visaljs 0.0.7 → 0.0.9

package/runtime/include/jscontext.h

@@ -1,10 +1,8 @@
 /*
- * jscontext.h — the two runtime handles (ADR 0011).
+ * jscontext.h — the two runtime handles.
  *
  *   JSRuntime  the agent: heap and GC, atoms, pending exception, job queue
  *   JSContext  a realm: global object and intrinsics. Reaches the agent via ctx->rt.
- *
- * Fields are added as each ADR is implemented.
  */
 #ifndef JSCONTEXT_H
 #define JSCONTEXT_H
@@ -17,7 +15,7 @@
 #include "js_jobs.h"
 
 /* Room left below the stack limit for the throw path and for runtime C code
- * called after the last check (ADR 0004). Sanitizers make frames larger. */
+ * called after the last check. Sanitizers make frames larger. */
 #if defined(__SANITIZE_ADDRESS__)
 #define JS_STACK_MARGIN ((uintptr_t)256 * 1024)
 #elif defined(__has_feature)
@@ -32,8 +30,7 @@
 /* Typed array element types (js_buffer.h lists them): one constructor and prototype each. */
 #define JS_TYPED_ARRAY_TYPES 12
 
-/* Per-realm objects the runtime needs (ADR 0011). Filled in as the object
- * model and built-ins land (M3); every slot is a GC root. */
+/* Per-realm objects the runtime needs; every slot is a GC root. */
 typedef enum JSIntrinsic {
     JS_INTRINSIC_GLOBAL_OBJECT,     /* globalThis */
     JS_INTRINSIC_OBJECT_PROTOTYPE,  /* %Object.prototype% */
@@ -70,7 +67,7 @@ typedef enum JSIntrinsic {
     JS_INTRINSIC_WEAK_SET_PROTOTYPE,
     JS_INTRINSIC_WEAK_REF_PROTOTYPE,
     JS_INTRINSIC_FINALIZATION_REGISTRY_PROTOTYPE,
-    JS_INTRINSIC_MAP_PROTOTYPE,             /* the collections component (ADR 0014), when installed */
+    JS_INTRINSIC_MAP_PROTOTYPE,             /* the collections component, when installed */
     JS_INTRINSIC_SET_PROTOTYPE,
     JS_INTRINSIC_MAP_ITERATOR_PROTOTYPE,
     JS_INTRINSIC_SET_ITERATOR_PROTOTYPE,
@@ -96,11 +93,11 @@ typedef enum JSIntrinsic {
     JS_INTRINSIC_ERROR_STACK_SET,
     JS_INTRINSIC_ERROR,             /* %Error%: Error.captureStackTrace reads its prepareStackTrace and stackTraceLimit */
     JS_INTRINSIC_CALL_SITE_PROTOTYPE,  /* the placeholder call sites Error.prepareStackTrace receives */
-    JS_INTRINSIC_REGEXP,            /* %RegExp%, when the RegExp component is installed (ADR 0015) */
+    JS_INTRINSIC_REGEXP,            /* %RegExp%, when the RegExp component is installed */
     JS_INTRINSIC_REGEXP_PROTOTYPE,
     JS_INTRINSIC_REGEXP_EXEC,       /* the original RegExp.prototype.exec: RegExpExec calls it directly */
     JS_INTRINSIC_REGEXP_STRING_ITERATOR_PROTOTYPE,
-    JS_INTRINSIC_DOM_EXCEPTION_PROTOTYPE,   /* the web-standard host layer (ADR 0012, layer 2) */
+    JS_INTRINSIC_DOM_EXCEPTION_PROTOTYPE,   /* the web-standard host layer */
     JS_INTRINSIC_TEXT_ENCODER_PROTOTYPE,
     JS_INTRINSIC_TEXT_DECODER_PROTOTYPE,
     JS_INTRINSIC_URL_PROTOTYPE,
@@ -111,7 +108,7 @@ typedef enum JSIntrinsic {
     JS_INTRINSIC_EVENT_TARGET_PROTOTYPE,
     JS_INTRINSIC_ABORT_SIGNAL_PROTOTYPE,
     JS_INTRINSIC_ABORT_CONTROLLER_PROTOTYPE,
-    JS_INTRINSIC_BUFFER,            /* Node's Buffer (ADR 0012, layer 3) */
+    JS_INTRINSIC_BUFFER,            /* Node's Buffer */
     JS_INTRINSIC_BUFFER_PROTOTYPE,
     JS_INTRINSIC_HEADERS_PROTOTYPE,
     JS_INTRINSIC_HEADERS_ITERATOR_PROTOTYPE,
@@ -128,26 +125,31 @@ typedef enum JSIntrinsic {
     JS_INTRINSIC_FILE_PROTOTYPE,
     JS_INTRINSIC_REQUEST_PROTOTYPE,
     JS_INTRINSIC_RESPONSE_PROTOTYPE,  /* the original entries: new URLSearchParams(params) copies directly */
-    JS_INTRINSIC_CRYPTO,            /* Web Crypto (ADR 0018): the crypto object */
+    JS_INTRINSIC_CRYPTO,            /* Web Crypto: the crypto object */
     JS_INTRINSIC_CRYPTO_PROTOTYPE,
     JS_INTRINSIC_SUBTLE_CRYPTO,     /* crypto.subtle */
     JS_INTRINSIC_SUBTLE_CRYPTO_PROTOTYPE,
     JS_INTRINSIC_CRYPTO_KEY_PROTOTYPE,
-    JS_INTRINSIC_UTIL_INSPECT,      /* the util.inspect function custom inspectors receive (ADR 0012) */
+    JS_INTRINSIC_UTIL_INSPECT,      /* the util.inspect function custom inspectors receive */
     JS_INTRINSIC_CONSOLE_STATE,     /* console's counters and timers, by label */
     JS_INTRINSIC_COUNT
 } JSIntrinsic;
 
