fix: 修复 Map/Set GC 追踪与 CodeForge 缓存键

crates/oxide_vm/src/builtins/map.rs

@@ -6,8 +6,6 @@ use crate::builtins::set::SetKey;
 use crate::native::NativeResult;
 use crate::vm::Vm;
 
-const MAP_PROP_INDEX: u8 = 0;
-
 macro_rules! native_try {
     ($expr:expr) => {
         match $expr {
@@ -17,7 +15,9 @@ macro_rules! native_try {
     };
 }
 
-/// Retrieve the `IndexMap` pointer stored at `MAP_PROP_INDEX` of a Map object.
+type MapInner = indexmap::IndexMap<SetKey, JsValue>;
+
+/// Retrieve the `IndexMap` pointer stored in a Map object's native-data slot.
 ///
 /// # Safety contract maintained by callers
 ///
@@ -27,7 +27,7 @@ macro_rules! native_try {
 /// is created in `new_map_inner()` and is never freed until the process exits (intentional
 /// leak — lifetime is tied to the epoch). Only one live `*mut` alias exists at a time
 /// per Map object because native calls are single-threaded.
-fn get_map_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexMap<SetKey, JsValue>, JsValue> {
+fn get_map_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut MapInner, JsValue> {
     if !this_val.is_object() {
         return Err(crate::builtins::error::create_type_error(vm, "called on non-Map object"));
     }
@@ -45,40 +45,108 @@ fn get_map_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexM
             "Map.prototype method called on incompatible receiver",
         ));
     }
-    let inner_val = map_obj.get_prop_at(MAP_PROP_INDEX);
-    if !inner_val.is_object() {
-        return Err(crate::builtins::error::create_type_error(vm, "Map internal state invalid"));
-    }
-    // SAFETY: inner_val holds the raw pointer written by `alloc_map` as
-    // `JsValue::object(Box::into_raw(Box::new(IndexMap::new())) as *mut u8)`.
-    // The pointer is a valid, heap-allocated `Box<IndexMap<SetKey, JsValue>>` and is
-    // never freed during the Map object's lifetime (see module safety contract above).
+    // SAFETY: native_data holds the raw pointer written by `alloc_map`.
+    // The pointer is a valid, heap-allocated `Box<IndexMap<SetKey, JsValue>>`.
     // Alignment: IndexMap requires at most 8-byte alignment; the global allocator satisfies this.
-    let inner_ptr = inner_val.as_js_object_ptr() as *mut indexmap::IndexMap<SetKey, JsValue>;
+    let inner_ptr = map_obj.native_data() as *mut MapInner;
     if inner_ptr.is_null() {
         return Err(crate::builtins::error::create_type_error(vm, "Map internal state invalid"));
     }
     Ok(inner_ptr)
 }
 
-/// Allocate a new `IndexMap` on the global heap.
-/// The caller is responsible for storing the pointer in the Map `JsObject` at `MAP_PROP_INDEX`
-/// via `JsValue::object(ptr as *mut u8)` and ensuring it is never double-freed.
-fn new_map_inner() -> *mut indexmap::IndexMap<SetKey, JsValue> {
-    Box::into_raw(Box::new(indexmap::IndexMap::new()))
+fn new_map_inner() -> *mut MapInner {
+    Box::into_raw(Box::new(MapInner::new()))
 }
 
 fn alloc_map(vm: &mut Vm) -> *mut JsObject {
     let map_proto = vm.session().builtin_world().map_proto.as_ptr() as *mut JsObject;
     let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(map_proto));
     obj.set_map(true);
-    // SAFETY: new_map_inner() returns a valid Box<IndexMap> pointer; stored as a JsValue
-    // object tag so get_map_inner() can retrieve and cast it back (same provenance).
     let inner = new_map_inner();
-    obj.set_prop_at(MAP_PROP_INDEX, JsValue::object(inner as *mut u8));
+    obj.set_native_data(inner as *mut u8);
     vm.epoch().alloc(obj)
 }
 
