visaljs 0.0.7 → 0.0.9

package/runtime/src/json.c

@@ -1,4 +1,4 @@
-/* JSON (§25.5): an optional component (ADR 0014), and the serializer util.format's %j uses.
+/* JSON (§25.5): an optional component, and the serializer util.format's %j uses.
  *
  * JSON.parse follows V8's parser closely enough to give its error messages: the same checks in
  * the same order, at the same positions ("Unexpected token '}', "[1,}" is not valid JSON",

package/runtime/src/math.c

@@ -1,4 +1,4 @@
-/* Math (§21.3), an optional component (ADR 0014). The transcendental functions are V8's
+/* Math (§21.3), an optional component. The transcendental functions are V8's
  * fdlibm port, so results match Node's to the last bit; the rest are exact. */
 #include "js_builtins.h"
 
@@ -9,6 +9,7 @@
 
 #include "ieee754.h"
 #include "internal.h"
+#include "js_buffer.h"
 #include "js_convert.h"
 #include "js_exception.h"
 #include "js_ops.h"
@@ -58,6 +59,10 @@ MATH1(math_exp, js_ieee754_exp)
 MATH1(math_expm1, js_ieee754_expm1)
 MATH1(math_floor, floor)
 MATH1(math_fround, js_fround)
+
+/* Math.f16round: the nearest half-precision float, as Float16Array stores it */
+static double js_f16round(double x) { return js_from_float16(js_to_float16(x)); }
+MATH1(math_f16round, js_f16round)
 MATH1(math_log, js_ieee754_log)
 MATH1(math_log1p, js_ieee754_log1p)
 MATH1(math_log10, js_ieee754_log10)
@@ -232,9 +237,12 @@ static const JSBuiltin math_entries[] = {
     JS_BUILTIN_NUMBER("PI", 3.141592653589793, 0),
     JS_BUILTIN_NUMBER("SQRT1_2", 0.7071067811865476, 0),
     JS_BUILTIN_NUMBER("SQRT2", 1.4142135623730951, 0),
+    JS_BUILTIN_FN("f16round", math_f16round, 1),  /* after the constants, where V8 13.6 adds it */
     JS_BUILTIN_SYMBOL_STRING(toStringTag, "Math", JS_PROP_CONFIGURABLE),
 };
 
+const JSNativeFn js_math_inline[JS_MATH_INLINE_COUNT] = { math_sqrt, math_abs, math_floor, math_ceil, math_trunc };
+
 static void install_math(JSContext *ctx, JSObject *global) {
     JSValue math = js_new_builtin_object(ctx, math_entries, JS_COUNTOF(math_entries));
     js_define_data(ctx, global, js_atom_from_cstr(ctx, "Math"), math, JS_BUILTIN_METHOD_ATTRS);

package/runtime/src/module.c

@@ -1,4 +1,4 @@
-/* Module-level host behavior (ADR 0009): import.meta, one object per original file, and
+/* Module-level host behavior: import.meta, one object per original file, and
  * import() of a specifier the bundler couldn't resolve at build time. Errors and URLs
  * follow Node: ERR_MODULE_NOT_FOUND, file: URLs percent-encoded like the WHATWG URL parser. */
 #include "js_module.h"
@@ -288,7 +288,7 @@ JSValue js_dynamic_import(JSContext *ctx, JSValue specifier, JSValue options, co
         JSValue with = js_get(ctx, js_as_object(options), js_atom_from_cstr(ctx, "with"), options);
         if (js_is_exception(with)) return reject_pending(ctx, promise);
         if (!js_is_undefined(with)) {
-            if (!js_is_object(with)) return reject_type_error(ctx, promise, "The 'assert' option must be an object");
+            if (!js_is_object(with)) return reject_type_error(ctx, promise, "The 'with' option must be an object");  /* V8 13.6's */
             JSValue keys = js_own_keys(ctx, js_as_object(with));
             if (js_is_exception(keys)) return reject_pending(ctx, promise);
             JSValueArray *list = (JSValueArray *)js_as_cell(keys);
@@ -301,7 +301,7 @@ JSValue js_dynamic_import(JSContext *ctx, JSValue specifier, JSValue options, co
                 if (!has || !(desc.attrs & JS_PROP_ENUMERABLE)) continue;
                 JSValue v = js_get(ctx, js_as_object(with), key, with);
                 if (js_is_exception(v)) return reject_pending(ctx, promise);
-                if (!js_is_string(v)) return reject_type_error(ctx, promise, "Import assertion value must be a string");
+                if (!js_is_string(v)) return reject_type_error(ctx, promise, "Import attribute value must be a string");
             }
         }
     }

