visaljs 0.0.7 → 0.0.8

package/runtime/include/js_generator.h

@@ -1,5 +1,5 @@
 /*
- * js_generator.h — generators (ECMAScript §27.5; ADR 0007).
+ * js_generator.h — generators (ECMAScript §27.5).
  *
  * The compiler turns a function* into an entry (its prologue, which ends by creating the
  * generator with js_generator_new) and a resume function: a state machine that saves the
@@ -56,7 +56,7 @@ JSValue js_yield_star_start(JSContext *ctx, JSValue iterable);
 JSValue js_yield_star_step(JSContext *ctx, JSValue rec, JSValue received, JSValue mode);
 JSValue js_yield_star_status(JSValue rec);
 
-/* ---- Async functions (§27.7; ADR 0007) ------------------------------------------------- */
+/* ---- Async functions (§27.7) ----------------------------------------------------------- */
 
 /* An async call's state: a generator-like object nothing in JS can reach. */
 JSValue js_async_new(JSContext *ctx, JSGeneratorResume resume, uint32_t slots);

package/runtime/include/js_host.h

@@ -1,10 +1,15 @@
-/* js_host.h — the host's layer 1 in the runtime (ADR 0012): console, process and global,
+/* js_host.h — the host's globals in the runtime: console, process and global,
  * installed before the program runs, and what host packages (node/) build on. Host packages
  * declare their own primitives (node/include/js_node.h); the generated code declares the ones
  * it uses. */
 #ifndef JS_HOST_H
 #define JS_HOST_H
 
+/* The Node API visaljs implements, as process.version reports it (node/compat.json's), and
+ * visaljs's own version, process.versions.visaljs (cli/package.json's). cli/test checks both. */
+#define JS_NODE_VERSION "24.21.0"
+#define JS_VISALJS_VERSION "0.0.7"
+
 #include "js_function.h"
 
 /* process.c: console, process and global, installed before the program runs (main); the end
@@ -18,4 +23,17 @@ void js_emit_warning(JSContext *ctx, JSValue message, const char *type, const ch
 /* cwd(): the working directory (process.cwd()), also a host primitive of node:path; -errno on failure. */
 JSValue js_host_cwd(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
 
+/* buffer.c: node:buffer's INSPECT_MAX_BYTES, as it is set. */
+JSValue js_host_buffer_inspect_max_bytes(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+
+/* web.c: an object's internal class, for structuredClone. */
+JSValue js_host_clone_class(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+
+/* fetch.c: fetch()'s primitives (node/prelude/internal/fetch.js): a Headers' list as sent, a
+ * request's body as sent, and a fetched Response. */
+JSValue js_host_fetch_header_list(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+JSValue js_host_fetch_request_body(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+JSValue js_host_fetch_response(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+JSValue js_host_fetch_form_data_hooks(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+
 #endif /* JS_HOST_H */

package/runtime/include/js_jobs.h

@@ -1,5 +1,5 @@
 /*
- * js_jobs.h — the job queue and the event loop (ADR 0008).
+ * js_jobs.h — the job queue and the event loop.
  *
  * Layer 1 (spec): microtasks, run at checkpoints when no JS is on the stack, then the
  * unhandled rejections are processed. Layer 2 (host): the event loop that runs the
@@ -25,7 +25,7 @@ typedef struct JSJob {
     uint8_t    kind;
     JSContext *realm;    /* set by js_enqueue_microtask: the realm that queued it */
     JSValue    a, b, c;
-    JSValue    context;  /* set by js_enqueue_microtask: the async context it runs under (ADR 0020) */
+    JSValue    context;  /* set by js_enqueue_microtask: the async context it runs under */
 } JSJob;
 
 typedef struct JSJobQueue {
@@ -33,7 +33,7 @@ typedef struct JSJobQueue {
     size_t head, count, cap;
 } JSJobQueue;
 
-/* A setTimeout / setInterval (ADR 0008). Its values are GC roots. */
+/* A setTimeout / setInterval. Its values are GC roots. */
 typedef struct JSTimer {
     uint64_t   deadline;   /* in the loop's milliseconds */
     uint64_t   seq;        /* creation order: breaks ties */
@@ -43,7 +43,7 @@ typedef struct JSTimer {
     JSContext *realm;
     JSValue    fn;
     JSValue    args;       /* an array of the extra arguments, or undefined */
-    JSValue    context;    /* the async context it was set in, which it runs under (ADR 0020) */
+    JSValue    context;    /* the async context it was set in, which it runs under */
 } JSTimer;
 
 typedef struct JSTimers {
@@ -86,7 +86,7 @@ uint32_t js_timer_start(JSContext *ctx, JSValue fn, double delay, bool immediate
 void js_timer_set_ref(JSContext *ctx, uint32_t id, bool ref);
 void js_timer_clear(JSContext *ctx, uint32_t id);
 