-/* Shapes the GC processes weakly (ADR 0005): root shapes by (class, proto,
+/* Shapes the GC processes weakly: root shapes by (class, proto,
  * capacity), and shapes whose transition tables point to children. */
 typedef struct JSShapeRegistry {
     struct JSShape **roots;       /* open addressing; NULL = empty */
     size_t root_cap, root_count;
     struct JSShape **parents;     /* shapes with transitions */
     size_t parent_count, parent_cap;
+    /* Since the last collection: the root shapes and transitions' children made (the only shapes
+     * a young collection can find dead), and the shapes given transitions, parents[old_parents..]. */
+    struct JSShape **young;
+    size_t young_count, young_cap;
+    size_t old_parents;
 } JSShapeRegistry;
 
-/* Registered inline-cache arrays (ADR 0005): reset weakly after marking. */
+/* Registered inline-cache arrays: reset weakly after marking. */
 typedef struct JSPropCacheTables {
     struct JSPropCacheTable { struct JSPropCache *ics; size_t n; } *tables;
     size_t count, cap;
@@ -160,7 +162,7 @@ typedef enum JSCollectionPreview {
     JS_PREVIEW_MAP_ENTRIES, JS_PREVIEW_SET_ENTRIES,      /* the [key, value] pairs left */
 } JSCollectionPreview;
 
