xbintsc 0.3.25 → 0.3.46

package/runtime/xt_fetch/response.inc

@@ -0,0 +1,107 @@
+/* -- Response ------------------------------------------------------------- */
+
+/*
+ * `fetch` resolves with a plain object shaped like a `Response`: the status
+ * fields are own properties, `headers` is a Headers object, and the body is
+ * kept verbatim under `__body`. The body consumers (`text` / `json` /
+ * `arrayBuffer` / `bytes`) return promises, matching the platform API even
+ * though the value is already available.
+ */
+
+static void *xt_response_method_impl(xt_value name);
+static xt_value xt_method_value_for_response(xt_value name);
+
+static xt_value xt_response_body(xt_value response) {
+  xt_value body = xt_object_get_cstr(response, "__body");
+  return XT_IS_STRING(body) ? body : xt_string_from_cstr("");
+}
+
+static xt_value xt_response_method_text(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  return xt_promise_resolve(xt_response_body(thisValue));
+}
+
+static xt_value xt_response_method_json(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  xt_value body = xt_response_body(thisValue);
+  return xt_promise_resolve(xt_json_parse(1, &body));
+}
+
+static xt_value xt_response_method_array_buffer(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  xt_value body = xt_response_body(thisValue);
+  const char *data = xt_string_data(body);
+  int32_t length = xt_string_length_value(body);
+  if (!data || length < 0) length = 0;
+  xt_value bytes = xt_array_new(0, NULL);
+  for (int32_t i = 0; i < length; i++) {
+    xt_array_push(bytes, xt_number((double)(unsigned char)data[i]));
+  }
+  return xt_promise_resolve(bytes);
+}
+
+static xt_value xt_response_method_clone(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  xt_value clone = xt_object_new();
+  xt_value keys = xt_object_keys(thisValue);
+  int32_t count = (int32_t)xt_to_number(xt_array_length(keys));
+  for (int32_t i = 0; i < count; i++) {
+    xt_value key = xt_array_get(keys, xt_number((double)i));
+    xt_value value = xt_object_get(thisValue, key);
+    if (XT_IS_FUNCTION(value)) {
+      /* Re-use the method implementation with the new receiver. */
+      xt_value name = key;
+      xt_object_set(clone, name, xt_method_value_for_response(name));
+    } else {
+      xt_object_set(clone, key, value);
+    }
+  }
+  return clone;
+}
+
+/* Map a Response method name back to its implementation so `clone()` can copy
+ * the methods without duplicating the dispatch table. */
+static void *xt_response_method_impl(xt_value name) {
+  const char *method = xt_string_data(name);
+  if (!method) return NULL;
+  if (strcmp(method, "text") == 0) return (void *)xt_response_method_text;
+  if (strcmp(method, "json") == 0) return (void *)xt_response_method_json;
+  if (strcmp(method, "arrayBuffer") == 0) return (void *)xt_response_method_array_buffer;
+  if (strcmp(method, "bytes") == 0) return (void *)xt_response_method_array_buffer;
+  if (strcmp(method, "clone") == 0) return (void *)xt_response_method_clone;
+  return NULL;
+}
+
+static xt_value xt_method_value_for_response(xt_value name) {
+  void *impl = xt_response_method_impl(name);
+  return impl ? xt_closure_new(impl, 0, NULL) : XT_UNDEFINED;
+}
+
+static xt_value xt_response_new(xt_value headers, int status, const char *statusText, const char *url,
+                                const char *body, size_t bodyLength) {
+  xt_value response = xt_object_new();
+  xt_object_set(response, xt_string_from_cstr("ok"),
+                (status >= 200 && status < 300) ? XT_TRUE : XT_FALSE);
+  xt_object_set(response, xt_string_from_cstr("status"), xt_number((double)status));
+  xt_object_set(response, xt_string_from_cstr("statusText"), xt_string_from_cstr(statusText ? statusText : ""));
+  xt_object_set(response, xt_string_from_cstr("url"), xt_string_from_cstr(url ? url : ""));
+  xt_object_set(response, xt_string_from_cstr("redirected"), XT_FALSE);
+  xt_object_set(response, xt_string_from_cstr("type"), xt_string_from_cstr("basic"));
+  xt_object_set(response, xt_string_from_cstr("bodyUsed"), XT_FALSE);
+  xt_object_set(response, xt_string_from_cstr("headers"), headers);
+  xt_object_set(response, xt_string_from_cstr("__body"), xt_string_new(body ? body : "", bodyLength));
+  xt_fetch_set_method(response, "text", (void *)xt_response_method_text);
+  xt_fetch_set_method(response, "json", (void *)xt_response_method_json);
+  xt_fetch_set_method(response, "arrayBuffer", (void *)xt_response_method_array_buffer);
+  xt_fetch_set_method(response, "bytes", (void *)xt_response_method_array_buffer);
+  xt_fetch_set_method(response, "clone", (void *)xt_response_method_clone);
+  return response;
+}