-/* The async context (ADR 0020): the host's value for the current chain of async work, which
+/* The async context: the host's value for the current chain of async work, which
  * jobs, timers and promise reactions carry to where they run (undefined: none). Setting it
  * isn't undone by the runtime: the caller restores the one it replaced. */
 JSValue js_async_context(JSContext *ctx);

package/runtime/include/js_module.h

@@ -1,4 +1,4 @@
-/* js_module.h — module-level host behavior (ADR 0009): import.meta and import(). */
+/* js_module.h — module-level host behavior: import.meta and import(). */
 #ifndef JS_MODULE_H
 #define JS_MODULE_H
 

package/runtime/include/js_object.h

@@ -1,5 +1,5 @@
 /*
- * js_object.h — the object model (ADR 0005): shapes, objects, property keys,
+ * js_object.h — the object model: shapes, objects, property keys,
  * and the ordinary internal methods ([[Get]], [[Set]], [[DefineOwnProperty]], …).
  *
  * Named properties (atoms, symbols) live in shape-described slots; indexed
@@ -54,7 +54,7 @@ typedef struct JSTransitions JSTransitions;
 /* JS_ORDINARY, but the answer for this key isn't a function of the shape: caches don't remember it. */
 #define JS_ORDINARY_UNCACHED 3
 
-/* Exotic behavior (ADR 0005, "class hooks"). NULL hooks mean ordinary behavior.
+/* Exotic behavior. NULL hooks mean ordinary behavior.
  * Grows as exotic objects arrive (Function, arguments, Proxy…). Inline caches rely on
  * this: whether a hook takes over a named key depends only on the object's shape, or
  * the hook changes the shape (Function's lazy `prototype`). */
@@ -110,6 +110,9 @@ struct JSShape {                    /* kind = SHAPE */
     uint16_t       pad_;
     JSPropTable   *table;           /* key → (slot, attrs): lazy for shared shapes, the truth for dictionaries */
     JSTransitions *transitions;     /* (key, attrs) → child shape; weak */
+    /* for…in's keys of objects with this shape (shared shapes only): its enumerable string keys
+     * in order, a JSValueArray; EMPTY until a for…in first needs them (iterate.c) */
+    JSValue        enum_keys;
 };
 
 /* The slot of an accessor property holds one of these. */
@@ -157,7 +160,7 @@ static inline bool js_is_object(JSValue v) {
 static inline JSObject *js_as_object(JSValue v) { return (JSObject *)js_as_cell(v); }
 static inline JSValue js_object_value(JSObject *o) { return js_cell(&o->cell); }
 
-/* The shared, static, empty elements store (ADR 0005, "never NULL"). */
+/* The shared, static, empty elements store. */
 extern const JSElements js_empty_elements;
 
 /* ---- Shapes ----------------------------------------------------------------- */
@@ -192,7 +195,7 @@ static inline JSValue *js_object_slot(JSObject *o, uint32_t n) {
 /* ---- Property keys --------------------------------------------------------------- */
 
 /* A key: an array index (a number: int32 below 2^31, a double up to 2^32 - 2), an atom,
- * or a symbol (ADR 0005). JS_EXCEPTION on failure. */
+ * or a symbol. JS_EXCEPTION on failure. */
 JS_WARN_UNUSED JSValue js_to_property_key(JSContext *ctx, JSValue v);
 static inline bool js_key_is_index(JSValue key) { return js_is_number(key); }
 static inline uint32_t js_key_index(JSValue key) {
@@ -226,7 +229,7 @@ void js_define_accessor(JSContext *ctx, JSObject *o, JSValue key, JSValue get, J
 
 /* ---- Internal methods (ordinary objects; exotic hooks arrive with their classes) ---- */
 
-/* Results: 1 true, 0 false, -1 exception (ADR 0004). */
+/* Results: 1 true, 0 false, -1 exception. */
 JS_WARN_UNUSED int js_get_own_property(JSContext *ctx, JSObject *o, JSValue key, JSPropertyDescriptor *out);
 JS_WARN_UNUSED int js_define_own_property(JSContext *ctx, JSObject *o, JSValue key, const JSPropertyDescriptor *desc, bool throw_on_fail);
 JS_WARN_UNUSED int js_has_property(JSContext *ctx, JSObject *o, JSValue key);
@@ -288,7 +291,7 @@ JSValue js_for_in_next(JSContext *ctx, JSValue it);
 /* The own keys in spec order (indices ascending, then strings, then symbols, by insertion). */
 JS_WARN_UNUSED JSValue js_own_keys(JSContext *ctx, JSObject *o);
 
-/* ---- Inline caches (ADR 0005) ---------------------------------------------------- */
+/* ---- Inline caches --------------------------------------------------------------- */
 