+pub(crate) fn map_native_edges(obj: &JsObject) -> Vec<JsValue> {
+    if !obj.is_map() {
+        return Vec::new();
+    }
+    let inner = obj.native_data() as *const MapInner;
+    if inner.is_null() {
+        return Vec::new();
+    }
+    unsafe {
+        (*inner)
+            .iter()
+            .flat_map(|(key, value)| [key.0, *value])
+            .filter(|value| value.is_object())
+            .collect()
+    }
+}
+
+pub(crate) fn clone_map_native_with_rewrite<F>(src: &JsObject, dst: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    if !src.is_map() {
+        return;
+    }
+    let inner = src.native_data() as *const MapInner;
+    if inner.is_null() {
+        dst.set_native_data(std::ptr::null_mut());
+        return;
+    }
+    let mut cloned = MapInner::new();
+    unsafe {
+        for (key, value) in (*inner).iter() {
+            let new_key = if key.0.is_object() { SetKey(rewrite(key.0)) } else { *key };
+            let new_value = if value.is_object() { rewrite(*value) } else { *value };
+            cloned.insert(new_key, new_value);
+        }
+    }
+    dst.set_native_data(Box::into_raw(Box::new(cloned)) as *mut u8);
+}
+
+pub(crate) fn rewrite_map_native<F>(obj: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    if !obj.is_map() {
+        return;
+    }
+    let inner = obj.native_data() as *mut MapInner;
+    if inner.is_null() {
+        return;
+    }
+    unsafe {
+        let mut rewritten = MapInner::with_capacity((*inner).len());
+        for (key, value) in (*inner).iter() {
+            let new_key = if key.0.is_object() { SetKey(rewrite(key.0)) } else { *key };
+            let new_value = if value.is_object() { rewrite(*value) } else { *value };
+            rewritten.insert(new_key, new_value);
+        }
+        *inner = rewritten;
+    }
+}
+
+pub(crate) fn drop_map_native(obj: &mut JsObject) -> u64 {
+    if !obj.is_map() {
+        return 0;
+    }
+    let inner = obj.native_data() as *mut MapInner;
+    if inner.is_null() {
+        return 0;
+    }
+    unsafe {
+        let boxed = Box::from_raw(inner);
+        let bytes = std::mem::size_of::<MapInner>() + boxed.capacity() * std::mem::size_of::<(SetKey, JsValue)>();
+        drop(boxed);
+        obj.set_native_data(std::ptr::null_mut());
+        bytes as u64
+    }
+}
+
 pub fn map_constructor(vm: &mut Vm, _args: &[u8]) -> NativeResult {
     let map_obj = alloc_map(vm);
     NativeResult::Ok(JsValue::from_js_object(map_obj))

crates/oxide_vm/src/builtins/set.rs

@@ -7,8 +7,6 @@ use oxide_types::value::JsValue;
 use crate::native::NativeResult;
 use crate::vm::Vm;
 
-const SET_PROP_INDEX: u8 = 0;
-
 macro_rules! native_try {
     ($expr:expr) => {
         match $expr {
@@ -59,7 +57,9 @@ impl Hash for SetKey {
     }
 }
 