-/* An I/O backend for the event loop (ADR 0008): libuv, set by the host code that first needs it
+/* An I/O backend for the event loop: libuv, set by the host code that first needs it
  * (node:http), so that programs without I/O don't link libuv. */
 typedef struct JSIOBackend {
     bool (*alive)(JSRuntime *rt);  /* open handles (servers, sockets) keep the program running */
@@ -174,16 +176,21 @@ struct JSRuntime {
     JSShapeRegistry shapes;
     JSPropCacheTables prop_caches;
     /* the shared second-level caches (object.c): get and set entries by (shape, key), for the
-     * sites a monomorphic cache misses and C code's lookups; emptied at every collection */
-    struct JSMegaEntry *mega_get, *mega_set;
+     * sites a monomorphic cache misses and C code's lookups, and the shape that defining a new
+     * key gives (object literals); emptied at every collection */
+    struct JSMegaEntry *mega_get, *mega_set, *mega_define;
+    /* Bumped when an object that is some shape's prototype changes shape (js_object_set_shape):
+     * caches that saw a prototype chain (ADD, PROTO) and remember the epoch it had are good
+     * while it's the same, without walking the chain again (optimizer step 11). */
+    uint32_t  proto_epoch;
     JSContext *realms;      /* every live JSContext, linked through next_realm */
-    JSAtomTable atoms;      /* weak (ADR 0003) */
-    JSValue   exception;    /* pending exception, JS_EMPTY if none; a GC root (ADR 0004) */
+    JSAtomTable atoms;      /* weak */
+    JSValue   exception;    /* pending exception, JS_EMPTY if none; a GC root */
     JSValue   symbol_registry;  /* Symbol.for's GlobalSymbolRegistry: key -> symbol (a root) */
     uintptr_t stack_limit;  /* lowest usable stack address, margin included */
-    JSJobQueue jobs;        /* microtasks (ADR 0008) */
-    JSTimers  timers;       /* setTimeout / setInterval (ADR 0008) */
-    /* The async context (ADR 0020): an opaque value the host keeps per chain of async work
+    JSJobQueue jobs;        /* microtasks */
+    JSTimers  timers;       /* setTimeout / setInterval */
+    /* The async context: an opaque value the host keeps per chain of async work
      * (node:async_hooks' AsyncLocalStorage keeps its stores in it). Every job, timer and promise
      * reaction takes the one current when it was queued, and runs under it. Undefined: none. A root. */
     JSValue   async_context;
@@ -198,13 +205,16 @@ struct JSRuntime {
     int     (*on_uncaught)(JSContext *ctx, JSValue error, JSValue promise);
     int     (*on_handled_late)(JSContext *ctx, JSValue promise);
     uint8_t   failure;  /* the exit status after an uncaught error: 1, or on_uncaught's */
-    struct JSWeakList { struct JSObject **items; size_t count, cap; } weak;  /* WeakMap/Set/Ref, registries (ADR 0002) */
+    struct JSWeakList { struct JSObject **items; size_t count, cap; } weak;  /* WeakMap/Set/Ref, registries */
+    /* WeakMap and WeakSet entries set since the last collection, by key (EMPTY: every entry of the
+     * table): the only ones a young collection looks at (weak.c). */
+    struct JSWeakWrites { struct JSWeakWrite { struct JSObject *table; JSValue key; } *items; size_t count, cap; } weak_writes;
     struct JSKeptAlive { JSValue *items; size_t count, cap; } kept_alive;    /* [[KeptAlive]]: roots until ClearKeptObjects */
-    const struct JSComponent *const *components;  /* installed in every realm (ADR 0014) */
+    const struct JSComponent *const *components;  /* installed in every realm */
     size_t    ncomponents;
     const struct JSCoreEntry *core;  /* the core methods every realm installs (js_core.def) */
     size_t    ncore;
-    /* Set by the collections component (ADR 0014: core reaches optional components through
+    /* Set by the collections component (core reaches optional components through
      * hooks): a Map's or Set's entries, or what an iterator has left, as an array (flat
      * [k1, v1, k2, v2, …] for a Map and the entries iterators); EMPTY for other values. */
     JSValue (*collection_preview)(JSContext *ctx, JSValue v, JSCollectionPreview *what);
@@ -213,9 +223,12 @@ struct JSRuntime {
     JSValue (*date_inspect)(JSContext *ctx, JSValue v);
     /* Set by RegExp: a RegExp's "/source/flags" for util.inspect; EMPTY otherwise. */
     JSValue (*regexp_inspect)(JSContext *ctx, JSValue v);
-    const JSBigIntOps *bigint;  /* set by the bigint component (ADR 0016) */
+    const JSBigIntOps *bigint;  /* set by the bigint component */
     /* A typed array's length now: -1 when out of bounds (detached), -2 for anything else. */
     double  (*typed_array_length)(JSValue v);
+    /* Set by typed arrays: a typed array's or DataView's bytes (its current window), true; false
+     * for anything else (an ArrayBuffer too: process.stdout.write takes views only). */
+    bool    (*view_bytes)(JSValue v, uint8_t **data, size_t *length);
     const JSIOBackend *io;     /* the event loop's I/O, once a program uses some */
     uint8_t   rejection_mode;  /* JSRejectionMode */
     uint8_t   in_checkpoint;   /* js_run_microtasks is running */
@@ -224,6 +237,7 @@ struct JSRuntime {
 struct JSContext {
     JSRuntime *rt;
     uintptr_t  stack_limit; /* copy of rt->stack_limit: one load in every function prologue */
+    uint8_t    barrier_threshold; /* js_store's slow path runs for an owner whose GC byte is this or more */
     JSValue    intrinsics[JS_INTRINSIC_COUNT];
     JSContext *next_realm;
 };
@@ -232,23 +246,52 @@ JSRuntime *js_runtime_new(void);
 void js_runtime_free(JSRuntime *rt);   /* frees every cell, running finalizers */
 JSContext *js_context_new(JSRuntime *rt);  /* a new realm; js_runtime_free frees any left */
 void js_context_free(JSContext *ctx);
-/* The test262 host (ADR 0011): defines $262 on ctx's global object and returns it. */
+/* The test262 host: defines $262 on ctx's global object and returns it. */
 JSValue js_test_host_init(JSContext *ctx);
 
