visaljs 0.0.6 → 0.0.8

package/runtime/include/js_atoms.h

@@ -1,5 +1,5 @@
 /*
- * js_atoms.h — atoms: interned strings (ADR 0003).
+ * js_atoms.h — atoms: interned strings.
  *
  * An atom is the unique flat string (flag JS_STR_ATOM) for its content, so
  * property keys compare by pointer. The table is weak: an atom nothing else

package/runtime/include/js_bigint.h

@@ -1,5 +1,5 @@
 /*
- * js_bigint.h — BigInt values (ECMAScript §6.1.6.2; ADR 0016).
+ * js_bigint.h — BigInt values (ECMAScript §6.1.6.2).
  *
  * A BigInt is a heap cell holding its value in two's complement limbs, least significant first,
  * normalized to the fewest limbs that hold it (QuickJS's representation). The arithmetic lives in

package/runtime/include/js_buffer.h

@@ -1,6 +1,6 @@
 /*
- * js_buffer.h — ArrayBuffer and DataView (ECMAScript §25.1, §25.3), the binary data component
- * (ADR 0014). The layout is here so that core code can read a buffer without linking the
+ * js_buffer.h — ArrayBuffer and DataView (ECMAScript §25.1, §25.3), the binary data component.
+ * The layout is here so that core code can read a buffer without linking the
  * component (util.inspect prints its bytes) and so that typed arrays can share it.
  */
 #ifndef JS_BUFFER_H
@@ -33,7 +33,7 @@ typedef struct JSDataView {
 } JSDataView;
 
 /* Typed array element types, in the spec's table order (§23.2, Table 71). The BigInt ones
- * arrive with BigInt (ADR 0016). JS_TYPED_ARRAY_TYPES (jscontext.h) counts them. */
+ * arrive with BigInt. JS_TYPED_ARRAY_TYPES (jscontext.h) counts them. */
 typedef enum JSTypedArrayType {
     JS_TA_INT8, JS_TA_UINT8, JS_TA_UINT8C, JS_TA_INT16, JS_TA_UINT16, JS_TA_INT32, JS_TA_UINT32,
     JS_TA_BIGINT64, JS_TA_BIGUINT64, JS_TA_FLOAT16, JS_TA_FLOAT32, JS_TA_FLOAT64,
@@ -65,7 +65,7 @@ JS_WARN_UNUSED int js_array_buffer_detach(JSContext *ctx, JSValue buffer);
 /* A new, zeroed ArrayBuffer of `length` bytes (%ArrayBuffer.prototype%); JS_EXCEPTION when it can't be allocated. */
 JS_WARN_UNUSED JSValue js_new_array_buffer(JSContext *ctx, size_t length);
 
-/* For the components that take or make bytes (TextDecoder, structuredClone; ADR 0012). These are
+/* For the components that take or make bytes (TextDecoder, structuredClone). These are
  * the typedarray component's: a component that calls them needs it. */
 /* The bytes of an ArrayBuffer, a typed array or a DataView (a view's current window; none when
  * it is out of bounds or its buffer is detached): true, or false for any other value. */

package/runtime/include/js_builtins.h

@@ -1,5 +1,5 @@
 /*
- * js_builtins.h — built-ins as tables, grouped in components (ADR 0014).
+ * js_builtins.h — built-ins as tables, grouped in components.
  *
  * A built-in object is a constant table of entries; js_define_builtins defines them with the
  * attributes the spec gives built-ins. Optional built-ins come in components that a program
@@ -85,7 +85,7 @@ void js_install_recorded_components(JSContext *ctx);
 typedef enum JSCoreTarget {
     JS_CORE_OBJECT, JS_CORE_OBJECT_PROTO, JS_CORE_ARRAY, JS_CORE_ARRAY_PROTO, JS_CORE_STRING, JS_CORE_STRING_PROTO,
     JS_CORE_NUMBER, JS_CORE_NUMBER_PROTO, JS_CORE_GLOBAL,
-    JS_CORE_CONSOLE,  /* the host's console (ADR 0012): installed by js_new_console, not by realm setup */
+    JS_CORE_CONSOLE,  /* the host's console: installed by js_new_console, not by realm setup */
     JS_CORE_TARGET_COUNT
 } JSCoreTarget;
 
@@ -159,7 +159,7 @@ extern const JSComponent js_component_typedarray;
 extern const JSComponent js_component_date;
 extern const JSComponent js_component_regexp;
 extern const JSComponent js_component_bigint;
-/* the web-standard host layer (ADR 0012, layer 2) */
+/* the web-standard host layer */
 extern const JSComponent js_component_domexception;
 extern const JSComponent js_component_encoding;
 extern const JSComponent js_component_base64;
@@ -181,4 +181,42 @@ extern const size_t js_all_components_count;
 /* Records them all for the realms js_context_new creates next (the runtime's unit tests). */
 void js_use_all_components(JSRuntime *rt);
 
