visaljs 0.0.8 → 0.0.10

package/runtime/include/js_buffer.h

@@ -10,7 +10,9 @@
 #include <stdint.h>
 #include <string.h>
 
+#include "js_convert.h"
 #include "js_object.h"
+#include "js_ops.h"
 
 #define JS_BUFFER_RESIZABLE 0x01u
 #define JS_BUFFER_DETACHED  0x02u
@@ -76,4 +78,187 @@ int js_typed_array_type(JSValue v);
 /* A new, zeroed Uint8Array of `length` bytes; its bytes are js_buffer_source_bytes'. */
 JS_WARN_UNUSED JSValue js_new_uint8_array(JSContext *ctx, size_t length);
 
+/* ---- Generated code: a typed array's elements inline ------------------------------------------ */
+
+/* The bytes of element i of a typed array generated code may read or write inline: a view of a
+ * fixed-size buffer (it can't shrink below the view, so i < length is in bounds), not detached,
+ * not immutable (for a write). NULL for anything else, which takes js_get_elem / js_set_elem. */
+static JS_FAST_PATH uint8_t *js_ta_inline_elem(JSContext *ctx, JSValue obj, int32_t i, bool write) {
+    if (!js_is_object(obj) || js_as_object(obj)->shape->cls != ctx->rt->typed_array_class) return NULL;
+    const JSTypedArray *ta = (const JSTypedArray *)js_as_object(obj);
+    const JSArrayBuffer *b = js_as_array_buffer(ta->buffer);
+    uint32_t bad = JS_BUFFER_DETACHED | JS_BUFFER_RESIZABLE | (write ? JS_BUFFER_IMMUTABLE : 0);
+    if (ta->length_tracking || i < 0 || (size_t)i >= ta->length || (b->flags & bad)) return NULL;
+    return b->data + ta->byte_offset;
+}
+
+/* obj[i]: a dense array's element or a typed array's (Int8, Uint8, Int32, Float64) inline. */
+static JS_FAST_PATH JSValue js_get_index_ta(JSContext *ctx, JSValue obj, JSValue key) {
+    if (JS_LIKELY(js_is_int32(key)) && !js_is_array(obj)) {
+        int32_t i = js_as_int32(key);
+        const uint8_t *p = js_ta_inline_elem(ctx, obj, i, false);
+        if (p) switch (((const JSTypedArray *)js_as_object(obj))->type) {
+            case JS_TA_UINT8: case JS_TA_UINT8C: return js_int32(p[i]);
+            case JS_TA_INT8: return js_int32((int8_t)p[i]);
+            case JS_TA_INT32: { int32_t v; memcpy(&v, p + 4 * (size_t)i, 4); return js_int32(v); }
+            case JS_TA_FLOAT64: { double v; memcpy(&v, p + 8 * (size_t)i, 8); return js_number(v); }
+            default: break;
+        }
+    }
+    return js_get_index(ctx, obj, key);
+}
+
+/* obj[i] = v: the same, for a Number v (no ToNumber code to run). */
+static JS_FAST_PATH int js_set_index_ta(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
+    if (JS_LIKELY(js_is_int32(key)) && js_is_number(v) && !js_is_array(obj)) {
+        int32_t i = js_as_int32(key);
+        uint8_t *p = js_ta_inline_elem(ctx, obj, i, true);
+        if (p) switch (((const JSTypedArray *)js_as_object(obj))->type) {
+            case JS_TA_UINT8: case JS_TA_INT8: p[i] = (uint8_t)(js_is_int32(v) ? js_as_int32(v) : js_double_to_int32(js_as_number(v))); return 1;
+            case JS_TA_INT32: { int32_t x = js_is_int32(v) ? js_as_int32(v) : js_double_to_int32(js_as_number(v)); memcpy(p + 4 * (size_t)i, &x, 4); return 1; }
+            case JS_TA_FLOAT64: { double x = js_as_number(v); memcpy(p + 8 * (size_t)i, &x, 8); return 1; }
+            default: break;
+        }
+    }
+    return js_set_index(ctx, obj, key, v, strict);
+}
+
+/* The same with a double key (an unboxed index): an integral one is the int32 key (-0 too: "0"). */
+static inline JSValue js_get_index_ta_f64(JSContext *ctx, JSValue obj, double key) {
+    int32_t i = (int32_t)key;
+    if (key >= -2147483648.0 && key <= 2147483647.0 && (double)i == key) return js_get_index_ta(ctx, obj, js_int32(i));
+    return js_get_index_f64(ctx, obj, key);
+}
+static inline int js_set_index_ta_f64(JSContext *ctx, JSValue obj, double key, JSValue v, bool strict) {
+    int32_t i = (int32_t)key;
+    if (key >= -2147483648.0 && key <= 2147483647.0 && (double)i == key) return js_set_index_ta(ctx, obj, js_int32(i), v, strict);
+    return js_set_index_f64(ctx, obj, key, v, strict);
+}
+
+/* A typed array's elements as generated code holds them (the typed-arrays pass): taken once,