-/// Retrieve the `IndexSet` pointer stored at `SET_PROP_INDEX` of a Set object.
+type SetInner = indexmap::IndexSet<SetKey>;
+
+/// Retrieve the `IndexSet` pointer stored in a Set object's native-data slot.
 ///
 /// # Safety contract maintained by callers
 ///
@@ -68,7 +68,7 @@ impl Hash for SetKey {
 /// native builtin is executing. The `Box<IndexSet>` is allocated in `new_set_inner()`
 /// and is never freed during the Set's lifetime. Only one live `*mut` alias exists per
 /// Set object at a time because native calls are single-threaded.
-fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexSet<SetKey>, JsValue> {
+fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut SetInner, JsValue> {
     if !this_val.is_object() {
         return Err(crate::builtins::error::create_type_error(vm, "called on non-Set object"));
     }
@@ -85,40 +85,100 @@ fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexS
             "Set.prototype.add called on incompatible receiver",
         ));
     }
-    let inner_val = set_obj.get_prop_at(SET_PROP_INDEX);
-    if !inner_val.is_object() {
-        return Err(crate::builtins::error::create_type_error(vm, "Set internal state invalid"));
-    }
-    // SAFETY: inner_val holds the raw pointer written by `alloc_set` as
-    // `JsValue::object(Box::into_raw(Box::new(IndexSet::new())) as *mut u8)`.
-    // The pointer is a valid, heap-allocated `Box<IndexSet<SetKey>>` and is never freed
-    // during the Set object's lifetime (see module safety contract above).
+    // SAFETY: native_data holds the raw pointer written by `alloc_set`.
+    // The pointer is a valid, heap-allocated `Box<IndexSet<SetKey>>`.
     // Alignment: IndexSet requires at most 8-byte alignment; the global allocator satisfies this.
-    let inner_ptr = inner_val.as_js_object_ptr() as *mut indexmap::IndexSet<SetKey>;
+    let inner_ptr = set_obj.native_data() as *mut SetInner;
     if inner_ptr.is_null() {
         return Err(crate::builtins::error::create_type_error(vm, "Set internal state invalid"));
     }
     Ok(inner_ptr)
 }
 
-/// Allocate a new `IndexSet` on the global heap.
-/// The caller is responsible for storing the pointer in the Set `JsObject` at `SET_PROP_INDEX`
-/// via `JsValue::object(ptr as *mut u8)` and ensuring it is never double-freed.
-fn new_set_inner() -> *mut indexmap::IndexSet<SetKey> {
-    Box::into_raw(Box::new(indexmap::IndexSet::new()))
+fn new_set_inner() -> *mut SetInner {
+    Box::into_raw(Box::new(SetInner::new()))
 }
 
 fn alloc_set(vm: &mut Vm) -> *mut JsObject {
     let set_proto = vm.session().builtin_world().set_proto.as_ptr() as *mut JsObject;
     let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(set_proto));
     obj.set_set(true);
-    // SAFETY: new_set_inner() returns a valid Box<IndexSet> pointer; stored as a JsValue
-    // object tag so get_set_inner() can retrieve and cast it back (same provenance).
     let inner = new_set_inner();
-    obj.set_prop_at(SET_PROP_INDEX, JsValue::object(inner as *mut u8));
+    obj.set_native_data(inner as *mut u8);
     vm.epoch().alloc(obj)
 }
 
+pub(crate) fn set_native_edges(obj: &JsObject) -> Vec<JsValue> {
+    if !obj.is_set() {
+        return Vec::new();
+    }
+    let inner = obj.native_data() as *const SetInner;
+    if inner.is_null() {
+        return Vec::new();
+    }
+    unsafe { (*inner).iter().map(|key| key.0).filter(|value| value.is_object()).collect() }
+}
+
+pub(crate) fn clone_set_native_with_rewrite<F>(src: &JsObject, dst: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    if !src.is_set() {
+        return;
+    }
+    let inner = src.native_data() as *const SetInner;
+    if inner.is_null() {
+        dst.set_native_data(std::ptr::null_mut());
+        return;
+    }
+    let mut cloned = SetInner::new();
+    unsafe {
+        for key in (*inner).iter() {
+            let new_key = if key.0.is_object() { SetKey(rewrite(key.0)) } else { *key };
+            cloned.insert(new_key);
+        }
+    }
+    dst.set_native_data(Box::into_raw(Box::new(cloned)) as *mut u8);
+}
+
+pub(crate) fn rewrite_set_native<F>(obj: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    if !obj.is_set() {
+        return;
+    }
+    let inner = obj.native_data() as *mut SetInner;
+    if inner.is_null() {
+        return;
+    }
+    unsafe {
+        let mut rewritten = SetInner::with_capacity((*inner).len());
+        for key in (*inner).iter() {
+            let new_key = if key.0.is_object() { SetKey(rewrite(key.0)) } else { *key };
+            rewritten.insert(new_key);
+        }
+        *inner = rewritten;
+    }
+}
+
+pub(crate) fn drop_set_native(obj: &mut JsObject) -> u64 {
+    if !obj.is_set() {
+        return 0;
+    }
+    let inner = obj.native_data() as *mut SetInner;
+    if inner.is_null() {
+        return 0;
+    }
+    unsafe {
+        let boxed = Box::from_raw(inner);
+        let bytes = std::mem::size_of::<SetInner>() + boxed.capacity() * std::mem::size_of::<SetKey>();
+        drop(boxed);
+        obj.set_native_data(std::ptr::null_mut());
+        bytes as u64
+    }
+}
+
 pub fn set_constructor(vm: &mut Vm, _args: &[u8]) -> NativeResult {
     let set_obj = alloc_set(vm);
     NativeResult::Ok(JsValue::from_js_object(set_obj))