 #define JS_IC_EMPTY  0
 #define JS_IC_OWN    1  /* get: an own data property; set: an own writable data property */
@@ -301,16 +304,23 @@ JS_WARN_UNUSED JSValue js_own_keys(JSContext *ctx, JSObject *o);
 /* One per property access site with a constant named key; a site is either a get or a
  * set. Monomorphic: a miss refills it. Never caches dictionary shapes (their layout
  * changes under the same pointer). Weak: the GC resets a cache whose shapes or holder
- * die, so every cache must be registered (js_register_prop_caches). */
+ * die, so every cache must be registered (js_register_prop_caches).
+ *
+ * `fast` is what the inline paths (js_get_prop, js_set_prop) test: the receiver shape of
+ * an OWN cache whose slot is inline, else NULL. A hit is then one compare and one load at
+ * `fast_off`, inlined at every access site; the other kinds, and OWN in an overflow slot,
+ * hit in the out-of-line slow path. */
 typedef struct JSPropCache {
-    JSShape  *shape;                    /* receiver shape; NULL = empty */
-    uint32_t  slot;                     /* OWN, PROTO: the slot */
+    JSShape  *fast;                     /* OWN, inline slot: the receiver shape; else NULL */
+    uint16_t  fast_off;                 /* with `fast`: the slot's byte offset in the object */
     uint8_t   kind;                     /* JS_IC_* */
     uint8_t   depth;                    /* PROTO: hops to the holder; ADD: prototypes up to null */
-    uint16_t  pad_;
+    uint32_t  slot;                     /* OWN, PROTO: the slot */
+    JSShape  *shape;                    /* receiver shape; NULL = empty */
     JSObject *holder;                   /* PROTO */
     JSShape  *next;                     /* ADD */
     JSShape  *chain[JS_IC_MAX_DEPTH];   /* PROTO, ADD: the prototypes' shapes, checked on a hit */
+    uint32_t  epoch;                    /* PROTO, ADD: the runtime's proto_epoch when `chain` was last seen to hold */
 } JSPropCache;
 
 /* A module's caches, once at startup (the GC resets them weakly). */
@@ -319,21 +329,84 @@ void js_register_prop_caches(JSRuntime *rt, JSPropCache *ics, size_t n);
 JS_WARN_UNUSED JSValue js_get_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic);
 JS_WARN_UNUSED int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSPropCache *ic);
 
-/* obj.key with a named key (an atom). A hit is a type check, a shape compare and a load. */
+/* The slot a fast hit reads or writes. */
+static inline JSValue *js_prop_cache_slot(JSObject *o, const JSPropCache *ic) {
+    return (JSValue *)((char *)o + ic->fast_off);
+}
+
+/* obj.key with a named key (an atom). A hit is a type check, a shape compare and a load:
+ * inlined at every site, so it stays this small (the rest is js_get_prop_slow's). */
 static inline JSValue js_get_prop(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic) {
+    if (JS_LIKELY(js_is_object(obj)) && js_as_object(obj)->shape == ic->fast) return *js_prop_cache_slot(js_as_object(obj), ic);
+    return js_get_prop_slow(ctx, obj, key, ic);
+}
+
+/* obj.key where the value is called (a method, optimizer step 11): js_get_prop, and a hit on
+ * the prototype that holds it inline too, while no prototype has changed shape since the cache
+ * saw the chain (proto_epoch). */
+static JS_FAST_PATH JSValue js_get_method(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic) {
     if (JS_LIKELY(js_is_object(obj))) {
         JSObject *o = js_as_object(obj);
-        if (o->shape == ic->shape && ic->kind == JS_IC_OWN) return *js_object_slot(o, ic->slot);
+        if (o->shape == ic->fast) return *js_prop_cache_slot(o, ic);
+        if (JS_LIKELY(o->shape == ic->shape && ic->kind == JS_IC_PROTO && ic->epoch == ctx->rt->proto_epoch))
+            return *js_object_slot(ic->holder, ic->slot);
     }
     return js_get_prop_slow(ctx, obj, key, ic);
 }
 