+ * for an array nothing else can reach, so nothing detaches or resizes its buffer. Empty (length
+ * 0) when the value isn't a typed array of that type: every access then takes the generic path. */
+typedef struct JSTAView {
+    uint8_t *base;
+    size_t   length;
+    int      type;   /* the element type it's for: a slow path that may have run code takes it again */
+} JSTAView;
+
+static inline JSTAView js_ta_view(JSContext *ctx, JSValue obj, int type) {
+    JSTAView v = { NULL, 0, type };
+    if (!js_is_object(obj) || js_as_object(obj)->shape->cls != ctx->rt->typed_array_class) return v;
+    const JSTypedArray *ta = (const JSTypedArray *)js_as_object(obj);
+    const JSArrayBuffer *b = js_as_array_buffer(ta->buffer);
+    if (ta->type != type || ta->length_tracking || (b->flags & (JS_BUFFER_DETACHED | JS_BUFFER_RESIZABLE | JS_BUFFER_IMMUTABLE)) || !b->data) return v;
+    v.base = b->data + ta->byte_offset;
+    v.length = ta->length;
+    return v;
+}
+
+/* Whether v is a typed array of that element type (a typed function's typed array parameter). */
+static inline bool js_ta_is(JSContext *ctx, JSValue v, int type) {
+    return js_is_object(v) && js_as_object(v)->shape->cls == ctx->rt->typed_array_class && ((const JSTypedArray *)js_as_object(v))->type == type;
+}
+
+/* The index a key names when it's in the view, else false. */
+static JS_FAST_PATH bool js_tav_index(const JSTAView *v, JSValue key, size_t *i) {
+    if (!js_is_int32(key) || js_as_int32(key) < 0 || (size_t)js_as_int32(key) >= v->length) return false;
+    *i = (size_t)js_as_int32(key);
+    return true;
+}
+static JS_FAST_PATH bool js_tav_index_d(const JSTAView *v, double key, size_t *i) {
+    if (!(key >= 0 && key < (double)v->length) || (double)(size_t)key != key) return false;
+    *i = (size_t)key;
+    return true;
+}
+
+/* Each element type's read and write (a Number, converted as the spec's NumericToRawBytes). */
+#define JS_TAV_ACCESS(name, ctype, box, unbox)                                                          \
+    static JS_FAST_PATH JSValue js_tav_get_##name(JSContext *ctx, JSTAView *v, JSValue obj, JSValue key) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(js_tav_index(v, key, &i))) { ctype x; memcpy(&x, v->base + i * sizeof x, sizeof x); return box(x); } \
+        JSValue r = js_get_elem(ctx, obj, key);                                                          \
+        *v = js_ta_view(ctx, obj, v->type);  /* a getter may have run */                                 \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH JSValue js_tav_get_##name##_d(JSContext *ctx, JSTAView *v, JSValue obj, double key) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(js_tav_index_d(v, key, &i))) { ctype x; memcpy(&x, v->base + i * sizeof x, sizeof x); return box(x); } \
+        JSValue r = js_get_elem(ctx, obj, js_number(key));                                               \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH JSValue js_tav_get_##name##_i(JSContext *ctx, JSTAView *v, JSValue obj, int32_t key) { \
+        if (JS_LIKELY((uint32_t)key < v->length)) { ctype x; memcpy(&x, v->base + (size_t)(uint32_t)key * sizeof x, sizeof x); return box(x); } \
+        JSValue r = js_get_elem(ctx, obj, js_int32(key));                                                \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH int js_tav_set_##name##_i(JSContext *ctx, JSTAView *v, JSValue obj, int32_t key, JSValue val, bool strict) { \
+        if (JS_LIKELY(js_is_number(val) && (uint32_t)key < v->length)) { ctype x = unbox(val); memcpy(v->base + (size_t)(uint32_t)key * sizeof x, &x, sizeof x); return 1; } \
+        int r = js_set_elem(ctx, obj, js_int32(key), val, strict);                                       \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH JSValue js_tav_get_##name##_l(JSContext *ctx, JSTAView *v, JSValue obj, int64_t key) { \
+        if (JS_LIKELY((uint64_t)key < v->length)) { ctype x; memcpy(&x, v->base + (size_t)key * sizeof x, sizeof x); return box(x); } \
