visaljs 0.0.9 → 0.0.11

package/runtime/src/gc.c

@@ -658,8 +658,8 @@ static JSCell *alloc_large(JSContext *ctx, size_t size) {
     b->is_large = 1;
     uint8_t shift = 9;  /* cards of 512 bytes, or more for a very large object */
     while ((size + ((size_t)1 << shift) - 1) >> shift > JS_LARGE_CARDS) shift++;
-    b->size_class = shift;
-    b->alloc_bits[0] = 1;
+    b->card_shift = shift;
+    b->large_alloc = 1;
 
     if (h->large_count == h->large_cap) {
         h->large_cap = h->large_cap ? h->large_cap * 2 : 16;
@@ -811,13 +811,12 @@ static void push_remembered(JSHeap *h, JSCell *c) {
  * next stores of young cells mark their own cards. */
 static void mark_cards(JSHeap *h, JSCell *c, const void *from, size_t bytes) {
     JSBlock *b = js_block_of(c);
-    unsigned shift = b->size_class;
+    unsigned shift = b->card_shift;
     size_t size = b->cell_size, off = (size_t)((const char *)from - (const char *)c);
     if (!from || (const char *)from < (const char *)c || off >= size) off = 0, bytes = size;
     if (!bytes) bytes = 1;
     size_t last = (off + bytes - 1 < size ? off + bytes - 1 : size - 1) >> shift;
-    uint64_t *cards = js_large_cards(b);
-    for (size_t k = off >> shift; k <= last; k++) cards[k / 64] |= UINT64_C(1) << (k % 64);
+    for (size_t k = off >> shift; k <= last; k++) b->cards[k / 64] |= UINT64_C(1) << (k % 64);
     if (!b->remembered) {
         b->remembered = 1;
         push_remembered(h, c);
@@ -918,6 +917,10 @@ static bool verify_edge(const JSTracer *trc, const JSCell *c) {
 /* Kinds that hold no cells: marked, never pushed or visited. */
 static const bool leaf_kind[JS_CELL_KIND_COUNT] = { [JS_CELL_STR_FLAT] = true, [JS_CELL_BIGINT] = true };
 
+static bool has_children(const JSCell *c) {
+    return !leaf_kind[c->kind] && !(c->kind == JS_CELL_HOST && !((const JSHostCell *)c)->cls->visit);
+}
+
 static JS_NOINLINE void grow_stack(JSTracer *trc) {
     trc->cap = trc->cap ? trc->cap * 2 : 4096;
     trc->stack = xrealloc(trc->stack, trc->cap * sizeof *trc->stack);
@@ -939,6 +942,18 @@ static inline void push(JSTracer *trc, JSCell *c) {
     trc->stack[trc->sp++] = c;
 }
 
+/* Sets heap cell `c`'s mark bit. Returns whether it was clear: this marker marked it, and it's old
+ * from now on. In a young collection every old cell's already is. */
+static inline bool mark_bit(JSTracer *trc, JSCell *c) {
+    JSBlock *b = js_block_of(c);
+    uint32_t i = cell_index(b, c);
+    if (!set_mark(trc, &b->mark_bits[i / 64], UINT64_C(1) << (i % 64))) return false;
+    c->gc = b->is_large ? JS_GC_OLD_LARGE : JS_GC_OLD;
+    trc->marked++;
+    trc->marked_bytes += b->is_large ? b->map_size : b->cell_size;
+    return true;
+}
+
 /* Marks `c`, and pushes it if it holds cells. Its header is read here, the first touch of the
  * cell: trace_cell prefetched it. */
 static inline void mark(JSTracer *trc, JSCell *c) {
@@ -947,14 +962,7 @@ static inline void mark(JSTracer *trc, JSCell *c) {
 #else
     if (js_cell_is_static(c)) return;
 #endif
-    JSBlock *b = js_block_of(c);
-    uint32_t i = cell_index(b, c);
-    if (!set_mark(trc, &b->mark_bits[i / 64], UINT64_C(1) << (i % 64))) return;  /* in a young collection, every old cell is */
-    c->gc = b->is_large ? JS_GC_OLD_LARGE : JS_GC_OLD;  /* it survives: old from now on */
-    trc->marked++;
-    trc->marked_bytes += b->is_large ? b->map_size : b->cell_size;
-    if (leaf_kind[c->kind] || (c->kind == JS_CELL_HOST && !((JSHostCell *)c)->cls->visit)) return;
-    push(trc, c);
+    if (mark_bit(trc, c) && has_children(c)) push(trc, c);
 }
 
