xbintsc 0.3.87 → 0.5.20

package/runtime/xt_containers/access.inc

@@ -2,6 +2,20 @@
 /* Generic member access                                                     */
 /* ------------------------------------------------------------------------- */
 
+/* Inherited lookup for values whose representation is not an `xt_object`
+ * property table (Map/Set/Date/RegExp/Promise/Symbol). `__proto__` returns the
+ * prototype itself instead of invoking Object.prototype's getter with the
+ * wrong receiver. */
+static xt_value xt_get_inherited(xt_value target, xt_value key) {
+  xt_value proto = xt_object_get_prototype(target);
+  if (proto == XT_UNDEFINED || proto == XT_NULL || proto == target) return XT_UNDEFINED;
+  if (XT_IS_STRING(key)) {
+    xt_string *k = xt_as_string(key);
+    if (k->length == 9 && memcmp(xt_string_bytes(k), "__proto__", 9) == 0) return proto;
+  }
+  return xt_get(proto, key);
+}
+
 /*
  * Reading a property of `null` / `undefined` is a TypeError in JavaScript.
  * Short-circuiting `?.` guards forbid reaching this point for a nullish
@@ -18,7 +32,77 @@ static void xt_throw_read_of_nullish(xt_value target, xt_value key) {
   char message[256];
   snprintf(message, sizeof(message),
            "TypeError: Cannot read properties of %s (reading '%s')", base, keybuf);
-  xt_throw(xt_string_from_cstr(message));
+  xt_throw(xt_error_from_message(message));
+}
+
+/* -- Array.prototype[Symbol.iterator] -------------------------------------- */
+/*
+ * `for...of` and spread use the internal index protocol, but libraries also
+ * call the iterator method explicitly (`arr[Symbol.iterator]()`, `Array.from`,
+ * manual `.next()`). Build a small iterator object per call: `next` closes over
+ * the array and a one-element box holding the current index, and the iterator
+ * is itself iterable so it can be passed back to `for...of` / spread.
+ */
+static xt_value xt_array_iterator_next(xt_value thisValue, xt_value env, int32_t argc,
+                                       xt_value *argv) {
+  (void)thisValue;
+  (void)argc;
+  (void)argv;
+  xt_value array = xt_closure_env(env, 0);
+  xt_value indexBox = xt_closure_env(env, 1);
+  int32_t index = xt_to_int32(xt_get(indexBox, xt_number(0)));
+  xt_array *items = xt_as_array(array);
+  xt_value result = xt_object_new();
+  if (!items || index < 0 || (uint32_t)index >= items->length) {
+    xt_object_set(result, xt_string_from_cstr("value"), XT_UNDEFINED);
+    xt_object_set(result, xt_string_from_cstr("done"), XT_TRUE);
+    return result;
+  }
+  xt_object_set(result, xt_string_from_cstr("value"), items->items[index]);
+  xt_object_set(result, xt_string_from_cstr("done"), XT_FALSE);
+  xt_set(indexBox, xt_number(0), xt_number(index + 1));
+  return result;
+}
+
+static xt_value xt_iterator_return_this(xt_value thisValue, xt_value env, int32_t argc,
+                                        xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  return thisValue;
+}
+
+static xt_value xt_array_iterator(xt_value thisValue, xt_value env, int32_t argc,
+                                  xt_value *argv) {
+  (void)env;
+  (void)argc;
+  (void)argv;
+  if (!XT_IS_ARRAY(thisValue)) {
+    xt_value message =
+        xt_string_from_cstr("Array.prototype[Symbol.iterator] called on a non-array");
+    xt_throw(xt_type_error_ctor(1, &message));
+  }
+  xt_value indexBox = xt_array_new(0, NULL);
+  xt_array_push(indexBox, xt_number(0));
+  xt_value captured[2] = {thisValue, indexBox};
+  xt_value iterator = xt_object_new();
+  xt_object_set(iterator, xt_string_from_cstr("next"),
+                xt_closure_new((void *)xt_array_iterator_next, 2, captured));
+  xt_object_set(iterator, xt_symbol_well_known("iterator"),
+                xt_closure_new((void *)xt_iterator_return_this, 0, NULL));
+  return iterator;
+}
+
+/* The method value is stable (`arr[Symbol.iterator] === arr[Symbol.iterator]`),
+ * so cache it and root the cache for the collector. */
+static xt_value xt_array_iterator_method_value = XT_UNDEFINED;
+
+static xt_value xt_array_iterator_method(void) {
+  if (!XT_IS_FUNCTION(xt_array_iterator_method_value)) {
+    xt_array_iterator_method_value = xt_closure_new((void *)xt_array_iterator, 0, NULL);
+    xt_gc_add_root(&xt_array_iterator_method_value);
+  }
+  return xt_array_iterator_method_value;
 }
 