+        JSValue r = js_get_elem(ctx, obj, js_number((double)key));                                       \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH int js_tav_set_##name##_l(JSContext *ctx, JSTAView *v, JSValue obj, int64_t key, JSValue val, bool strict) { \
+        if (JS_LIKELY(js_is_number(val) && (uint64_t)key < v->length)) { ctype x = unbox(val); memcpy(v->base + (size_t)key * sizeof x, &x, sizeof x); return 1; } \
+        int r = js_set_elem(ctx, obj, js_number((double)key), val, strict);                              \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH int js_tav_set_##name(JSContext *ctx, JSTAView *v, JSValue obj, JSValue key, JSValue val, bool strict) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(js_is_number(val) && js_tav_index(v, key, &i))) { ctype x = unbox(val); memcpy(v->base + i * sizeof x, &x, sizeof x); return 1; } \
+        int r = js_set_elem(ctx, obj, key, val, strict);  /* valueOf, a setter: they may have run */    \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }                                                                                                    \
+    static JS_FAST_PATH int js_tav_set_##name##_d(JSContext *ctx, JSTAView *v, JSValue obj, double key, JSValue val, bool strict) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(js_is_number(val) && js_tav_index_d(v, key, &i))) { ctype x = unbox(val); memcpy(v->base + i * sizeof x, &x, sizeof x); return 1; } \
+        int r = js_set_elem(ctx, obj, js_number(key), val, strict);                                      \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }
+static JS_FAST_PATH int32_t js_tav_to_int32(JSValue v) { return js_is_int32(v) ? js_as_int32(v) : js_double_to_int32(js_as_number(v)); }
+#define JS_TAV_INT(x) js_int32((int32_t)(x))
+JS_TAV_ACCESS(i8, int8_t, JS_TAV_INT, (int8_t)js_tav_to_int32)
+JS_TAV_ACCESS(u8, uint8_t, JS_TAV_INT, (uint8_t)js_tav_to_int32)
+JS_TAV_ACCESS(i32, int32_t, JS_TAV_INT, js_tav_to_int32)
+JS_TAV_ACCESS(f64, double, js_number, js_as_number)
+
+/* A Float64Array's element as a double, for typed code ("use static": its type is number):
+ * past the end, undefined as a number (NaN). False with an exception pending. And a store of a
+ * double, boxed only on the slow path. */
+static inline bool js_tav_num_slow(JSContext *ctx, JSTAView *v, JSValue obj, JSValue key, double *out) {
+    JSValue r = js_get_elem(ctx, obj, key);
+    *v = js_ta_view(ctx, obj, v->type);
+    if (js_is_exception(r)) return false;
+    if (js_is_number(r)) { *out = js_as_number(r); return true; }
+    return js_to_number(ctx, out, r) == 0;
+}
+#define JS_TAV_F64(suffix, ktype, in_view, boxed_key)                                                   \
+    static JS_FAST_PATH bool js_tav_num_f64##suffix(JSContext *ctx, JSTAView *v, JSValue obj, ktype key, double *out) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(in_view)) { memcpy(out, v->base + i * 8, 8); return true; }                        \
+        return js_tav_num_slow(ctx, v, obj, boxed_key, out);                                            \
+    }                                                                                                    \
+    static JS_FAST_PATH int js_tav_put_f64##suffix(JSContext *ctx, JSTAView *v, JSValue obj, ktype key, double x, bool strict) { \
+        size_t i;                                                                                        \
+        if (JS_LIKELY(in_view)) { memcpy(v->base + i * 8, &x, 8); return 1; }                            \
+        int r = js_set_elem(ctx, obj, boxed_key, js_number(x), strict);                                  \
+        *v = js_ta_view(ctx, obj, v->type);                                                              \
+        return r;                                                                                        \
+    }
+JS_TAV_F64(, JSValue, js_tav_index(v, key, &i), key)
+JS_TAV_F64(_d, double, js_tav_index_d(v, key, &i), js_number(key))
+JS_TAV_F64(_i, int32_t, ((i = (size_t)(uint32_t)key) < v->length), js_int32(key))
+JS_TAV_F64(_l, int64_t, ((i = (size_t)(uint64_t)key) < v->length), js_number((double)key))
+
 #endif /* JS_BUFFER_H */

