visaljs 0.0.9 → 0.0.10

package/runtime/include/jscontext.h

@@ -226,6 +226,12 @@ struct JSRuntime {
     const JSBigIntOps *bigint;  /* set by the bigint component */
     /* A typed array's length now: -1 when out of bounds (detached), -2 for anything else. */
     double  (*typed_array_length)(JSValue v);
+    /* Set by typed arrays: obj[i] and obj[i] = d (a Number) of a typed array, inline, for an index
+     * in bounds and an element that is a Number (not a BigInt): true when done; false for
+     * anything else, which takes the generic path. */
+    bool    (*typed_array_get)(JSValue v, int32_t i, JSValue *out);
+    bool    (*typed_array_set)(JSValue v, int32_t i, double d);
+    const struct JSClass *typed_array_class;  /* set by typed arrays: js_buffer.h's inline element access tests it */
     /* Set by typed arrays: a typed array's or DataView's bytes (its current window), true; false
      * for anything else (an ArrayBuffer too: process.stdout.write takes views only). */
     bool    (*view_bytes)(JSValue v, uint8_t **data, size_t *length);
@@ -240,6 +246,7 @@ struct JSContext {
     uint8_t    barrier_threshold; /* js_store's slow path runs for an owner whose GC byte is this or more */
     JSValue    intrinsics[JS_INTRINSIC_COUNT];
     JSContext *next_realm;
+    struct JSShape *array_shape;  /* the root shape of its arrays with Array.prototype (js_new_array), made at the first */
 };
 
 JSRuntime *js_runtime_new(void);

package/runtime/src/builtins.c

@@ -793,7 +793,7 @@ CORE(object_proto_lookup_setter) {
 
 /* ---- Function.prototype (§20.2.3) --------------------------------------------------------------- */
 
-BUILTIN(function_proto_call) {
+JSValue js_function_proto_call(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.call called on a non-function");
     return js_call(ctx, this_val, ARG(0), argc > 1 ? argc - 1 : 0, argv + (argc > 1 ? 1 : argc));
@@ -822,10 +822,23 @@ static JSValueArray *list_from_array_like(JSContext *ctx, JSValue v) {
 
 JSValueArray *js_list_from_array_like(JSContext *ctx, JSValue v) { return list_from_array_like(ctx, v); }
 
-BUILTIN(function_proto_apply) {
+JSValue js_function_proto_apply(JSContext *ctx, JSValue callee, JSValue this_val, uint32_t argc, const JSValue *argv, JSValue new_target) {
     UNUSED_ARGS;
     if (!js_is_callable(this_val)) return js_throw_type_error(ctx, "Function.prototype.apply was called on a non-function");
     if (js_is_nullish(ARG(1))) return js_call(ctx, this_val, ARG(0), 0, NULL);
+    /* a short dense array without holes (emit's arguments): its elements are its own data
+     * properties, so reading them can't run code. Copied, as the callee may change the array. */
+    if (js_is_array(ARG(1))) {
+        JSObject *a = js_as_object(ARG(1));
+        JSElements *e = a->elements;
+        uint32_t n = js_array_length(a);
+        JSValue args[8];
+        if (e->kind == JS_ELEMENTS_DENSE && e->length == n && n <= 8) {
+            uint32_t i = 0;
+            while (i < n && !js_is_empty(e->data[i])) args[i] = e->data[i], i++;
+            if (i == n) return js_call(ctx, this_val, ARG(0), n, args);
+        }
+    }
     JSValueArray *list = list_from_array_like(ctx, ARG(1));
     if (!list) return JS_EXCEPTION;
     JSValue r = js_call(ctx, this_val, ARG(0), list->cell.aux, list->values);
@@ -959,8 +972,8 @@ void js_builtins_realm_init(JSContext *ctx, JSObject *global) {
 