package/runtime/src/object.c

@@ -1,4 +1,4 @@
-/* Objects and the ordinary internal methods (ADR 0005; ECMAScript §10.1). */
+/* Objects and the ordinary internal methods (ECMAScript §10.1). */
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -21,50 +21,24 @@ const JSElements js_empty_elements = {
     { JS_CELL_ELEMENTS, 0, JS_CELL_STATIC, 0 }, JS_ELEMENTS_DENSE, 0, 0, 0, 0, 0,
 };
 
-/* ---- GC classes ------------------------------------------------------------ */
+/* ---- GC classes (gc_visit.h visits them) ----------------------------------- */
 
-static void accessor_visit(JSCell *c, JSTracer *trc) {
-    JSAccessorPair *p = (JSAccessorPair *)c;
-    js_trace_value(trc, p->get);
-    js_trace_value(trc, p->set);
-}
-const JSCellClass js_accessor_cell_class = { "AccessorPair", accessor_visit, NULL };
-
-static void elements_visit(JSCell *c, JSTracer *trc) {
-    JSElements *e = (JSElements *)c;
-    if (e->kind == JS_ELEMENTS_SPARSE) {
-        JSSparseElements *s = (JSSparseElements *)e;
-        for (uint32_t k = 0; k < s->cap; k++)
-            if (s->entries[k].state == 1) js_trace_value(trc, s->entries[k].value);
-        return;
-    }
-    for (uint32_t i = 0; i < e->length; i++) js_trace_value(trc, e->data[i]);
-}
-const JSCellClass js_elements_cell_class = { "Elements", elements_visit, js_elements_finalize };
-
-static void object_visit(JSCell *c, JSTracer *trc) {
-    JSObject *o = (JSObject *)c;
-    js_trace_cell(trc, &o->shape->cell);
-    if (o->ool) js_trace_cell(trc, &o->ool->cell);
-    js_trace_cell(trc, &o->elements->cell);
-    JSValue *slots = js_object_slots(o);
-    for (uint16_t i = 0; i < o->shape->inline_cap; i++) js_trace_value(trc, slots[i]);
-    if (o->shape->cls->visit) o->shape->cls->visit(c, trc);
-}
+const JSCellClass js_accessor_cell_class = { "AccessorPair", NULL, NULL, NULL };
+const JSCellClass js_elements_cell_class = { "Elements", NULL, js_elements_finalize, NULL };
 
 static void object_finalize(JSRuntime *rt, JSCell *c) {
     JSObject *o = (JSObject *)c;
     if (o->shape->cls->finalize) o->shape->cls->finalize(rt, c);
 }
-const JSCellClass js_object_cell_class = { "Object", object_visit, object_finalize };
+const JSCellClass js_object_cell_class = { "Object", NULL, object_finalize, NULL };
 
 /* ---- Allocation ---------------------------------------------------------------- */
 