package/runtime/include/js_builtins.h

@@ -211,6 +211,59 @@ static inline JSValue js_call_char_code_at(JSContext *ctx, JSValue f, JSValue s,
     return js_call_site(ctx, f, s, 1, &i, site);
 }
 
+/* s.charCodeAt(i) in typed code ("use static"), which trusts the built-ins to be the standard
+ * ones (char_code_at): s is a string; its unit read inline, else (a rope, an index out of
+ * range) the built-in's answer. */
+static inline double js_string_char_code_at(JSContext *ctx, JSValue s, double i) {
+    JSStrView v;
+    if (JS_LIKELY(i >= 0 && i < 4294967295.0 && js_string_units(s, &v) && (uint32_t)i < v.length && (double)(uint32_t)i == i))
+        return (double)js_view_at(v, (uint32_t)i);
+    JSValue index = js_number(i);
+    return js_as_number(js_core_string_proto_char_code_at(ctx, JS_UNDEFINED, s, 1, &index, JS_UNDEFINED));
+}
+
+/* s.charCodeAt(i) in typed code for an index the optimizer proved in s: the unit, an int32 (a
+ * rope not yet flattened takes the built-in). */
+static inline int32_t js_string_unit_at(JSContext *ctx, JSValue s, uint32_t i) {
+    JSStrView v;
+    if (JS_LIKELY(js_string_units(s, &v))) return (int32_t)js_view_at(v, i);
+    return (int32_t)js_string_char_code_at(ctx, s, (double)i);
+}
+
+/* Function.prototype.apply and call: generated code tells them by their entry. */
+JSValue js_function_proto_apply(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+JSValue js_function_proto_call(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
+
+/* f.apply(t, args), `m` the value of f.apply: when m is the built-in and f callable, f is called
+ * without the built-in in between, with a short dense array's elements copied to the stack (its
+ * elements are its own data properties: reading them runs no code; copied, as f may change the
+ * array). Anything else is the call of m. */
+static inline JSValue js_call_apply(JSContext *ctx, JSValue m, JSValue f, JSValue t, JSValue args, const char *site) {
+    if (JS_LIKELY(js_is_function(m) && js_as_function(m)->entry == js_function_proto_apply && js_is_callable(f))) {
+        if (js_is_nullish(args)) return js_call(ctx, f, t, 0, NULL);
+        if (js_is_array(args)) {
+            JSObject *a = js_as_object(args);
+            JSElements *e = a->elements;
+            uint32_t n = js_array_length(a);
+            JSValue copy[8];
+            if (e->kind == JS_ELEMENTS_DENSE && e->length == n && n <= 8) {
+                uint32_t i = 0;
+                while (i < n && !js_is_empty(e->data[i])) copy[i] = e->data[i], i++;
+                if (i == n) return js_call(ctx, f, t, n, copy);
+            }
+        }
+    }
+    return js_call_site(ctx, m, f, 2, (const JSValue[]){ t, args }, site);
+}
+
+/* f.call(t, …), `m` the value of f.call: f called directly when m is the built-in and f callable.
+ * argv: t, then the arguments. */
+static inline JSValue js_call_call(JSContext *ctx, JSValue m, JSValue f, uint32_t argc, const JSValue *argv, const char *site) {
+    if (JS_LIKELY(js_is_function(m) && js_as_function(m)->entry == js_function_proto_call && js_is_callable(f)))
+        return js_call(ctx, f, argc ? argv[0] : JS_UNDEFINED, argc ? argc - 1 : 0, argc ? argv + 1 : NULL);
+    return js_call_site(ctx, m, f, argc, argv, site);
+}
+
 /* String.fromCharCode(c): a unit up to 0xFF is a static one-unit string. */
 static inline JSValue js_call_from_char_code(JSContext *ctx, JSValue f, JSValue this_val, JSValue c, const char *site) {
     if (JS_LIKELY(js_is_function(f) && js_as_function(f)->entry == js_core_string_from_char_code && js_is_int32(c)

package/runtime/include/js_exception.h

@@ -28,6 +28,9 @@ JS_WARN_UNUSED JSValue js_throw_reference_error(JSContext *ctx, const char *fmt,
 JS_WARN_UNUSED JSValue js_throw_syntax_error(JSContext *ctx, const char *fmt, ...);
 JS_WARN_UNUSED JSValue js_throw_uri_error(JSContext *ctx, const char *fmt, ...);
 JS_WARN_UNUSED JSValue js_throw_stack_overflow(JSContext *ctx);  /* RangeError: Maximum call stack size exceeded */
+/* ERR_INVALID_ARG_TYPE: `The "dest" argument must be <expected>. Received …` (Node's wording
+ * of the value). Generated code calls it: a "use static" function's checked entry. */
+JS_WARN_UNUSED JSValue js_throw_invalid_arg_type(JSContext *ctx, const char *name, const char *expected, JSValue value);
 