+/* ---- Generated code's inline built-in calls --------------------------------------------- */
+
+/* A string's units without allocating: flat, a flattened rope, or a slice; else false. */
+static inline bool js_string_units(JSValue s, JSStrView *out) {
+    JSCell *c = js_as_cell(s);
+    if (c->kind == JS_CELL_STR_ROPE) {
+        JSRope *r = (JSRope *)c;
+        if (!js_is_empty(r->right)) return false;  /* not flattened yet */
+        c = js_as_cell(r->left);
+    }
+    const JSSlice *slice = c->kind == JS_CELL_STR_SLICE ? (const JSSlice *)c : NULL;
+    if (slice) c = js_as_cell(slice->parent);
+    if (c->kind != JS_CELL_STR_FLAT) return false;
+    JSString *f = (JSString *)c;
+    uint32_t offset = slice ? slice->offset : 0, length = slice ? slice->length : f->length;
+    bool latin1 = (f->cell.flags & JS_STR_LATIN1) != 0;
+    *out = (JSStrView){ latin1 ? (const void *)(f->chars.latin1 + offset) : (const void *)(f->chars.utf16 + offset), length, latin1 };
+    return true;
+}
+
+/* s.charCodeAt(i): the unit inline when the callee is the built-in, s a string whose units are
+ * at hand and i an index in it; anything else is the call. */
+static inline JSValue js_call_char_code_at(JSContext *ctx, JSValue f, JSValue s, JSValue i, const char *site) {
+    JSStrView v;
+    if (JS_LIKELY(js_is_function(f) && js_as_function(f)->entry == js_core_string_proto_char_code_at && js_is_string(s)
+                  && js_is_int32(i) && js_string_units(s, &v) && (uint32_t)js_as_int32(i) < v.length))
+        return js_int32((int32_t)js_view_at(v, (uint32_t)js_as_int32(i)));
+    return js_call_site(ctx, f, s, 1, &i, site);
+}
+
+/* String.fromCharCode(c): a unit up to 0xFF is a static one-unit string. */
+static inline JSValue js_call_from_char_code(JSContext *ctx, JSValue f, JSValue this_val, JSValue c, const char *site) {
+    if (JS_LIKELY(js_is_function(f) && js_as_function(f)->entry == js_core_string_from_char_code && js_is_int32(c)
+                  && (uint32_t)js_as_int32(c) <= 0xFF))
+        return js_char_string((uint8_t)js_as_int32(c));
+    return js_call_site(ctx, f, this_val, 1, &c, site);
+}
+
 #endif /* JS_BUILTINS_H */

package/runtime/include/js_console.h

@@ -1,5 +1,5 @@
 /*
- * js_console.h — console, util.inspect and util.format (ADR 0012), in C: Node's
+ * js_console.h — console, util.inspect and util.format, in C: Node's
  * algorithms, so output matches Node's byte for byte. Also the test host's print and the
  * uncaught-error report.
  */
@@ -8,7 +8,7 @@
 
 #include "js_function.h"
 
-/* util.inspect's options (the ones visaljs honors; colors and getters are always off). */
+/* util.inspect's options (the ones visaljs honors; colors are always off). */
 typedef struct JSInspectOptions {
     bool   show_hidden;
     double depth;              /* INFINITY for null */
@@ -17,9 +17,12 @@ typedef struct JSInspectOptions {
     double max_string_length;
     double break_length;
     int    compact;            /* -1 for true, 0 for false, else a number */
-    bool   sorted;
+    bool   sorted;             /* true: entries in the default sort order (a comparator isn't supported) */
+    int    getters;            /* JS_INSPECT_GETTERS_*: which getters are called to show their value */
 } JSInspectOptions;
 
+enum { JS_INSPECT_GETTERS_OFF, JS_INSPECT_GETTERS_ALL, JS_INSPECT_GETTERS_GET, JS_INSPECT_GETTERS_SET };
+
 extern const JSInspectOptions js_inspect_defaults;  /* Node's util.inspect.defaultOptions */
 
 /* util.inspect(v) with the default options, or with `o`. */
@@ -43,11 +46,13 @@ JSValue js_util_inspect_function(JSContext *ctx);
 /* Writes a string as UTF-8 (lone surrogates as U+FFFD) to fd 1 or 2; stdout is flushed
  * before anything goes to stderr, so the two interleave as written. */
 void js_write_output(JSContext *ctx, int fd, JSValue s);
+/* Writes bytes as they are to fd 1 or 2, as js_write_output does a string. */
+void js_write_bytes(int fd, const uint8_t *data, size_t length);
 
 /* The global console object. */
 JSValue js_new_console(JSContext *ctx);
 