crates/oxide_vm/src/session_arena.rs

@@ -3,6 +3,7 @@ use std::collections::HashMap;
 use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
 
+use crate::builtins::{map, set};
 use crate::vm::Vm;
 
 impl Vm {
@@ -41,6 +42,15 @@ impl Vm {
 
         let dst_ref = unsafe { &mut *dst };
         dst_ref.rewrite_object_values(|value| self.promote_value_if_epoch_object(value, forwarding));
+        if src_ref.is_map() {
+            map::clone_map_native_with_rewrite(src_ref, dst_ref, |value| {
+                self.promote_value_if_epoch_object(value, forwarding)
+            });
+        } else if src_ref.is_set() {
+            set::clone_set_native_with_rewrite(src_ref, dst_ref, |value| {
+                self.promote_value_if_epoch_object(value, forwarding)
+            });
+        }
         dst
     }
 

crates/oxide_vm/src/session_gc.rs

@@ -5,6 +5,7 @@ use std::time::Instant;
 use oxide_types::object::{JsObject, PropMetaEntry};
 use oxide_types::value::JsValue;
 
+use crate::builtins::{map, set};
 use crate::vm::Vm;
 
 pub struct SessionGc {
@@ -80,6 +81,12 @@ impl SessionGc {
         if obj.home_object().is_object() {
             edges.push(obj.home_object());
         }
+        if obj.is_map() {
+            edges.extend(map::map_native_edges(obj));
+        }
+        if obj.is_set() {
+            edges.extend(set::set_native_edges(obj));
+        }
         edges
     }
 
@@ -161,6 +168,9 @@ impl SessionGc {
                 std::mem::drop(vec);
             }
 
+            freed_bytes += map::drop_map_native(obj);
+            freed_bytes += set::drop_set_native(obj);
+
             freed_bytes
         }
     }
@@ -186,8 +196,15 @@ impl SessionGc {
             let is_live = unsafe { (*old_ptr).is_gc_marked() };
             if is_live {
                 survivors += 1;
-                let clone = unsafe { &*old_ptr }.clone_for_session_epoch();
+                let old_ref = unsafe { &*old_ptr };
+                let clone = old_ref.clone_for_session_epoch();
                 let new_ptr = new_arena.alloc(clone) as *mut JsObject;
+                let new_ref = unsafe { &mut *new_ptr };
+                if old_ref.is_map() {
+                    map::clone_map_native_with_rewrite(old_ref, new_ref, |value| value);
+                } else if old_ref.is_set() {
+                    set::clone_set_native_with_rewrite(old_ref, new_ref, |value| value);
+                }
                 forwarding.insert(old_ptr, new_ptr);
                 freed_bytes += Self::drop_session_object_heap_data(old_ptr);
             } else {
@@ -208,6 +225,11 @@ impl SessionGc {
                 }
                 value
             });
+            if obj.is_map() {
+                map::rewrite_map_native(obj, |value| rewrite_forwarded_value(value, &forwarding));
+            } else if obj.is_set() {
+                set::rewrite_set_native(obj, |value| rewrite_forwarded_value(value, &forwarding));
+            }
         }
 
         rewrite_vm_roots(vm, &forwarding);
@@ -353,6 +375,8 @@ mod tests {
     use oxide_types::object::JsObject;
 
     use super::*;
+    use crate::builtins::{map, set};
+    use crate::native::NativeResult;
     use crate::vm::{CallFrame, FrameContinuation};
 
     fn plain_object(vm: &mut Vm) -> *mut JsObject {
@@ -480,6 +504,14 @@ mod tests {
         Vm::with_kernel_core(core)
     }
 