 /* ---- Catching ---------------------------------------------------------- */
 

package/runtime/include/js_function.h

@@ -79,7 +79,7 @@ typedef struct JSFunction {       /* kind = FUNCTION */
     JSContext             *realm;        /* the realm the function was created in */
     uint32_t               flags;
     uint32_t               pad_;
-    struct JSShape        *instance_shape;  /* a class's instances' root shape, made at its first `new` (js_new_class_instance) */
+    struct JSShape        *instance_shape;  /* the root shape of the objects `new` makes with it as new.target: inline slots for all their constructors add */
 } JSFunction;
 
 extern const JSClass js_class_function;

package/runtime/include/js_object.h

@@ -296,10 +296,10 @@ JS_WARN_UNUSED JSValue js_own_keys(JSContext *ctx, JSObject *o);
 #define JS_IC_EMPTY  0
 #define JS_IC_OWN    1  /* get: an own data property; set: an own writable data property */
 #define JS_IC_PROTO  2  /* get: a data property of `holder`, `depth` prototypes up */
-#define JS_IC_ADD    3  /* set: adding the key takes the receiver from `shape` to `next` */
+#define JS_IC_ADD    3  /* set: adding the key takes the receiver from `shape` to `next`; `depth` prototypes up to null, or to one whose writable data property it shadows */
 #define JS_IC_GETTER 4  /* get: an accessor of `holder` (NULL: the receiver), `depth` prototypes up */
 #define JS_IC_ABSENT 5  /* get: no such property on the receiver or its `depth` prototypes (the last's proto is null) */
-#define JS_IC_MAX_DEPTH 4
+#define JS_IC_MAX_DEPTH 8  /* prototypes a cache can check: Node's sockets are 6 deep (Socket, Duplex, Readable, Stream, EventEmitter, Object) */
 
 /* One per property access site with a constant named key; a site is either a get or a
  * set. Monomorphic: a miss refills it. Never caches dictionary shapes (their layout
@@ -314,7 +314,7 @@ typedef struct JSPropCache {
     JSShape  *fast;                     /* OWN, inline slot: the receiver shape; else NULL */
     uint16_t  fast_off;                 /* with `fast`: the slot's byte offset in the object */
     uint8_t   kind;                     /* JS_IC_* */
-    uint8_t   depth;                    /* PROTO: hops to the holder; ADD: prototypes up to null */
+    uint8_t   depth;                    /* PROTO: hops to the holder; ADD: prototypes checked (JS_IC_ADD) */
     uint32_t  slot;                     /* OWN, PROTO: the slot */
     JSShape  *shape;                    /* receiver shape; NULL = empty */
     JSObject *holder;                   /* PROTO */
@@ -326,6 +326,8 @@ typedef struct JSPropCache {
 /* A module's caches, once at startup (the GC resets them weakly). */
 void js_register_prop_caches(JSRuntime *rt, JSPropCache *ics, size_t n);
 
+/* The slow paths of a named access: `ic` is the site's cache, or NULL for a computed key's access
+ * (the runtime's shared caches only). */
 JS_WARN_UNUSED JSValue js_get_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSPropCache *ic);
 JS_WARN_UNUSED int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSPropCache *ic);
 
@@ -373,6 +375,22 @@ static inline int js_set_prop(JSContext *ctx, JSValue obj, JSValue key, JSValue
     return js_set_prop_slow(ctx, obj, key, v, strict, ic);
 }
 
+/* obj[key] and obj[key] = v at a site whose key is most likely always the same symbol or string
+ * (the optimizer's guess: a module binding stored once, as Node's kState). `site` holds the key
+ * the site's cache is for (EMPTY: none yet): while the key is that one, the access is a named
+ * access's, inline cache and all. Another key the slow path makes the site's, or, when it isn't
+ * a property key already (an index, a string not interned), accesses generically. */
+JS_WARN_UNUSED JSValue js_get_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic);
+JS_WARN_UNUSED int js_set_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic);
+static inline JSValue js_get_keyed(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (JS_LIKELY(js_same_bits(key, *site))) return js_get_prop(ctx, obj, key, ic);
+    return js_get_keyed_slow(ctx, obj, key, site, ic);
+}
+static inline int js_set_keyed(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic) {
+    if (JS_LIKELY(js_same_bits(key, *site))) return js_set_prop(ctx, obj, key, v, strict, ic);
+    return js_set_keyed_slow(ctx, obj, key, v, strict, site, ic);
+}
+
 /* An object's new shape. When the object is a prototype, caches that checked the chain it's on
  * may be stale: the runtime's proto_epoch moves on. */
 static JS_FAST_PATH void js_object_set_shape(JSContext *ctx, JSObject *o, JSShape *s) {