 /* The marking barrier's: marked now, and on the marker's stack to be visited. */
@@ -1011,13 +1019,7 @@ static inline void mark_ool(JSTracer *trc, JSValueArray *a) {
     }
     if (verify_edge(trc, c)) return;
 #endif
-    JSBlock *b = js_block_of(c);
-    uint32_t i = cell_index(b, c);
-    if (set_mark(trc, &b->mark_bits[i / 64], UINT64_C(1) << (i % 64))) {
-        c->gc = b->is_large ? JS_GC_OLD_LARGE : JS_GC_OLD;
-        trc->marked++;
-        trc->marked_bytes += b->is_large ? b->map_size : b->cell_size;
-    }
+    mark_bit(trc, c);
     for (uint32_t k = 0; k < c->aux; k++) trace_value(trc, a->values[k]);
 }
 
@@ -1115,6 +1117,11 @@ static void add_task(JSMarkPool *p, JSCell *c, size_t from, size_t to) {
     atomic_store_int(&p->news, p->news + 1);
 }
 
+/* Bytes [from, to) of `c` as tasks of MARK_CHUNK bytes at most. */
+static void add_chunk_tasks(JSMarkPool *p, JSCell *c, size_t from, size_t to) {
+    for (; from < to; from += MARK_CHUNK) add_task(p, c, from, to - from > MARK_CHUNK ? from + MARK_CHUNK : to);
+}
+
 static void give_packet(JSTracer *trc, JSMarkPool *p) {
     size_t n = (trc->sp - trc->base) / 2;
     if (n > PACKET) n = PACKET;
@@ -1199,10 +1206,8 @@ static size_t splittable_bytes(const JSCell *c) {
 /* A large cell met while marking with others: its chunks but the first become tasks, for
  * whoever is free; this marker visits the first. */
 static void split_cell(JSTracer *trc, JSMarkPool *p, JSCell *c) {
-    size_t size = js_block_of(c)->cell_size;
     js_os_lock(p->lock);
-    for (size_t from = MARK_CHUNK; from < size; from += MARK_CHUNK)
-        add_task(p, c, from, size - from > MARK_CHUNK ? from + MARK_CHUNK : size);
+    add_chunk_tasks(p, c, MARK_CHUNK, js_block_of(c)->cell_size);
     js_os_cond_broadcast(p->work);
     js_os_unlock(p->lock);
 #ifdef JS_GC_VERIFY
@@ -1373,10 +1378,6 @@ static void drain(JSTracer *trc) {
 #endif
 }
 
-static bool has_children(const JSCell *c) {
-    return !leaf_kind[c->kind] && !(c->kind == JS_CELL_HOST && !((const JSHostCell *)c)->cls->visit);
-}
-
 /* The slots of `slots[0..n)` (at byte `base` of their cell) in bytes [from, to) of it. */
 static void trace_slots_in(JSTracer *trc, const JSValue *slots, size_t n, size_t base, size_t from, size_t to) {
     size_t first = from <= base ? 0 : (from - base) / sizeof(JSValue);
@@ -1416,43 +1417,50 @@ static bool visit_range(JSTracer *trc, JSCell *c, size_t from, size_t to) {
     return false;
 }
 
+/* Whether visit_range can visit part of `c`, not the whole cell whatever the range. */
+static bool visits_part(const JSCell *c) {
+    if (c->kind == JS_CELL_HOST) return ((const JSHostCell *)c)->cls->visit_range != NULL;
+    return splittable_bytes(c) != 0;
+}
+
+static bool card_marked(const JSBlock *b, size_t k) { return (b->cards[k / 64] >> (k % 64)) & 1; }
+
+/* The next run of large `b`'s cards from card *k that are marked (`marked`) or not: bytes
+ * [*from, *to) of its cell. Returns false when there's none left. */
+static bool next_card_run(const JSBlock *b, bool marked, size_t *k, size_t *from, size_t *to) {
+    unsigned shift = b->card_shift;
+    size_t n = (b->cell_size + ((size_t)1 << shift) - 1) >> shift;
+    while (*k < n && card_marked(b, *k) != marked) (*k)++;
+    if (*k == n) return false;
+    size_t end = *k + 1;
+    while (end < n && card_marked(b, end) == marked) end++;
+    *from = *k << shift;
+    *to = end << shift < b->cell_size ? end << shift : b->cell_size;
+    *k = end;
+    return true;
+}
+
+static void forget_cards(JSBlock *b) {
+    memset(b->cards, 0, sizeof b->cards);
+    b->remembered = 0;
+}
+
 /* A remembered large cell: visits its marked cards, a run of them at a time (`marked`), or, for
  * the barrier verifier, the others; then, when visiting the marked ones, forgets them. */
 static void visit_cards(JSTracer *trc, JSCell *c, bool marked) {
     JSBlock *b = js_block_of(c);
-    uint64_t *cards = js_large_cards(b);
-    unsigned shift = b->size_class;
-    size_t n = (b->cell_size + ((size_t)1 << shift) - 1) >> shift;
-    for (size_t k = 0; k < n;) {
-        if ((bool)((cards[k / 64] >> (k % 64)) & 1) != marked) {
-            k++;
-            continue;
-        }
-        size_t end = k + 1;
-        while (end < n && (bool)((cards[end / 64] >> (end % 64)) & 1) == marked) end++;
+    size_t from, to;
+    for (size_t k = 0; next_card_run(b, marked, &k, &from, &to);) {
 #ifdef JS_GC_VERIFY
         trc->visiting = c;
 #endif
-        size_t to = end << shift < b->cell_size ? end << shift : b->cell_size;
-        if (!visit_range(trc, c, k << shift, to) && !marked) return;  /* inexact: can't check part */
-        k = end;
-    }
-    if (marked) {
-        memset(cards, 0, JS_LARGE_CARDS / 8);
-        b->remembered = 0;
+        if (!visit_range(trc, c, from, to) && !marked) return;  /* inexact: can't check part */
     }
+    if (marked) forget_cards(b);
 }
 