     JSValue object = define_constructor(ctx, global, "Object", object_ctor, 1, in[JS_INTRINSIC_OBJECT_PROTOTYPE]);
     static const JSBuiltin function_proto[] = {
-        JS_BUILTIN_FN("call", function_proto_call, 1),
-        JS_BUILTIN_FN("apply", function_proto_apply, 2),
+        JS_BUILTIN_FN("call", js_function_proto_call, 1),
+        JS_BUILTIN_FN("apply", js_function_proto_apply, 2),
         JS_BUILTIN_FN("bind", function_proto_bind, 1),
         JS_BUILTIN_FN("toString", function_proto_to_string, 0),
     };

package/runtime/src/function.c

@@ -222,10 +222,38 @@ JSValue js_get_prototype_from_constructor(JSContext *ctx, JSValue new_target, JS
     return realm ? realm->intrinsics[fallback] : JS_EXCEPTION;
 }
 
+/* The root shape of the objects `new f` makes, with at least `slots` inline slots: kept on f, and
+ * grown by learn_instance_slots to what its instances end up holding. */
+static JSShape *instance_root(JSContext *ctx, JSFunction *f, JSValue proto, uint16_t slots) {
+    JSShape *s = f->instance_shape;
+    if (JS_UNLIKELY(!s || !js_same_bits(s->proto, proto) || s->inline_cap < slots)) {
+        s = js_shape_root(ctx, &js_class_object, proto, slots);
+        js_store_ptr(ctx, &f->obj.cell, &f->instance_shape, s);
+    }
+    return s;
+}
+
+/* Slack tracking: when the constructors (a class's and its bases') left `v` with more properties
+ * than its root shape has inline slots, the next instances get room for them all. A derived
+ * class's `this` is made by its base, which can't count its subclasses' properties; the rest
+ * would sit out of line, where an inline cache's hit isn't inlined. */
+static void learn_instance_slots(JSContext *ctx, JSFunction *f, JSValue v) {
+    JSShape *root = f->instance_shape;
+    if (!root || !js_is_object(v)) return;
+    JSShape *s = js_as_object(v)->shape;
+    if (JS_LIKELY(s->prop_count <= root->inline_cap || root->inline_cap >= JS_MAX_INLINE_SLOTS)) return;
+    JSShape *r = s;
+    while (r->parent) r = r->parent;
+    if (r != root) return;  /* not made from it: an object the constructor returned, or a dictionary */
+    JSShape *grown = js_shape_root(ctx, &js_class_object, root->proto, (uint16_t)(s->prop_count < JS_MAX_INLINE_SLOTS ? s->prop_count : JS_MAX_INLINE_SLOTS));
+    js_store_ptr(ctx, &f->obj.cell, &f->instance_shape, grown);
+}
+
 JSValue js_create_from_constructor(JSContext *ctx, JSValue new_target, JSIntrinsic fallback) {
     JSValue proto = js_get_prototype_from_constructor(ctx, new_target, fallback);
     if (js_is_exception(proto)) return JS_EXCEPTION;
-    return js_new_object_proto(ctx, proto, JS_DEFAULT_INLINE_SLOTS);
+    if (!js_is_function(new_target)) return js_new_object_proto(ctx, proto, JS_DEFAULT_INLINE_SLOTS);
+    return js_object_value(js_alloc_object(ctx, JS_CELL_OBJECT, instance_root(ctx, js_as_function(new_target), proto, JS_DEFAULT_INLINE_SLOTS)));
 }
 
 JSValue js_new_instance(JSContext *ctx, JSValue fv, uint16_t slots, JSPropCache *ic) {
@@ -234,26 +262,25 @@ JSValue js_new_instance(JSContext *ctx, JSValue fv, uint16_t slots, JSPropCache
                                                                     : js_get_prop(ctx, fv, JS_ATOM(prototype), ic);
     if (js_is_exception(proto)) return JS_EXCEPTION;
     if (!js_is_object(proto)) proto = ctx->intrinsics[JS_INTRINSIC_OBJECT_PROTOTYPE];  /* OrdinaryCreateFromConstructor's fallback */
-    JSFunction *f = js_as_function(fv);
-    JSShape *s = f->instance_shape;
-    if (JS_UNLIKELY(!s || !js_same_bits(s->proto, proto) || s->inline_cap != slots)) {
-        s = js_shape_root(ctx, &js_class_object, proto, slots);
-        js_store_ptr(ctx, &f->obj.cell, &f->instance_shape, s);
-    }
-    return js_object_value(js_alloc_object(ctx, JS_CELL_OBJECT, s));
+    return js_object_value(js_alloc_object(ctx, JS_CELL_OBJECT, instance_root(ctx, js_as_function(fv), proto, slots)));
 }
 