package/runtime/include/js_ops.h

@@ -46,6 +46,33 @@ JS_WARN_UNUSED JSValue js_ge(JSContext *ctx, JSValue a, JSValue b);
 /* ===, !==: never throw (strings compare by content). */
 bool js_strict_equals(JSContext *ctx, JSValue a, JSValue b);
 static inline JSValue js_strict_eq(JSContext *ctx, JSValue a, JSValue b) { return js_bool(js_strict_equals(ctx, a, b)); }
+/* A Number as a typed file's ("use static") int, an int64_t: truncated toward zero and wrapped
+ * modulo 2^64, as ToInt32 is for 32 bits; NaN and the infinities 0 (a plain C conversion of those
+ * would be undefined behaviour). */
+static inline int64_t js_f64_to_i64(double d) {
+    if (d >= -9223372036854775808.0 && d < 9223372036854775808.0) return (int64_t)d;
+    if (d != d || d == INFINITY || d == -INFINITY) return 0;
+    double m = fmod(trunc(d), 18446744073709551616.0);  /* exact: d is an integer this large */
+    if (m < 0) m += 18446744073709551616.0;
+    return (int64_t)(uint64_t)m;
+}
+/* A Number value as an int; anything else (typed code's caller passed it unchecked) 0. */
+static inline int64_t js_value_to_i64(JSValue v) {
+    if (js_is_int32(v)) return js_as_int32(v);
+    return js_is_number(v) ? js_f64_to_i64(js_as_number(v)) : 0;
+}
+
+/* v === d, d a number literal (not NaN): v is a Number of that value (0 and -0 alike). */
+static inline bool js_strict_eq_num(JSValue v, double d) {
+    if (js_is_int32(v)) return (double)js_as_int32(v) == d;
+    return js_is_number(v) && js_as_number(v) == d;
+}
+
+/* a === s, s a string literal: an atom, so a string with its units is s itself unless it isn't
+ * interned */
+static inline bool js_strict_eq_atom(JSContext *ctx, JSValue a, JSValue s) {
+    return js_same_bits(a, s) || (js_is_string(a) && !js_is_atom(a) && js_string_equals(ctx, a, s));
+}
 static inline JSValue js_strict_ne(JSContext *ctx, JSValue a, JSValue b) { return js_bool(!js_strict_equals(ctx, a, b)); }
 
 /* A switch whose cases are all string literals: the index of the first case `v` is === to, or

package/runtime/include/js_runtime.h

@@ -17,6 +17,7 @@
 #include "js_console.h"
 #include "js_ops.h"
 #include "js_object.h"
+#include "js_buffer.h"
 #include "js_function.h"
 #include "js_error.h"
 #include "js_generator.h"

package/runtime/include/js_web.h

@@ -13,9 +13,6 @@
 JS_WARN_UNUSED JSValue js_throw_node_error(JSContext *ctx, JSErrorKind kind, const char *code, const char *fmt, ...);
 /* ERR_INVALID_THIS: `Value of "this" must be of type TextDecoder`. */
 JS_WARN_UNUSED JSValue js_throw_invalid_this(JSContext *ctx, const char *type);
-/* ERR_INVALID_ARG_TYPE: `The "dest" argument must be <expected>. Received …` (Node's wording
- * of the value). */
-JS_WARN_UNUSED JSValue js_throw_invalid_arg_type(JSContext *ctx, const char *name, const char *expected, JSValue value);
 /* Node's "Received …" tail for a value: " Received type number (1)", " Received an instance of
  * Array", " Received undefined". */
 void js_node_received(JSContext *ctx, JSValue v, char *buf, size_t cap);
@@ -57,6 +54,9 @@ bool js_is_abort_signal(JSValue v);
 void js_abort_signal_abort(JSContext *ctx, JSValue signal, JSValue reason);
 /* A new signal that aborts when `source` does (AbortSignal.any([source])). */
 JS_WARN_UNUSED JSValue js_abort_signal_follow(JSContext *ctx, JSValue source);
+/* node:events' primitive: an EventTarget's listeners for a type, in the order added (getEventListeners,
+ * listenerCount); undefined for a value that isn't an EventTarget. */
+JSValue js_event_target_listeners(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target);
 
 /* headers.c (the headers component): Headers for Request and Response. */
 typedef enum JSHeadersGuard { JS_HEADERS_NONE, JS_HEADERS_IMMUTABLE } JSHeadersGuard;

package/runtime/include/jscontext.h

@@ -142,6 +142,11 @@ typedef struct JSShapeRegistry {
     size_t root_cap, root_count;
     struct JSShape **parents;     /* shapes with transitions */
     size_t parent_count, parent_cap;
+    /* Since the last collection: the root shapes and transitions' children made (the only shapes
+     * a young collection can find dead), and the shapes given transitions, parents[old_parents..]. */
+    struct JSShape **young;
+    size_t young_count, young_cap;
+    size_t old_parents;
 } JSShapeRegistry;
 