 /* ---- Incremental marking: slices ---------------------------------------- */
 
-/* A large cell is visited this much at a time in a slice, when its kind's range visit is exact. */
-
-static bool visits_in_chunks(const JSCell *c) {
-    if (!js_block_of(c)->is_large || js_block_of(c)->cell_size <= MARK_CHUNK) return false;
-    return c->kind == JS_CELL_VALUE_ARRAY || c->kind == JS_CELL_ENV ||
-           (c->kind == JS_CELL_ELEMENTS && ((const JSElements *)c)->kind == JS_ELEMENTS_DENSE);
-}
-
 /* The next chunk of the partly visited cell. Returns the bytes it covered. */
 static size_t visit_chunk(JSTracer *trc) {
     JSCell *c = trc->partial;
@@ -1489,7 +1497,7 @@ static bool drain_some(JSTracer *trc, size_t budget) {
             }
             if (!trc->sp) break;
             JSCell *c = trc->stack[--trc->sp];
-            if (visits_in_chunks(c)) {
+            if (splittable_bytes(c) > MARK_CHUNK) {
                 trc->partial = c;
                 trc->partial_from = 0;
                 continue;
@@ -1508,56 +1516,32 @@ static void drain_all(JSTracer *trc) {
     drain(trc);
 }
 
-/* A young collection's other roots: the old cells a store gave a young cell. They're marked
- * already, so they're pushed to be visited, dead or alive: a remembered cell that died since keeps
- * its young cells until the next collection, so nothing it points to is freed under it (a stale
- * stack word could still find it). Each becomes plain old again. */
 /* Below this much in marked cards, a young collection visits them itself. */
 #define PARALLEL_CARDS ((size_t)256 << 10)
 
-static bool exact_range(const JSCell *c) {
-    switch (c->kind) {
-    case JS_CELL_VALUE_ARRAY: case JS_CELL_ENV: return true;
-    case JS_CELL_ELEMENTS: return ((const JSElements *)c)->kind == JS_ELEMENTS_DENSE;
-    case JS_CELL_HOST: return ((const JSHostCell *)c)->cls->visit_range != NULL;
-    default: return false;
-    }
-}
-
-
 /* Large `c`'s marked card runs, as tasks of MARK_CHUNK bytes at most (the whole cell, once, for a
  * kind that can't visit part of it); then its cards are forgotten. Returns the tasks' bytes. */
 static size_t card_tasks(JSMarkPool *p, JSCell *c) {
     JSBlock *b = js_block_of(c);
-    uint64_t *cards = js_large_cards(b);
-    unsigned shift = b->size_class;
-    size_t n = (b->cell_size + ((size_t)1 << shift) - 1) >> shift, bytes = 0;
-    if (!exact_range(c)) {
+    size_t bytes = 0, from, to;
+    if (!visits_part(c)) {
         add_task(p, c, 0, b->cell_size);
         bytes = b->cell_size;
     } else {
-        for (size_t k = 0; k < n;) {
-            if (!((cards[k / 64] >> (k % 64)) & 1)) {
-                k++;
-                continue;
-            }
-            size_t end = k + 1;
-            while (end < n && ((cards[end / 64] >> (end % 64)) & 1)) end++;
-            size_t to = end << shift < b->cell_size ? end << shift : b->cell_size;
-            for (size_t from = k << shift; from < to; from += MARK_CHUNK) {
-                add_task(p, c, from, to - from > MARK_CHUNK ? from + MARK_CHUNK : to);
-                bytes += to - from > MARK_CHUNK ? MARK_CHUNK : to - from;
-            }
-            k = end;
+        for (size_t k = 0; next_card_run(b, true, &k, &from, &to);) {
+            add_chunk_tasks(p, c, from, to);
+            bytes += to - from;
         }
     }
-    memset(cards, 0, JS_LARGE_CARDS / 8);
-    b->remembered = 0;
+    forget_cards(b);
     return bytes;
 }
 