 xt_value xt_get(xt_value target, xt_value key) {
@@ -37,8 +121,16 @@ xt_value xt_get(xt_value target, xt_value key) {
           xt_value value = xt_object_get(extra, key);
           if (value != XT_UNDEFINED) return value;
         }
-        /* Fall back to first-class built-in methods (`arr.map`). */
-        return xt_method_value(target, key);
+        /* Fall back to first-class built-in methods (`arr.map`) and then to
+         * the array's [[Prototype]] (`arr.hasOwnProperty`). */
+        xt_value method = xt_method_value(target, key);
+        if (method != XT_UNDEFINED) return method;
+        xt_value proto = ((xt_array *)XT_GET_PTR(target))->prototype;
+        if (proto != XT_UNDEFINED && proto != XT_NULL) {
+          if (k->length == 9 && memcmp(xt_string_bytes(k), "__proto__", 9) == 0) return proto;
+          return xt_get(proto, key);
+        }
+        return XT_UNDEFINED;
       }
       return xt_array_get(target, key);
     }
@@ -49,7 +141,14 @@ xt_value xt_get(xt_value target, xt_value key) {
         xt_value value = xt_object_get(extra, key);
         if (value != XT_UNDEFINED) return value;
       }
-      return xt_method_value(target, key);
+      /* Array.prototype[Symbol.iterator] is the fallback, after any own
+       * symbol property the program assigned. */
+      if (key == xt_symbol_well_known("iterator")) return xt_array_iterator_method();
+      xt_value method = xt_method_value(target, key);
+      if (method != XT_UNDEFINED) return method;
+      xt_value proto = ((xt_array *)XT_GET_PTR(target))->prototype;
+      if (proto != XT_UNDEFINED && proto != XT_NULL) return xt_get(proto, key);
+      return XT_UNDEFINED;
     }
     return xt_array_get(target, key);
   }
@@ -69,6 +168,9 @@ xt_value xt_get(xt_value target, xt_value key) {
     {
       xt_value value = xt_object_get(target, key);
       if (value != XT_UNDEFINED) return value;
+      /* `const A = Array; A.isArray`, `const S = Symbol; S.iterator`, ... */
+      value = xt_builtin_static_value(target, key);
+      if (value != XT_UNDEFINED) return value;
       return xt_method_value(target, key);
     }
   }
@@ -76,6 +178,17 @@ xt_value xt_get(xt_value target, xt_value key) {
     /* Map/Set expose `.size`; promises, dates and regexps have their own
      * getters implemented in the standard library. */
     xt_object *obj = (xt_object *)XT_GET_PTR(target);
+    if (obj->header.kind == XT_OBJECT_KIND_GENERATOR && xt_is_symbol(key)) {
+      /* Generators are iterable objects: `Symbol.iterator` returns the
+       * generator itself, and an async generator also exposes
+       * `Symbol.asyncIterator`. */
+      if (key == xt_symbol_well_known("asyncIterator") && xt_is_async_generator(target)) {
+        return xt_async_iterator_method();
+      }
+      if (key == xt_symbol_well_known("iterator") && !xt_is_async_generator(target)) {
+        return xt_async_iterator_method();
+      }
+    }
     if (obj->header.kind == XT_OBJECT_KIND_SYMBOL) {
       if (XT_IS_STRING(key)) {
         xt_string *k = xt_as_string(key);
@@ -83,7 +196,9 @@ xt_value xt_get(xt_value target, xt_value key) {
           return xt_symbol_description(target);
         }
       }
-      return xt_method_value(target, key);
+      xt_value method = xt_method_value(target, key);
+      if (method != XT_UNDEFINED) return method;
+      return xt_get_inherited(target, key);
     }
     if (obj->header.kind == XT_OBJECT_KIND_MAP || obj->header.kind == XT_OBJECT_KIND_SET) {
       if (XT_IS_STRING(key)) {
@@ -107,27 +222,51 @@ xt_value xt_get(xt_value target, xt_value key) {
       }
     }
     {
+      /* Typed arrays keep their elements in a shared ArrayBuffer: serve
+       * `.buffer` / element reads from it instead of the property bag. */
+      int typed = xt_typed_array_kind_of(target);
+      if (typed >= 0) {
+        if (XT_IS_STRING(key)) {
+          xt_string *k = xt_as_string(key);
+          if (k->length == 6 && memcmp(xt_string_bytes(k), "buffer", 6) == 0) {
+            return xt_typed_array_buffer_of(target);
+          }
+          if (k->length == 10 && memcmp(xt_string_bytes(k), "byteOffset", 10) == 0) {
+            return xt_number((double)xt_typed_array_byte_offset_of(target));
+          }
+          uint32_t index = 0;
+          if (xt_key_is_array_index(k, &index)) return xt_typed_array_read(target, index);
+        } else if (XT_IS_NUMBER(key)) {
+          int32_t index = xt_to_int32(key);
+          if (index >= 0) return xt_typed_array_read(target, (uint32_t)index);
+        }
+      }
       xt_value value = xt_object_get(target, key);
       if (value != XT_UNDEFINED) return value;
-      return xt_method_value(target, key);
+      xt_value method = xt_method_value(target, key);
+      if (method != XT_UNDEFINED) return method;
+      if (obj->header.kind != XT_OBJECT_KIND_OBJECT && obj->header.kind != XT_OBJECT_KIND_ERROR) {
+        return xt_get_inherited(target, key);
+      }
+      return XT_UNDEFINED;
     }
   }
   if (XT_IS_STRING(target)) {
     /* Property access on a string: `.length`, numeric indexing and built-in
-     * methods. */
+     * methods. Indices are UTF-16 code units, so `s[0]` of a Chinese string is
+     * the whole character and an emoji index into its surrogate pair. */
     xt_string *s = xt_as_string(target);
+    uint32_t units = xt_string_utf16_length(s);
     if (XT_IS_STRING(key)) {
       xt_string *k = xt_as_string(key);
-      if (k->length == 6 && memcmp(xt_string_bytes(k), "length", 6) == 0) return xt_number((double)s->length);
+      if (k->length == 6 && memcmp(xt_string_bytes(k), "length", 6) == 0) return xt_number((double)units);
       uint32_t index = 0;
-      if (xt_key_is_array_index(k, &index) && index < s->length) {
-        return xt_string_new(xt_string_bytes(s) + index, 1);
-      }
+      if (xt_key_is_array_index(k, &index) && index < units) return xt_string_unit_value(s, (int32_t)index);
       return xt_method_value(target, key);
     }
     if (XT_IS_NUMBER(key)) {
       int32_t index = xt_to_int32(key);
-      if (index >= 0 && (uint32_t)index < s->length) return xt_string_new(xt_string_bytes(s) + index, 1);
+      if (index >= 0 && (uint32_t)index < units) return xt_string_unit_value(s, index);
     }
     return XT_UNDEFINED;
   }
@@ -138,6 +277,47 @@ xt_value xt_get(xt_value target, xt_value key) {
   return XT_UNDEFINED;
 }
 