package/runtime/xt_fetch/socket.inc

@@ -0,0 +1,72 @@
+/* -- TCP socket helpers --------------------------------------------------- */
+
+/*
+ * `fetch` performs a conventional blocking request/response exchange: connect,
+ * write the request, read until the response is complete (or the peer closes).
+ * The socket carries a receive timeout so a stalled server cannot hang the
+ * program forever; the timeout surfaces as a rejected promise.
+ */
+#define XT_FETCH_TIMEOUT_SECONDS 30
+
+static void xt_fetch_set_timeouts(int fd) {
+#if defined(_WIN32)
+  DWORD ms = (DWORD)XT_FETCH_TIMEOUT_SECONDS * 1000;
+  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (const char *)&ms, (int)sizeof(ms));
+  setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (const char *)&ms, (int)sizeof(ms));
+#else
+  struct timeval timeout;
+  timeout.tv_sec = XT_FETCH_TIMEOUT_SECONDS;
+  timeout.tv_usec = 0;
+  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
+  setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));
+#endif
+}
+
+static int xt_fetch_connect(const xt_fetch_url *url) {
+  struct addrinfo hints;
+  memset(&hints, 0, sizeof(hints));
+  hints.ai_family = AF_UNSPEC;
+  hints.ai_socktype = SOCK_STREAM;
+  struct addrinfo *result = NULL;
+  if (getaddrinfo(url->host, url->port, &hints, &result) != 0) return -1;
+  int fd = -1;
+  for (struct addrinfo *info = result; info; info = info->ai_next) {
+    int candidate = socket(info->ai_family, info->ai_socktype, info->ai_protocol);
+    if (candidate < 0) continue;
+    if (connect(candidate, info->ai_addr, (xt_fetch_socklen_t)info->ai_addrlen) == 0) {
+      fd = candidate;
+      break;
+    }
+    xt_fetch_close_socket(candidate);
+  }
+  freeaddrinfo(result);
+  if (fd >= 0) xt_fetch_set_timeouts(fd);
+  return fd;
+}
+
+static int xt_fetch_send_all(int fd, const char *data, size_t length) {
+  size_t sent = 0;
+  while (sent < length) {
+#if defined(_WIN32)
+    int written = send(fd, data + sent, (int)(length - sent), 0);
+#else
+    ssize_t written = send(fd, data + sent, length - sent, 0);
+#endif
+    if (written > 0) {
+      sent += (size_t)written;
+      continue;
+    }
+    return -1;
+  }
+  return 0;
+}
+
+/** Receive one chunk; returns the byte count, `0` on close, `-1` on error. */
+static int xt_fetch_recv(int fd, char *buffer, size_t capacity) {
+#if defined(_WIN32)
+  return recv(fd, buffer, (int)capacity, 0);
+#else
+  ssize_t count = recv(fd, buffer, capacity, 0);
+  return count > 2147483647 ? 2147483647 : (int)count;
+#endif
+}