 JSObject *js_alloc_object(JSContext *ctx, JSCellKind kind, JSShape *shape) {
     size_t size = shape->slot_offset + (size_t)shape->inline_cap * sizeof(JSValue);
     JSObject *o = (JSObject *)js_alloc_cell(ctx, kind, size);
-    o->shape = shape;
-    o->elements = (JSElements *)&js_empty_elements;
+    o->shape = shape;  /* barrier: fresh cell */
+    o->elements = (JSElements *)&js_empty_elements;  /* barrier: fresh cell */
     JSValue *slots = js_object_slots(o);
     for (uint16_t i = 0; i < shape->inline_cap; i++) slots[i] = JS_UNDEFINED;
     if (shape->cls->finalize) {
@@ -167,11 +141,11 @@ static void ensure_slot(JSContext *ctx, JSObject *o, uint32_t n) {
     uint32_t need = n - cap + 1;
     uint32_t have = o->ool ? o->ool->cell.aux : 0;
     if (need <= have) return;
-    uint32_t grown = have < 4 ? 4 : have + have / 2;  /* ×1.5 (ADR 0005) */
+    uint32_t grown = have < 4 ? 4 : have + have / 2;  /* ×1.5 */
     if (grown < need) grown = need;
     JSValueArray *a = js_alloc_value_array(ctx, grown);
-    for (uint32_t i = 0; i < grown; i++) a->values[i] = i < have ? o->ool->values[i] : JS_UNDEFINED;
-    o->ool = a;
+    for (uint32_t i = 0; i < grown; i++) a->values[i] = i < have ? o->ool->values[i] : JS_UNDEFINED;  /* barrier: fresh cell */
+    js_store_ptr(ctx, &o->cell, &o->ool, a);
 }
 
 /* Gives `o` a private dictionary shape holding its current properties. */
@@ -180,13 +154,13 @@ static void to_dictionary(JSContext *ctx, JSObject *o) {
     JSShape *old = o->shape;
     JSShape *d = js_alloc_shape(ctx);
     d->cls = old->cls;
-    d->proto = old->proto;
+    d->proto = old->proto;  /* barrier: fresh cell */
     d->flags = (uint8_t)(old->flags | JS_SHAPE_DICTIONARY);
     d->inline_cap = old->inline_cap;
     d->slot_offset = old->slot_offset;
     d->prop_count = old->prop_count;
     d->table = js_prop_table_clone(js_shape_entries(old));
-    o->shape = d;
+    js_object_set_shape(ctx, o, d);
 }
 
 static void add_own(JSContext *ctx, JSObject *o, JSValue key, JSValue value, uint8_t attrs) {
@@ -198,7 +172,7 @@ static void add_own(JSContext *ctx, JSObject *o, JSValue key, JSValue value, uin
         if (!crowded && !too_many_transitions) {
             JSShape *child = js_shape_add(ctx, s, key, attrs);
             ensure_slot(ctx, o, s->prop_count);
-            o->shape = child;
+            js_object_set_shape(ctx, o, child);
             js_store(ctx, &o->cell, js_object_slot(o, child->prop_count - 1), value);
             return;
         }
@@ -208,7 +182,7 @@ static void add_own(JSContext *ctx, JSObject *o, JSValue key, JSValue value, uin
             for (uint32_t i = 0; i < t->count; i++)
                 if (js_same_bits(t->items[i].key, key) && t->items[i].attrs == attrs) {
                     ensure_slot(ctx, o, s->prop_count);
-                    o->shape = t->items[i].child;
+                    js_object_set_shape(ctx, o, t->items[i].child);
                     js_store(ctx, &o->cell, js_object_slot(o, o->shape->prop_count - 1), value);
                     return;
                 }
@@ -218,6 +192,7 @@ static void add_own(JSContext *ctx, JSObject *o, JSValue key, JSValue value, uin
     uint32_t slot = o->shape->prop_count;
     ensure_slot(ctx, o, slot);
     js_prop_table_add(o->shape->table, key, slot, attrs);
+    js_write_barrier(ctx, &o->shape->cell, NULL, key);  /* a dictionary's keys are traced from its shape */
     o->shape->prop_count++;
     js_store(ctx, &o->cell, js_object_slot(o, slot), value);
 }
@@ -227,7 +202,7 @@ static void remove_own(JSContext *ctx, JSObject *o, JSValue key, int32_t slot) {
     if (!is_dictionary(o) && s->parent && js_same_bits(s->key, key)) {
         /* the last-added property: back to the parent shape */
         *js_object_slot(o, (uint32_t)slot) = JS_UNDEFINED;
-        o->shape = s->parent;
+        js_object_set_shape(ctx, o, s->parent);
         return;
     }
     to_dictionary(ctx, o);
@@ -395,10 +370,18 @@ int js_define_own_property(JSContext *ctx, JSObject *o, JSValue key, const JSPro
     return js_ordinary_define_own_property(ctx, o, key, desc, throw_on_fail);
 }
 