+/* s.key where the compiler proved s a string and key is neither `length` nor an index: a
+ * property of String.prototype (a string has no other own properties), which `ic` caches with
+ * String.prototype as the receiver. A hit is that object's shape compare and a load. */
+static inline JSValue js_get_string_prop(JSContext *ctx, JSValue s, JSValue key, JSPropCache *ic) {
+    JSObject *p = js_as_object(ctx->intrinsics[JS_INTRINSIC_STRING_PROTOTYPE]);
+    if (JS_LIKELY(p->shape == ic->shape) && ic->kind == JS_IC_OWN) return *js_object_slot(p, ic->slot);
+    return js_get_prop_slow(ctx, s, key, ic);
+}
+
 /* obj.key = v with a named key: 1 done, 0 failed (sloppy), -1 exception. */
 static inline int js_set_prop(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSPropCache *ic) {
+    if (JS_LIKELY(js_is_object(obj)) && js_as_object(obj)->shape == ic->fast) {
+        JSObject *o = js_as_object(obj);
+        js_store(ctx, &o->cell, js_prop_cache_slot(o, ic), v);
+        return 1;
+    }
+    return js_set_prop_slow(ctx, obj, key, v, strict, ic);
+}
+
+/* An object's new shape. When the object is a prototype, caches that checked the chain it's on
+ * may be stale: the runtime's proto_epoch moves on. */
+static JS_FAST_PATH void js_object_set_shape(JSContext *ctx, JSObject *o, JSShape *s) {
+    js_store_ptr(ctx, &o->cell, &o->shape, s);
+    if (JS_UNLIKELY(o->cell.flags & JS_CELL_PROTOTYPE)) ctx->rt->proto_epoch++;
+}
+
+/* Whether the prototypes an ADD or PROTO cache saw still have the shapes it saw: then nothing on
+ * the chain gained a setter, a read-only property or the key. */
+static inline bool js_prop_cache_chain_holds(const JSPropCache *ic) {
+    JSValue p = ic->shape->proto;
+    for (unsigned d = 0; d < ic->depth; d++) {
+        if (!js_is_object(p)) return false;
+        JSShape *s = js_as_object(p)->shape;
+        if (s != ic->chain[d]) return false;
+        p = s->proto;
+    }
+    return true;
+}
+
+/* obj.key = v where the compiler expects the key to be added (`this.key = v` in a constructor,
+ * optimizer step 10): js_set_prop, and a cached addition inline too, when the object has room
+ * for it. Its new shape and the value are stores into an object the program just made. */
+static JS_FAST_PATH int js_set_prop_add(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSPropCache *ic) {
     if (JS_LIKELY(js_is_object(obj))) {
         JSObject *o = js_as_object(obj);
-        if (o->shape == ic->shape && ic->kind == JS_IC_OWN) {
-            js_store(ctx, &o->cell, js_object_slot(o, ic->slot), v);
+        JSShape *s = o->shape;
+        if (JS_LIKELY(s == ic->shape && ic->kind == JS_IC_ADD && s->prop_count < s->inline_cap && ic->epoch == ctx->rt->proto_epoch)) {
+            js_object_set_shape(ctx, o, ic->next);
+            js_store(ctx, &o->cell, &js_object_slots(o)[s->prop_count], v);
+            return 1;
+        }
+        if (s == ic->fast) {
+            js_store(ctx, &o->cell, js_prop_cache_slot(o, ic), v);
             return 1;
         }
     }
@@ -343,11 +416,65 @@ static inline int js_set_prop(JSContext *ctx, JSValue obj, JSValue key, JSValue
 /* Convenience: the value of `obj.key` / `obj.key = v` for any value (ToObject rules). */
 JS_WARN_UNUSED JSValue js_get_value(JSContext *ctx, JSValue obj, JSValue key);
 JS_WARN_UNUSED int js_set_value(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict);
-/* ---- Generated code (ADR 0010): property operators on any value ---------------------- */
+/* ---- Generated code: property operators on any value --------------------------------- */
 
 /* obj[key] and obj[key] = v with a computed key: ToPropertyKey after the nullish check. */
 JS_WARN_UNUSED JSValue js_get_elem(JSContext *ctx, JSValue obj, JSValue key);
 JS_WARN_UNUSED int js_set_elem(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict);
+/* The same with a key the compiler proved a Number (get_index / set_index): a present element of
+ * a dense array is read or written inline. A dense element is always a writable data property
+ * (other attributes make the store sparse), so nothing else can see the access. */
+static inline JSValue js_get_index(JSContext *ctx, JSValue obj, JSValue key) {
+    if (JS_LIKELY(js_is_array(obj) && js_is_int32(key))) {
+        JSElements *d = js_as_object(obj)->elements;
+        uint32_t i = (uint32_t)js_as_int32(key);  /* negative: past any length */
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && i < d->length && !js_is_empty(d->data[i]))) return d->data[i];
+    }
+    return js_get_elem(ctx, obj, key);
+}
+static inline int js_set_index(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
+    if (JS_LIKELY(js_is_array(obj) && js_is_int32(key))) {
+        JSElements *d = js_as_object(obj)->elements;
+        uint32_t i = (uint32_t)js_as_int32(key);
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && i < d->length && !js_is_empty(d->data[i]))) {
+            js_store(ctx, &d->cell, &d->data[i], v);
+            return 1;
+        }
+    }
+    return js_set_elem(ctx, obj, key, v, strict);
+}
+/* The same with an unboxed key (a C double): an integral one in range is the element's index. */
+static inline bool js_f64_index(double key, uint32_t *i) {
+    if (!(key >= 0 && key < 4294967295.0)) return false;  /* NaN too; the cast below is then defined */
+    *i = (uint32_t)key;
+    return (double)*i == key;
+}
+static inline JSValue js_get_index_f64(JSContext *ctx, JSValue obj, double key) {
+    uint32_t i;
+    if (JS_LIKELY(js_is_array(obj) && js_f64_index(key, &i))) {
+        JSElements *d = js_as_object(obj)->elements;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && i < d->length && !js_is_empty(d->data[i]))) return d->data[i];
+    }
+    return js_get_elem(ctx, obj, js_number(key));
+}
+static inline int js_set_index_f64(JSContext *ctx, JSValue obj, double key, JSValue v, bool strict) {
+    uint32_t i;
+    if (JS_LIKELY(js_is_array(obj) && js_f64_index(key, &i))) {
+        JSElements *d = js_as_object(obj)->elements;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && i < d->length && !js_is_empty(d->data[i]))) {
+            js_store(ctx, &d->cell, &d->data[i], v);
+            return 1;
+        }
+    }
+    return js_set_elem(ctx, obj, js_number(key), v, strict);
+}
+/* obj.length: an array's and a string's inline, anything else as js_get_prop (an array's length
+ * is always its own data property, a string's its own value). */
+static inline JSValue js_get_length(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic) {
+    if (JS_LIKELY(js_is_array(obj))) return js_number((double)js_array_length(js_as_object(obj)));
+    if (js_is_string(obj)) return js_int32((int32_t)js_string_length(obj));  /* below 2^30 */
+    return js_get_prop(ctx, obj, key, ic);
+}
 /* delete obj[key]: true or false (sloppy), a TypeError when strict and not deletable.
  * `key` is a property key; js_delete_elem converts it first. */
 JS_WARN_UNUSED JSValue js_delete_value(JSContext *ctx, JSValue obj, JSValue key, bool strict);