-/* A young collection's other roots: the remembered cells. With helpers, large cells' marked cards
- * become tasks that every marker takes a share of (drain), when there are enough of them. */
+/* A young collection's other roots: the old cells a store gave a young cell. They're marked
+ * already, so they're pushed to be visited, dead or alive: a remembered cell that died since keeps
+ * its young cells until the next collection, so nothing it points to is freed under it (a stale
+ * stack word could still find it). Each becomes plain old again. With helpers, large cells' marked
+ * cards become tasks that every marker takes a share of (drain), when there are enough of them. */
 static void mark_remembered(JSHeap *h, JSTracer *trc) {
     JSMarkPool *p = h->gc_helpers ? mark_pool(h) : NULL;
     size_t task_bytes = 0;
@@ -1588,10 +1572,7 @@ static void mark_remembered(JSHeap *h, JSTracer *trc) {
 static void forget_remembered(JSHeap *h) {
     for (size_t i = 0; i < h->remembered_count; i++) {
         JSCell *c = h->remembered[i];
-        if (c->gc != JS_GC_OLD_LARGE) continue;  /* JS_GC_OLD again when it's marked */
-        JSBlock *b = js_block_of(c);
-        memset(js_large_cards(b), 0, JS_LARGE_CARDS / 8);
-        b->remembered = 0;
+        if (c->gc == JS_GC_OLD_LARGE) forget_cards(js_block_of(c));  /* the others: JS_GC_OLD again when they're marked */
     }
     h->remembered_count = 0;
 }
@@ -1646,8 +1627,10 @@ static void mark_roots(JSRuntime *rt, JSTracer *trc) {
     js_trace_value(trc, rt->async_context);
     js_jobs_trace(rt, trc);  /* queued jobs, unhandled rejections */
     js_weak_trace_roots(rt, trc);  /* the WeakRef kept-alive set */
-    for (JSContext *realm = rt->realms; realm; realm = realm->next_realm)
+    for (JSContext *realm = rt->realms; realm; realm = realm->next_realm) {
         for (unsigned i = 0; i < JS_INTRINSIC_COUNT; i++) js_trace_value(trc, realm->intrinsics[i]);
+        if (realm->array_shape) js_trace_cell(trc, &realm->array_shape->cell);
+    }
     for (size_t t = 0; t < h->root_table_count; t++)
         for (size_t i = 0; i < h->root_tables[t].n; i++) js_trace_value(trc, h->root_tables[t].slots[i]);
     for (size_t i = 0; i < h->root_count; i++) js_trace_value(trc, *h->roots[i]);

package/runtime/src/inspect.c

@@ -438,6 +438,23 @@ static JSValue get_constructor_name(Insp *ip, JSValue obj, double recurse) {
 }
 
 /* getPrefix: "Foo ", "Foo [Tag] ", "[Object: null prototype] " */
+/* Node's getPrefix: the constructor's name already shows the tag when it contains it, at its end
+ * or before a character that isn't lowercase (SecretKeyObject shows KeyObject; Foox doesn't show Foo) */
+static bool names_tag(JSContext *ctx, JSValue constructor, JSValue tag) {
+    JSStrView c = js_string_view(ctx, constructor), t = js_string_view(ctx, tag);
+    if (t.length == 0 || t.length > c.length) return false;
+    for (uint32_t pos = 0; pos + t.length <= c.length; pos++) {  /* the first occurrence decides, as indexOf */
+        uint32_t i = 0;
+        while (i < t.length && js_view_at(c, pos + i) == js_view_at(t, i)) i++;
+        if (i < t.length) continue;
+        uint32_t end = pos + t.length;
+        if (end == c.length) return true;
+        uint32_t next = js_view_at(c, end);
+        return next >= 'A' && next <= 'Z';  /* Node: not equal to its own lowercase (ASCII here) */
+    }
+    return false;
+}
+
 static void put_prefix(Builder *b, JSContext *ctx, JSValue constructor, JSValue tag, const char *fallback, const char *size) {
     bool has_tag = js_string_length(tag) != 0;
     if (js_is_null(constructor)) {
@@ -455,7 +472,7 @@ static void put_prefix(Builder *b, JSContext *ctx, JSValue constructor, JSValue
     }
     put_str(b, ctx, constructor);
     put_ascii(b, size);
-    if (has_tag && !js_string_equals(ctx, constructor, tag)) {
+    if (has_tag && !names_tag(ctx, constructor, tag)) {
         put_ascii(b, " [");
         put_str(b, ctx, tag);
         put_ascii(b, "]");