+/* Inline-cached property read. The generated code gives every source-level
+ * property access two zeroed i64 words; the first stores the receiver's shape
+ * and the second the property index. A shape hit is a pointer compare plus one
+ * key check, which avoids the linear property scan. Only ordinary objects and
+ * errors use the cache; arrays, functions, strings and containers fall back to
+ * the generic path. */
+xt_value xt_get_ic(xt_value target, xt_value key, int64_t *cache) {
+  if (!cache || !XT_IS_OBJECT(target)) return xt_get(target, key);
+  xt_object *obj = (xt_object *)XT_GET_PTR(target);
+  if (obj->header.kind != XT_OBJECT_KIND_OBJECT && obj->header.kind != XT_OBJECT_KIND_ERROR) {
+    return xt_get(target, key);
+  }
+  if (!XT_IS_STRING(key) && !xt_is_symbol(key)) return xt_get(target, key);
+  xt_shape *shape = obj->shape;
+  uintptr_t cachedShape = (uintptr_t)cache[0];
+  int64_t cachedIndex = cache[1];
+  if (shape && cachedShape == (uintptr_t)shape && cachedIndex >= 0 &&
+      cachedIndex < (int64_t)obj->count) {
+    xt_property *prop = &obj->properties[cachedIndex];
+    if (prop->key == key || xt_property_key_equals(prop->key, key)) {
+      if (prop->getter != XT_UNDEFINED && XT_IS_FUNCTION(prop->getter)) {
+        return xt_call_with_this(prop->getter, target, 0, NULL);
+      }
+      if (prop->getter != XT_UNDEFINED) return XT_UNDEFINED;
+      return prop->value;
+    }
+  }
+  xt_value propertyKey = xt_to_property_key(key);
+  xt_property *prop = xt_object_find_property(obj, propertyKey);
+  if (prop) {
+    cache[0] = (int64_t)(uintptr_t)shape;
+    cache[1] = (int64_t)(prop - obj->properties);
+    if (prop->getter != XT_UNDEFINED && XT_IS_FUNCTION(prop->getter)) {
+      return xt_call_with_this(prop->getter, target, 0, NULL);
+    }
+    if (prop->getter != XT_UNDEFINED) return XT_UNDEFINED;
+    return prop->value;
+  }
+  return xt_get(target, key);
+}
+
 xt_value xt_set(xt_value target, xt_value key, xt_value value) {
   if (XT_IS_ARRAY(target)) {
     /* Assigning `arr.length` truncates or extends the array. */
@@ -173,7 +353,7 @@ xt_value xt_set(xt_value target, xt_value key, xt_value value) {
         if ((k->length == 6 && memcmp(xt_string_bytes(k), "length", 6) == 0) ||
             (k->length == 10 && memcmp(xt_string_bytes(k), "byteLength", 10) == 0) ||
             (k->length == 10 && memcmp(xt_string_bytes(k), "byteOffset", 10) == 0)) {
-          xt_throw(xt_string_from_cstr("TypeError: Cannot assign to read only property"));
+          xt_throw(xt_error_from_message("TypeError: Cannot assign to read only property"));
           return value;
         }
       }
@@ -191,7 +371,8 @@ xt_value xt_set(xt_value target, xt_value key, xt_value value) {
       if (isIndex) {
         double length = xt_to_number(xt_object_get_cstr(target, "length"));
         if (index >= (uint32_t)length) return value; /* out-of-bounds writes are ignored */
-        return xt_object_set(target, key, xt_number(xt_typed_array_coerce(typed, xt_to_number(value))));
+        xt_typed_array_write(target, index, value);
+        return value;
       }
     }
     return xt_object_set(target, key, value);