package/runtime/include/js_ops.h

@@ -1,9 +1,8 @@
 /*
- * js_ops.h — the JS operators generated code calls (ADR 0010: generic
- * operators on boxed JSValues; specialized unboxed ones come with M10).
+ * js_ops.h — the JS operators generated code calls (generic
+ * operators on boxed JSValues, and the optimizer's inline ones on proven Numbers).
  *
- * Primitives only for now: objects (ToPrimitive, valueOf) arrive in M3.
- * Every function that can fail returns JS_EXCEPTION with the error pending (ADR 0004).
+ * Every function that can fail returns JS_EXCEPTION with the error pending.
  */
 #ifndef JS_OPS_H
 #define JS_OPS_H
@@ -49,6 +48,11 @@ bool js_strict_equals(JSContext *ctx, JSValue a, JSValue b);
 static inline JSValue js_strict_eq(JSContext *ctx, JSValue a, JSValue b) { return js_bool(js_strict_equals(ctx, a, b)); }
 static inline JSValue js_strict_ne(JSContext *ctx, JSValue a, JSValue b) { return js_bool(!js_strict_equals(ctx, a, b)); }
 
+/* A switch whose cases are all string literals: the index of the first case `v` is === to, or
+ * -1. `cases` are the literals' static strings (NULL: the empty string), atoms but for those of
+ * one unit: an atom `v` matches its case by address, after one call instead of one per case. */
+int32_t js_switch_string(JSContext *ctx, JSValue v, const JSString *const *cases, uint32_t n);
+
 /* ---- Never throw -------------------------------------------------------- */
 
 /* ToBoolean, as a C bool: branches test this. */
@@ -86,7 +90,10 @@ static inline JSValue js_check_tdz(JSContext *ctx, JSValue v, const char *name)
 
 /* A name no declaration binds: the global object's property, or a ReferenceError (global.c). */
 JS_WARN_UNUSED JSValue js_global_name(JSContext *ctx, const char *name);
-/* A sloppy function's `this` (ADR 0006 prologue, §10.2.1.2): undefined and null become the
+/* The same with the name's key (an atom) at hand: an own data property of the global object
+ * (Math, Array, console…) in one lookup, anything else as js_global_name. */
+JS_WARN_UNUSED JSValue js_global_get(JSContext *ctx, JSValue key, const char *name);
+/* A sloppy function's `this` (§10.2.1.2): undefined and null become the
  * global object, other primitives their wrapper (ToObject). */
 static inline JSValue js_sloppy_this(JSContext *ctx, JSValue v) {
     if (js_is_nullish(v)) return ctx->intrinsics[JS_INTRINSIC_GLOBAL_OBJECT];
@@ -108,4 +115,99 @@ JS_WARN_UNUSED JSValue js_throw_const_assign(JSContext *ctx);
 /* ToInt32 / ToUint32 of a number (ECMAScript §7.1.6). */
 int32_t js_double_to_int32(double d);
 
