oneOf)
+    if (owner !== null) {
+      // An object goes to the branch its first key names; anything else, and
+      // an object with no keys, takes the loop over every branch.
+      const entries = [...owner].map(([k, i]) => `[${JSON.stringify(k)},${names[i]}]`).join(',')
+      hoist(ctx, `const _ofm${fi}=new Map([${entries}])`)
+      lines.push(`{let _ofk${fi};if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${ownHead(ctx, v, '_q', 'const')}{_ofk${fi}=_q;break}}` +
+        `if(_ofk${fi}!==undefined){const _ob${fi}=_ofm${fi}.get(_ofk${fi});if(_ob${fi}===undefined||!_ob${fi}(${v}))return false}` +
+        `else{let _oc${fi}=0;${calls};if(_oc${fi}!==1)return false}}`)
+      return
+    }
     lines.push(`{let _oc${fi}=0;${calls};if(_oc${fi}!==1)return false}`)
   } else {
     const fns = branchBodies.map(body => `function(_ov){${body}}`)
@@ -4032,7 +4134,7 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
         ctx.deferredChecks = null
         const outerReuse = ctx.plainReuse
         ctx.plainReuse = undefined
-        try { genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx) } finally { ctx.plainReuse = outerReuse }
+        try { genIsolated(ctx, () => genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)) } finally { ctx.plainReuse = outerReuse }
         if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
         ctx.deferredChecks = outerDeferred
         // The def is hoisted above the entry function, where the recursive
@@ -4070,7 +4172,7 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
         const outerReuse = ctx.plainReuse
         ctx.plainReuse = undefined
         try {
-          genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)
+          genIsolated(ctx, () => genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx))
         } finally {
           ctx.refStack.delete(schema.$ref)
           ctx.plainReuse = outerReuse
@@ -4078,9 +4180,12 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
         if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
         ctx.deferredChecks = outerDeferred
         if (bodyLines.some((l) => /\b_validate\b/.test(l))) throw DECLINE
-        hoist(ctx, `function ${fnName}(d){${bodyLines.join('\n  ')}\n  return true}`)
+        const body = bodyLines.join('\n  ')
+        hoist(ctx, `function ${fnName}(d){${body}\n  return true}`)
+        if (!ctx.sharedDefBody) ctx.sharedDefBody = new Map()
+        ctx.sharedDefBody.set(fnName, body)
       }
-      lines.push(`if(!${fnName}(${v}))return false`)
+      lines.push(`if(!${sharedDefCopy(ctx, defName, fnName)}(${v}))return false`)
       if (!hasSiblings) return true
     } else if (ctx.refStack.has(schema.$ref)) { if (ctx.nestedBoolean) throw DECLINE; if (!hasSiblings) return true }
     else {
@@ -4177,7 +4282,7 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
       genCode(apSchema, `_apv${pi}`, apLines, ctx)
       apCheck = apLines.join(';')
     }
-    lines.push(`${guard}{for(const ${kVar} in ${v}){`)
+    lines.push(`${guard}{${ownHead(ctx, v, kVar, 'const')}{`)
     // propertyNames checks (merged into same loop)
     if (pn) {
       if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${pn.minLength})return false`)
@@ -4228,7 +4333,7 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
   } else {
     // No additionalProperties: validate matching keys + propertyNames
     handledPropertyNames = !!pn
-    lines.push(`${guard}{for(const ${kVar} in ${v}){`)
+    lines.push(`${guard}{${ownHead(ctx, v, kVar, 'const')}{`)
     // propertyNames checks (merged)
     if (pn) {
       if (pn.minLength !== undefined) lines.push(`if(${kVar}.length<${pn.minLength})return false`)
@@ -4307,7 +4412,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         if (!earlyKeyCount) {
           // Adaptive: for-in for <=15 keys, Object.keys for >15
           inner = propCount <= 15
-            ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount})return false`
+            ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount}&&${ownCountOff(ctx, v, propCount, plainFlag(ctx, v))})return false`
             : `if(Object.keys(${v}).length!==${propCount})return false`
                       _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
         }
@@ -4320,10 +4425,10 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         // document. The hoisted name lookup is the same cure it was there.
         inner = propCount >= AP_LOOKUP_MIN
           ? apMembershipCheck(ctx, knownKeys, v)
-          : genCharCodeSwitch(knownKeys, v)
+          : genCharCodeSwitch(knownKeys, v, ctx)
                   _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
       } else {
-        inner = `for(var _k in ${v})return false`
+        inner = `for(var _k in ${v})if(${ownFail(ctx, v)})return false`
                   _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
       }
     } else if (typeof schema.unevaluatedProperties === 'object') {
@@ -4341,7 +4446,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         } else if (knownKeys.length > 0) {
           skipKnown = `if(${knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')})continue;`
         }
-        const inner = `for(var ${ukVar} in ${v}){${skipKnown}${check}}`
+        const inner = `${ownHead(ctx, v, ukVar, 'var')}{${skipKnown}${check}}`
                   _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
       }
     }
@@ -4386,8 +4491,8 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
         const uniqueThen = [...new Set([...baseProps, ...ifProps, ...(thenEval.props || [])])]
         const uniqueElse = [...new Set([...baseProps, ...(elseEval.props || [])])]
 