+static bool define_cached(JSContext *ctx, JSObject *o, JSValue key, JSValue value);
+static void remember_define(JSContext *ctx, JSShape *before, JSObject *o, JSValue key);
+
 void js_define_data(JSContext *ctx, JSObject *o, JSValue key, JSValue value, uint8_t attrs) {
+    /* an object literal's properties: a new key's transition, seen before, is taken directly */
+    bool plain = attrs == JS_PROP_DEFAULT && !js_key_is_index(key);
+    if (plain && define_cached(ctx, o, key, value)) return;
+    JSShape *before = o->shape;
     JSPropertyDescriptor d = js_data_descriptor(value, attrs);
     int r = js_define_own_property(ctx, o, key, &d, false);
     (void)r;
+    if (plain) remember_define(ctx, before, o, key);
 }
 
 JSValue js_get_prototype_of(JSObject *o) {
@@ -449,7 +432,7 @@ static void reroot(JSContext *ctx, JSObject *o, JSValue proto) {
     JSShape *r = js_shape_root(ctx, s->cls, proto, s->inline_cap);
     for (uint32_t i = 0; i < n; i++) r = js_shape_add(ctx, r, steps[i]->key, steps[i]->attrs);
     if (steps != small) free(steps);
-    o->shape = r;
+    js_object_set_shape(ctx, o, r);
 }
 
 int js_set_prototype_of(JSContext *ctx, JSObject *o, JSValue proto) {
@@ -463,7 +446,7 @@ int js_set_prototype_of(JSContext *ctx, JSObject *o, JSValue proto) {
         return 1;
     }
     to_dictionary(ctx, o);
-    o->shape->proto = proto;
+    js_store(ctx, &o->shape->cell, &o->shape->proto, proto);
     return 1;
 }
 
@@ -621,12 +604,12 @@ JSValue js_ordinary_own_keys(JSContext *ctx, JSObject *o) {
     JSValueArray *keys = js_alloc_value_array(ctx, n_idx + n_extra + n_named);
     JSPropTable *t = js_shape_entries(o->shape);
     uint32_t k = 0;
-    for (uint32_t i = 0; i < n_idx; i++) keys->values[k++] = indices->values[i];
-    for (uint32_t i = 0; i < n_extra; i++) keys->values[k++] = extra[i];
+    for (uint32_t i = 0; i < n_idx; i++) keys->values[k++] = indices->values[i];  /* barrier: fresh cell */
+    for (uint32_t i = 0; i < n_extra; i++) keys->values[k++] = extra[i];  /* barrier: fresh cell */
     for (int symbols = 0; symbols < 2; symbols++)
         for (uint32_t i = 0; i < n_named; i++) {
             JSValue key = t->entries[i].key;
-            if (js_is_symbol(key) == (symbols == 1) && !js_is_private_name(key)) keys->values[k++] = key;
+            if (js_is_symbol(key) == (symbols == 1) && !js_is_private_name(key)) keys->values[k++] = key;  /* barrier: fresh cell */
         }
     keys->cell.aux = k;  /* private names don't count */
     return js_cell(&keys->cell);
@@ -634,9 +617,9 @@ JSValue js_ordinary_own_keys(JSContext *ctx, JSObject *o) {
 
 /* ---- Arrays (§10.4.2) ------------------------------------------------------------ */
 
-#define ARRAY_LENGTH_FROZEN 0x80u  /* cell.reserved: `length` is non-writable */
+#define ARRAY_LENGTH_FROZEN 0x01u  /* cell flags (kind-specific): `length` is non-writable */
 
-static bool length_writable(JSObject *a) { return !(a->cell.reserved & ARRAY_LENGTH_FROZEN); }
+static bool length_writable(JSObject *a) { return !(a->cell.flags & ARRAY_LENGTH_FROZEN); }
 
 static bool is_length(JSValue key) { return js_same_bits(key, JS_ATOM(length)); }
 
@@ -683,7 +666,7 @@ static int array_set_length(JSContext *ctx, JSObject *a, const JSPropertyDescrip
         }
     }
     a->cell.aux = new_len;
-    if (make_frozen) a->cell.reserved |= ARRAY_LENGTH_FROZEN;
+    if (make_frozen) a->cell.flags |= ARRAY_LENGTH_FROZEN;
     return result;
 }
 