-/* Allocation fast path: pop the class's free list and zero the cell (ADR 0002).
- * Zeroed memory reads as JS_EMPTY, so a half-initialized cell is always safe to trace.
- * GC-stress builds (ADR 0011) always take the slow path, which collects first. */
+/* Every store of a JSValue into a cell that may already be reachable: the write barrier.
+ * One compare when the owner is young or already remembered. */
+static inline void js_store(JSContext *ctx, JSCell *owner, JSValue *slot, JSValue v) {
+    assert(!js_is_exception(v) && "JS_EXCEPTION stored into a cell");
+    *slot = v;
+    if (JS_UNLIKELY(owner->gc >= ctx->barrier_threshold) && js_is_cell(v)) js_write_barrier_slow(ctx, owner, slot, js_as_cell(v));
+}
+
+/* The barrier alone, after storing `v` at `slot` (NULL: in malloc'd memory) where js_store can't
+ * write: a malloc'd table's entry, a struct holding several values. */
+static inline void js_write_barrier(JSContext *ctx, JSCell *owner, const void *slot, JSValue v) {
+    if (JS_UNLIKELY(owner->gc >= ctx->barrier_threshold) && js_is_cell(v)) js_write_barrier_slow(ctx, owner, slot, js_as_cell(v));
+}
+
+/* The barrier for a store of a cell pointer (a JSShape *, a JSEnv *, ...) into `owner`, after the
+ * store: js_store_ptr does both. */
+static inline void js_write_barrier_cell(JSContext *ctx, JSCell *owner, const void *slot, const JSCell *c) {
+    if (JS_UNLIKELY(owner->gc >= ctx->barrier_threshold) && c) js_write_barrier_slow(ctx, owner, slot, c);
+}
+#define js_store_ptr(ctx, owner, slot, p) \
+    do { *(slot) = (p); js_write_barrier_cell((ctx), (owner), (slot), (const JSCell *)(p)); } while (0)
+
+/* Copies `n` values into `owner` (memmove: the ranges may overlap), then remembers the owner if
+ * it's old: one barrier for a bulk copy. */
+static inline void js_store_range(JSContext *ctx, JSCell *owner, JSValue *dst, const JSValue *src, size_t n) {
+    memmove(dst, src, n * sizeof *dst);
+    if (JS_UNLIKELY(owner->gc >= ctx->barrier_threshold) && n) js_remember(ctx, owner, dst, n * sizeof *dst);
+}
+
+/* Allocation fast path: the lowest free cell of the class's window.
+ * Its cells are zeroed, and zeroed memory reads as JS_EMPTY, so a half-initialized cell is always
+ * safe to trace. Checking builds (JS_GC_VERIFY, implied by JS_GC_STRESS) always take the slow
+ * path, which checks the dead cell and, under stress, collects first. */
 static inline void *js_alloc_small(JSContext *ctx, unsigned size_class) {
-#ifdef JS_GC_STRESS
-    JSFreeCell *c = (JSFreeCell *)js_alloc_slow(ctx, size_class);
-#else
-    JSHeap *h = &ctx->rt->heap;
-    JSFreeCell *c = h->free[size_class];
-    if (JS_LIKELY(c)) h->free[size_class] = c->next;
-    else c = (JSFreeCell *)js_alloc_slow(ctx, size_class);
+#ifndef JS_GC_VERIFY
+    JSAllocator *a = &ctx->rt->heap.alloc[size_class];
+    uint64_t free = a->free;
+    if (JS_LIKELY(free)) {
+        a->free = free & (free - 1);
+        return (void *)(a->base + js_ctz64(free) * a->cell_size);
+    }
 #endif
-    memset(c, 0, js_size_class_bytes[size_class]);
-    return c;
+    return js_alloc_slow(ctx, size_class);
 }
 
 #endif /* JSCONTEXT_H */

package/runtime/include/jsnum.h

@@ -1,5 +1,5 @@
 /*
- * jsnum.h — number <-> string conversion (ADR 0013).
+ * jsnum.h — number <-> string conversion.
  *
  * Digit generation and rounding come from the vendored QuickJS dtoa.c.
  * The JS grammar (StringNumericLiteral) is ours.

package/runtime/include/jsstring.h

@@ -1,11 +1,12 @@
 /*
- * jsstring.h — strings (ADR 0003).
+ * jsstring.h — strings.
  *
  * A string is a sequence of UTF-16 code units. Cells are flat (characters
  * inline, Latin-1 when every unit is <= 0xFF, else UTF-16), ropes (lazy
  * concatenations, flattened on first read) or slices (long substrings, which
- * share their parent's characters). Everything that reads characters goes
- * through a JSStrView.
+ * share their parent's characters). Strings built by appending in a loop are
+ * slices of a buffer: a flat cell with room to grow (below). Everything that
+ * reads characters goes through a JSStrView.
  */
 #ifndef JSSTRING_H
 #define JSSTRING_H
@@ -23,12 +24,21 @@ typedef struct JSContext JSContext;
 #define JS_STR_LATIN1  0x01u  /* flat: 1 byte per unit; rope: both sides are Latin-1; slice: the parent is */
 #define JS_STR_ATOM    0x02u  /* the unique interned copy of its content */
 #define JS_STR_PRIVATE 0x04u  /* a private name (#x): a property key no key listing shows */
+#define JS_STR_BUFFER  0x08u  /* flat: an append buffer, only ever a slice's parent (below) */
 