 JSValue js_construct(JSContext *ctx, JSValue f, uint32_t argc, const JSValue *argv, JSValue new_target, const char *callee_text) {
     if (JS_UNLIKELY(!js_is_constructor(f))) return not_callable(ctx, f, callee_text, "constructor");
     JSFunction *fn = js_as_function(f);
+    bool outermost = js_is_undefined(new_target) || js_same_bits(new_target, f);  /* not a super() */
     if (js_is_undefined(new_target)) new_target = f;
-    if (!(fn->flags & JS_FN_ORDINARY))  /* builtins create their own object; a derived constructor gets it from super() */
-        return fn->entry(fn->flags & JS_FN_PROXY ? ctx : fn->realm, f, JS_UNDEFINED, argc, argv, new_target);
+    if (!(fn->flags & JS_FN_ORDINARY)) {  /* builtins create their own object; a derived constructor gets it from super() */
+        JSValue r = fn->entry(fn->flags & JS_FN_PROXY ? ctx : fn->realm, f, JS_UNDEFINED, argc, argv, new_target);
+        if (outermost && (fn->flags & JS_FN_DERIVED) && !js_is_exception(r)) learn_instance_slots(ctx, fn, r);
+        return r;
+    }
     /* [[Construct]] of an ordinary function (§10.2.2): this = a new object; an object result wins */
     JSValue this_val = js_create_from_constructor(fn->realm, new_target, JS_INTRINSIC_OBJECT_PROTOTYPE);
     if (js_is_exception(this_val)) return JS_EXCEPTION;
     JSValue r = fn->entry(fn->realm, f, this_val, argc, argv, new_target);
     if (js_is_exception(r)) return JS_EXCEPTION;
+    if (outermost) learn_instance_slots(ctx, fn, this_val);
     return js_is_object(r) ? r : this_val;
 }
 

package/runtime/src/gc.c

@@ -1646,8 +1646,10 @@ static void mark_roots(JSRuntime *rt, JSTracer *trc) {
     js_trace_value(trc, rt->async_context);
     js_jobs_trace(rt, trc);  /* queued jobs, unhandled rejections */
     js_weak_trace_roots(rt, trc);  /* the WeakRef kept-alive set */
-    for (JSContext *realm = rt->realms; realm; realm = realm->next_realm)
+    for (JSContext *realm = rt->realms; realm; realm = realm->next_realm) {
         for (unsigned i = 0; i < JS_INTRINSIC_COUNT; i++) js_trace_value(trc, realm->intrinsics[i]);
+        if (realm->array_shape) js_trace_cell(trc, &realm->array_shape->cell);
+    }
     for (size_t t = 0; t < h->root_table_count; t++)
         for (size_t i = 0; i < h->root_tables[t].n; i++) js_trace_value(trc, h->root_tables[t].slots[i]);
     for (size_t i = 0; i < h->root_count; i++) js_trace_value(trc, *h->roots[i]);

package/runtime/src/iterator.c

@@ -236,7 +236,11 @@ JSValue js_iter_next(JSContext *ctx, JSValue rec) {
     if (r->done) return JS_EMPTY;
     JSValue value;
     if (r->mode == MODE_ARRAY) {
-        value = array_step(ctx, r->iterator, r->index, KIND_VALUES);
+        /* a dense array's present element: what array_step's [[Get]] would read */
+        const JSElements *d = js_as_object(r->iterator)->elements;
+        uint32_t i = (uint32_t)r->index;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && r->index < d->length && !js_is_empty(d->data[i]))) value = d->data[i];
+        else value = array_step(ctx, r->iterator, r->index, KIND_VALUES);
         r->index++;
     } else if (r->mode == MODE_STRING) {
         uint32_t i = (uint32_t)r->index;

package/runtime/src/object.c

@@ -697,8 +697,7 @@ const JSClass js_class_array = {
     "Array", sizeof(JSObject), array_get_own, array_define, array_delete, array_extra_keys, NULL, NULL, NULL,
 };
 