package/runtime/xt_fetch/url.inc

@@ -0,0 +1,108 @@
+/* -- URL parsing ---------------------------------------------------------- */
+
+/*
+ * `fetch` accepts absolute `http://` / `https://` URLs (there is no document
+ * base to resolve relative ones against). The parsed pieces are kept in a
+ * fixed-size struct because `fetch` hands them straight to `getaddrinfo`.
+ */
+typedef struct {
+  int secure;
+  char host[256];
+  char port[8];
+  char path[4096];
+} xt_fetch_url;
+
+/** Parse `url` into `out`. Returns 0 on success, -1 on a malformed URL. */
+static int xt_fetch_parse_url(const char *url, xt_fetch_url *out) {
+  if (!url) return -1;
+  out->secure = 0;
+  const char *cursor = url;
+  if (strncmp(cursor, "http://", 7) == 0) {
+    cursor += 7;
+    snprintf(out->port, sizeof(out->port), "80");
+  } else if (strncmp(cursor, "https://", 8) == 0) {
+    cursor += 8;
+    out->secure = 1;
+    snprintf(out->port, sizeof(out->port), "443");
+  } else {
+    return -1;
+  }
+
+  /* The authority ends at the first `/`, `?` or `#` (or the end of the URL). */
+  const char *authorityEnd = cursor;
+  while (*authorityEnd && *authorityEnd != '/' && *authorityEnd != '?' && *authorityEnd != '#') authorityEnd++;
+
+  /* Drop any `user:password@` prefix. */
+  const char *hostStart = cursor;
+  for (const char *p = cursor; p < authorityEnd; p++) {
+    if (*p == '@') hostStart = p + 1;
+  }
+
+  const char *hostEnd = authorityEnd;
+  const char *portStart = NULL;
+  if (hostStart < authorityEnd && *hostStart == '[') {
+    /* IPv6 literal: `[::1]:8080`. */
+    const char *close = (const char *)memchr(hostStart, ']', (size_t)(authorityEnd - hostStart));
+    if (!close) return -1;
+    hostEnd = close;
+    if (close + 1 < authorityEnd && close[1] == ':') portStart = close + 2;
+    hostStart++;
+  } else {
+    const char *colon = (const char *)memchr(hostStart, ':', (size_t)(authorityEnd - hostStart));
+    if (colon) {
+      hostEnd = colon;
+      portStart = colon + 1;
+    }
+  }
+
+  size_t hostLength = (size_t)(hostEnd - hostStart);
+  if (hostLength == 0 || hostLength >= sizeof(out->host)) return -1;
+  memcpy(out->host, hostStart, hostLength);
+  out->host[hostLength] = '\0';
+
+  if (portStart && portStart < authorityEnd) {
+    size_t portLength = (size_t)(authorityEnd - portStart);
+    if (portLength >= sizeof(out->port)) return -1;
+    memcpy(out->port, portStart, portLength);
+    out->port[portLength] = '\0';
+    for (const char *p = out->port; *p; p++) {
+      if (*p < '0' || *p > '9') return -1;
+    }
+  }
+
+  /* The request target keeps the query string but drops the fragment. */
+  if (*authorityEnd == '\0' || *authorityEnd == '#') {
+    snprintf(out->path, sizeof(out->path), "/");
+  } else {
+    const char *pathEnd = authorityEnd;
+    while (*pathEnd && *pathEnd != '#') pathEnd++;
+    size_t pathLength = (size_t)(pathEnd - authorityEnd);
+    if (pathLength >= sizeof(out->path)) return -1;
+    memcpy(out->path, authorityEnd, pathLength);
+    out->path[pathLength] = '\0';
+  }
+  return 0;
+}
+
+/*
+ * Resolve a `Location` header against the URL just requested. Only absolute
+ * URLs and root-relative paths are supported; anything else is reported as a
+ * failure so the caller can return the 3xx response unchanged.
+ */
+static int xt_fetch_resolve_location(const xt_fetch_url *base, const char *location, char *out, size_t size) {
+  if (strncmp(location, "http://", 7) == 0 || strncmp(location, "https://", 8) == 0) {
+    snprintf(out, size, "%s", location);
+    return 0;
+  }
+  const char *scheme = base->secure ? "https" : "http";
+  if (location[0] == '/') {
+    int defaultPort = base->secure ? 443 : 80;
+    if (atoi(base->port) == defaultPort) {
+      snprintf(out, size, "%s://%s%s", scheme, base->host, location);
+    } else {
+      snprintf(out, size, "%s://%s:%s%s", scheme, base->host, base->port, location);
+    }
+    return 0;
+  }
+  return -1;
+}