@@ -721,7 +704,7 @@ static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity
         JSElements *e = (JSElements *)js_alloc_cell(ctx, JS_CELL_ELEMENTS, sizeof(JSElements) + (size_t)capacity * sizeof(JSValue));
         e->kind = JS_ELEMENTS_DENSE;
         e->capacity = capacity;
-        a->elements = e;
+        js_store_ptr(ctx, &a->cell, &a->elements, e);
     }
     return js_object_value(a);
 }
@@ -746,6 +729,13 @@ int js_array_push(JSContext *ctx, JSObject *a, JSValue v) {
         js_discard(js_throw_type_error(ctx, "Pushing 1 elements on an array-like of length 4294967295 is disallowed"));
         return -1;
     }
+    /* the usual case, a dense array without holes at its end: what the define below would do */
+    JSElements *e = a->elements;
+    if (a->cell.kind == JS_CELL_ARRAY && e->kind == JS_ELEMENTS_DENSE && e->length == len && length_writable(a) && js_is_extensible(a)) {
+        js_elements_append_dense(ctx, a, v);
+        a->cell.aux = len + 1;
+        return 1;
+    }
     JSPropertyDescriptor d = js_data_descriptor(v, JS_PROP_DEFAULT);
     return js_define_own_property(ctx, a, js_index_key(len), &d, true);
 }
@@ -842,7 +832,7 @@ int js_set_value(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool stric
     return js_set(ctx, js_primitive_prototype(ctx, obj), key, v, obj, strict);
 }
 
-/* ---- Inline caches (ADR 0005) ------------------------------------------------------- */
+/* ---- Inline caches ------------------------------------------------------------------ */
 
 void js_register_prop_caches(JSRuntime *rt, JSPropCache *ics, size_t n) {
     JSPropCacheTables *t = &rt->prop_caches;
@@ -878,6 +868,7 @@ void js_prop_caches_sweep(JSRuntime *rt) {
     /* the shared caches hold shapes and holders unmarked: emptied, not swept */
     if (rt->mega_get) memset(rt->mega_get, 0, MEGA_SIZE * sizeof *rt->mega_get);
     if (rt->mega_set) memset(rt->mega_set, 0, MEGA_SIZE * sizeof *rt->mega_set);
+    if (rt->mega_define) memset(rt->mega_define, 0, MEGA_SIZE * sizeof *rt->mega_define);
     for (size_t t = 0; t < rt->prop_caches.count; t++) {
         struct JSPropCacheTable *table = &rt->prop_caches.tables[t];
         for (size_t i = 0; i < table->n; i++) {
@@ -895,20 +886,53 @@ void js_prop_caches_sweep(JSRuntime *rt) {
 void js_prop_caches_free(JSRuntime *rt) {
     free(rt->mega_get);
     free(rt->mega_set);
-    rt->mega_get = rt->mega_set = NULL;
+    free(rt->mega_define);
+    rt->mega_get = rt->mega_set = rt->mega_define = NULL;
     free(rt->prop_caches.tables);
     memset(&rt->prop_caches, 0, sizeof rt->prop_caches);
 }
 