-/* The test host's print (ADR 0011): String(argument) and a newline, on stdout. */
+/* The test host's print: String(argument) and a newline, on stdout. */
 JSValue js_print(JSContext *ctx, JSValue callee, JSValue this_val,
                  uint32_t argc, const JSValue *argv, JSValue new_target);
 

package/runtime/include/js_convert.h

@@ -16,7 +16,7 @@ JS_WARN_UNUSED JSValue js_to_primitive(JSContext *ctx, JSValue v, JSHint hint);
 JS_WARN_UNUSED JSValue js_ordinary_to_primitive(JSContext *ctx, JSValue v, JSHint hint);
 /* ToString. */
 JS_WARN_UNUSED JSValue js_to_string(JSContext *ctx, JSValue v);
-/* ToNumber: 0 on success with *out set, -1 with an exception pending (ADR 0004). */
+/* ToNumber: 0 on success with *out set, -1 with an exception pending. */
 JS_WARN_UNUSED int js_to_number(JSContext *ctx, double *out, JSValue v);
 
 #endif /* JS_CONVERT_H */

package/runtime/include/js_core.def

@@ -1,6 +1,6 @@
 /*
- * js_core.def — the core built-in methods a program installs only when it names them
- * (ADR 0014), in V8's order. One line per property:
+ * js_core.def — the core built-in methods a program installs only when it names them,
+ * in V8's order. One line per property:
  *
  *   JS_CORE_FN(target, "name", native, length)        a method
  *   JS_CORE_HOST_FN(target, "name", native, length)   a host method (enumerable: console.log)
@@ -55,8 +55,9 @@ JS_CORE_FN(OBJECT_PROTO, "toLocaleString", object_proto_to_locale_string, 0)
 /* Array (§23.1) */
 JS_CORE_FN(ARRAY, "isArray", array_is_array, 1)
 JS_CORE_FN(ARRAY, "from", array_from, 1)
-JS_CORE_FN(ARRAY, "of", array_of, 0)
+/* fromAsync before of: V8 13.6's order */
 JS_CORE_FN(ARRAY, "fromAsync", array_from_async, 1)
+JS_CORE_FN(ARRAY, "of", array_of, 0)
 JS_CORE_SYMBOL_GETTER(ARRAY, species, array_species)
 JS_CORE_FN(ARRAY_PROTO, "at", array_proto_at, 1)
 JS_CORE_FN(ARRAY_PROTO, "concat", array_proto_concat, 1)
@@ -188,7 +189,7 @@ JS_CORE_FN(GLOBAL, "decodeURIComponent", global_decode_uri_component, 1)
 JS_CORE_FN(GLOBAL, "encodeURI", global_encode_uri, 1)
 JS_CORE_FN(GLOBAL, "encodeURIComponent", global_encode_uri_component, 1)
 
-/* console (ADR 0012), in Node's order: own enumerable methods, each its own function
+/* console, in Node's order: own enumerable methods, each its own function
  * (console.info !== console.log), though several share a native */
 JS_CORE_HOST_FN(CONSOLE, "log", console_log, 0)
 JS_CORE_HOST_FN(CONSOLE, "warn", console_error, 0)

package/runtime/include/js_crypto.h

@@ -1,4 +1,4 @@
-/* js_crypto.h — crypto (ADR 0018): node:crypto's host primitives, which node/index.ts lists for
+/* js_crypto.h — crypto: node:crypto's host primitives, which node/index.ts lists for
  * the compiler (generated code declares the ones a program uses), and what the crypto
  * component shares with them. The primitives are the runtime's, as Web Crypto runs on the same
  * C (runtime/src/crypto_internal.h). */

package/runtime/include/js_error.h

@@ -1,5 +1,5 @@
 /*
- * js_error.h — Error objects (ECMAScript §20.5; ADR 0004).
+ * js_error.h — Error objects (ECMAScript §20.5).
  *
  * An error is an ordinary object of class js_class_error (it has [[ErrorData]]).
  * The js_throw_*_error helpers in js_exception.h create and throw them.

package/runtime/include/js_exception.h

@@ -1,5 +1,5 @@
 /*
- * js_exception.h — exception propagation (ADR 0004).
+ * js_exception.h — exception propagation.
  *
  * A function that fails returns JS_EXCEPTION (or < 0 for int results) and
  * leaves the error in ctx->rt->exception. Callers check and propagate.
@@ -62,4 +62,24 @@ static inline bool js_has_exception(const JSContext *ctx) {
             return js_throw_stack_overflow(ctx);                              \
     } while (0)
 
+/* After every direct call between generated functions: the call is then never the caller's last
+ * action, so C compilers keep it a call. Turned into a jump (tail-call elimination), JS
+ * recursion would run in constant stack, and unbounded recursion would loop forever instead of
+ * throwing a RangeError at the stack limit. */
+#if defined(_MSC_VER) && !defined(__clang__)
+#define JS_NO_TAIL_CALL() _ReadWriteBarrier()
+#else
+#define JS_NO_TAIL_CALL() __asm__ volatile("" ::: "memory")
+#endif
+
+/* The same in a function returning `fail` (a double or a bool: generated code's unboxed direct
+ * entries): the caller sees the pending exception. */
+#define JS_CHECK_STACK_OR(ctx, fail)                                          \
+    do {                                                                      \
+        if (JS_UNLIKELY(JS_FRAME_ADDRESS() < (ctx)->stack_limit)) {           \
+            js_discard(js_throw_stack_overflow(ctx));                         \
+            return (fail);                                                    \
+        }                                                                     \
+    } while (0)
+
 #endif /* JS_EXCEPTION_H */

package/runtime/include/js_function.h

@@ -1,5 +1,5 @@
 /*
- * js_function.h — function objects and calls (ADR 0006).
+ * js_function.h — function objects and calls.
  *
  * A function is an object (a JSFunction cell). Every function has a generic
  * entry with one signature; compiled functions also have a direct entry the
@@ -10,7 +10,7 @@
 