package/runtime/xt_fetch.c

@@ -0,0 +1,39 @@
+/*
+ * xbintsc runtime — the global `fetch` API.
+ *
+ * This is a small, dependency-free HTTP/1.1 client exposed as the platform
+ * `fetch` global. The runtime has no event loop (promises are drained
+ * synchronously by `await`), so the request is performed with blocking sockets
+ * and the returned promise is already settled. TLS is not implemented, so only
+ * `http://` URLs are accepted; `https://` rejects with a `TypeError`.
+ *
+ * The implementation is grouped by concern under `xt_fetch/` and `#include`d
+ * here as a single translation unit, following the other runtime modules.
+ */
+
+#include "rt_internal.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#if defined(_WIN32)
+#include <winsock2.h>
+#include <ws2tcpip.h>
+typedef int xt_fetch_socklen_t;
+#define xt_fetch_close_socket closesocket
+#else
+#include <netdb.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+typedef socklen_t xt_fetch_socklen_t;
+#define xt_fetch_close_socket close
+#endif
+
+#include "xt_fetch/buffer.inc"
+#include "xt_fetch/url.inc"
+#include "xt_fetch/socket.inc"
+#include "xt_fetch/headers.inc"
+#include "xt_fetch/response.inc"
+#include "xt_fetch/request.inc"

package/runtime/xt_generator.c

@@ -45,14 +45,23 @@ typedef struct xt_generator {
   int done;
   int threw;
   int booted;
+  /* Private stack bounds, registered as an active stack region while the
+   * generator runs and scanned conservatively while it is suspended. */
+  char *stack;
+  size_t stack_size;
+  int stack_pushed;
   void *saved_try_top;
 #ifdef _WIN32
   void *fiber;
   void *caller_fiber;
+  /* `SwitchToFiber` keeps the resumer's callee-saved registers in an opaque
+   * fiber context (POSIX stores them in `caller`), so snapshot them for the
+   * collector before switching away. */
+  jmp_buf caller_regs;
+  int has_caller_regs;
 #else
   ucontext_t ctx;
   ucontext_t caller;
-  char *stack;
 #endif
 } xt_generator;
 
@@ -93,6 +102,27 @@ static void xt_generator_suspend(xt_generator *gen) {
 
 /* Runs on the generator's private stack. */
 static void xt_generator_run(xt_generator *gen) {
+#ifdef _WIN32
+  /* The fiber stack is not observable from the outside; capture its bounds
+   * here (before the body allocates anything) so a collection during the body
+   * has a valid scan region. */
+  if (!gen->stack) {
+    MEMORY_BASIC_INFORMATION info;
+    uintptr_t here = (uintptr_t)&info;
+    if (VirtualQuery((LPCVOID)here, &info, sizeof(info))) {
+      /* Use the *committed* region containing the current frame: a Windows
+       * stack reserves more than it commits, and `AllocationBase + RegionSize`
+       * can fall in uncommitted memory. `BaseAddress + RegionSize` is the
+       * stack top. */
+      gen->stack = (char *)info.BaseAddress;
+      gen->stack_size = info.RegionSize;
+    }
+  }
+#endif
+  if (gen->stack && gen->stack_size && !gen->stack_pushed) {
+    xt_gc_push_stack((uintptr_t)gen->stack, (uintptr_t)gen->stack + gen->stack_size);
+    gen->stack_pushed = 1;
+  }
   void *boundary = xt_try_enter();
   if (xt_try_setjmp(boundary) == 0) {
     xt_function *function = (xt_function *)XT_GET_PTR(gen->function);
@@ -127,6 +157,7 @@ static void xt_generator_boot(xt_generator *gen) {
   size_t size = 1 << 20;
   gen->stack = (char *)malloc(size);
   if (!gen->stack) abort();
+  gen->stack_size = size;
   if (getcontext(&gen->ctx) != 0) abort();
   gen->ctx.uc_stack.ss_sp = gen->stack;
   gen->ctx.uc_stack.ss_size = size;
@@ -146,6 +177,9 @@ static void xt_generator_dispose(xt_generator *gen) {
     gen->fiber = NULL;
   }
   gen->caller_fiber = NULL;
+  /* `DeleteFiber` releases the stack: never scan it again. */
+  gen->stack = NULL;
+  gen->stack_size = 0;
 #else
   if (gen->stack) {
     free(gen->stack);
@@ -158,9 +192,20 @@ static void xt_generator_resume(xt_generator *gen) {
   if (!gen->booted) xt_generator_boot(gen);
   xt_generator *previous = g_active_generator;
   g_active_generator = gen;
+  /* Record where the current (calling) stack suspends before switching away.
+   * On Windows the first push happens inside the fiber once its stack bounds
+   * are known, so the caller's region must be marked suspended here, on the
+   * caller's own stack. */
+  xt_gc_suspend((uintptr_t)&gen);
+  if (gen->stack && gen->stack_size && !gen->stack_pushed) {
+    xt_gc_push_stack((uintptr_t)gen->stack, (uintptr_t)gen->stack + gen->stack_size);
+    gen->stack_pushed = 1;
+  }
   void *caller_try = xt_try_mark();
   xt_try_restore(gen->saved_try_top);
 #ifdef _WIN32
+  _setjmp(gen->caller_regs);
+  gen->has_caller_regs = 1;
   gen->caller_fiber = GetCurrentFiber();
   SwitchToFiber(gen->fiber);
 #else
@@ -168,15 +213,63 @@ static void xt_generator_resume(xt_generator *gen) {
 #endif
   gen->saved_try_top = xt_try_mark();
   xt_try_restore(caller_try);
+  if (gen->stack_pushed) {
+    xt_gc_pop_stack();
+    gen->stack_pushed = 0;
+  }
   if (gen->done) xt_generator_dispose(gen);
   g_active_generator = previous;
 }
 