-        const thenCheck = genCharCodeSwitch(uniqueThen, v)
-        const elseCheck = genCharCodeSwitch(uniqueElse, v)
+        const thenCheck = genCharCodeSwitch(uniqueThen, v, ctx)
+        const elseCheck = genCharCodeSwitch(uniqueElse, v, ctx)
         const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
         lines.push(`${guard}{const _uif${ufi}=${ifFn2};if(_uif${ufi}(${v})){${thenCheck}}else{${elseCheck}}}`)
       } else if (branchKeyword) {
@@ -4458,8 +4563,8 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
           }
           const dynamicCheck = `switch(_k.charCodeAt(0)){${switchCases}default:break}`
           const inner = staticCheck
-            ? `for(var _k in ${v}){if(${staticCheck})continue;${dynamicCheck}return false}`
-            : `for(var _k in ${v}){${dynamicCheck}return false}`
+            ? `for(var _k in ${v}){if(${staticCheck})continue;${dynamicCheck}if(${ownFail(ctx, v)})return false}`
+            : `for(var _k in ${v}){${dynamicCheck}if(${ownFail(ctx, v)})return false}`
                       _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
         } else {
           // Fallback: plain object tracking
@@ -4484,7 +4589,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
             // Single pass: validate anyOf (at least one) + track all matching
             lines.push(`let _am${bfi}=false;for(let _bi=0;_bi<_bf${bfi}.length;_bi++){if(_bf${bfi}[_bi](${v})){_am${bfi}=true;for(const _p of _bk${bfi}[_bi])${evVar}[_p]=1}}if(!_am${bfi})return false`)
           }
-          const inner = `for(var _k in ${v}){if(!${evVar}[_k])return false}`
+          const inner = `for(var _k in ${v}){if(!${evVar}[_k]&&${ownFail(ctx, v)})return false}`
                       _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
         }
       } else if (schema.dependentSchemas) {
@@ -4499,7 +4604,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
             lines.push(`if(${ownKeyExpr(ctx, v, trigger)}){${depResult.props.map(k => `${evVar}[${JSON.stringify(k)}]=1`).join(';')}}`)
           }
         }
-        const inner = `for(var _k in ${v}){if(!${evVar}[_k])return false}`
+        const inner = `for(var _k in ${v}){if(!${evVar}[_k]&&${ownFail(ctx, v)})return false}`
                   _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
       } else {
         // General fallback: collect all patternProperties from root + allOf sub-schemas + if
@@ -4559,10 +4664,10 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
             }
             const rootPatCheck = rootReVars.map(rv => `if(${rv}.test(_k))continue;`).join('')
             const ifPatCheck = ifReVars.map(rv => `if(${rv}.test(_k))continue;`).join('')
-            const inner = `const _uif${ufi}=${ifFn};if(_uif${ufi}(${v})){for(var _k in ${v}){if(${evVar}[_k])continue;${rootPatCheck}${ifPatCheck}return false}}else{for(var _k in ${v}){if(${evVar}[_k])continue;${rootPatCheck}return false}}`
+            const inner = `const _uif${ufi}=${ifFn};if(_uif${ufi}(${v})){for(var _k in ${v}){if(${evVar}[_k])continue;${rootPatCheck}${ifPatCheck}if(${ownFail(ctx, v)})return false}}else{for(var _k in ${v}){if(${evVar}[_k])continue;${rootPatCheck}if(${ownFail(ctx, v)})return false}}`
                           _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
           } else {
-            const inner = `for(var _k in ${v}){if(${evVar}[_k])continue;${reVars.map(rv => `if(${rv}.test(_k)){${evVar}[_k]=1;continue}`).join('')}return false}`
+            const inner = `for(var _k in ${v}){if(${evVar}[_k])continue;${reVars.map(rv => `if(${rv}.test(_k)){${evVar}[_k]=1;continue}`).join('')}if(${ownFail(ctx, v)})return false}`
                           _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
           }
         } else {
@@ -4573,7 +4678,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
           const evVar = `_ev${ei}`
           lines.push(`{const ${evVar}={}`)
           for (const k of baseProps) lines.push(`${evVar}[${JSON.stringify(k)}]=1`)
-          const inner = `for(var _k in ${v}){if(!${evVar}[_k])return false}`
+          const inner = `for(var _k in ${v}){if(!${evVar}[_k]&&${ownFail(ctx, v)})return false}`
           _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
         }
       }
@@ -4613,7 +4718,7 @@ function genUnevaluatedPropertiesNode(schema, v, lines, ctx, knownType, isObj, h
       genCode(schema.unevaluatedProperties, `${v}[${ukVar}]`, subLines2, ctx)
       if (subLines2.length > 0) {
         const check = subLines2.join(';')
-        const inner = `for(var ${ukVar} in ${v}){if(${evVar}[${ukVar}])continue;${check}}`
+        const inner = `${ownHead(ctx, v, ukVar, 'var')}{if(${evVar}[${ukVar}])continue;${check}}`
                   _deferOrInline(ctx, lines, v, isObj ? inner + '}' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}}`)
       } else {
         lines.push('}')
@@ -5051,13 +5156,57 @@ function fastPrefixCheck(pattern, keyVar) {
   return `${keyVar}.startsWith(${JSON.stringify(prefix)})`
 }
 