 #include "js_object.h"
 
-/* The generic entry (ADR 0006): `this_val` is raw (coercion happens in the
+/* The generic entry: `this_val` is raw (coercion happens in the
  * callee); `new_target` is undefined for [[Call]], the constructor for [[Construct]]. */
 typedef JSValue (*JSNativeFn)(JSContext *ctx, JSValue callee, JSValue this_val,
                               uint32_t argc, const JSValue *argv, JSValue new_target);
@@ -23,8 +23,8 @@ typedef JSValue (*JSNativeFn)(JSContext *ctx, JSValue callee, JSValue this_val,
 #define JS_FN_CLASS_CTOR   0x10u  /* throws when called without new */
 #define JS_FN_DERIVED      0x20u  /* a derived class constructor: [[Construct]] doesn't create `this` (super() does) */
 #define JS_FN_BOUND        0x40u  /* a bound function (Function.prototype.bind): home_object is the target */
-#define JS_FN_GENERATOR    0x80u  /* function* (ADR 0007): its [[Prototype]] and `prototype` differ */
-#define JS_FN_ASYNC        0x100u /* async function (ADR 0007): [[Prototype]] %AsyncFunction.prototype% */
+#define JS_FN_GENERATOR    0x80u  /* function*: its [[Prototype]] and `prototype` differ */
+#define JS_FN_ASYNC        0x100u /* async function: [[Prototype]] %AsyncFunction.prototype% */
 #define JS_FN_PROXY        0x200u /* a callable proxy: it runs in its caller's realm */
 
 /* Emitted by the compiler as static const data, one per function in the source. */
@@ -39,7 +39,7 @@ typedef struct JSFunctionInfo {
     uint32_t        source_length;
 } JSFunctionInfo;
 
-/* A scope's captured variables (ADR 0006, "Closures"): one cell per scope that has
+/* A scope's captured variables: one cell per scope that has
  * any, linked to the enclosing scope's. Generated code reaches a variable by a static
  * (depth, slot). Slots start EMPTY (zeroed memory): uninitialized let/const. */
 typedef struct JSEnv {            /* kind = ENV */
@@ -73,12 +73,13 @@ typedef struct JSFunction {       /* kind = FUNCTION */
     JSObject               obj;
     JSNativeFn             entry;        /* copy of info->generic: one load at call time */
     const JSFunctionInfo  *info;         /* NULL for builtins created at runtime */
-    struct JSEnv          *env;          /* captured scope (M4), or NULL */
-    JSValue                home_object;  /* methods: where `super` looks (M4) */
-    JSValue                bound_this;   /* arrows: the captured `this`, else EMPTY (M4) */
-    JSContext             *realm;        /* the realm the function was created in (ADR 0011) */
+    struct JSEnv          *env;          /* captured scope, or NULL */
+    JSValue                home_object;  /* methods: where `super` looks */
+    JSValue                bound_this;   /* arrows: the captured `this`, else EMPTY */
+    JSContext             *realm;        /* the realm the function was created in */
     uint32_t               flags;
     uint32_t               pad_;
+    struct JSShape        *instance_shape;  /* a class's instances' root shape, made at its first `new` (js_new_class_instance) */
 } JSFunction;
 