-/* Whether the prototypes after ic->shape still have the shapes the cache saw. */
-static bool chain_holds(const JSPropCache *ic) {
-    JSValue p = ic->shape->proto;
-    for (unsigned d = 0; d < ic->depth; d++) {
-        if (!js_is_object(p)) return false;
-        JSShape *s = js_as_object(p)->shape;
-        if (s != ic->chain[d]) return false;
-        p = s->proto;
+/* js_define_data of a new key with default attributes: a transition from o's shape remembered
+ * by remember_define. The shape fixes the class (no define hook), extensibility and that the key
+ * isn't there yet, so the define would add it the same way. */
+static bool define_cached(JSContext *ctx, JSObject *o, JSValue key, JSValue value) {
+    JSMegaEntry *m = mega_entry(&ctx->rt->mega_define, o->shape, key);
+    if (m->c.shape != o->shape || !js_same_bits(m->key, key)) return false;
+    JSShape *next = m->c.next;  /* on the stack: kept alive if ensure_slot collects */
+    ensure_slot(ctx, o, o->shape->prop_count);
+    js_object_set_shape(ctx, o, next);
+    js_store(ctx, &o->cell, js_object_slot(o, next->prop_count - 1), value);
+    return true;
+}
+
+static void remember_define(JSContext *ctx, JSShape *before, JSObject *o, JSValue key) {
+    if (before->cls->define_own_property || is_dictionary(o) || o->shape->parent != before || !js_same_bits(o->shape->key, key) ||
+        o->shape->attrs != JS_PROP_DEFAULT)
+        return;
+    JSMegaEntry *m = mega_entry(&ctx->rt->mega_define, before, key);
+    m->key = key;
+    m->c = (JSPropCache){ .kind = JS_IC_ADD, .shape = before, .next = o->shape };
+}
+
+/* A cache with its inline fast path set: `fast` for an OWN cache whose slot is inline. */
+static JSPropCache with_fast_path(JSPropCache c) {
+    if (c.kind == JS_IC_OWN && c.slot < c.shape->inline_cap) {
+        uint32_t off = c.shape->slot_offset + c.slot * (uint32_t)sizeof(JSValue);
+        if (off <= UINT16_MAX) {
+            c.fast = c.shape;
+            c.fast_off = (uint16_t)off;
+        }
     }
+    return c;
+}
+
+/* Whether the prototypes after ic->shape still have the shapes the cache saw. */
+/* A cache's prototypes are as it saw them: at the epoch it remembers no prototype has changed
+ * shape since; else walk the chain, and remember the epoch it still holds at. */
+static bool chain_holds(JSContext *ctx, JSPropCache *ic) {
+    if (ic->epoch == ctx->rt->proto_epoch) return true;
+    if (!js_prop_cache_chain_holds(ic)) return false;
+    ic->epoch = ctx->rt->proto_epoch;
     return true;
 }
 
@@ -955,22 +979,22 @@ static void lookup(JSContext *ctx, JSObject *o, JSValue key, Lookup *l) {
 }
 
 /* A cached get that still holds for o: true with the value (or JS_EXCEPTION from a getter). */
-static bool cached_get(JSContext *ctx, JSObject *o, JSValue receiver, const JSPropCache *c, JSValue *out) {
+static bool cached_get(JSContext *ctx, JSObject *o, JSValue receiver, JSPropCache *c, JSValue *out) {
     if (c->shape != o->shape) return false;
     switch (c->kind) {
     case JS_IC_OWN: *out = *js_object_slot(o, c->slot); return true;
     case JS_IC_PROTO:
-        if (!chain_holds(c)) return false;
+        if (!chain_holds(ctx, c)) return false;
         *out = *js_object_slot(c->holder, c->slot);
         return true;
     case JS_IC_GETTER: {
-        if (!chain_holds(c)) return false;
+        if (!chain_holds(ctx, c)) return false;
         JSAccessorPair *p = (JSAccessorPair *)js_as_cell(*js_object_slot(c->holder ? c->holder : o, c->slot));
         *out = js_is_undefined(p->get) ? JS_UNDEFINED : call_accessor(ctx, p->get, receiver, 0, JS_UNDEFINED);
         return true;
     }
     case JS_IC_ABSENT:
-        if (!chain_holds(c)) return false;
+        if (!chain_holds(ctx, c)) return false;
         *out = JS_UNDEFINED;
         return true;
     default: return false;
@@ -979,10 +1003,16 @@ static bool cached_get(JSContext *ctx, JSObject *o, JSValue receiver, const JSPr
 