-#define JS_STRING_MAX_LENGTH ((UINT32_C(1) << 30) - 1)
+/* V8's String::kMaxLength on 64-bit, which Node's buffer.constants.MAX_STRING_LENGTH reports */
+#define JS_STRING_MAX_LENGTH ((UINT32_C(1) << 29) - 24)
 #define JS_ROPE_MIN          13    /* shorter concatenations copy instead */
 #define JS_ROPE_MAX_DEPTH    1024  /* deeper concatenations flatten eagerly */
 #define JS_SLICE_MIN         13    /* shorter substrings copy instead */
 #define JS_SLICE_MAX_WASTE   4     /* a slice is at least 1/4 of its parent; smaller ones copy */
+#define JS_BUFFER_MIN_DEPTH  16    /* appending to a rope this deep continues in a buffer */
+
+/* An append buffer is a STR_FLAT with JS_STR_BUFFER: `length` units are filled
+ * and never change again, `cell.aux` is its capacity. JS code never sees one,
+ * only slices of it at offset 0. Appending to the slice that ends at the fill
+ * mark (the newest string built in it) writes past the mark and returns a
+ * longer slice; any older one is a shorter prefix and stays valid. */
 
 typedef struct JSString {        /* kind = STR_FLAT */
     JSCell   cell;               /* flags: STR_LATIN1, STR_ATOM, CELL_STATIC */
@@ -126,7 +136,10 @@ uint32_t js_string_hash(JSContext *ctx, JSValue s);  /* cached in the cell (not
 
 /* "" and every single code unit 0…255: static atoms, never allocated. */
 JSValue js_empty_string(void);
-JSValue js_char_string(uint8_t unit);
+typedef JS_STATIC_LATIN1_TYPE(1) JSStaticChar;
+extern const JSStaticChar js_char_strings[256];
+/* Inline: generated code names one-character keys (`o.x`) with it at every access. */
+static inline JSValue js_char_string(uint8_t unit) { return js_cell((JSCell *)&js_char_strings[unit]); }
 
 /* ---- Creating strings -------------------------------------------------- */
 
@@ -149,7 +162,7 @@ bool js_string_equals(JSContext *ctx, JSValue a, JSValue b);
 /* <0, 0, >0 by code units (the relational operators on strings). */
 int js_string_compare(JSContext *ctx, JSValue a, JSValue b);
 
-/* Number::toString(n) as a string cell (ADR 0013). `n` is an int32 or a double. */
+/* Number::toString(n) as a string cell. `n` is an int32 or a double. */
 JSValue js_number_to_string(JSContext *ctx, JSValue n);
 
 /* ---- Output ------------------------------------------------------------ */

package/runtime/include/jsvalue.h

@@ -1,5 +1,5 @@
 /*
- * jsvalue.h — JS value representation (ADR 0001).
+ * jsvalue.h — JS value representation.
  *
  * NaN-boxing with raw pointers (JavaScriptCore layout):
  *
@@ -21,12 +21,16 @@
 #if defined(__GNUC__) || defined(__clang__)
 #define JS_LIKELY(x)   __builtin_expect(!!(x), 1)
 #define JS_UNLIKELY(x) __builtin_expect(!!(x), 0)
+/* An inline cache's hit, at every site of a big function too (the compiler's size limits would
+ * otherwise leave a call there): only fast paths of a few instructions. */
+#define JS_FAST_PATH   inline __attribute__((always_inline))
 #else
 #define JS_LIKELY(x)   (x)
 #define JS_UNLIKELY(x) (x)
+#define JS_FAST_PATH   inline
 #endif
 
-/* On every runtime function that can fail (ADR 0004): ignoring its result is an error. */
+/* On every runtime function that can fail: ignoring its result is an error. */
 #if defined(__GNUC__) || defined(__clang__)
 #define JS_WARN_UNUSED __attribute__((warn_unused_result))
 #elif defined(_MSC_VER)
@@ -59,7 +63,7 @@ typedef struct { uint64_t bits; } JSValue;
 #define JS_TAG_FALSE      UINT64_C(0x06)
 #define JS_TAG_TRUE       UINT64_C(0x07)
 #define JS_TAG_UNDEFINED  UINT64_C(0x0A)
-#define JS_TAG_EXCEPTION  UINT64_C(0x0E)  /* internal: "an exception is pending" (ADR 0004) */
+#define JS_TAG_EXCEPTION  UINT64_C(0x0E)  /* internal: "an exception is pending" */
 
 #define JS_EMPTY      ((JSValue){ JS_TAG_EMPTY })
 #define JS_NULL       ((JSValue){ JS_TAG_NULL })

package/runtime/src/arguments.c

@@ -1,4 +1,4 @@
-/* Arguments objects (ECMAScript §10.4.4; ADR 0006 prologue).
+/* Arguments objects (ECMAScript §10.4.4).
  *
  * Unmapped (strict code, or a non-simple parameter list): an ordinary object of
  * the Arguments class holding the argument values, `length`, and a `callee` that
@@ -94,7 +94,7 @@ JSValue js_new_arguments(JSContext *ctx, JSValue args, JSValue callee, JSValue e
     js_define_data(ctx, o, JS_SYMBOL(iterator), ctx->intrinsics[JS_INTRINSIC_ARRAY_VALUES], JS_PROP_WRITABLE | JS_PROP_CONFIGURABLE);
     if (slots) {
         /* mapped: only the parameters actually passed alias (§10.4.4.7 step 15), and at most 64 */
-        a->env = js_as_env(env);
+        js_store_ptr(ctx, &a->obj.cell, &a->env, js_as_env(env));
         a->slots = slots;
         for (uint32_t i = 0; i < nmapped && i < argc && i < 64; i++)
             if (slots[i] != UINT32_MAX) a->mapped |= (uint64_t)1 << i;  /* duplicate names: only the last maps */