package/runtime/src/iterator.c

@@ -236,7 +236,11 @@ JSValue js_iter_next(JSContext *ctx, JSValue rec) {
     if (r->done) return JS_EMPTY;
     JSValue value;
     if (r->mode == MODE_ARRAY) {
-        value = array_step(ctx, r->iterator, r->index, KIND_VALUES);
+        /* a dense array's present element: what array_step's [[Get]] would read */
+        const JSElements *d = js_as_object(r->iterator)->elements;
+        uint32_t i = (uint32_t)r->index;
+        if (JS_LIKELY(d->kind == JS_ELEMENTS_DENSE && r->index < d->length && !js_is_empty(d->data[i]))) value = d->data[i];
+        else value = array_step(ctx, r->iterator, r->index, KIND_VALUES);
         r->index++;
     } else if (r->mode == MODE_STRING) {
         uint32_t i = (uint32_t)r->index;

package/runtime/src/jobs.c

@@ -17,8 +17,7 @@
 
 /* ---- The queue -------------------------------------------------------------------- */
 
-void js_enqueue_microtask(JSContext *ctx, const JSJob *job) {
-    JSJobQueue *q = &ctx->rt->jobs;
+static void enqueue(JSContext *ctx, JSJobQueue *q, const JSJob *job) {
     if (q->count == q->cap) {  /* grow, unwrapping the ring: no allocation of cells, so no GC */
         size_t cap = q->cap ? q->cap * 2 : 64;
         JSJob *items = malloc(cap * sizeof *items);
@@ -36,6 +35,14 @@ void js_enqueue_microtask(JSContext *ctx, const JSJob *job) {
     q->count++;
 }
 
+void js_enqueue_microtask(JSContext *ctx, const JSJob *job) {
+    enqueue(ctx, &ctx->rt->jobs, job);
+}
+
+void js_enqueue_tick(JSContext *ctx, const JSJob *job) {
+    enqueue(ctx, &ctx->rt->ticks, job);
+}
+
 /* ---- The async context --------------------------------------------------------------- */
 
 JSValue js_async_context(JSContext *ctx) { return ctx->rt->async_context; }
@@ -144,25 +151,31 @@ static int process_rejections(JSContext *ctx) {
 
 /* ---- The checkpoint -------------------------------------------------------------- */
 
+/* Runs every job in `q`, the ones queued meanwhile too: 0, or -1 after an uncaught error (reported) */
+static int drain(JSJobQueue *q) {
+    while (q->count) {
+        JSJob job = q->items[q->head];  /* on the C stack: the conservative scan keeps it alive */
+        q->head = (q->head + 1) % q->cap;
+        q->count--;
+        if (run_job(&job) < 0 && js_report_uncaught(job.realm)) return -1;  /* handled: the next job runs */
+    }
+    return 0;
+}
+
+/* Node's processTicksAndRejections: the ticks, then the microtasks (a tick a microtask queues
+ * waits for them all), again while there are ticks; the rejections only then, so a handler a
+ * tick adds is in time */
 int js_run_microtasks(JSContext *ctx) {
     JSRuntime *rt = ctx->rt;
     if (rt->in_checkpoint) return 0;
     rt->in_checkpoint = 1;
-    JSJobQueue *q = &rt->jobs;
     int status = 0;
-    do {  /* again while the host's handling of a rejection queued jobs */
-        while (q->count) {
-            JSJob job = q->items[q->head];  /* on the C stack: the conservative scan keeps it alive */
-            q->head = (q->head + 1) % q->cap;
-            q->count--;
-            if (run_job(&job) < 0 && js_report_uncaught(job.realm)) {  /* handled: the next job runs */
-                status = -1;
-                break;
-            }
-        }
+    do {
+        status = drain(&rt->ticks);
+        if (status == 0) status = drain(&rt->jobs);
         js_clear_kept_objects(rt);  /* the end of the job: WeakRef targets may go now */
-        if (status == 0) status = process_rejections(ctx);
-    } while (status == 0 && (q->count || rt->handled_late.count));
+        if (status == 0 && rt->ticks.count == 0) status = process_rejections(ctx);
+    } while (status == 0 && (rt->ticks.count || rt->jobs.count || rt->handled_late.count));
     rt->in_checkpoint = 0;
     return status;
 }
@@ -170,13 +183,14 @@ int js_run_microtasks(JSContext *ctx) {
 /* ---- GC and teardown (gc.c) ----------------------------------------------------- */
 