+/* The active generator is only reachable through this static pointer, and its
+ * private stack holds values that are invisible to a scan of the main stack. */
+static void xt_generator_gc_scan_roots(void) {
+  if (!g_active_generator) return;
+  xt_gc_mark_header((xt_header *)g_active_generator);
+}
+
+static void xt_generator_gc_register(void) {
+  static int registered = 0;
+  if (registered) return;
+  registered = 1;
+  xt_gc_register_root_provider(xt_generator_gc_scan_roots);
+}
+
+void xt_generator_gc_trace(xt_header *header) {
+  xt_generator *gen = (xt_generator *)header;
+  size_t payload = header->size > sizeof(xt_header) ? header->size - sizeof(xt_header) : 0;
+  xt_gc_scan_region((const char *)header + sizeof(xt_header), payload);
+  if (gen->args && gen->argc > 0) {
+    xt_gc_scan_region(gen->args, sizeof(xt_value) * (size_t)gen->argc);
+  }
+  if (gen->stack && gen->stack_size) xt_gc_scan_region(gen->stack, gen->stack_size);
+#ifndef _WIN32
+  /* Registers saved by `swapcontext` at the last yield are not on the stack. */
+  xt_gc_scan_region(&gen->ctx, sizeof(gen->ctx));
+#else
+  if (gen->has_caller_regs) xt_gc_scan_region(&gen->caller_regs, sizeof(gen->caller_regs));
+#endif
+}
+
+void xt_generator_gc_release(xt_header *header) {
+  xt_generator *gen = (xt_generator *)header;
+  free(gen->args);
+#ifdef _WIN32
+  if (gen->fiber) DeleteFiber(gen->fiber);
+#else
+  free(gen->stack);
+#endif
+}
+
 xt_value xt_generator_new(xt_value function, xt_value thisValue, int32_t argc, xt_value *argv) {
   xt_generator *gen = (xt_generator *)xt_alloc(sizeof(xt_generator), XT_OBJECT_KIND_GENERATOR);
   gen->function = function;
   gen->this_value = thisValue;
   gen->argc = argc;
+  gen->args = NULL;
+  gen->stack = NULL;
+  gen->stack_size = 0;
+  gen->stack_pushed = 0;
   gen->result = XT_UNDEFINED;
   gen->sent = XT_UNDEFINED;
   gen->iter_value = XT_UNDEFINED;
@@ -185,6 +278,7 @@ xt_value xt_generator_new(xt_value function, xt_value thisValue, int32_t argc, x
     if (!gen->args) abort();
     memcpy(gen->args, argv, sizeof(xt_value) * (size_t)argc);
   }
+  xt_generator_gc_register();
   return XT_FROM_PTR(XT_TAG_OBJECT, gen);
 }
 

package/runtime/xt_loop.c

@@ -130,14 +130,22 @@ static int64_t xt_timer_next_due(void) {
 static void xt_timer_compact(void) {
   uint32_t write = 0;
   for (uint32_t read = 0; read < xt_timer_count; read++) {
-    if (!xt_timers[read].active) continue;
+    if (!xt_timers[read].active) {
+      free(xt_timers[read].args);
+      xt_timers[read].args = NULL;
+      xt_timers[read].argc = 0;
+      continue;
+    }
     if (write != read) xt_timers[write] = xt_timers[read];
     write++;
   }
   xt_timer_count = write;
 }
 