package/runtime/src/array.c

@@ -1,4 +1,4 @@
-/* Array and Array.prototype (§23.1): core built-ins (ADR 0014). The methods are generic, as
+/* Array and Array.prototype (§23.1): core built-ins. The methods are generic, as
  * the spec makes them: they work on any array-like through Get/Set/HasProperty/Delete, so
  * holes, getters and proxies-to-come behave as in V8. Methods that create arrays honour
  * Symbol.species (ArraySpeciesCreate). */
@@ -8,6 +8,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "elements.h"
 #include "internal.h"
 #include "js_atoms.h"
 #include "js_convert.h"
@@ -502,6 +503,8 @@ CORE(array_proto_fill) {
     double len, k, final;
     if (receiver(ctx, this_val, "Array.prototype.fill", &len) < 0) return JS_EXCEPTION;
     if (js_relative_index(ctx, ARG(1), len, 0, &k) < 0 || js_relative_index(ctx, ARG(2), len, len, &final) < 0) return JS_EXCEPTION;
+    /* an array's length is below 2^32: k and final are uint32s */
+    if (js_is_array(this_val) && k < final && js_elements_fill(ctx, js_as_object(this_val), (uint32_t)k, (uint32_t)final, ARG(0))) return this_val;
     for (; k < final; k++)
         if (set_index(ctx, this_val, k, ARG(0)) < 0) return JS_EXCEPTION;
     return this_val;

package/runtime/src/arraybuffer.c

@@ -1,9 +1,10 @@
-/* ArrayBuffer and DataView (ECMAScript §25.1, §25.3), the arraybuffer component (ADR 0014):
+/* ArrayBuffer and DataView (ECMAScript §25.1, §25.3), the arraybuffer component:
  * resizable buffers, transfer, and the immutable-ArrayBuffer proposal; DataView with Float16.
- * The BigInt64 accessors exist when the bigint component does (ADR 0016).
+ * The BigInt64 accessors exist when the bigint component does.
  *
- * A buffer's bytes are malloc'd and freed by its finalizer. A detached buffer has no bytes and
- * length 0. Views read the buffer's current data pointer and length on every access, since a
+ * A buffer's bytes are malloc'd and freed by its finalizer, and counted as the heap's external
+ * memory: byte_length of them while it has any. A detached buffer has no
+ * bytes and length 0. Views read the buffer's current data pointer and length on every access, since a
  * resize or a transfer may move or drop the bytes. */
 #include <math.h>
 #include <stdio.h>
@@ -27,8 +28,9 @@
 /* ---- ArrayBuffer objects --------------------------------------------------------------------- */
 
 static void buffer_finalize(JSRuntime *rt, JSCell *c) {
-    (void)rt;
-    free(((JSArrayBuffer *)c)->data);
+    JSArrayBuffer *b = (JSArrayBuffer *)c;
+    if (b->data) js_gc_external_sub(rt, b->byte_length);
+    free(b->data);
 }
 
 static const JSClass array_buffer_class = { "ArrayBuffer", sizeof(JSArrayBuffer), NULL, NULL, NULL, NULL, NULL, buffer_finalize, NULL };
@@ -64,6 +66,12 @@ static int alloc_bytes(JSContext *ctx, double length, uint8_t **out) {
     return 0;
 }
 