 extern const JSClass js_class_function;
@@ -113,6 +114,24 @@ JSValue js_define_method(JSContext *ctx, JSObject *o, const char *name, JSNative
  * (the source text at a call site; NULL for runtime callers). */
 JS_WARN_UNUSED JSValue js_call(JSContext *ctx, JSValue f, JSValue this_val, uint32_t argc, const JSValue *argv);
 JS_WARN_UNUSED JSValue js_call_site(JSContext *ctx, JSValue f, JSValue this_val, uint32_t argc, const JSValue *argv, const char *callee_text);
+
+/* Math.f(x) in generated code: when the callee is the built-in (its entry, from
+ * any realm) and x a Number, the C function inline; anything else is the call. The entries are
+ * math.c's (a program naming Math links it). */
+enum { JS_MATH_SQRT, JS_MATH_ABS, JS_MATH_FLOOR, JS_MATH_CEIL, JS_MATH_TRUNC, JS_MATH_INLINE_COUNT };
+extern const JSNativeFn js_math_inline[JS_MATH_INLINE_COUNT];
+#define JS_MATH_CALL(name, index, cfn)                                                                       \
+    static inline JSValue js_call_math_##name(JSContext *ctx, JSValue f, JSValue this_val, JSValue x, const char *site) { \
+        if (JS_LIKELY(js_is_number(x) && js_is_function(f) && js_as_function(f)->entry == js_math_inline[index])) \
+            return js_number(cfn(js_as_number(x)));                                                          \
+        return js_call_site(ctx, f, this_val, 1, &x, site);                                                  \
+    }
+JS_MATH_CALL(sqrt, JS_MATH_SQRT, sqrt)
+JS_MATH_CALL(abs, JS_MATH_ABS, fabs)
+JS_MATH_CALL(floor, JS_MATH_FLOOR, floor)
+JS_MATH_CALL(ceil, JS_MATH_CEIL, ceil)
+JS_MATH_CALL(trunc, JS_MATH_TRUNC, trunc)
+#undef JS_MATH_CALL
 JS_WARN_UNUSED JSValue js_construct(JSContext *ctx, JSValue f, uint32_t argc, const JSValue *argv, JSValue new_target, const char *callee_text);
 /* The same with the arguments in an array (a call with spreads). */
 JS_WARN_UNUSED JSValue js_call_spread(JSContext *ctx, JSValue f, JSValue this_val, JSValue args, const char *callee_text);
@@ -123,6 +142,11 @@ JS_WARN_UNUSED JSValue js_construct_spread(JSContext *ctx, JSValue f, JSValue ar
 /* GetFunctionRealm: f's realm (a proxy's target's), ctx for non-functions; NULL with a TypeError for a revoked proxy. */
 JSContext *js_function_realm(JSContext *ctx, JSValue f);
 JS_WARN_UNUSED JSValue js_get_prototype_from_constructor(JSContext *ctx, JSValue new_target, JSIntrinsic fallback);
+/* `new F(…)` where F is a constructor the program compiled (optimizer step 10): `this`, an
+ * ordinary object with F's `prototype` (read by the site's cache `ic`: an own data property that
+ * can't become an accessor, so no user code runs) and `slots` inline slots. The instances' root
+ * shape is cached on F, and used while F's `prototype` is the same object. */
+JS_WARN_UNUSED JSValue js_new_instance(JSContext *ctx, JSValue f, uint16_t slots, JSPropCache *ic);
 /* OrdinaryCreateFromConstructor: an ordinary object with that prototype. */
 JS_WARN_UNUSED JSValue js_create_from_constructor(JSContext *ctx, JSValue new_target, JSIntrinsic fallback);
 

package/runtime/include/js_gc.h

@@ -1,5 +1,5 @@
 /*
- * js_gc.h — heap and garbage collector (ADR 0002).
+ * js_gc.h — heap and garbage collector.
  *
  * Non-moving mark-sweep. Cells come from 64 KiB aligned blocks, one size
  * class per block, or from the large-object space. Mark and allocation bits
@@ -30,29 +30,45 @@ typedef struct JSContext JSContext;
 #define JS_BLOCK_MAX_CELLS  (JS_BLOCK_SIZE / JS_CELL_ALIGN)
 #define JS_BITMAP_WORDS     (JS_BLOCK_MAX_CELLS / 64)
 
-/* Collection policy (ADR 0002). */
-#define JS_GC_MIN_HEAP      ((size_t)4 << 20)  /* never collect before this much is allocated */
-#define JS_EMPTY_POOL_MAX   32                 /* empty blocks kept; the rest go back to the OS */
+/* Collection policy. */
+#define JS_GC_MIN_HEAP      ((size_t)4 << 20)  /* the old generation's smallest limit */
+#define JS_GC_NURSERY       ((size_t)4 << 20)  /* a young collection after this much is allocated */
 
-typedef struct JSFreeCell { struct JSFreeCell *next; } JSFreeCell;
+/* Checking builds: JS_GC_STRESS collects at every allocation;
+ * JS_GC_VERIFY checks every pointer the marker follows and poisons dead cells. Stress implies
+ * verification. Both make allocation take the slow path. */
+#if defined(JS_GC_STRESS) && !defined(JS_GC_VERIFY)
+#define JS_GC_VERIFY 1
+#endif
 
 /* The header of a 64 KiB block of same-size cells, or of a large object:
  * a 64 KiB-aligned mapping holding exactly one cell (is_large). Either way
  * js_block_of(cell) finds it. */
 typedef struct JSBlock {
     struct JSBlock *next;        /* in its size class's list, or in the empty pool */
+    struct JSBlock *prev;        /* in its size class's list */
     size_t   map_size;           /* JS_BLOCK_SIZE, or the large object's mapping */
     uint32_t cell_size;
     uint32_t cell_count;
     uint8_t  size_class;
     uint8_t  is_large;
-    uint8_t  unswept;            /* marked by the last GC, not swept yet */
+    union {
+        uint8_t queued;          /* in its class's sweep queue */
+        uint8_t remembered;      /* a large object: in the remembered set, with cards marked */
+    };
     uint8_t  has_finalizable;
-    uint8_t  pad_[4];
+    uint32_t index_magic;        /* ceil(2^32 / cell_size): a cell's index is (offset * magic) >> 32 */
+    uint8_t  young;              /* the allocator took it since the last collection */
     uint64_t mark_bits[JS_BITMAP_WORDS];
     uint64_t alloc_bits[JS_BITMAP_WORDS];  /* exact only while the world is stopped */
 } JSBlock;
 