 void js_jobs_trace(JSRuntime *rt, JSTracer *trc) {
-    JSJobQueue *q = &rt->jobs;
-    for (size_t i = 0; i < q->count; i++) {
-        JSJob *j = &q->items[(q->head + i) % q->cap];
-        js_trace_value(trc, j->a);
-        js_trace_value(trc, j->b);
-        js_trace_value(trc, j->c);
-        js_trace_value(trc, j->context);
+    for (JSJobQueue *q = &rt->jobs; q; q = q == &rt->jobs ? &rt->ticks : NULL) {
+        for (size_t i = 0; i < q->count; i++) {
+            JSJob *j = &q->items[(q->head + i) % q->cap];
+            js_trace_value(trc, j->a);
+            js_trace_value(trc, j->b);
+            js_trace_value(trc, j->c);
+            js_trace_value(trc, j->context);
+        }
     }
     for (size_t i = 0; i < rt->rejections.count; i++) js_trace_value(trc, rt->rejections.items[i]);
     for (size_t i = 0; i < rt->handled_late.count; i++) js_trace_value(trc, rt->handled_late.items[i]);
@@ -189,6 +203,7 @@ void js_jobs_trace(JSRuntime *rt, JSTracer *trc) {
 
 void js_jobs_free(JSRuntime *rt) {
     free(rt->jobs.items);
+    free(rt->ticks.items);
     free(rt->rejections.items);
     free(rt->handled_late.items);
     free(rt->timers.heap);

package/runtime/src/object.c

@@ -544,7 +544,8 @@ int js_ordinary_set(JSContext *ctx, JSObject *o, JSValue key, JSValue v, JSValue
         /* not for classes that intercept indices (mapped arguments); arrays only guard length */
         bool plain = !o->shape->cls->define_own_property || o->shape->cls == &js_class_array;
         if (plain && js_elements_try_store(ctx, o, js_key_index(key), v)) return 1;
-    } else if (js_is_object(receiver) && js_as_object(receiver) == o) {
+    } else if (js_is_object(receiver) && js_as_object(receiver) == o &&
+               (!o->shape->cls->define_own_property || o->shape->cls == &js_class_array)) {  /* a class that intercepts writes (process.env) sees each */
         uint8_t attrs;
         int32_t slot = find_own(o, key, &attrs);
         if (slot >= 0 && (attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE) {
@@ -697,8 +698,7 @@ const JSClass js_class_array = {
     "Array", sizeof(JSObject), array_get_own, array_define, array_delete, array_extra_keys, NULL, NULL, NULL,
 };
 
-static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity) {
-    JSShape *shape = js_shape_root(ctx, &js_class_array, proto, 0);  /* named properties on arrays are rare */
+static JSValue array_of_shape(JSContext *ctx, JSShape *shape, uint32_t capacity) {
     JSObject *a = js_alloc_object(ctx, JS_CELL_ARRAY, shape);
     if (capacity) {
         JSElements *e = (JSElements *)js_alloc_cell(ctx, JS_CELL_ELEMENTS, sizeof(JSElements) + (size_t)capacity * sizeof(JSValue));
@@ -709,8 +709,13 @@ static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity
     return js_object_value(a);
 }
 
+static JSValue array_with_proto(JSContext *ctx, JSValue proto, uint32_t capacity) {
+    return array_of_shape(ctx, js_shape_root(ctx, &js_class_array, proto, 0), capacity);  /* named properties on arrays are rare */
+}
+
 JSValue js_new_array(JSContext *ctx, uint32_t capacity) {
-    return array_with_proto(ctx, ctx->intrinsics[JS_INTRINSIC_ARRAY_PROTOTYPE], capacity);
+    if (JS_UNLIKELY(!ctx->array_shape)) ctx->array_shape = js_shape_root(ctx, &js_class_array, ctx->intrinsics[JS_INTRINSIC_ARRAY_PROTOTYPE], 0);
+    return array_of_shape(ctx, ctx->array_shape, capacity);
 }
 
 JSValue js_new_array_from(JSContext *ctx, const JSValue *values, uint32_t n) {
@@ -740,6 +745,51 @@ int js_array_push(JSContext *ctx, JSObject *a, JSValue v) {
     return js_define_own_property(ctx, a, js_index_key(len), &d, true);
 }
 