-static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity) {
-    JSShape *shape = js_shape_root(ctx, &js_class_array, proto, 0);  /* named properties on arrays are rare */
+static JSValue array_of_shape(JSContext *ctx, JSShape *shape, uint32_t capacity) {
     JSObject *a = js_alloc_object(ctx, JS_CELL_ARRAY, shape);
     if (capacity) {
         JSElements *e = (JSElements *)js_alloc_cell(ctx, JS_CELL_ELEMENTS, sizeof(JSElements) + (size_t)capacity * sizeof(JSValue));
@@ -709,8 +708,13 @@ static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity
     return js_object_value(a);
 }
 
+static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity) {
+    return array_of_shape(ctx, js_shape_root(ctx, &js_class_array, proto, 0), capacity);  /* named properties on arrays are rare */
+}
+
 JSValue js_new_array(JSContext *ctx, uint32_t capacity) {
-    return array_with_proto(ctx, ctx->intrinsics[JS_INTRINSIC_ARRAY_PROTOTYPE], capacity);
+    if (JS_UNLIKELY(!ctx->array_shape)) ctx->array_shape = js_shape_root(ctx, &js_class_array, ctx->intrinsics[JS_INTRINSIC_ARRAY_PROTOTYPE], 0);
+    return array_of_shape(ctx, ctx->array_shape, capacity);
 }
 
 JSValue js_new_array_from(JSContext *ctx, const JSValue *values, uint32_t n) {
@@ -821,7 +825,7 @@ JSValue js_get_value(JSContext *ctx, JSValue obj, JSValue key) {
 }
 
 int js_set_value(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
-    if (js_is_object(obj)) return js_set(ctx, js_as_object(obj), key, v, obj, strict);
+    if (js_is_object(obj)) return js_key_is_index(key) ? js_set(ctx, js_as_object(obj), key, v, obj, strict) : js_set_prop_slow(ctx, obj, key, v, strict, NULL);
     if (js_is_nullish(obj)) {
         js_discard(nullish_error(ctx, obj, key, "set"));
         return -1;
@@ -1045,6 +1049,11 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
     JS_ASSERT_NOT_EXC(obj);
     JS_ASSERT_NOT_EXC(v);
     if (!js_is_object(obj) || js_key_is_index(key)) return js_set_value(ctx, obj, key, v, strict);
+    JSPropCache none;  /* no site (a computed key): only the shared cache */
+    if (!ic) {
+        none.kind = JS_IC_EMPTY;
+        ic = &none;
+    }
     JSObject *o = js_as_object(obj);
     if (ic->kind == JS_IC_ADD && o->shape == ic->shape && chain_holds(ctx, ic)) {
         JSShape *next = ic->next;  /* on the stack: kept alive if ensure_slot collects */
@@ -1083,8 +1092,10 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
         return 1;
     }
     int r = js_set(ctx, o, key, v, obj, strict);
-    /* a plain add (no setter or read-only property on the chain): remember the transition */
-    if (r == 1 && cacheable && !l.holder && !before->cls->define_own_property && !is_dictionary(o) &&
+    /* a plain add (no setter or read-only property on the chain, or a prototype's writable data
+     * property it shadows, as EventEmitter.prototype._events): remember the transition */
+    bool shadows = l.holder && l.holder != o && (l.attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE;
+    if (r == 1 && cacheable && (!l.holder || shadows) && !before->cls->define_own_property && !is_dictionary(o) &&
         o->shape->parent == before && js_same_bits(o->shape->key, key)) {
         JSPropCache c = { .kind = JS_IC_ADD, .depth = l.depth, .shape = before, .next = o->shape, .epoch = epoch };
         memcpy(c.chain, l.chain, sizeof c.chain);
@@ -1098,9 +1109,32 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
 
 /* ---- Generated code: computed keys, delete, literals --------------------------------- */
 