+/* A large object's cards: a bit per 2^card_shift bytes of the object
+ * that a store gave a young cell since the last collection. They live in the allocation bitmap,
+ * whose only other bit is bit 0 of word 0. A large object's size_class is its card_shift. */
+#define JS_LARGE_CARDS ((JS_BITMAP_WORDS - 1) * 64)
+static inline uint64_t *js_large_cards(JSBlock *b) { return &b->alloc_bits[1]; }
+
 #define JS_BLOCK_FIRST_CELL \
     ((sizeof(JSBlock) + JS_CELL_ALIGN - 1) & ~(size_t)(JS_CELL_ALIGN - 1))
 
@@ -76,20 +92,74 @@ static inline unsigned js_size_class(size_t size) {
     return 8 + (unsigned)(b - 7) * 4 + ((s >> (b - 2)) - 4);
 }
 
+/* The index of x's lowest set bit; x != 0. */
+static inline unsigned js_ctz64(uint64_t x) {
+#if defined(_MSC_VER) && !defined(__clang__)
+    unsigned long i;
+    _BitScanForward64(&i, x);
+    return (unsigned)i;
+#else
+    return (unsigned)__builtin_ctzll(x);
+#endif
+}
+
 /* ---- Heap -------------------------------------------------------------- */
 
+/* What the collector has done, counted always (a few clock reads per collection). JS_GC_TRACE=1
+ * prints a line per collection, JS_GC_STATS=1 a JSON summary at exit. */
+typedef struct JSGCStats {
+    uint64_t collections;
+    uint64_t young_collections;               /* of them: the rest were full */
+    uint64_t idle_collections;                /* of the full ones: when the program was idle */
+    uint64_t mark_slices;                     /* incremental marking's pauses, in pause_ms too */
+    uint64_t parallel_markings;               /* pauses' markings the helper threads joined */
+    double   pause_ms, max_pause_ms;          /* the world stopped: everything below but sweep */
+    double   mark_ms, weak_ms, finish_ms;     /* the pause: marking; weak references; finalizers, large objects, accounting */
+    double   sweep_ms;                        /* lazy sweeping, in allocation: timed only when reporting */
+    uint64_t blocks_swept;
+    uint64_t allocated_bytes;                 /* handed to the allocator, in total */
+    uint64_t marked_cells;                    /* by the last collection */
+    size_t   peak_heap_bytes;                 /* js_heap_size's high-water mark */
+    size_t   peak_external_bytes;             /* external memory's high-water mark */
+} JSGCStats;
+
+/* Allocation in one size class, a word of the allocation bitmap at a
+ * time: `free` has a bit for each free cell of a window of 64 cells at `base`, zeroed and not
+ * handed out yet. The fast path takes the lowest. A dead cell isn't written until it's reused. */
+typedef struct JSAllocator {
+    uint64_t  free;             /* hot: the fast path's two loads */
+    uintptr_t base;
+    uintptr_t cell_size;
+    JSBlock  *block;            /* the block the window is in; NULL: none */
+    uint32_t  word;             /* the bitmap word after the window's: where the next one is looked for */
+    uint32_t  fresh;            /* the block is a new mapping, zero-filled */
+} JSAllocator;
+
 typedef struct JSHeap {
-    JSFreeCell *free[JS_NUM_SIZE_CLASSES];  /* hot: popped by the inline fast path */
-    JSBlock *current[JS_NUM_SIZE_CLASSES];  /* the block `free` points into */
-    JSBlock *blocks[JS_NUM_SIZE_CLASSES];   /* every block of the class */
-    JSBlock **sweep_link[JS_NUM_SIZE_CLASSES]; /* link to the next block to sweep lazily */
+    JSAllocator alloc[JS_NUM_SIZE_CLASSES]; /* hot: the inline fast path */
+    JSBlock *blocks[JS_NUM_SIZE_CLASSES];   /* every block of the class (doubly linked) */
+    /* Lazy sweeping: the blocks of each class to sweep before the allocator takes them. A full
+     * collection queues them all; a young one, those the allocator took since the last one (the
+     * others hold old cells only, and a young collection frees none). malloc'd. */
+    struct JSBlockList { JSBlock **items; size_t count, cap; } to_sweep[JS_NUM_SIZE_CLASSES], young_blocks;
+    /* Swept blocks with free cells the allocator hasn't taken: finish_sweeping's, before a full
+     * collection's marking or after an idle one. Emptied when a full collection queues every block. */
+    struct JSBlockList ready[JS_NUM_SIZE_CLASSES];
     JSBlock *empty;                         /* pool of empty blocks, any class */
-    size_t   block_count;
+    size_t   block_count;                   /* mapped, decommitted ones included */
     size_t   empty_count;
+    /* Empty blocks given back to the OS, their addresses kept for reuse (malloc'd); not in the block
+     * set. Each with the full collections there had been when it was decommitted: one still
+     * unused after another full collection is unmapped. */
+    struct JSDecommitted { JSBlock *block; size_t full_count; } *decommitted;
+    size_t   decommitted_count, decommitted_cap;
+    size_t   full_count;                    /* full collections so far */
     JSBlock **large;                        /* large objects, sorted by address (malloc'd) */
     size_t   large_count;
     size_t   large_cap;
-    size_t   large_bytes;
+    size_t   large_bytes;                   /* their mappings, and the cache's */
+    JSBlock **large_cache;                  /* dead large objects' mappings, for reuse (malloc'd) */
+    size_t   large_cache_count, large_cache_cap, large_cache_bytes;
 