package/runtime/xt_containers/arrays.inc

@@ -15,12 +15,20 @@ void xt_array_reserve(xt_array *array, uint32_t needed) {
   array->capacity = capacity;
 }
 
-xt_value xt_array_new(int32_t count, xt_value *items) {
+/* Array.prototype: every ordinary array inherits from it. The prototype itself
+ * is an array, like ECMAScript, so `Array.isArray(Array.prototype)` holds. It
+ * is created with the ordinary object prototype as its own [[Prototype]], which
+ * terminates the array-specific link. */
+static xt_value xt_array_proto_root = XT_UNDEFINED;
+static int xt_array_proto_ready = 0;
+
+static xt_value xt_array_new_with_proto(int32_t count, xt_value *items, xt_value proto) {
   xt_array *array = (xt_array *)xt_alloc(sizeof(xt_array), XT_OBJECT_KIND_ARRAY);
   array->length = 0;
   array->capacity = 0;
   array->items = NULL;
   array->extra = XT_UNDEFINED;
+  array->prototype = proto;
   if (count > 0) {
     xt_array_reserve(array, (uint32_t)count);
     for (int32_t i = 0; i < count; i++) array->items[i] = items[i];
@@ -29,6 +37,22 @@ xt_value xt_array_new(int32_t count, xt_value *items) {
   return XT_FROM_PTR(XT_TAG_ARRAY, array);
 }
 