+/* ---- Number operators (the optimizer's num_* ops) ------------------------------
+ * Both operands are proven Numbers (int32 or double JSValues), so these never throw, allocate
+ * or run user code: inline, with the int32 case first. Where the optimizer unboxes the values,
+ * the operators are plain C on doubles instead; these serve generator and async functions. */
+
+static inline JSValue js_num_add(JSValue a, JSValue b) {
+    int32_t r;
+    if (js_is_int32(a) && js_is_int32(b) && !__builtin_add_overflow(js_as_int32(a), js_as_int32(b), &r)) return js_int32(r);
+    return js_number(js_as_number(a) + js_as_number(b));
+}
+static inline JSValue js_num_sub(JSValue a, JSValue b) {
+    int32_t r;
+    if (js_is_int32(a) && js_is_int32(b) && !__builtin_sub_overflow(js_as_int32(a), js_as_int32(b), &r)) return js_int32(r);
+    return js_number(js_as_number(a) - js_as_number(b));
+}
+static inline JSValue js_num_mul(JSValue a, JSValue b) {
+    int32_t r;
+    /* a zero product of a negative operand is -0: a double */
+    if (js_is_int32(a) && js_is_int32(b) && !__builtin_mul_overflow(js_as_int32(a), js_as_int32(b), &r) &&
+        (r != 0 || (js_as_int32(a) >= 0 && js_as_int32(b) >= 0))) return js_int32(r);
+    return js_number(js_as_number(a) * js_as_number(b));
+}
+static inline JSValue js_num_div(JSValue a, JSValue b) { return js_number(js_as_number(a) / js_as_number(b)); }
+static inline JSValue js_num_mod(JSValue a, JSValue b) {
+    if (js_is_int32(a) && js_is_int32(b) && js_as_int32(a) >= 0 && js_as_int32(b) > 0) return js_int32(js_as_int32(a) % js_as_int32(b));
+    return js_number(fmod(js_as_number(a), js_as_number(b)));
+}
+static inline JSValue js_num_neg(JSValue v) {
+    if (js_is_int32(v) && js_as_int32(v) != 0 && js_as_int32(v) != INT32_MIN) return js_int32(-js_as_int32(v));
+    return js_number(-js_as_number(v));
+}
+static inline JSValue js_num_inc(JSValue v) { return js_num_add(v, js_int32(1)); }
+static inline JSValue js_num_dec(JSValue v) { return js_num_sub(v, js_int32(1)); }
+
+static inline JSValue js_num_lt(JSValue a, JSValue b) { return js_bool(js_as_number(a) < js_as_number(b)); }
+static inline JSValue js_num_le(JSValue a, JSValue b) { return js_bool(js_as_number(a) <= js_as_number(b)); }
+static inline JSValue js_num_gt(JSValue a, JSValue b) { return js_bool(js_as_number(a) > js_as_number(b)); }
+static inline JSValue js_num_ge(JSValue a, JSValue b) { return js_bool(js_as_number(a) >= js_as_number(b)); }
+static inline JSValue js_num_eq(JSValue a, JSValue b) { return js_bool(js_as_number(a) == js_as_number(b)); }
+static inline JSValue js_num_ne(JSValue a, JSValue b) { return js_bool(js_as_number(a) != js_as_number(b)); }
+
+/* ToInt32 of a double: below 2^63 in magnitude, truncating to int64 and keeping the low 32 bits
+ * is exactly ToInt32 (a hash's `(h * 31 + c) | 0` lands there), else the general one (NaN and
+ * the infinities fail the comparisons). */
+static inline int32_t js_f64_to_int32(double d) {
+    if (d > -9223372036854775808.0 && d < 9223372036854775808.0) return (int32_t)(uint32_t)(int64_t)d;
+    return js_double_to_int32(d);
+}
+/* A Number the compiler proved an int32, from its boxed form: an int32 holding one
+ * may still be a double (runtime code making 3.0 with js_double). */
+static inline int32_t js_as_int32_value(JSValue v) {
+    return js_is_int32(v) ? js_as_int32(v) : (int32_t)js_as_double(v);
+}
+/* a % b on doubles: integer % when both are integers in int32 range and the dividend isn't
+ * negative (a negative one can give -0), else fmod (a libm call, much slower) */
+static inline double js_f64_mod(double a, double b) {
+    if (a <= 2147483647.0 && !signbit(a) && b >= 1.0 && b <= 2147483647.0) {
+        int32_t x = (int32_t)a, y = (int32_t)b;
+        if ((double)x == a && (double)y == b) return (double)(x % y);
+    }
+    return fmod(a, b);
+}
+/* ToInt32 of a Number */
+static inline int32_t js_num_int32(JSValue v) { return js_is_int32(v) ? js_as_int32(v) : js_f64_to_int32(js_as_double(v)); }
+static inline JSValue js_num_bitand(JSValue a, JSValue b) { return js_int32(js_num_int32(a) & js_num_int32(b)); }
+static inline JSValue js_num_bitor(JSValue a, JSValue b) { return js_int32(js_num_int32(a) | js_num_int32(b)); }
+static inline JSValue js_num_bitxor(JSValue a, JSValue b) { return js_int32(js_num_int32(a) ^ js_num_int32(b)); }
+static inline JSValue js_num_bitnot(JSValue v) { return js_int32(~js_num_int32(v)); }
+static inline JSValue js_num_shl(JSValue a, JSValue b) { return js_int32((int32_t)((uint32_t)js_num_int32(a) << (js_num_int32(b) & 31))); }
+static inline JSValue js_num_sar(JSValue a, JSValue b) { return js_int32(js_num_int32(a) >> (js_num_int32(b) & 31)); }
+static inline JSValue js_num_shr(JSValue a, JSValue b) { return js_number((double)((uint32_t)js_num_int32(a) >> (js_num_int32(b) & 31))); }
+
+/* Operators on values the compiler couldn't type, in loops: the Number path
+ * inline when both operands are Numbers, else the generic operator. */
+#define JS_NUMBER_FIRST2(op)                                                                    \
+    static inline JSValue js_##op##_fast(JSContext *ctx, JSValue a, JSValue b) {               \
+        if (JS_LIKELY(js_is_number(a) && js_is_number(b))) return js_num_##op(a, b);           \
+        return js_##op(ctx, a, b);                                                              \
+    }
+#define JS_NUMBER_FIRST1(op)                                                                    \
+    static inline JSValue js_##op##_fast(JSContext *ctx, JSValue a) {                          \
+        if (JS_LIKELY(js_is_number(a))) return js_num_##op(a);                                  \
+        return js_##op(ctx, a);                                                                 \
+    }
+JS_NUMBER_FIRST2(add) JS_NUMBER_FIRST2(sub) JS_NUMBER_FIRST2(mul) JS_NUMBER_FIRST2(div) JS_NUMBER_FIRST2(mod)
+JS_NUMBER_FIRST2(lt) JS_NUMBER_FIRST2(le) JS_NUMBER_FIRST2(gt) JS_NUMBER_FIRST2(ge) JS_NUMBER_FIRST2(eq) JS_NUMBER_FIRST2(ne)
+JS_NUMBER_FIRST2(bitand) JS_NUMBER_FIRST2(bitor) JS_NUMBER_FIRST2(bitxor) JS_NUMBER_FIRST2(shl) JS_NUMBER_FIRST2(sar)
+JS_NUMBER_FIRST2(shr)
+JS_NUMBER_FIRST1(neg) JS_NUMBER_FIRST1(inc) JS_NUMBER_FIRST1(dec) JS_NUMBER_FIRST1(bitnot)
+static inline JSValue js_to_numeric_fast(JSContext *ctx, JSValue v) {
+    return JS_LIKELY(js_is_number(v)) ? v : js_to_numeric(ctx, v);
+}
+#undef JS_NUMBER_FIRST1
+#undef JS_NUMBER_FIRST2
+
 #endif /* JS_OPS_H */