+static const char *const SARRAY_KINDS[] = { "number", "string", "boolean" };
+
+static JSValue sarray_not_array(JSContext *ctx, int kind) {
+    return js_throw_type_error(ctx, "A %s[] of static code isn't an array", SARRAY_KINDS[kind]);
+}
+
+static JSValue sarray_out_of_range(JSContext *ctx, int64_t i, uint32_t len) {
+    if (i < 0) return js_throw_range_error(ctx, "Invalid array index for length %u", len);
+    return js_throw_range_error(ctx, "Index %lld is out of range for length %u", (long long)i, len);
+}
+
+JSValue js_sarray_get_slow(JSContext *ctx, JSValue arr, int64_t i, int kind) {
+    if (!js_is_array(arr)) return sarray_not_array(ctx, kind);
+    uint32_t len = js_array_length(js_as_object(arr));
+    if (i < 0 || i >= len) return sarray_out_of_range(ctx, i, len);
+    /* a hole, a sparse store: the element as JavaScript reads it, which may be of another kind */
+    JSValue v = js_get_elem(ctx, arr, js_number((double)i));
+    if (js_is_exception(v) || js_sarray_is(v, kind)) return v;
+    return js_throw_type_error(ctx, "Element %lld of a %s[] isn't a %s", (long long)i, SARRAY_KINDS[kind], SARRAY_KINDS[kind]);
+}
+
+int js_sarray_set_slow(JSContext *ctx, JSValue arr, int64_t i, JSValue v, int kind) {
+    JSValue error = !js_is_array(arr) ? sarray_not_array(ctx, kind)
+        : !js_sarray_is(v, kind) ? js_throw_type_error(ctx, "A %s[]'s element can't be another type", SARRAY_KINDS[kind])
+        : JS_UNDEFINED;
+    if (js_is_exception(error)) return -1;
+    uint32_t len = js_array_length(js_as_object(arr));
+    if (i == len) return js_array_push(ctx, js_as_object(arr), v);
+    if (i < 0 || i > len) {
+        js_discard(sarray_out_of_range(ctx, i, len));
+        return -1;
+    }
+    return js_set_elem(ctx, arr, js_number((double)i), v, true);
+}
+
+JSValue js_sarray_length_slow(JSContext *ctx, JSValue arr) {
+    if (!js_is_array(arr)) return sarray_not_array(ctx, JS_SARRAY_NUMBER);
+    return js_throw_range_error(ctx, "A static array's length is below 2^31");
+}
+
+JSValue js_sarray_push_slow(JSContext *ctx, JSValue arr, JSValue v, int kind) {
+    if (js_sarray_set_slow(ctx, arr, js_is_array(arr) ? js_array_length(js_as_object(arr)) : 0, v, kind) < 0) return JS_EXCEPTION;
+    return js_sarray_length(ctx, arr);
+}
+
 int js_array_append(JSContext *ctx, JSValue arr, JSValue v) {
     JSObject *a = js_as_object(arr);
     if (!js_is_empty(v)) return js_array_push(ctx, a, v);
@@ -821,7 +871,7 @@ JSValue js_get_value(JSContext *ctx, JSValue obj, JSValue key) {
 }
 
 int js_set_value(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
-    if (js_is_object(obj)) return js_set(ctx, js_as_object(obj), key, v, obj, strict);
+    if (js_is_object(obj)) return js_key_is_index(key) ? js_set(ctx, js_as_object(obj), key, v, obj, strict) : js_set_prop_slow(ctx, obj, key, v, strict, NULL);
     if (js_is_nullish(obj)) {
         js_discard(nullish_error(ctx, obj, key, "set"));
         return -1;
@@ -1045,6 +1095,11 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
     JS_ASSERT_NOT_EXC(obj);
     JS_ASSERT_NOT_EXC(v);
     if (!js_is_object(obj) || js_key_is_index(key)) return js_set_value(ctx, obj, key, v, strict);
+    JSPropCache none;  /* no site (a computed key): only the shared cache */
+    if (!ic) {
+        none.kind = JS_IC_EMPTY;
+        ic = &none;
+    }
     JSObject *o = js_as_object(obj);
     if (ic->kind == JS_IC_ADD && o->shape == ic->shape && chain_holds(ctx, ic)) {
         JSShape *next = ic->next;  /* on the stack: kept alive if ensure_slot collects */
@@ -1074,7 +1129,8 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
     lookup(ctx, o, key, &l);
     JSShape *before = o->shape;
     bool cacheable = l.cacheable && !l.exotic;
-    if (cacheable && l.holder == o && (l.attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE) {
+    bool intercepts = before->cls->define_own_property && before->cls != &js_class_array;
+    if (cacheable && !intercepts && l.holder == o && (l.attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE) {
         JSPropCache c = with_fast_path((JSPropCache){ .kind = JS_IC_OWN, .slot = (uint32_t)l.slot, .shape = before });
         *ic = c;
         m->key = key;
@@ -1083,8 +1139,10 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
         return 1;
     }
     int r = js_set(ctx, o, key, v, obj, strict);
-    /* a plain add (no setter or read-only property on the chain): remember the transition */
-    if (r == 1 && cacheable && !l.holder && !before->cls->define_own_property && !is_dictionary(o) &&
+    /* a plain add (no setter or read-only property on the chain, or a prototype's writable data
+     * property it shadows, as EventEmitter.prototype._events): remember the transition */
+    bool shadows = l.holder && l.holder != o && (l.attrs & (JS_PROP_WRITABLE | JS_PROP_ACCESSOR)) == JS_PROP_WRITABLE;
+    if (r == 1 && cacheable && (!l.holder || shadows) && !before->cls->define_own_property && !is_dictionary(o) &&
         o->shape->parent == before && js_same_bits(o->shape->key, key)) {
         JSPropCache c = { .kind = JS_IC_ADD, .depth = l.depth, .shape = before, .next = o->shape, .epoch = epoch };
         memcpy(c.chain, l.chain, sizeof c.chain);
@@ -1098,9 +1156,32 @@ int js_set_prop_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool s
 