+/* A buffer's bytes went from `from` to `to` (0: none). */
+static void resize_external(JSContext *ctx, size_t from, size_t to) {
+    if (to > from) js_gc_external_add(ctx->rt, to - from);
+    else js_gc_external_sub(ctx->rt, from - to);
+}
+
 /* AllocateArrayBuffer (§25.1.3.1): the prototype first, then the bytes. max < 0: not resizable. */
 static JSValue allocate(JSContext *ctx, JSValue new_target, double length, double max) {
     if (max >= 0 && length > max) return js_throw_range_error(ctx, "Invalid array buffer max length");
@@ -75,6 +83,7 @@ static JSValue allocate(JSContext *ctx, JSValue new_target, double length, doubl
     JSArrayBuffer *b = (JSArrayBuffer *)js_alloc_object(ctx, JS_CELL_OBJECT, js_shape_root(ctx, &array_buffer_class, proto, 0));
     b->data = data;
     b->byte_length = (size_t)length;
+    if (data) js_gc_external_add(ctx->rt, b->byte_length);
     b->max_byte_length = max >= 0 ? (size_t)max : (size_t)length;
     b->flags = max >= 0 ? JS_BUFFER_RESIZABLE : 0;
     return js_object_value(&b->obj);
@@ -90,6 +99,7 @@ int js_array_buffer_detach(JSContext *ctx, JSValue buffer) {
         js_discard(js_throw_type_error(ctx, "Cannot detach an immutable ArrayBuffer"));
         return -1;
     }
+    if (b->data) js_gc_external_sub(ctx->rt, b->byte_length);
     free(b->data);
     b->data = NULL;
     b->byte_length = 0;
@@ -198,6 +208,7 @@ BUILTIN(array_buffer_resize) {
         if (n > b->byte_length) memset(data + b->byte_length, 0, n - b->byte_length);
         b->data = data;
     }
+    resize_external(ctx, b->byte_length, n);
     b->byte_length = n;
     return JS_UNDEFINED;
 }
@@ -295,6 +306,7 @@ static JSValue copy_and_detach(JSContext *ctx, JSValue this_val, JSValue new_len
         if (!data) return js_throw_range_error(ctx, "Array buffer allocation failed");
         if (n > b->byte_length) memset(data + b->byte_length, 0, n - b->byte_length);
     }
+    resize_external(ctx, b->byte_length, n);  /* counted for nb from here on */
     b->data = NULL;  /* allocate() may collect: b must not free them */
     JSValue r = allocate(ctx, JS_UNDEFINED, 0, max);
     JSArrayBuffer *nb = js_as_array_buffer(r);
@@ -575,7 +587,7 @@ static const JSBuiltin data_view_proto[] = {
     JS_BUILTIN_SYMBOL_STRING(toStringTag, "DataView", JS_PROP_CONFIGURABLE),
 };
 
-/* with BigInt (ADR 0016): the bigint component is installed first when the program reaches it */
+/* with BigInt: the bigint component is installed first when the program reaches it */
 static const JSBuiltin data_view_bigint_proto[] = {
     JS_BUILTIN_FN("getBigInt64", data_view_get_BigInt64, 1),
     JS_BUILTIN_FN("setBigInt64", data_view_set_BigInt64, 2),

package/runtime/src/async_iter.c

@@ -1,6 +1,6 @@
 /* Async generators (ECMAScript §27.6) and async iteration (§27.1.4–6): the request queue
  * and its driver, %AsyncIteratorPrototype%, the async-from-sync iterator, for await, and
- * yield* in async generators (§15.5.5). ADR 0007. */
+ * yield* in async generators (§15.5.5). */
 #include "internal.h"
 #include "js_atoms.h"
 #include "js_builtins.h"
@@ -55,7 +55,7 @@ static void request_visit(JSCell *c, JSTracer *trc) {
     js_trace_value(trc, r->promise);
     js_trace_value(trc, r->next);
 }
-static const JSCellClass request_class = { "AsyncGeneratorRequest", request_visit, NULL };
+static const JSCellClass request_class = { "AsyncGeneratorRequest", request_visit, NULL, NULL };
 
 static const JSClass async_generator_class = { "AsyncGenerator", sizeof(JSGenerator), NULL, NULL, NULL, NULL, js_generator_visit, NULL, NULL };
 
@@ -324,7 +324,7 @@ static void async_iter_visit(JSCell *c, JSTracer *trc) {
     js_trace_value(trc, ((AsyncIter *)c)->iterator);
     js_trace_value(trc, ((AsyncIter *)c)->next);
 }
-static const JSCellClass async_iter_class = { "AsyncIteratorRecord", async_iter_visit, NULL };
+static const JSCellClass async_iter_class = { "AsyncIteratorRecord", async_iter_visit, NULL, NULL };
 
 static AsyncIter *rec_of(JSValue rec) { return (AsyncIter *)js_as_cell(rec); }
 
@@ -473,6 +473,7 @@ static void install_async_iterator(JSContext *ctx, JSObject *global) {
     JSObject *agp = js_as_object(in[JS_INTRINSIC_ASYNC_GENERATOR_PROTOTYPE]);
     js_define_data(ctx, agfp, JS_ATOM(prototype), in[JS_INTRINSIC_ASYNC_GENERATOR_PROTOTYPE], JS_PROP_CONFIGURABLE);
     js_define_data(ctx, agfp, JS_SYMBOL(toStringTag), js_atom_from_cstr(ctx, "AsyncGeneratorFunction"), JS_PROP_CONFIGURABLE);
+    js_define_function_kind_ctor(ctx, in[JS_INTRINSIC_ASYNC_GENERATOR_FUNCTION_PROTOTYPE], 2);
     js_define_data(ctx, agp, JS_ATOM(constructor), in[JS_INTRINSIC_ASYNC_GENERATOR_FUNCTION_PROTOTYPE], JS_PROP_CONFIGURABLE);
     (void)js_define_method(ctx, agp, "next", async_generator_next, 1);
     (void)js_define_method(ctx, agp, "return", async_generator_return, 1);

package/runtime/src/atoms.c

@@ -1,4 +1,4 @@
-/* Atoms: interned strings, held weakly (ADR 0003). */
+/* Atoms: interned strings, held weakly. */
 #include "js_atoms.h"
 