+// The head of a loop over the own enumerable keys of `v`, written as
+// `for...in`, the fast way to walk an object, which also visits enumerable
+// keys its prototype carries. An ordinary object's prototype is
+// Object.prototype, and its keys are taken as they come; any other object, a
+// class instance or one made with Object.create, has each key checked as its
+// own, as the interpreter reads them. One statement, so the body that follows
+// is written as it was: `for(var _k in v)if(...)continue;else BODY`.
+// For a loop whose only work is to reject on a key it does not expect: the
+// key is the object's own, or the object is ordinary, whose prototype's keys
+// are taken as they come. Read only on the way to `return false`, so an
+// object that has only expected keys pays nothing.
+// `_ok` reads the prototype rather than the node's flag: this check can land
+// in a hoisted branch function the flag is not declared in.
+function ownFail (ctx, v, k = '_k') {
+  useOwnHelper(ctx, '_ok')
+  return `_ok(${v},${k})`
+}
+// For a key count that came out wrong: whether it is wrong counting own keys
+// only. An ordinary object's count stands; any other object is counted again.
+// A oneOf of closed objects fails its other branches here on every value, so
+// this is not only a cold path.
+function ownCountOff (ctx, v, n, pk) {
+  // A call to a shared helper rather than the test written in place: a oneOf
+  // branch this small is inlined into its caller by V8, and the longer
+  // bytecode cost that, 8% on a document of patch operations. The node's
+  // ordinary-object flag is not used: this can land in a hoisted branch
+  // function it is not declared in.
+  useOwnHelper(ctx, '_nk')
+  // `pk`: the node's own ordinary-object flag, where the caller holds it in
+  // the same function as this check. An ordinary object needs no recount.
+  return pk ? `(${pk}||_nk(${v},${n}))` : `_nk(${v},${n})`
+}
+
+function ownHead (ctx, v, k = '_k', kind = 'var') {
+  useOwnHelper(ctx, '_hop')
+  // Read here rather than taken from the node's flag: generated bodies that
+  // become functions of their own (branches, annotations, definitions) take
+  // the same parameter names and do not see the flag. Written in place, not
+  // through a shared helper, which would see every object shape of the
+  // document and read the prototype megamorphically: 7% on validate().
+  const i = ctx.varCounter++
+  return `var _pl${i}=${v}!==null&&typeof ${v}==='object'&&${protoIs(ctx, v)};for(${kind} ${k} in ${v})if(!_pl${i}&&!_hop.call(${v},${k}))continue;else `
+}
+
 // Generate a charCodeAt(0)-based switch tree for fast key validation.
 // V8 compiles switch to jump tables — O(1) dispatch vs O(n) chain.
-function genCharCodeSwitch(keys, v) {
-  if (keys.length === 0) return `for(var _k in ${v})return false`
+function genCharCodeSwitch(keys, v, ctx) {
+  if (keys.length === 0) return `for(var _k in ${v})if(${ownFail(ctx, v)})return false`
   if (keys.length <= 3) {
     // Small set: simple chain is faster than switch overhead
-    return `for(var _k in ${v})if(${keys.map(k => `_k!==${JSON.stringify(k)}`).join('&&')})return false`
+    return `for(var _k in ${v})if(${keys.map(k => `_k!==${JSON.stringify(k)}`).join('&&')}&&${ownFail(ctx, v)})return false`
   }
 