+xt_value xt_array_prototype(void) {
+  if (xt_array_proto_ready) return xt_array_proto_root;
+  xt_array_proto_ready = 1;
+  xt_array_proto_root = xt_array_new_with_proto(0, NULL, xt_object_prototype());
+  xt_gc_add_root(&xt_array_proto_root);
+  xt_value constructor = xt_builtin_constructor(xt_string_from_cstr("Array"));
+  if (constructor != XT_UNDEFINED) {
+    xt_set(xt_array_proto_root, xt_string_from_cstr("constructor"), constructor);
+  }
+  return xt_array_proto_root;
+}
+
+xt_value xt_array_new(int32_t count, xt_value *items) {
+  return xt_array_new_with_proto(count, items, xt_array_prototype());
+}
+
 /* Named properties of an array live in a lazily-created side object. Returns
  * XT_UNDEFINED when `create` is false and no such object exists yet. */
 static xt_value xt_array_extra(xt_array *array, int create) {
@@ -69,7 +93,7 @@ xt_value xt_array_push(xt_value value, xt_value newValue) {
 
 xt_value xt_array_length(xt_value value) {
   if (XT_IS_ARRAY(value)) return xt_number((double)((xt_array *)XT_GET_PTR(value))->length);
-  if (XT_IS_STRING(value)) return xt_number((double)xt_string_length(xt_as_string(value)));
+  if (XT_IS_STRING(value)) return xt_number((double)xt_string_utf16_length(xt_as_string(value)));
   /* Functions expose their arity as `.length`. */
   if (XT_IS_FUNCTION(value)) {
     int32_t arity = ((xt_function *)XT_GET_PTR(value))->arity;

package/runtime/xt_containers/objects.inc

@@ -14,13 +14,159 @@ static void xt_object_reserve(xt_object *obj, uint32_t needed) {
   obj->capacity = capacity;
 }
 