+static void xt_loop_gc_register(void);
+
 static uint64_t xt_timer_add(xt_value callback, int64_t delay_ms, int64_t interval_ms, int32_t argc, xt_value *argv) {
+  xt_loop_gc_register();
   if (xt_timer_count >= xt_timer_capacity) {
     xt_timer_capacity = xt_timer_capacity == 0 ? 16 : xt_timer_capacity * 2;
     xt_timer *grown = (xt_timer *)realloc(xt_timers, sizeof(xt_timer) * xt_timer_capacity);
@@ -170,6 +178,31 @@ static int xt_timer_cancel(uint64_t id) {
   return 0;
 }
 
+/* Watchers and pending timers hold values outside the value graph: the timer
+ * callbacks/arguments live in the flat array, and extension watchers keep an
+ * `xt_value *` box in their opaque userdata (the `xt_loop_add` convention). */
+static void xt_loop_gc_scan_roots(void) {
+  for (int i = 0; i < xt_loop_watcher_count; i++) {
+    if (!xt_loop_watchers[i].active) continue;
+    xt_value *boxed = (xt_value *)xt_loop_watchers[i].userdata;
+    if (boxed) xt_gc_mark_value(*boxed);
+  }
+  for (uint32_t i = 0; i < xt_timer_count; i++) {
+    if (!xt_timers[i].active) continue;
+    xt_gc_mark_value(xt_timers[i].callback);
+    if (xt_timers[i].args && xt_timers[i].argc > 0) {
+      xt_gc_scan_region(xt_timers[i].args, sizeof(xt_value) * (size_t)xt_timers[i].argc);
+    }
+  }
+}
+
+static void xt_loop_gc_register(void) {
+  static int registered = 0;
+  if (registered) return;
+  registered = 1;
+  xt_gc_register_root_provider(xt_loop_gc_scan_roots);
+}
+
 /* Invoke every timer whose deadline has passed. Timers scheduled by a callback
  * (or by a microtask) are left for the next reactor iteration, so a recursive
  * `setTimeout(fn, 0)` cannot spin forever inside a single call. */
@@ -232,6 +265,7 @@ xt_value xt_clear_interval(int32_t argc, xt_value *argv) {
 
 int xt_loop_add(int fd, int events, xt_io_handler handler, void *userdata) {
   if (fd < 0 || !handler) return -1;
+  xt_loop_gc_register();
   xt_loop_watcher *existing = xt_loop_find(fd);
   if (existing) {
     existing->events = events;

package/runtime/xt_promise.c

@@ -63,6 +63,8 @@ static xt_value xt_promise_value(xt_promise *promise) {
   return XT_FROM_PTR(XT_TAG_OBJECT, promise);
 }
 
+static void xt_promise_gc_register(void);
+
 static xt_promise *xt_promise_new(void) {
   xt_promise *promise = (xt_promise *)xt_alloc(sizeof(xt_promise), XT_OBJECT_KIND_PROMISE);
   promise->state = XT_PROMISE_PENDING;
@@ -70,9 +72,52 @@ static xt_promise *xt_promise_new(void) {
   promise->reactions = NULL;
   promise->reaction_count = 0;
   promise->reaction_capacity = 0;
+  xt_promise_gc_register();
   return promise;
 }
 
+/* Reactions are plain `malloc` blocks referenced from promises and from the
+ * microtask queue, so neither can be found by scanning the heap: the queue is
+ * a root provider and a promise traces the reactions it still owns. */
+static void xt_promise_gc_scan_roots(void) {
+  for (uint32_t i = xt_microtask_head; i < xt_microtask_count; i++) {
+    xt_reaction *reaction = xt_microtasks[i];
+    if (!reaction) continue;
+    xt_gc_mark_header((xt_header *)reaction->promise);
+    xt_gc_mark_value(reaction->on_fulfilled);
+    xt_gc_mark_value(reaction->on_rejected);
+    xt_gc_mark_header((xt_header *)reaction->result);
+  }
+}
+
+static void xt_promise_gc_register(void) {
+  static int registered = 0;
+  if (registered) return;
+  registered = 1;
+  xt_gc_register_root_provider(xt_promise_gc_scan_roots);
+}
+
+void xt_promise_gc_trace(xt_header *header) {
+  xt_promise *promise = (xt_promise *)header;
+  xt_gc_mark_value(promise->value);
+  for (uint32_t i = 0; i < promise->reaction_count; i++) {
+    xt_reaction *reaction = promise->reactions[i];
+    if (!reaction) continue;
+    xt_gc_mark_header((xt_header *)reaction->promise);
+    xt_gc_mark_value(reaction->on_fulfilled);
+    xt_gc_mark_value(reaction->on_rejected);
+    xt_gc_mark_header((xt_header *)reaction->result);
+  }
+}
+
+void xt_promise_gc_release(xt_header *header) {
+  xt_promise *promise = (xt_promise *)header;
+  /* Pending reactions are owned solely by the promise; queued ones live in
+   * `xt_microtasks` and are freed as they run. */
+  for (uint32_t i = 0; i < promise->reaction_count; i++) free(promise->reactions[i]);
+  free(promise->reactions);
+}
+
 static void xt_promise_settle(xt_promise *promise, int state, xt_value value);
 