     /* Precise roots (malloc'd arrays). */
     struct JSRootTable { JSValue *slots; size_t n; } *root_tables;
@@ -97,24 +167,64 @@ typedef struct JSHeap {
     JSValue **roots;
     size_t   root_count, root_cap;
 
-    /* Conservative pointer test (ADR 0002). */
+    /* Conservative pointer test. */
     uintptr_t *block_set;                   /* open addressing over block addresses; 0 = empty */
     size_t   block_set_cap, block_set_count;
     uint64_t block_bloom[4];                /* 256-bit Bloom filter over block_set */
     uintptr_t min_addr, max_addr;           /* bounds of every mapping the heap made */
     void    *stack_base;                    /* highest stack address of the owning thread */
 
-    JSCell **mark_stack;                    /* malloc'd; reused across collections */
+    /* Generations: old cells a store gave a young cell (malloc'd). */
+    JSCell **remembered;
+    size_t   remembered_count, remembered_cap;
+
+    JSCell **mark_stack;                    /* malloc'd; a tracer's, kept between collections */
+
+    /* Incremental marking: an old collection's marking in
+     * slices, while the program runs and allocates. */
+    struct JSTracer *marker;                /* the marking in progress (malloc'd), or NULL */
+    bool     incremental;                   /* old collections mark incrementally (env JS_GC_INCREMENTAL=0: not) */
+    double   mark_ratio;                    /* bytes to mark per byte allocated */
+    size_t   slice_clock;                   /* the allocation clock at the last slice */
+    size_t   next_slice;                    /* the next slice when the clock gets there */
+    size_t   mark_alloc_limit;              /* the final pause when it gets there, done or not */
+    double   mark_rate;                     /* promotion_rate when the marking started */
+    double   marking_ms;                    /* its pauses so far */
+    unsigned marking_slices;
+    /* Parallel marking: helper threads mark with the collector in
+     * its pauses, started when a marking first has enough to do. */
+    struct JSMarkPool *pool;
+    unsigned gc_helpers;                    /* how many (env JS_GC_THREADS) */
+    bool     exact;                         /* the next collection abandons a marking in progress, and marks from scratch */
     size_t   mark_stack_cap;
     size_t   gc_count;
     int      in_gc;
-
-    /* Policy: collect when allocated_since_gc > max(min_heap, live_after_gc). */
+    int      report;                        /* JS_GC_TRACE (1: each collection) / JS_GC_STATS (2: at exit) bits */
+    JSGCStats stats;
+
+    /* Policy: a young collection when what was allocated since the last one,
+     * cells and external memory, exceeds the nursery; it's a full one when the old generation
+     * (its cells and the external memory they keep) has outgrown old_limit, or the heap limit is
+     * near. Each full collection sets old_limit from how fast the old generation grew and how
+     * long the collection took, so that full collections take about JS_GC_TARGET of the time. */
     size_t   allocated_since_gc;            /* bytes handed to the allocator */
-    size_t   live_after_gc;                 /* bytes marked by the last collection */
+    size_t   external_since_gc;             /* external bytes added since the last collection */
+    size_t   external_bytes;                /* external memory now (js_gc_external_add / _sub) */
+    size_t   live_after_gc;                 /* bytes marked by the last collection: the old generation's cells */
+    size_t   old_after_full;                /* the old generation after the last full collection */
+    size_t   old_limit;                     /* a full collection when the old generation outgrows it */
+    double   full_end_cpu;                  /* the thread's CPU time when the last full collection ended */
+    double   pause_since_full;              /* young pauses since then */
+    double   growth;                        /* > 0: a fixed growth factor instead (env JS_GC_GROWTH) */
+    size_t   nursery;
     size_t   min_heap;
+    int      full_next;                     /* the next collection is full */
+    int      collect_requested;             /* the next allocation collects, or marks a slice (external memory asked) */
+    size_t   allocated_since_idle;          /* cells and external memory, until the last collection */
+    bool     idle;                          /* the collection running is js_gc_idle's */
     size_t   heap_limit;                    /* 0 = unlimited; env JS_HEAP_LIMIT_MB */
     size_t   stress_interval, stress_counter;  /* JS_GC_STRESS builds; env JS_GC_STRESS_INTERVAL */
+    size_t   stress_collections;
 } JSHeap;
 