+/* Whether `key` can be a keyed site's: a property key as it is (a symbol, an interned string
+ * that isn't an index), so that the same bits mean the same key. Makes the site its. */
+static bool take_site_key(JSContext *ctx, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (!js_is_symbol(key) && !(js_is_string(key) && js_is_atom(key))) return false;
+    JSValue k = js_to_property_key(ctx, key);  /* a primitive: no user code */
+    if (!js_same_bits(k, key) || js_key_is_index(k)) return false;
+    memset(ic, 0, sizeof *ic);  /* its entries were for the old key */
+    *site = key;
+    return true;
+}
+
+JSValue js_get_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (take_site_key(ctx, key, site, ic)) return js_get_prop(ctx, obj, key, ic);
+    return js_get_elem(ctx, obj, key);
+}
+
+int js_set_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic) {
+    if (take_site_key(ctx, key, site, ic)) return js_set_prop(ctx, obj, key, v, strict, ic);
+    return js_set_elem(ctx, obj, key, v, strict);
+}
+
 JSValue js_get_elem(JSContext *ctx, JSValue obj, JSValue key) {
     JS_ASSERT_NOT_EXC(obj);
     JS_ASSERT_NOT_EXC(key);
+    JSValue elem;  /* a typed array's element: the component reads it inline */
+    if (js_is_int32(key) && ctx->rt->typed_array_get && ctx->rt->typed_array_get(obj, js_as_int32(key), &elem)) return elem;
     if (js_is_nullish(obj)) {
         JSValue k = js_is_object(key) ? key : js_to_property_key(ctx, key);  /* primitives only: no user code */
         if (js_is_exception(k)) return JS_EXCEPTION;
@@ -1113,6 +1147,8 @@ JSValue js_get_elem(JSContext *ctx, JSValue obj, JSValue key) {
 
 int js_set_elem(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
     JS_ASSERT_NOT_EXC(v);
+    /* a Number into a typed array's element: no ToNumber code to run, the component stores it inline */
+    if (js_is_int32(key) && js_is_number(v) && ctx->rt->typed_array_set && ctx->rt->typed_array_set(obj, js_as_int32(key), js_as_number(v))) return 1;
     if (js_is_nullish(obj)) {
         JSValue k = js_is_object(key) ? js_empty_string() : js_to_property_key(ctx, key);
         if (js_is_exception(k)) return -1;

package/runtime/src/typedarray.c

@@ -1234,6 +1234,26 @@ static double hook_typed_array_length(JSValue v) {
     return out_of_bounds(as_ta(v)) ? -1 : (double)ta_length(as_ta(v));
 }
 
+/* An element the core may read or write inline: of a typed array, a valid index (§10.4.5.15
+ * IsValidIntegerIndex), a Number element. Its own data property: no prototype, no code runs. */
+static bool inline_elem(JSValue v, int32_t i) {
+    if (!is_ta(v) || i < 0) return false;
+    const JSTypedArray *ta = as_ta(v);
+    return !is_bigint_type(ta->type) && (size_t)i < ta_length(ta);
+}
+
+static bool hook_typed_array_get(JSValue v, int32_t i, JSValue *out) {
+    if (!inline_elem(v, i)) return false;
+    *out = js_number(load_number(as_ta(v), (size_t)i));
+    return true;
+}
+
+static bool hook_typed_array_set(JSValue v, int32_t i, double d) {
+    if (!inline_elem(v, i) || immutable(as_ta(v))) return false;
+    store(as_ta(v), (size_t)i, d);
+    return true;
+}
+
 static bool hook_view_bytes(JSValue v, uint8_t **data, size_t *length) {
     return !js_is_array_buffer(v) && js_buffer_source_bytes(v, data, length);
 }
@@ -1330,6 +1350,9 @@ static void install_typedarray(JSContext *ctx, JSObject *global) {
     ctx->rt->is_typed_array = hook_is_typed_array;
     ctx->rt->typed_array_length = hook_typed_array_length;
     ctx->rt->view_bytes = hook_view_bytes;
+    ctx->rt->typed_array_get = hook_typed_array_get;
+    ctx->rt->typed_array_class = &ta_class;
+    ctx->rt->typed_array_set = hook_typed_array_set;
 }
 
 const JSComponent js_component_typedarray = { "typedarray", install_typedarray };