 /* Registered inline-cache arrays: reset weakly after marking. */
@@ -201,6 +206,9 @@ struct JSRuntime {
     int     (*on_handled_late)(JSContext *ctx, JSValue promise);
     uint8_t   failure;  /* the exit status after an uncaught error: 1, or on_uncaught's */
     struct JSWeakList { struct JSObject **items; size_t count, cap; } weak;  /* WeakMap/Set/Ref, registries */
+    /* WeakMap and WeakSet entries set since the last collection, by key (EMPTY: every entry of the
+     * table): the only ones a young collection looks at (weak.c). */
+    struct JSWeakWrites { struct JSWeakWrite { struct JSObject *table; JSValue key; } *items; size_t count, cap; } weak_writes;
     struct JSKeptAlive { JSValue *items; size_t count, cap; } kept_alive;    /* [[KeptAlive]]: roots until ClearKeptObjects */
     const struct JSComponent *const *components;  /* installed in every realm */
     size_t    ncomponents;
@@ -218,6 +226,12 @@ struct JSRuntime {
     const JSBigIntOps *bigint;  /* set by the bigint component */
     /* A typed array's length now: -1 when out of bounds (detached), -2 for anything else. */
     double  (*typed_array_length)(JSValue v);
+    /* Set by typed arrays: obj[i] and obj[i] = d (a Number) of a typed array, inline, for an index
+     * in bounds and an element that is a Number (not a BigInt): true when done; false for
+     * anything else, which takes the generic path. */
+    bool    (*typed_array_get)(JSValue v, int32_t i, JSValue *out);
+    bool    (*typed_array_set)(JSValue v, int32_t i, double d);
+    const struct JSClass *typed_array_class;  /* set by typed arrays: js_buffer.h's inline element access tests it */
     /* Set by typed arrays: a typed array's or DataView's bytes (its current window), true; false
      * for anything else (an ArrayBuffer too: process.stdout.write takes views only). */
     bool    (*view_bytes)(JSValue v, uint8_t **data, size_t *length);
@@ -232,6 +246,7 @@ struct JSContext {
     uint8_t    barrier_threshold; /* js_store's slow path runs for an owner whose GC byte is this or more */
     JSValue    intrinsics[JS_INTRINSIC_COUNT];
     JSContext *next_realm;
+    struct JSShape *array_shape;  /* the root shape of its arrays with Array.prototype (js_new_array), made at the first */
 };
 
 JSRuntime *js_runtime_new(void);

package/runtime/src/atoms.c

@@ -63,6 +63,24 @@ static void insert(JSAtomTable *t, JSString *s, uint32_t hash) {
     t->count++;
 }
 
+/* Removes `s`, which is in the table. Linear probing: later entries of its probe run move back
+ * into the hole, so that every lookup still finds them. */
+static void remove_atom(JSAtomTable *t, const JSString *s) {
+    size_t mask = t->cap - 1, i = s->hash & mask;
+    while (t->entries[i].str != s) i = (i + 1) & mask;
+    t->entries[i].str = NULL;
+    t->count--;
+    for (size_t j = (i + 1) & mask; t->entries[j].str; j = (j + 1) & mask) {
+        size_t home = t->entries[j].hash & mask;
+        bool stays = i <= j ? (i < home && home <= j) : (i < home || home <= j);
+        if (!stays) {
+            t->entries[i] = t->entries[j];  /* barrier: none, the table is malloc'd and weak */
+            t->entries[j].str = NULL;
+            i = j;
+        }
+    }
+}
+
 /* ---- Lifecycle --------------------------------------------------------- */
 
 void js_register_static_atoms(JSRuntime *rt, const JSString *const *cells, size_t n) {
@@ -96,10 +114,18 @@ void js_atoms_init(JSRuntime *rt) {
 
 static bool survives(const JSString *s) { return js_gc_is_marked(&s->cell); }
 
-/* Drops unmarked atoms and resizes for the survivors: load <= 1/2, shrinking
- * after mass death (dynamic keys), never below 512 entries. */
-void js_atoms_sweep(JSRuntime *rt) {
+/* Drops unmarked atoms. A young collection checks only the atoms added since the last one, and
+ * removes the dead ones in place. A full collection checks every atom, and resizes for the
+ * survivors: load <= 1/2, shrinking after mass death (dynamic keys), never below 512 entries. */
+void js_atoms_sweep(JSRuntime *rt, bool full) {
     JSAtomTable *t = &rt->atoms;
+    if (!full) {
+        for (size_t i = 0; i < t->young_count; i++)
+            if (!survives(t->young[i])) remove_atom(t, t->young[i]);
+        t->young_count = 0;
+        return;
+    }
+    t->young_count = 0;
     size_t live = 0;
     for (size_t i = 0; i < t->cap; i++) live += t->entries[i].str && survives(t->entries[i].str);
     size_t cap = 512;
@@ -110,6 +136,8 @@ void js_atoms_sweep(JSRuntime *rt) {
 void js_atoms_free(JSRuntime *rt) {
     free(rt->atoms.entries);
     rt->atoms.entries = NULL;
+    free(rt->atoms.young);
+    rt->atoms.young = NULL;
 }
 