 static void xt_promise_resolve_into(xt_promise *result, xt_value value) {
@@ -122,6 +167,7 @@ static xt_value xt_promise_run_reactions(void) {
     } else {
       xt_promise_settle(reaction->result, XT_PROMISE_REJECTED, promise->value);
     }
+    free(reaction);
   }
   xt_microtask_head = 0;
   xt_microtask_count = 0;

package/runtime/xt_stdlib2/error.inc

@@ -19,6 +19,7 @@ static int xt_error_is_family(const char *name) {
 static xt_value xt_error_root_proto = XT_UNDEFINED;
 
 static xt_value xt_error_proto_for(const char *name) {
+  xt_gc_add_root(&xt_error_root_proto);
   if (!XT_IS_OBJECT(xt_error_root_proto)) {
     xt_error_root_proto = xt_object_new();
     xt_object_set(xt_error_root_proto, xt_string_from_cstr("name"),

package/runtime/xt_stdlib2/regexp-match.inc

@@ -326,8 +326,10 @@ xt_value xt_regexp_replace(xt_value value, xt_value regexpValue, xt_value replac
     int32_t end = (int32_t)matches[0].rm_eo;
     xt_regexp_append(&out, &length, &capacity, text->data + cursor, (size_t)(start - cursor));
     if (useFunction) {
-      xt_value *args = (xt_value *)malloc(sizeof(xt_value) * (size_t)(jsTotal + 3));
-      args[0] = xt_string_new(text->data + start, (int64_t)(end - start));
+      /* Accumulate in an `xt_array` so the earlier match/group strings stay
+         reachable while later groups (and the callback itself) allocate. */
+      xt_value argArray = xt_array_new(0, NULL);
+      xt_array_push(argArray, xt_string_new(text->data + start, (int64_t)(end - start)));
       for (int g = 1; g <= jsTotal; g++) {
         xt_value groupValue = XT_UNDEFINED;
         for (int i = 0; i < groupCount; i++) {
@@ -337,12 +339,11 @@ xt_value xt_regexp_replace(xt_value value, xt_value regexpValue, xt_value replac
           }
           break;
         }
-        args[g] = groupValue;
+        xt_array_push(argArray, groupValue);
       }
-      args[jsTotal + 1] = xt_number((double)start);
-      args[jsTotal + 2] = xt_to_string(value);
-      xt_value produced = xt_closure_call(replacementValue, jsTotal + 3, args);
-      free(args);
+      xt_array_push(argArray, xt_number((double)start));
+      xt_array_push(argArray, xt_to_string(value));
+      xt_value produced = xt_closure_call(replacementValue, jsTotal + 3, xt_as_array(argArray)->items);
       xt_string *producedText = xt_as_string(xt_to_string(produced));
       if (producedText) xt_regexp_append(&out, &length, &capacity, producedText->data, producedText->length);
     } else {

package/runtime/xt_stdlib2/set.inc

@@ -39,7 +39,7 @@ static int xt_is_iterator_state(xt_value value) {
  * any other object with a `Symbol.iterator` method is wrapped. */
 xt_value xt_iter_open(xt_value value) {
   if (XT_IS_ARRAY(value) || XT_IS_STRING(value) || xt_is_map(value) || xt_is_set(value) ||
-      xt_is_generator(value))
+      xt_is_generator(value) || xt_typed_array_kind_of(value) >= 0)
     return value;
   if (XT_IS_OBJECT(value)) {
     xt_value method = xt_object_get(value, xt_symbol_well_known("iterator"));