 JSValue js_get_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic) {
     JS_ASSERT_NOT_EXC(obj);
-    if (!js_is_object(obj) || js_key_is_index(key)) return js_get_value(ctx, obj, key);
-    JSObject *o = js_as_object(obj);
     JSValue v;
-    if (ic && cached_get(ctx, o, obj, ic, &v)) return v;
+    /* first: the site's cache, missed inline (a prototype's property, or an out-of-line slot's).
+     * A site's key is one name: its cache never holds an index */
+    if (ic && js_is_object(obj) && cached_get(ctx, js_as_object(obj), obj, ic, &v)) return v;
+    if (js_key_is_index(key) || js_is_nullish(obj) || (js_is_string(obj) && is_length(key))) return js_get_value(ctx, obj, key);
+    /* a primitive's named property (s.charCodeAt) is its prototype's: a string's own properties
+     * are only its indices and length. The prototype is cached like an object, the primitive
+     * still the receiver of a getter. */
+    JSObject *o = js_is_object(obj) ? js_as_object(obj) : js_primitive_prototype(ctx, obj);
+    if (ic && !js_is_object(obj) && cached_get(ctx, o, obj, ic, &v)) return v;
     if (o->cell.kind == JS_CELL_ARRAY && is_length(key)) return js_number((double)js_array_length(o));
     JSMegaEntry *m = mega_entry(&ctx->rt->mega_get, o->shape, key);
     if (js_same_bits(m->key, key) && cached_get(ctx, o, obj, &m->c, &v)) {
@@ -990,13 +1020,15 @@ JSValue js_get_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *
         return v;
     }
     Lookup l;
+    uint32_t epoch = ctx->rt->proto_epoch;  /* the chain as the lookup sees it */
     lookup(ctx, o, key, &l);
     if (l.exotic) return js_get(ctx, o, key, obj);
     if (l.cacheable) {
         uint8_t kind = !l.holder ? JS_IC_ABSENT : (l.attrs & JS_PROP_ACCESSOR) ? JS_IC_GETTER : l.holder == o ? JS_IC_OWN : JS_IC_PROTO;
         JSObject *holder = kind == JS_IC_ABSENT || l.holder == o ? NULL : l.holder;
-        JSPropCache c = { o->shape, l.holder ? (uint32_t)l.slot : 0, kind, l.depth, 0, holder, NULL, { NULL } };
+        JSPropCache c = { .kind = kind, .depth = l.depth, .slot = l.holder ? (uint32_t)l.slot : 0, .shape = o->shape, .holder = holder, .epoch = epoch };
         memcpy(c.chain, l.chain, sizeof c.chain);
+        c = with_fast_path(c);
         if (ic) *ic = c;
         m->key = key;
         m->c = c;
@@ -1014,10 +1046,10 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
     JS_ASSERT_NOT_EXC(v);
     if (!js_is_object(obj) || js_key_is_index(key)) return js_set_value(ctx, obj, key, v, strict);
     JSObject *o = js_as_object(obj);
-    if (ic->kind == JS_IC_ADD && o->shape == ic->shape && chain_holds(ic)) {
+    if (ic->kind == JS_IC_ADD && o->shape == ic->shape && chain_holds(ctx, ic)) {
         JSShape *next = ic->next;  /* on the stack: kept alive if ensure_slot collects */
         ensure_slot(ctx, o, o->shape->prop_count);
-        o->shape = next;
+        js_object_set_shape(ctx, o, next);
         js_store(ctx, &o->cell, js_object_slot(o, next->prop_count - 1), v);
         return 1;
     }
@@ -1028,21 +1060,22 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
             js_store(ctx, &o->cell, js_object_slot(o, m->c.slot), v);
             return 1;
         }
-        if (m->c.kind == JS_IC_ADD && chain_holds(&m->c)) {
+        if (m->c.kind == JS_IC_ADD && chain_holds(ctx, &m->c)) {
             *ic = m->c;
             JSShape *next = m->c.next;
             ensure_slot(ctx, o, o->shape->prop_count);
-            o->shape = next;
+            js_object_set_shape(ctx, o, next);
             js_store(ctx, &o->cell, js_object_slot(o, next->prop_count - 1), v);
             return 1;
         }
     }
     Lookup l;
+    uint32_t epoch = ctx->rt->proto_epoch;  /* the chain as the lookup sees it */
     lookup(ctx, o, key, &l);
     JSShape *before = o->shape;
     bool cacheable = l.cacheable && !l.exotic;
     if (cacheable && l.holder == o && (l.attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE) {
-        JSPropCache c = { before, (uint32_t)l.slot, JS_IC_OWN, 0, 0, NULL, NULL, { NULL } };
+        JSPropCache c = with_fast_path((JSPropCache){ .kind = JS_IC_OWN, .slot = (uint32_t)l.slot, .shape = before });
         *ic = c;
         m->key = key;
         m->c = c;
@@ -1053,7 +1086,7 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
     /* a plain add (no setter or read-only property on the chain): remember the transition */
     if (r == 1 && cacheable && !l.holder && !before->cls->define_own_property && !is_dictionary(o) &&
         o->shape->parent == before && js_same_bits(o->shape->key, key)) {
-        JSPropCache c = { before, 0, JS_IC_ADD, l.depth, 0, NULL, o->shape, { NULL } };
+        JSPropCache c = { .kind = JS_IC_ADD, .depth = l.depth, .shape = before, .next = o->shape, .epoch = epoch };
         memcpy(c.chain, l.chain, sizeof c.chain);
         *ic = c;
         m = mega_entry(&ctx->rt->mega_set, before, key);  /* js_set may have collected: the table was emptied, not moved */