-xt_value xt_object_new(void) { return xt_object_new_with_proto(XT_UNDEFINED); }
+xt_value xt_object_new(void) { return xt_object_new_with_proto(xt_object_prototype()); }
+
+/* ------------------------------------------------------------------------- */
+/* Object.prototype                                                          */
+/* ------------------------------------------------------------------------- */
+
+/* `Object.prototype` is the root of the ordinary object prototype chain. Every
+ * plain object created by `xt_object_new` inherits from it, which is what makes
+ *
+ *     Object.getPrototypeOf({}) === Object.prototype
+ *     Object.prototype.hasOwnProperty.call(obj, key)
+ *
+ * hold. It is created lazily (and exactly once) with a null prototype, so the
+ * root itself terminates the chain. */
+static xt_value xt_object_proto_root = XT_UNDEFINED;
+static int xt_object_proto_ready = 0;
+static xt_value xt_function_proto_root = XT_UNDEFINED;
+static int xt_function_proto_ready = 0;
+
+static const char *xt_object_tag_of(xt_value value) {
+  if (value == XT_UNDEFINED) return "Undefined";
+  if (value == XT_NULL) return "Null";
+  if (XT_IS_ARRAY(value)) return "Array";
+  if (XT_IS_FUNCTION(value)) return "Function";
+  if (XT_IS_STRING(value)) return "String";
+  if (XT_IS_BIGINT(value)) return "BigInt";
+  if (XT_IS_NUMBER(value)) return "Number";
+  if (value == XT_TRUE || value == XT_FALSE) return "Boolean";
+  if (XT_IS_OBJECT(value)) {
+    switch (((xt_object *)XT_GET_PTR(value))->header.kind) {
+      case XT_OBJECT_KIND_ERROR: return "Error";
+      case XT_OBJECT_KIND_MAP: return "Map";
+      case XT_OBJECT_KIND_SET: return "Set";
+      case XT_OBJECT_KIND_WEAK_MAP: return "WeakMap";
+      case XT_OBJECT_KIND_WEAK_SET: return "WeakSet";
+      case XT_OBJECT_KIND_WEAK_REF: return "WeakRef";
+      case XT_OBJECT_KIND_DATE: return "Date";
+      case XT_OBJECT_KIND_REGEXP: return "RegExp";
+      case XT_OBJECT_KIND_PROMISE: return "Promise";
+      case XT_OBJECT_KIND_SYMBOL: return "Symbol";
+      case XT_OBJECT_KIND_GENERATOR: return "Generator";
+      default: return "Object";
+    }
+  }
+  return "Object";
+}
+
+/* Backing trampoline for the methods on `Object.prototype`. The method name
+ * travels in environment slot 0; `this` is the receiver, exactly like a
+ * JavaScript method. */
+static xt_value xt_object_proto_method(xt_value thisValue, xt_value env, int32_t argc,
+                                       xt_value *argv) {
+  xt_value nameValue = xt_closure_env(env, 0);
+  const char *name = xt_string_data(nameValue);
+  if (!name) return XT_UNDEFINED;
+  if (strcmp(name, "hasOwnProperty") == 0) {
+    if (thisValue == XT_UNDEFINED || thisValue == XT_NULL) {
+      xt_throw(xt_error_from_message("TypeError: Cannot convert undefined or null to object"));
+    }
+    return xt_object_has_own(thisValue, xt_arg_at(argc, argv, 0));
+  }
+  if (strcmp(name, "propertyIsEnumerable") == 0) {
+    if (thisValue == XT_UNDEFINED || thisValue == XT_NULL) {
+      xt_throw(xt_error_from_message("TypeError: Cannot convert undefined or null to object"));
+    }
+    /* Enumerability is not tracked; every own property is enumerable. */
+    return xt_object_has_own(thisValue, xt_arg_at(argc, argv, 0));
+  }
+  if (strcmp(name, "toString") == 0) {
+    char buffer[64];
+    snprintf(buffer, sizeof(buffer), "[object %s]", xt_object_tag_of(thisValue));
+    return xt_string_from_cstr(buffer);
+  }
+  if (strcmp(name, "valueOf") == 0) return thisValue;
+  if (strcmp(name, "isPrototypeOf") == 0) {
+    xt_value cursor = xt_object_get_prototype(xt_arg_at(argc, argv, 0));
+    while (cursor != XT_UNDEFINED && cursor != XT_NULL) {
+      if (cursor == thisValue) return XT_TRUE;
+      cursor = xt_object_get_prototype(cursor);
+    }
+    return XT_FALSE;
+  }
+  if (strcmp(name, "__proto__") == 0) return xt_object_get_prototype(thisValue);
+  return XT_UNDEFINED;
+}
+
+/* `__proto__ = value`: ordinary assignment through the inherited setter. */
+static xt_value xt_object_proto_setter(xt_value thisValue, xt_value env, int32_t argc,
+                                       xt_value *argv) {
+  (void)env;
+  (void)argc;
+  xt_value proto = xt_arg_at(argc, argv, 0);
+  if (proto == XT_NULL || XT_IS_OBJECT(proto) || XT_IS_ARRAY(proto) || XT_IS_FUNCTION(proto)) {
+    xt_object_set_prototype(thisValue, proto);
+  }
+  return XT_UNDEFINED;
+}
+
+static xt_value xt_object_proto_define(xt_value proto, const char *name, int32_t arity) {
+  xt_value env[1] = {xt_string_from_cstr(name)};
+  xt_value closure = xt_closure_new((void *)xt_object_proto_method, 1, env);
+  xt_function_set_metadata(closure, env[0], arity);
+  xt_object_set(proto, env[0], closure);
+  return closure;
+}
+
+xt_value xt_function_prototype(void) {
+  if (xt_function_proto_ready) return xt_function_proto_root;
+  xt_function_proto_ready = 1;
+  xt_function_proto_root = xt_object_new_with_proto(xt_object_prototype());
+  xt_gc_add_root(&xt_function_proto_root);
+  /* `Array.constructor === Function` (every function inherits from here). The
+   * factory sees the ready flag, so this does not recurse. */
+  xt_value constructor = xt_builtin_constructor(xt_string_from_cstr("Function"));
+  if (constructor != XT_UNDEFINED) {
+    xt_object_set(xt_function_proto_root, xt_string_from_cstr("constructor"), constructor);
+  }
+  return xt_function_proto_root;
+}
+
+xt_value xt_object_prototype(void) {
+  if (xt_object_proto_ready) return xt_object_proto_root;
+  xt_object_proto_ready = 1;
+  xt_object_proto_root = xt_object_new_with_proto(XT_NULL);
+  xt_gc_add_root(&xt_object_proto_root);
+  xt_object_proto_define(xt_object_proto_root, "hasOwnProperty", 1);
+  xt_object_proto_define(xt_object_proto_root, "propertyIsEnumerable", 1);
+  xt_object_proto_define(xt_object_proto_root, "isPrototypeOf", 1);
+  xt_object_proto_define(xt_object_proto_root, "toString", 0);
+  xt_object_proto_define(xt_object_proto_root, "valueOf", 0);
+  xt_value protoEnv[1] = {xt_string_from_cstr("__proto__")};
+  xt_value getter = xt_closure_new((void *)xt_object_proto_method, 1, protoEnv);
+  xt_value setter = xt_closure_new((void *)xt_object_proto_setter, 0, NULL);
+  xt_function_set_metadata(getter, protoEnv[0], 0);
+  xt_function_set_metadata(setter, protoEnv[0], 1);
+  xt_object_define_getter(xt_object_proto_root, protoEnv[0], getter);
+  xt_object_define_setter(xt_object_proto_root, protoEnv[0], setter);
+  /* `({}).constructor === Object`. The constructor factory calls back into
+   * `xt_object_prototype` while building the Object function, but the ready
+   * flag is already set and the root exists. */
+  xt_value constructor = xt_builtin_constructor(xt_string_from_cstr("Object"));
+  if (constructor != XT_UNDEFINED) {
+    xt_object_set(xt_object_proto_root, xt_string_from_cstr("constructor"), constructor);
+  }
+  return xt_object_proto_root;
+}
 