 size_t js_atom_count(const JSRuntime *rt) {
@@ -137,6 +165,12 @@ JSValue js_atomize(JSContext *ctx, JSValue s) {
     flat->cell.flags |= JS_STR_ATOM;  /* immutable content: becoming the atom changes nothing else */
     flat->hash = hash;
     insert(t, flat, hash);
+    if (t->young_count == t->young_cap) {
+        t->young_cap = t->young_cap ? t->young_cap * 2 : 256;
+        t->young = realloc(t->young, t->young_cap * sizeof *t->young);
+        if (!t->young) js_fatal("out of memory growing the atom table");
+    }
+    t->young[t->young_count++] = flat;
     return js_cell(&flat->cell);
 }
 

package/runtime/src/builtins.c

@@ -793,7 +793,7 @@ CORE(object_proto_lookup_setter) {
 
 /* ---- Function.prototype (§20.2.3) --------------------------------------------------------------- */
 
-BUILTIN(function_proto_call) {
+JSValue js_function_proto_call(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.call called on a non-function");
     return js_call(ctx, this_val, ARG(0), argc > 1 ? argc - 1 : 0, argv + (argc > 1 ? 1 : argc));
@@ -822,10 +822,23 @@ static JSValueArray *list_from_array_like(JSContext *ctx, JSValue v) {
 
 JSValueArray *js_list_from_array_like(JSContext *ctx, JSValue v) { return list_from_array_like(ctx, v); }
 
-BUILTIN(function_proto_apply) {
+JSValue js_function_proto_apply(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.apply was called on a non-function");
     if (js_is_nullish(ARG(1))) return js_call(ctx, this_val, ARG(0), 0, NULL);
+    /* a short dense array without holes (emit's arguments): its elements are its own data
+     * properties, so reading them can't run code. Copied, as the callee may change the array. */
+    if (js_is_array(ARG(1))) {
+        JSObject *a = js_as_object(ARG(1));
+        JSElements *e = a->elements;
+        uint32_t n = js_array_length(a);
+        JSValue args[8];
+        if (e->kind == JS_ELEMENTS_DENSE && e->length == n && n <= 8) {
+            uint32_t i = 0;
+            while (i < n && !js_is_empty(e->data[i])) args[i] = e->data[i], i++;
+            if (i == n) return js_call(ctx, this_val, ARG(0), n, args);
+        }
+    }
     JSValueArray *list = list_from_array_like(ctx, ARG(1));
     if (!list) return JS_EXCEPTION;
     JSValue r = js_call(ctx, this_val, ARG(0), list->cell.aux, list->values);
@@ -959,8 +972,8 @@ void js_builtins_realm_init(JSContext *ctx, JSObject *global) {
 
     JSValue object = define_constructor(ctx, global, "Object", object_ctor, 1, in[JS_INTRINSIC_OBJECT_PROTOTYPE]);
     static const JSBuiltin function_proto[] = {
-        JS_BUILTIN_FN("call", function_proto_call, 1),
-        JS_BUILTIN_FN("apply", function_proto_apply, 2),
+        JS_BUILTIN_FN("call", js_function_proto_call, 1),
+        JS_BUILTIN_FN("apply", js_function_proto_apply, 2),
         JS_BUILTIN_FN("bind", function_proto_bind, 1),
         JS_BUILTIN_FN("toString", function_proto_to_string, 0),
     };

package/runtime/src/events.c

@@ -337,6 +337,25 @@ BUILTIN(remove_on_abort) {
     return JS_UNDEFINED;
 }
 
+JSValue js_event_target_listeners(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
+    (void)callee, (void)this_val, (void)new_target;
+    EventTargetObject *t = argc > 0 ? as_target(argv[0]) : NULL;
+    if (!t) return JS_UNDEFINED;
+    JSValue type = js_to_string(ctx, argc > 1 ? argv[1] : JS_UNDEFINED);
+    if (js_is_exception(type)) return type;
+    /* the callbacks first, then the array: its one allocation can't move what the loop reads */
+    JSValue *callbacks = malloc((t->n ? t->n : 1) * sizeof *callbacks);
+    if (!callbacks) js_fatal("out of memory in events");
+    uint32_t n = 0;
+    for (uint32_t i = 0; i < t->n; i++) {
+        ListenerObject *l = listener_at(t, i);
+        if (js_string_equals(ctx, l->type, type)) callbacks[n++] = l->callback;
+    }
+    JSValue list = js_new_array_from(ctx, callbacks, n);
+    free(callbacks);
+    return list;
+}
+
 /* addEventListener(type, listener, options | capture) */
 BUILTIN(target_add_event_listener) {
     UNUSED_ARGS;