   // Group keys by first charCode
@@ -5074,7 +5223,7 @@ function genCharCodeSwitch(keys, v) {
     cases += `case ${cc}:if(${cond})continue;break;`
   }
 
-  return `for(var _k in ${v}){switch(_k.charCodeAt(0)){${cases}default:break}return false}`
+  return `for(var _k in ${v}){switch(_k.charCodeAt(0)){${cases}default:break}if(${ownFail(ctx, v)})return false}`
 }
 
 // The verdict form of genUnevaluatedDynamicC: the same set, built the same
@@ -5120,7 +5269,7 @@ function genUnevalDynamicVerdict(schema, v, lines, ctx, isObj, nonObjApplicators
 // additionalProperties is there.
 function addLocalAnnotations(node, v, S, out, ctx) {
   if (node.additionalProperties !== undefined) {
-    out.push(`for(const _ka in ${v})${S}.push(_ka)`)
+    out.push(`${ownHead(ctx, v, `_ka`, 'const')}${S}.push(_ka)`)
     return
   }
   for (const k of Object.keys(node.properties || {})) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${S}.push(${JSON.stringify(k)})`)
@@ -5136,7 +5285,7 @@ function addLocalAnnotations(node, v, S, out, ctx) {
       ctx.closureVals.push(safeReClosure(ctx, pat))
       tests.push(`_re${ri}.test(${kv})`)
     }
-    out.push(`for(const ${kv} in ${v})if(${tests.join('||')})${S}.push(${kv})`)
+    out.push(`${ownHead(ctx, v, kv, 'const')}if(${tests.join('||')})${S}.push(${kv})`)
   }
 }
 
@@ -5419,4 +5568,4 @@ Object.defineProperty(module.exports, '_expandDynamicScopes', { value: expandDyn
 // For tests/test_custom_keyword_codegen.js, which holds these copies to the interpreter's.
 Object.defineProperty(module.exports, '_kwTypeBits', { value: { kwTypeBit, kwDataBits, KW_T_ANY }, enumerable: false })
 