 xt_value xt_object_new_with_proto(xt_value proto) {
   xt_object *obj = (xt_object *)xt_alloc(sizeof(xt_object), XT_OBJECT_KIND_OBJECT);
   obj->count = 0;
   obj->capacity = 0;
   obj->properties = NULL;
+  obj->shape = xt_shape_empty();
   obj->prototype = proto;
   obj->frozen = 0;
   obj->is_array_base = 0;
@@ -32,7 +178,7 @@ xt_object *xt_as_object(xt_value value) {
   if (XT_IS_FUNCTION(value)) {
     /* Functions carry their own property bag (used for static members). */
     xt_function *fn = (xt_function *)XT_GET_PTR(value);
-    if (!fn->properties) fn->properties = (xt_object *)XT_GET_PTR(xt_object_new_with_proto(XT_UNDEFINED));
+    if (!fn->properties) fn->properties = (xt_object *)XT_GET_PTR(xt_object_new_with_proto(xt_function_prototype()));
     return fn->properties;
   }
   return NULL;
@@ -87,6 +233,7 @@ static xt_property *xt_object_insert_property(xt_object *obj, xt_value key) {
       }
     }
   }
+  uint32_t oldCount = obj->count;
   xt_object_reserve(obj, obj->count + 1);
   for (uint32_t i = obj->count; i > position; i--) obj->properties[i] = obj->properties[i - 1];
   xt_property *prop = &obj->properties[position];
@@ -95,6 +242,10 @@ static xt_property *xt_object_insert_property(xt_object *obj, xt_value key) {
   prop->getter = XT_UNDEFINED;
   prop->setter = XT_UNDEFINED;
   obj->count++;
+  /* Appending follows a transition; inserting an integer key into the middle
+   * reorders the list, so rebuild the canonical shape from the new layout. */
+  if (position == oldCount && obj->shape) obj->shape = xt_shape_transition(obj->shape, key);
+  else xt_object_shape_changed(obj);
   return prop;
 }
 
@@ -224,12 +375,41 @@ xt_value xt_object_define_setter(xt_value value, xt_value key, xt_value setter)
 }
 
 xt_value xt_object_get_prototype(xt_value value) {
-  xt_object *obj = xt_as_object(value);
-  if (obj) return obj->prototype;
+  if (XT_IS_ARRAY(value)) return ((xt_array *)XT_GET_PTR(value))->prototype;
+  if (XT_IS_FUNCTION(value)) {
+    /* A function's [[Prototype]] is the prototype of its property bag
+     * (`Function.prototype` unless `Object.setPrototypeOf` changed it). */
+    xt_object *bag = xt_as_object(value);
+    return bag ? bag->prototype : XT_UNDEFINED;
+  }
+  if (XT_IS_OBJECT(value)) {
+    xt_object *obj = (xt_object *)XT_GET_PTR(value);
+    switch (obj->header.kind) {
+      case XT_OBJECT_KIND_OBJECT:
+      case XT_OBJECT_KIND_ERROR:
+        return obj->prototype;
+      case XT_OBJECT_KIND_SYMBOL:
+      case XT_OBJECT_KIND_MAP:
+      case XT_OBJECT_KIND_SET:
+      case XT_OBJECT_KIND_WEAK_MAP:
+      case XT_OBJECT_KIND_WEAK_SET:
+      case XT_OBJECT_KIND_WEAK_REF:
+      case XT_OBJECT_KIND_DATE:
+      case XT_OBJECT_KIND_REGEXP:
+      case XT_OBJECT_KIND_PROMISE:
+        return xt_builtin_prototype_for_kind(obj->header.kind);
+      default:
+        return XT_UNDEFINED;
+    }
+  }
   return XT_UNDEFINED;
 }
 