 #include <stdlib.h>
@@ -63,6 +63,24 @@ static void insert(JSAtomTable *t, JSString *s, uint32_t hash) {
     t->count++;
 }
 
+/* Removes `s`, which is in the table. Linear probing: later entries of its probe run move back
+ * into the hole, so that every lookup still finds them. */
+static void remove_atom(JSAtomTable *t, const JSString *s) {
+    size_t mask = t->cap - 1, i = s->hash & mask;
+    while (t->entries[i].str != s) i = (i + 1) & mask;
+    t->entries[i].str = NULL;
+    t->count--;
+    for (size_t j = (i + 1) & mask; t->entries[j].str; j = (j + 1) & mask) {
+        size_t home = t->entries[j].hash & mask;
+        bool stays = i <= j ? (i < home && home <= j) : (i < home || home <= j);
+        if (!stays) {
+            t->entries[i] = t->entries[j];  /* barrier: none, the table is malloc'd and weak */
+            t->entries[j].str = NULL;
+            i = j;
+        }
+    }
+}
+
 /* ---- Lifecycle --------------------------------------------------------- */
 
 void js_register_static_atoms(JSRuntime *rt, const JSString *const *cells, size_t n) {
@@ -96,10 +114,18 @@ void js_atoms_init(JSRuntime *rt) {
 
 static bool survives(const JSString *s) { return js_gc_is_marked(&s->cell); }
 
-/* Drops unmarked atoms and resizes for the survivors: load <= 1/2, shrinking
- * after mass death (dynamic keys), never below 512 entries. */
-void js_atoms_sweep(JSRuntime *rt) {
+/* Drops unmarked atoms. A young collection checks only the atoms added since the last one, and
+ * removes the dead ones in place. A full collection checks every atom, and resizes for the
+ * survivors: load <= 1/2, shrinking after mass death (dynamic keys), never below 512 entries. */
+void js_atoms_sweep(JSRuntime *rt, bool full) {
     JSAtomTable *t = &rt->atoms;
+    if (!full) {
+        for (size_t i = 0; i < t->young_count; i++)
+            if (!survives(t->young[i])) remove_atom(t, t->young[i]);
+        t->young_count = 0;
+        return;
+    }
+    t->young_count = 0;
     size_t live = 0;
     for (size_t i = 0; i < t->cap; i++) live += t->entries[i].str && survives(t->entries[i].str);
     size_t cap = 512;
@@ -110,6 +136,8 @@ void js_atoms_sweep(JSRuntime *rt) {
 void js_atoms_free(JSRuntime *rt) {
     free(rt->atoms.entries);
     rt->atoms.entries = NULL;
+    free(rt->atoms.young);
+    rt->atoms.young = NULL;
 }
 
 size_t js_atom_count(const JSRuntime *rt) {
@@ -137,6 +165,12 @@ JSValue js_atomize(JSContext *ctx, JSValue s) {
     flat->cell.flags |= JS_STR_ATOM;  /* immutable content: becoming the atom changes nothing else */
     flat->hash = hash;
     insert(t, flat, hash);
+    if (t->young_count == t->young_cap) {
+        t->young_cap = t->young_cap ? t->young_cap * 2 : 256;
+        t->young = realloc(t->young, t->young_cap * sizeof *t->young);
+        if (!t->young) js_fatal("out of memory growing the atom table");
+    }
+    t->young[t->young_count++] = flat;
     return js_cell(&flat->cell);
 }
 

package/runtime/src/base64.c

@@ -1,5 +1,5 @@
-/* atob and btoa (HTML §8.3, forgiving-base64 in Infra §4.7), the base64 component (ADR 0012,
- * layer 2), which needs domexception: Node's checks, in Node's order, and its DOMExceptions. */
+/* atob and btoa (HTML §8.3, forgiving-base64 in Infra §4.7), the base64 component,
+ * which needs domexception: Node's checks, in Node's order, and its DOMExceptions. */
 #include <stdlib.h>
 
 #include "builtins_util.h"

package/runtime/src/bigint.c

@@ -1,4 +1,4 @@
-/* BigInt (ECMAScript §6.1.6.2, §21.2), the bigint component (ADR 0016).
+/* BigInt (ECMAScript §6.1.6.2, §21.2), the bigint component.
  *
  * The arithmetic is ported from QuickJS (https://github.com/bellard/quickjs, upstream commit
  * a38171d37357edff256c28a73eaeb41d2466d1d5, the one runtime/third_party/quickjs-dtoa comes from):