package/runtime/src/ops.c

@@ -12,7 +12,7 @@
 
 int32_t js_double_to_int32(double d) {
     if (!isfinite(d)) return 0;
-    if (d >= -2147483648.0 && d <= 2147483647.0) return (int32_t)d;  /* truncates toward zero */
+    if (d > -9223372036854775808.0 && d < 9223372036854775808.0) return (int32_t)(uint32_t)(int64_t)d;  /* truncates toward zero */
     double m = fmod(trunc(d), 4294967296.0);  /* exact: |d| < 2^1024, fmod is exact */
     if (m < 0) m += 4294967296.0;
     return (int32_t)(uint32_t)m;
@@ -39,7 +39,7 @@ static int numerics(JSContext *ctx, JSValue *a, JSValue *b) {
     return js_is_bigint(*a) || js_is_bigint(*b);
 }
 
-/* A binary operator on ToNumeric'd operands of which one is a BigInt (ADR 0016). */
+/* A binary operator on ToNumeric'd operands of which one is a BigInt. */
 static JSValue bigint_binary(JSContext *ctx, JSBigIntOp op, JSValue a, JSValue b) {
     if (!js_is_bigint(a) || !js_is_bigint(b)) return js_throw_type_error(ctx, "Cannot mix BigInt and other types, use explicit conversions");
     return ctx->rt->bigint->arith(ctx, op, a, b);
@@ -133,7 +133,7 @@ JSValue js_exp(JSContext *ctx, JSValue a, JSValue b) {
     if (n < 0) return JS_EXCEPTION;
     if (n) return bigint_binary(ctx, JS_BIGINT_EXP, a, b);
     double x = js_as_number(a), y = js_as_number(b);
-    return js_number(js_ieee754_pow(x, y));  /* V8's: Node's results to the last bit (ADR 0014) */
+    return js_number(js_ieee754_pow(x, y));  /* V8's: Node's results to the last bit */
 }
 
 /* ---- Bitwise ------------------------------------------------------------------ */
@@ -213,6 +213,24 @@ bool js_strict_equals(JSContext *ctx, JSValue a, JSValue b) {
     return js_same_bits(a, b);
 }
 
+int32_t js_switch_string(JSContext *ctx, JSValue v, const JSString *const *cases, uint32_t n) {
+    if (!js_is_string(v)) return -1;
+    const JSCell *c = js_as_cell(v);
+    uint32_t length = js_string_length(v);
+    bool atom = js_is_atom(v);
+    for (uint32_t i = 0; i < n; i++) {
+        const JSString *s = cases[i];
+        if (s == NULL) {
+            if (length == 0) return (int32_t)i;
+            continue;
+        }
+        if (&s->cell == c) return (int32_t)i;
+        if (s->length != length || (atom && (s->cell.flags & JS_STR_ATOM))) continue;  /* distinct atoms differ */
+        if (js_string_equals(ctx, v, js_cell((JSCell *)s))) return (int32_t)i;
+    }
+    return -1;
+}
+
 /* StringToBigInt of a string: the BigInt, or EMPTY when it isn't one. */
 static JSValue string_to_bigint(JSContext *ctx, JSValue s) {
     return ctx->rt->bigint->from_string(ctx, s);