 xt_value xt_object_set_prototype(xt_value value, xt_value proto) {
+  if (XT_IS_ARRAY(value)) {
+    ((xt_array *)XT_GET_PTR(value))->prototype = proto;
+    return value;
+  }
   xt_object *obj = xt_as_object(value);
   if (obj && !obj->frozen) obj->prototype = proto;
   return value;
@@ -247,8 +427,33 @@ int xt_object_is_frozen(xt_value value) {
 }
 
 xt_value xt_object_has_own(xt_value value, xt_value key) {
+  if (XT_IS_ARRAY(value)) {
+    xt_array *array = (xt_array *)XT_GET_PTR(value);
+    xt_value propertyKey = xt_to_property_key(key);
+    if (XT_IS_STRING(propertyKey)) {
+      xt_string *k = xt_as_string(propertyKey);
+      if (k->length == 6 && memcmp(xt_string_bytes(k), "length", 6) == 0) return XT_TRUE;
+      uint32_t index = 0;
+      if (xt_key_is_array_index(k, &index)) return xt_bool(index < array->length);
+    }
+    return xt_bool(XT_IS_OBJECT(array->extra) &&
+                   xt_object_find((xt_object *)XT_GET_PTR(array->extra), propertyKey));
+  }
+  if (XT_IS_STRING(value)) {
+    xt_string *string = xt_as_string(value);
+    if (xt_is_symbol(key)) return XT_FALSE;
+    xt_string *k = xt_as_string(xt_to_string(key));
+    if (k->length == 6 && memcmp(xt_string_bytes(k), "length", 6) == 0) return XT_TRUE;
+    uint32_t index = 0;
+    return xt_bool(xt_key_is_array_index(k, &index) && index < xt_string_utf16_length(string));
+  }
   xt_object *obj = xt_as_object(value);
   if (!obj) return XT_FALSE;
+  /* Map/Set/Date/RegExp/Promise/Symbol use their own struct layout and have no
+   * property bag; interpreting them as `xt_object` would read past the end. */
+  if (obj->header.kind != XT_OBJECT_KIND_OBJECT && obj->header.kind != XT_OBJECT_KIND_ERROR) {
+    return XT_FALSE;
+  }
   return xt_bool(xt_object_find(obj, xt_to_property_key(key)) != NULL);
 }
 
@@ -267,6 +472,9 @@ xt_value xt_object_from_entries(xt_value entries) {
 xt_value xt_object_has(xt_value value, xt_value key) {
   if (!XT_IS_OBJECT(value)) return XT_FALSE;
   xt_object *obj = (xt_object *)XT_GET_PTR(value);
+  if (obj->header.kind != XT_OBJECT_KIND_OBJECT && obj->header.kind != XT_OBJECT_KIND_ERROR) {
+    return XT_FALSE;
+  }
   return xt_bool(xt_object_find(obj, xt_to_property_key(key)) != NULL);
 }
 
@@ -286,6 +494,18 @@ xt_value xt_object_own_property_symbols(xt_value value) {
 
 xt_value xt_object_keys(xt_value value) {
   xt_value result = xt_array_new(0, NULL);
+  /* A typed array's enumerable own keys are its indices; `length` and the
+   * buffer metadata are observable but not enumerable. */
+  int typed = xt_typed_array_kind_of(value);
+  if (typed >= 0) {
+    uint32_t length = (uint32_t)xt_to_number(xt_object_get_cstr(value, "length"));
+    for (uint32_t i = 0; i < length; i++) {
+      char buffer[32];
+      snprintf(buffer, sizeof(buffer), "%u", i);
+      xt_array_push(result, xt_string_from_cstr(buffer));
+    }
+    return result;
+  }
   if (XT_IS_OBJECT(value)) {
     xt_object *obj = (xt_object *)XT_GET_PTR(value);
     for (uint32_t i = 0; i < obj->count; i++) {
@@ -310,7 +530,8 @@ xt_value xt_object_keys(xt_value value) {
   }
   if (XT_IS_STRING(value)) {
     xt_string *s = xt_as_string(value);
-    for (uint32_t i = 0; i < s->length; i++) {
+    uint32_t units = xt_string_utf16_length(s);
+    for (uint32_t i = 0; i < units; i++) {
       char buffer[32];
       snprintf(buffer, sizeof(buffer), "%u", i);
       xt_array_push(result, xt_string_from_cstr(buffer));