package/runtime/include/js_promise.h

@@ -1,8 +1,8 @@
 /*
- * js_promise.h — promises (ECMAScript §27.2; ADR 0008).
+ * js_promise.h — promises (ECMAScript §27.2).
  *
  * A promise keeps its reactions in a list until it settles; settling queues one
- * microtask per reaction (js_jobs.h). Async functions (ADR 0007) build on these.
+ * microtask per reaction (js_jobs.h). Async functions build on these.
  */
 #ifndef JS_PROMISE_H
 #define JS_PROMISE_H
@@ -32,7 +32,7 @@ void js_promise_reject_internal(JSContext *ctx, JSValue promise, JSValue reason)
 /* PromiseResolve(%Promise%, v) (§27.2.4.7.1): v if it is a native promise of this realm. */
 JS_WARN_UNUSED JSValue js_promise_resolve(JSContext *ctx, JSValue v);
 
-/* await (ADR 0007): when the promise settles, a job resumes the async state `gen` (a
+/* await: when the promise settles, a job resumes the async state `gen` (a
  * reaction with no derived promise and no JS closure); marks the promise handled. */
 void js_promise_await(JSContext *ctx, JSValue promise, JSValue gen);
 

package/runtime/include/js_regexp.h

@@ -1,5 +1,5 @@
 /*
- * js_regexp.h — regular expression literals (ADR 0015), for generated code.
+ * js_regexp.h — regular expression literals, for generated code.
  *
  * The compiler compiles each literal when the program is built (QuickJS's libregexp, run as the
  * regexp-compile tool) and emits its bytecode as static data; evaluating the literal creates a

package/runtime/include/js_symbol.h

@@ -1,5 +1,5 @@
 /*
- * js_symbol.h — symbols (ECMAScript §6.1.5, §20.4; ADR 0001, 0005).
+ * js_symbol.h — symbols (ECMAScript §6.1.5, §20.4).
  *
  * A symbol is a heap cell compared by identity; as a property key it is used as is. The
  * well-known symbols are static cells, like the predefined atoms: JS_SYMBOL(iterator).

package/runtime/include/js_web.h

@@ -1,4 +1,4 @@
-/* js_web.h — the web-standard host layer (ADR 0012, layer 2): what its components share.
+/* js_web.h — the web-standard host layer: what its components share.
  * DOMException is a component of its own (domexception.c); the components that throw one
  * need it. The Node-style errors are web.c's, linked into the programs that throw them. */
 #ifndef JS_WEB_H
@@ -80,6 +80,7 @@ typedef struct JSStreamSource {
 JS_WARN_UNUSED JSValue js_new_readable_stream(JSContext *ctx, const JSStreamSource *source, JSValue data, double high_water_mark);
 /* A byte stream of one chunk (a Uint8Array), or of none (undefined), closed after it. */
 JS_WARN_UNUSED JSValue js_readable_stream_of_bytes(JSContext *ctx, JSValue chunk);
+JS_WARN_UNUSED JSValue js_readable_stream_of_chunk(JSContext *ctx, JSValue chunk);  /* not a byte stream */
 bool js_is_readable_stream(JSValue v);
 bool js_readable_stream_locked(JSValue v);
 bool js_readable_stream_disturbed(JSValue v);

package/runtime/include/jscell.h

@@ -1,41 +1,48 @@
 /*
- * jscell.h — the header word every heap cell starts with (ADR 0001, 0002).
+ * jscell.h — the header word every heap cell starts with.
  */
 #ifndef JSCELL_H
 #define JSCELL_H
 