 /* ---- Cell classes and tracing ---------------------------------------- */
@@ -125,6 +235,9 @@ typedef struct JSCellClass {
     const char *name;
     void (*visit)(JSCell *cell, JSTracer *trc);      /* trace every JSValue the cell holds */
     void (*finalize)(JSRuntime *rt, JSCell *cell);   /* NULL for almost all kinds */
+    /* Optional, for a large cell: trace what it holds in bytes [from, to) of the cell, at least.
+     * Without it a young collection visits a large remembered cell whole. */
+    void (*visit_range)(JSCell *cell, JSTracer *trc, size_t from, size_t to);
 } JSCellClass;
 
 /* Ignores non-cells and static cells. */
@@ -154,18 +267,18 @@ typedef struct JSHostCell {
 
 JSHostCell *js_alloc_host_cell(JSContext *ctx, const JSCellClass *cls, size_t size);
 
-/* ---- Stores into heap cells (ABI hook, ADR 0002) ---------------------- */
+/* ---- Stores into heap cells (ABI hook) -------------------------------- */
 
-/* Every store of a JSValue into a cell that may already be reachable.
- * A plain store today; a generational or incremental barrier goes here. */
-static inline void js_store(JSContext *ctx, JSCell *owner, JSValue *slot, JSValue v) {
-    (void)ctx;
-    (void)owner;
-    assert(!js_is_exception(v) && "JS_EXCEPTION stored into a cell (ADR 0004, invariant 3)");
-    *slot = v;
-}
+/* js_store and js_store_range, the write barrier, are in jscontext.h: they read the context. */
+
+/* The barrier's slow path: `owner` is old; when `c` is a young cell, remembers the owner, or the
+ * card of a large one that `slot` is in (NULL: anywhere in it). */
+void js_write_barrier_slow(JSContext *ctx, JSCell *owner, const void *slot, const JSCell *c);
+/* Remembers an old `owner`, or `bytes` of a large one from `from`, whatever it was given. */
+void js_remember(JSContext *ctx, JSCell *owner, const void *from, size_t bytes);
 
-/* Initializing store into a cell allocated with no allocation in between. */
+/* Initializing store into a cell allocated with no allocation in between: the cell is young, so
+ * it needs no barrier. */
 static inline void js_init_slot(JSValue *slot, JSValue v) { *slot = v; }
 
 /* Keeps `v` visibly live to the conservative scan up to this point. */
@@ -185,11 +298,40 @@ void js_remove_root(JSRuntime *rt, JSValue *slot);
 
 /* ---- Control ----------------------------------------------------------- */
 
-void js_gc(JSContext *ctx);  /* full collection */
+void js_gc(JSContext *ctx);        /* full collection: everything unreachable now (a marking in progress starts over) */
+void js_gc_young(JSContext *ctx);  /* young collection: the cells allocated since the last one */
+
+/* Incremental marking, started and stepped by allocation;
+ * these drive it by hand, for tests. A slice marks about `bytes` bytes of cells, and runs the
+ * final pause when there's nothing left. js_gc and js_gc_young finish a marking in progress. */
+void js_gc_start_marking(JSContext *ctx);
+bool js_gc_marking(const JSRuntime *rt);
+void js_gc_mark_slice(JSContext *ctx, size_t bytes);
+
+/* The program is idle: the event loop waited JS_GC_IDLE_MS with nothing to
+ * do. When enough was allocated since the last time, js_gc_idle runs a full collection, finishes
+ * the sweeping, and gives back to the OS what's free: the empty blocks, and malloc's memory. */
+#define JS_GC_IDLE_MS 1000
+bool js_gc_idle_wanted(const JSRuntime *rt);
+void js_gc_idle(JSContext *ctx);
+
+/* External memory: bytes outside the heap that a cell owns and frees in its
+ * finalizer (an ArrayBuffer's), counted toward collections as if they were cells. `add` never
+ * collects: when the count calls for a collection, the next allocation runs it. `sub` is for
+ * the bytes freed, by the finalizer or before it. */
+void js_gc_external_add(JSRuntime *rt, size_t bytes);
+void js_gc_external_sub(JSRuntime *rt, size_t bytes);
+/* malloc and free for memory a cell owns, counted as external memory: for libraries that take an
+ * allocator (zlib, Brotli, zstd), whose frees don't say the size. NULL when out of memory. */
+void *js_gc_external_malloc(JSRuntime *rt, size_t bytes);
+void js_gc_external_free(JSRuntime *rt, void *p);
 
 /* Exits with "heap limit reached" when the cells would need more than `bytes`. 0 = no limit. */
 void js_set_heap_limit(JSRuntime *rt, size_t bytes);
-/* Bytes currently mapped for cells: blocks (including empty ones) and large objects. */
+/* Bytes currently committed for cells: blocks (empty ones included, decommitted ones not) and
+ * large objects. */
 size_t js_heap_size(const JSRuntime *rt);
+/* The counters so far. */
+const JSGCStats *js_gc_stats(const JSRuntime *rt);
 
 #endif /* JS_GC_H */