-module.exports._internal = { hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun }
+module.exports._internal = { ownHead, hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun }

package/lib/safe-regex.js

@@ -381,6 +381,24 @@ function __ataSafeRegex () {
     const states = []
     const stateIds = new Map()
     let overflow = false
+    // Transitions in one flat table per end flag, 128 slots per state (ASCII),
+    // -2 for not computed yet, -1 for overflow; `flags` holds isMatch (1) and
+    // dead (2) per state. The loop below then reads two typed arrays per
+    // character instead of a state object and the tables hanging off it. The
+    // tables grow with the states, so a pattern with few states stays small.
+    // State ids stay below MAX_STATES, so 16 bits hold them and the two
+    // sentinels: half the memory of the per-state tables this replaced.
+    let cap = 0
+    let trans = new Int16Array(0)
+    let transEnd = new Int16Array(0)
+    let flags = new Uint8Array(0)
+    function grow () {
+      const next = cap === 0 ? 2 : cap * 2
+      const t = new Int16Array(next * 128).fill(-2); t.set(trans); trans = t
+      const te = new Int16Array(next * 128).fill(-2); te.set(transEnd); transEnd = te
+      const f = new Uint8Array(next); f.set(flags); flags = f
+      cap = next
+    }
 
     function closure (list, count, pc, atStart, atEnd) {
       // Same walk as addThread, with the position replaced by the two flags.
@@ -411,7 +429,9 @@ function __ataSafeRegex () {
       let isMatch = false
       for (let k = 0; k < pcs.length; k++) if (ops[pcs[k]] === OP_MATCH) { isMatch = true; break }
       // `dead`: an anchored match with no thread left cannot recover.
-      states.push({ pcs: Int32Array.from(pcs), isMatch, dead: anchored && pcs.length === 0, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })
+      states.push({ pcs: Int32Array.from(pcs) })
+      if (id >= cap) grow()
+      flags[id] = (isMatch ? 1 : 0) | (anchored && pcs.length === 0 ? 2 : 0)
       stateIds.set(key, id)
       return id
     }
@@ -452,37 +472,36 @@ function __ataSafeRegex () {
         id = startNonEmpty
       }
       if (id < 0) return testNFA(s)
-      let state = states[id]
-      if (len === 0) return state.isMatch
+      if (len === 0) return (flags[id] & 1) === 1
       // The last character is stepped with the end-of-input flag set and is
       // handled after the loop, so the loop body selects no table and tests
       // no position.
       const last = len - 1
       for (let pos = 0; pos < last; pos++) {
-        if (state.isMatch) return true
+        if ((flags[id] & 1) === 1) return true
         const c = s.charCodeAt(pos)
         let nid
         if (c < 128) {
-          nid = state.next[c]
-          if (nid === -2) { nid = step(state, c, false); state.next[c] = nid }
+          nid = trans[(id << 7) | c]
+          if (nid === -2) { nid = step(states[id], c, false); if (nid >= 0 || overflow) trans[(id << 7) | c] = nid }
         } else {
-          nid = step(state, c, false)
+          nid = step(states[id], c, false)
         }
         if (nid < 0) return testNFA(s)
-        state = states[nid]
-        if (state.dead) return false
+        id = nid
+        if ((flags[id] & 2) === 2) return false
       }
-      if (state.isMatch) return true
+      if ((flags[id] & 1) === 1) return true
       const c = s.charCodeAt(last)
       let nid
       if (c < 128) {
-        nid = state.nextEnd[c]
-        if (nid === -2) { nid = step(state, c, true); state.nextEnd[c] = nid }
+        nid = transEnd[(id << 7) | c]
+        if (nid === -2) { nid = step(states[id], c, true); if (nid >= 0 || overflow) transEnd[(id << 7) | c] = nid }
       } else {
-        nid = step(state, c, true)
+        nid = step(states[id], c, true)
       }
       if (nid < 0) return testNFA(s)
-      return states[nid].isMatch
+      return (flags[nid] & 1) === 1
     }
 
     return function test (s) {