 #include <stdint.h>
 
-/* Cell kinds. Each has a JSCellClass (visit, finalize) in the GC.
- * Kinds are added as their ADRs are implemented. */
+/* Cell kinds. Each has a JSCellClass (visit, finalize) in the GC. */
 typedef enum JSCellKind {
     JS_CELL_INVALID = 0,   /* never a live cell */
-    JS_CELL_STR_FLAT,      /* JSString: inline Latin-1 or UTF-16 characters (ADR 0003) */
-    JS_CELL_STR_ROPE,      /* JSRope: lazy concatenation (ADR 0003) */
-    JS_CELL_STR_SLICE,     /* JSSlice: a substring sharing its parent's characters (ADR 0003) */
+    JS_CELL_STR_FLAT,      /* JSString: inline Latin-1 or UTF-16 characters */
+    JS_CELL_STR_ROPE,      /* JSRope: lazy concatenation */
+    JS_CELL_STR_SLICE,     /* JSSlice: a substring sharing its parent's characters */
     JS_CELL_VALUE_ARRAY,   /* internal: fixed-length JSValue array (overflow slots, …) */
-    JS_CELL_HOST,          /* internal: native payload with its own class (ADR 0012) */
-    JS_CELL_SHAPE,         /* JSShape: hidden class (ADR 0005) */
+    JS_CELL_HOST,          /* internal: native payload with its own class */
+    JS_CELL_SHAPE,         /* JSShape: hidden class */
     JS_CELL_ACCESSOR,      /* JSAccessorPair: {get, set} in an accessor property's slot */
     JS_CELL_ELEMENTS,      /* JSElements: indexed properties */
-    JS_CELL_ENV,           /* JSEnv: a scope's captured variables (ADR 0006) */
-    JS_CELL_SYMBOL,        /* JSSymbol: a symbol primitive (ADR 0001) */
-    JS_CELL_BIGINT,        /* JSBigInt: a BigInt primitive (ADR 0016) */
+    JS_CELL_ENV,           /* JSEnv: a scope's captured variables */
+    JS_CELL_SYMBOL,        /* JSSymbol: a symbol primitive */
+    JS_CELL_BIGINT,        /* JSBigInt: a BigInt primitive */
     /* Objects: every kind from here on starts with a JSObject (js_is_object). */
     JS_CELL_OBJECT,        /* ordinary objects, and exotic ones whose class is in the shape */
     JS_CELL_ARRAY,         /* JSArray */
-    JS_CELL_FUNCTION,      /* JSFunction (ADR 0006) */
+    JS_CELL_FUNCTION,      /* JSFunction */
     JS_CELL_KIND_COUNT
 } JSCellKind;
 
-/* Cell flags. The low byte is kind-specific (e.g. STR_LATIN1, ADR 0003). */
+/* Cell flags. The low byte is kind-specific (e.g. STR_LATIN1; an array's frozen length). */
 #define JS_CELL_STATIC       0x8000u  /* emitted by the compiler: never marked or swept */
 #define JS_CELL_FINALIZABLE  0x4000u  /* the class finalizer must run when it dies */
+#define JS_CELL_PROTOTYPE    0x2000u  /* an object some shape has as its prototype: its shape changes bump proto_epoch */
 
-/* 8 bytes, so the fields after it start 8-aligned and a 16-byte header fits two more words. */
+/* 8 bytes, so the fields after it start 8-aligned and a 16-byte header fits two more words.
+ * `gc` belongs to the collector: the write barrier reads it, and
+ * nothing outside the GC writes it. A byte of its own, so a collector thread can write it while
+ * the program writes `flags`. 0 in a new cell and in a static one. */
+#define JS_GC_YOUNG       0  /* allocated since the last collection (or static) */
+#define JS_GC_REMEMBERED  1  /* old, and in the remembered set: stores into it need nothing more */
+#define JS_GC_OLD         2  /* survived a collection: a store of a young cell into it is remembered */
+#define JS_GC_OLD_LARGE   3  /* old and a large object: a store of a young cell marks a card of it */
 typedef struct JSCell {
     uint8_t  kind;      /* JSCellKind */
-    uint8_t  reserved;
+    uint8_t  gc;
     uint16_t flags;
     uint32_t aux;       /* kind-specific */
 } JSCell;