+    fn native_ok(result: NativeResult) -> JsValue {
+        match result {
+            NativeResult::Ok(value) => value,
+            NativeResult::Err(err) => panic!("native error: {err}"),
+            NativeResult::TailCall { .. } => panic!("unexpected native bytecode call"),
+        }
+    }
+
     #[test]
     fn reset_maybe_collect_collects_after_threshold() {
         let mut vm = vm_with_low_threshold();
@@ -536,4 +568,67 @@ mod tests {
         assert!(!std::ptr::eq(new_value.as_js_object_ptr(), old_ptr));
         assert_eq!(unsafe { (*new_value.as_js_object_ptr()).get_prop_at(0) }, JsValue::int(42));
     }
+
+    #[test]
+    fn map_native_storage_is_not_a_normal_object_edge() {
+        let mut vm = Vm::new();
+        let map_value = native_ok(map::map_constructor(&mut vm, &[]));
+        let map_obj = unsafe { &*map_value.as_js_object_ptr() };
+        let native_ptr = map_obj.native_data() as *mut JsObject;
+
+        assert!(map_obj.hash_props_vec().is_none());
+        assert!(!map_obj.native_data().is_null());
+        assert!(!SessionGc::new()
+            .object_edges(map_obj)
+            .iter()
+            .any(|edge| std::ptr::eq(edge.as_js_object_ptr(), native_ptr)));
+    }
+
+    #[test]
+    fn session_gc_traces_map_object_key_and_value() {
+        let mut vm = vm_with_low_threshold();
+        let map_value = native_ok(map::map_constructor(&mut vm, &[]));
+        let key = JsValue::from_js_object(plain_object(&mut vm));
+        let value = JsValue::from_js_object(plain_object(&mut vm));
+        vm.regs[0] = map_value;
+        vm.regs[1] = key;
+        vm.regs[2] = value;
+        native_ok(map::map_set(&mut vm, &[0, 1, 2]));
+
+        let map_session = vm.promote_object(map_value.as_js_object_ptr());
+        vm.regs.fill(JsValue::undefined());
+        vm.regs[0] = JsValue::from_js_object(map_session);
+        let mut gc = std::mem::replace(&mut vm.session_gc, SessionGc::new());
+        gc.collect(&mut vm);
+        vm.session_gc = gc;
+
+        let live_map = unsafe { &*vm.regs[0].as_js_object_ptr() };
+        let edges = map::map_native_edges(live_map);
+        assert_eq!(edges.len(), 2);
+        assert!(edges.iter().all(|value| vm.is_session_ptr(value.as_js_object_ptr())));
+        assert_eq!(vm.session_object_ptrs.len(), 3);
+    }
+
+    #[test]
+    fn session_gc_traces_set_object_key() {
+        let mut vm = vm_with_low_threshold();
+        let set_value = native_ok(set::set_constructor(&mut vm, &[]));
+        let key = JsValue::from_js_object(plain_object(&mut vm));
+        vm.regs[0] = set_value;
+        vm.regs[1] = key;
+        native_ok(set::set_add(&mut vm, &[0, 1]));
+
+        let set_session = vm.promote_object(set_value.as_js_object_ptr());
+        vm.regs.fill(JsValue::undefined());
+        vm.regs[0] = JsValue::from_js_object(set_session);
+        let mut gc = std::mem::replace(&mut vm.session_gc, SessionGc::new());
+        gc.collect(&mut vm);
+        vm.session_gc = gc;
+
+        let live_set = unsafe { &*vm.regs[0].as_js_object_ptr() };
+        let edges = set::set_native_edges(live_set);
+        assert_eq!(edges.len(), 1);
+        assert!(vm.is_session_ptr(edges[0].as_js_object_ptr()));
+        assert_eq!(vm.session_object_ptrs.len(), 2);
+    }
 }