 /* ---- Generated code: computed keys, delete, literals --------------------------------- */
 
+/* Whether `key` can be a keyed site's: a property key as it is (a symbol, an interned string
+ * that isn't an index), so that the same bits mean the same key. Makes the site its. */
+static bool take_site_key(JSContext *ctx, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (!js_is_symbol(key) && !(js_is_string(key) && js_is_atom(key))) return false;
+    JSValue k = js_to_property_key(ctx, key);  /* a primitive: no user code */
+    if (!js_same_bits(k, key) || js_key_is_index(k)) return false;
+    memset(ic, 0, sizeof *ic);  /* its entries were for the old key */
+    *site = key;
+    return true;
+}
+
+JSValue js_get_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue *site, JSPropCache *ic) {
+    if (take_site_key(ctx, key, site, ic)) return js_get_prop(ctx, obj, key, ic);
+    return js_get_elem(ctx, obj, key);
+}
+
+int js_set_keyed_slow(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict, JSValue *site, JSPropCache *ic) {
+    if (take_site_key(ctx, key, site, ic)) return js_set_prop(ctx, obj, key, v, strict, ic);
+    return js_set_elem(ctx, obj, key, v, strict);
+}
+
 JSValue js_get_elem(JSContext *ctx, JSValue obj, JSValue key) {
     JS_ASSERT_NOT_EXC(obj);
     JS_ASSERT_NOT_EXC(key);
+    JSValue elem;  /* a typed array's element: the component reads it inline */
+    if (js_is_int32(key) && ctx->rt->typed_array_get && ctx->rt->typed_array_get(obj, js_as_int32(key), &elem)) return elem;
     if (js_is_nullish(obj)) {
         JSValue k = js_is_object(key) ? key : js_to_property_key(ctx, key);  /* primitives only: no user code */
         if (js_is_exception(k)) return JS_EXCEPTION;
@@ -1113,6 +1194,8 @@ JSValue js_get_elem(JSContext *ctx, JSValue obj, JSValue key) {
 
 int js_set_elem(JSContext *ctx, JSValue obj, JSValue key, JSValue v, bool strict) {
     JS_ASSERT_NOT_EXC(v);
+    /* a Number into a typed array's element: no ToNumber code to run, the component stores it inline */
+    if (js_is_int32(key) && js_is_number(v) && ctx->rt->typed_array_set && ctx->rt->typed_array_set(obj, js_as_int32(key), js_as_number(v))) return 1;
     if (js_is_nullish(obj)) {
         JSValue k = js_is_object(key) ? js_empty_string() : js_to_property_key(ctx, key);
         if (js_is_exception(k)) return -1;

package/runtime/src/os.c

@@ -151,6 +151,10 @@ const char *js_os_timezone_id(void) {
     return tz && *tz ? tz : "";  /* Windows zone names aren't IANA ids: the offset fallback */
 }
 
+void js_os_timezone_changed(void) {
+    _tzset();
+}
+
 
 double js_os_thread_cpu_ms(void) {
     FILETIME created, exited, kernel, user;
@@ -331,11 +335,18 @@ double js_os_time_ms(void) {
     return (double)ts.tv_sec * 1000.0 + (double)(ts.tv_nsec / 1000000);
 }
 
+static bool tz_initialized, tz_id_done;
+
+void js_os_timezone_changed(void) {
+    tzset();
+    tz_initialized = true;
+    tz_id_done = false;
+}
+
 int32_t js_os_local_offset(int64_t seconds, bool *dst) {
-    static bool initialized;
-    if (!initialized) {
+    if (!tz_initialized) {
         tzset();
-        initialized = true;
+        tz_initialized = true;
     }
     time_t t = (time_t)seconds;
     struct tm tm;
@@ -351,9 +362,8 @@ int32_t js_os_local_offset(int64_t seconds, bool *dst) {
  * points. */
 const char *js_os_timezone_id(void) {
     static char id[512];
-    static bool done;
-    if (done) return id;
-    done = true;
+    if (tz_id_done) return id;
+    tz_id_done = true;
     const char *tz = getenv("TZ");
     char path[512] = "";
     if (tz && *tz) {