diff --git a/crates/oxide_builtins/src/bigint.rs b/crates/oxide_builtins/src/bigint.rs index 9ac68889..4ff6d6b2 100644 --- a/crates/oxide_builtins/src/bigint.rs +++ b/crates/oxide_builtins/src/bigint.rs @@ -170,7 +170,7 @@ fn this_bigint_value(vm: &mut H, this_val: JsValue) -> Result(vm: &mut H, args: &[u8]) -> NativeResult { let obj = unsafe { &mut *this_val.as_js_object_ptr() }; obj.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ; - obj.push_prop(JsValue::bool(bool_val)); + obj.set_boxed_value(JsValue::bool(bool_val)); NativeResult::Ok(this_val) } @@ -72,7 +72,7 @@ pub fn boolean_prototype_value_of(vm: &mut H, args: &[u8]) -> NativeR "Boolean.prototype.valueOf called on non-Boolean object", )); } - let val = obj.get_prop_at(0); + let val = obj.boxed_value(); NativeResult::Ok(val) } @@ -100,7 +100,7 @@ pub fn boolean_prototype_to_string(vm: &mut H, args: &[u8]) -> Native "Boolean.prototype.toString called on non-Boolean object", )); } - let val = obj.get_prop_at(0); + let val = obj.boxed_value(); let is_true = if val.is_bool() { val.as_bool() } else { diff --git a/crates/oxide_builtins/src/number.rs b/crates/oxide_builtins/src/number.rs index ef4f48e2..24a34f13 100644 --- a/crates/oxide_builtins/src/number.rs +++ b/crates/oxide_builtins/src/number.rs @@ -46,7 +46,7 @@ pub fn number_constructor(vm: &mut H, args: &[u8]) -> NativeResult { } else { JsValue::float(n) }; - obj.set_prop_at(0, boxed); + obj.set_boxed_value(boxed); return NativeResult::Ok(this_val); } @@ -514,7 +514,7 @@ pub fn number_value_of(vm: &mut H, args: &[u8]) -> NativeResult { } let obj = unsafe { &*ptr }; if obj.is_number_obj() { - return NativeResult::Ok(obj.get_prop_at(0)); + return NativeResult::Ok(obj.boxed_value()); } } } diff --git a/crates/oxide_builtins/src/object.rs b/crates/oxide_builtins/src/object.rs index 7aaa1a8b..20301a8f 100644 --- a/crates/oxide_builtins/src/object.rs +++ b/crates/oxide_builtins/src/object.rs @@ -431,7 +431,7 @@ pub fn object_constructor(vm: &mut H, args: &[u8]) -> NativeResult { let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto))); let obj_ref = unsafe { &mut *obj }; obj_ref.type_tag = JsObject::OBJ_TYPE_NUMBER_OBJ; - obj_ref.set_prop_at(0, val); + obj_ref.set_boxed_value(val); return NativeResult::Ok(JsValue::from_js_object(obj)); } if val.is_string() { @@ -447,7 +447,7 @@ pub fn object_constructor(vm: &mut H, args: &[u8]) -> NativeResult { let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto))); let obj_ref = unsafe { &mut *obj }; obj_ref.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ; - obj_ref.set_prop_at(0, val); + obj_ref.set_boxed_value(val); return NativeResult::Ok(JsValue::from_js_object(obj)); } if val.is_symbol() { @@ -455,14 +455,14 @@ pub fn object_constructor(vm: &mut H, args: &[u8]) -> NativeResult { let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto))); let obj_ref = unsafe { &mut *obj }; obj_ref.type_tag = JsObject::OBJ_TYPE_SYMBOL_OBJ; - obj_ref.set_prop_at(0, val); + obj_ref.set_boxed_value(val); return NativeResult::Ok(JsValue::from_js_object(obj)); } if val.is_bigint() { let proto = vm.session().builtin_world().bigint_proto.as_ptr() as *mut JsObject; let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto))); let obj_ref = unsafe { &mut *obj }; - obj_ref.set_prop_at(0, val); + obj_ref.set_boxed_value(val); return NativeResult::Ok(JsValue::from_js_object(obj)); } let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(object_proto))); diff --git a/crates/oxide_builtins/src/symbol.rs b/crates/oxide_builtins/src/symbol.rs index 18968183..60a694b3 100644 --- a/crates/oxide_builtins/src/symbol.rs +++ b/crates/oxide_builtins/src/symbol.rs @@ -53,7 +53,7 @@ pub fn symbol_constructor(vm: &mut H, args: &[u8]) -> NativeResult { /// `Symbol.prototype.toString`：返回 `Symbol(description)` 形式字符串。 /// this 必须是 Symbol，否则抛 TypeError。 -/// thisSymbolValue：Symbol 原样返回；包装对象解盒（prop 0 存原始 Symbol）；其它类型 TypeError。 +/// thisSymbolValue：Symbol 原样返回；包装对象解盒（专属载荷字段存原始 Symbol）；其它类型 TypeError。 fn this_symbol_value(vm: &mut H, this_val: JsValue) -> Result { if this_val.is_symbol() { return Ok(this_val); @@ -67,7 +67,7 @@ fn this_symbol_value(vm: &mut H, this_val: JsValue) -> Result bool { /// ToObject（ECMA-262 §7.1.13）：null/undefined 抛 TypeError，其余原始值包装为对应包装对象。 /// -/// 包装对象按类型选择原型（String/Number/Boolean 原型或默认 Object 原型），原始值存入 hash props 槽。 +/// 包装对象按类型选择原型（String/Number/Boolean 原型或默认 Object 原型）； +/// 被包基元写入对象专属载荷字段，不占命名属性区。字符串盒暂仍预存属性区 +/// 槽 0——其消费面（解盒读原始串）与规范固有属性面同批切换，两端不可分拆。 pub fn to_object(val: JsValue, host: &mut H) -> Result { if val.is_object() { return Ok(val); @@ -768,8 +770,12 @@ pub fn to_object(val: JsValue, host: &mut H) -> Result>) /// -/// 字段自和：116 字节，另有 4 字节对齐填充（native_fn 之前） -/// 总计：120 字节 +/// 字段自和：124 字节，另有 4 字节对齐填充（native_fn 之前） +/// 总计：128 字节 /// 对齐：8 字节 pub struct JsObject { header: u32, @@ -126,6 +127,11 @@ pub struct JsObject { table_gen: u32, captured_this: JsValue, home_object: JsValue, + /// 装箱基元对象（Number/String/Boolean/Symbol 盒与 BigInt 包装）的被包 + /// 基元载荷：构造期直接写入本字段，不占用命名属性区——属性区存储位与 + /// shape 槽位保持恒等映射，后续索引/命名属性写读不干扰被包值。 + /// 未装箱对象恒为 undefined。 + boxed_value: JsValue, pub upvalues: *mut u8, } @@ -375,6 +381,7 @@ impl JsObject { table_gen: 0, captured_this: JsValue::undefined(), home_object: JsValue::undefined(), + boxed_value: JsValue::undefined(), upvalues: std::ptr::null_mut(), } } @@ -401,6 +408,7 @@ impl JsObject { table_gen: 0, captured_this: JsValue::undefined(), home_object: JsValue::undefined(), + boxed_value: JsValue::undefined(), upvalues: std::ptr::null_mut(), }; let vec = Box::new(vec![JsValue::undefined(); n_elements.min(MAX_DENSE_PROPS)]); @@ -499,6 +507,7 @@ impl JsObject { table_gen: self.table_gen, captured_this: self.captured_this, home_object: self.home_object, + boxed_value: self.boxed_value, upvalues: self.upvalues, } } @@ -641,6 +650,9 @@ impl JsObject { if self.home_object.is_object() { self.home_object = rewrite(self.home_object); } + if self.boxed_value.is_object() { + self.boxed_value = rewrite(self.boxed_value); + } if !self.upvalues.is_null() { let cells = unsafe { &mut *(self.upvalues as *mut Vec<*mut Cell>) }; for cell_ptr in cells { @@ -943,6 +955,20 @@ impl JsObject { pub fn set_home_object(&mut self, v: JsValue) { self.home_object = v; } + + /// 装箱对象的被包基元载荷（未装箱对象为 undefined）。 + pub fn boxed_value(&self) -> JsValue { + self.boxed_value + } + + /// 设置装箱对象的被包基元载荷。 + /// + /// # 注意事项 + /// 仅供装箱构造点调用：写入前对象须尚未进入属性读写路径， + /// 载荷不参与 shape/属性区，写后不得再经属性区预存同一值。 + pub fn set_boxed_value(&mut self, v: JsValue) { + self.boxed_value = v; + } } #[cfg(test)] diff --git a/crates/oxide_vm/src/session_gc.rs b/crates/oxide_vm/src/session_gc.rs index 372687a3..538b3749 100644 --- a/crates/oxide_vm/src/session_gc.rs +++ b/crates/oxide_vm/src/session_gc.rs @@ -162,6 +162,7 @@ impl SessionGc { Self::process_edge(obj.proto(), vm, stack, live_strings, live_bigints); Self::process_edge(obj.captured_this(), vm, stack, live_strings, live_bigints); Self::process_edge(obj.home_object(), vm, stack, live_strings, live_bigints); + Self::process_edge(obj.boxed_value(), vm, stack, live_strings, live_bigints); if obj.is_map() { for value in map::map_native_edges(obj) { Self::process_edge(value, vm, stack, live_strings, live_bigints); @@ -329,6 +330,9 @@ impl SessionGc { if obj.home_object().is_string() { Self::mark_string_live(live, obj.home_object().as_string_ptr_mut()); } + if obj.boxed_value().is_string() { + Self::mark_string_live(live, obj.boxed_value().as_string_ptr_mut()); + } // 扫描 upvalue cell 中的字符串引用。 for cell_ptr in obj.upvalues_slice() { if cell_ptr.is_null() { diff --git a/crates/oxide_vm/tests/boxed_primitive_prop_tests.rs b/crates/oxide_vm/tests/boxed_primitive_prop_tests.rs new file mode 100644 index 00000000..677a1435 --- /dev/null +++ b/crates/oxide_vm/tests/boxed_primitive_prop_tests.rs @@ -0,0 +1,137 @@ +//! 装箱基元对象（Number/Boolean/Symbol/BigInt 盒）索引写读回钉： +//! 构造期被包基元住专属载荷字段而非属性区，后续索引/命名属性写读与 +//! 被包值互不干扰，值与 node 实测一致。 + +use std::sync::Arc; + +use oxide_compiler::compiler::Compiler; +use oxide_types::value::JsValue; +use oxide_vm::vm::Vm; + +fn eval(vm: &mut Vm, source: &str) -> Result { + let allocator = oxide_parser::Allocator::default(); + let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?; + let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?; + vm.run(&Arc::new(module)) +} + +/// 读数组结果第 i 个元素（结果必为数组）。 +fn elem(result: JsValue, i: usize) -> JsValue { + let obj = unsafe { &*result.as_js_object_ptr() }; + obj.get_prop_at(i) +} + +#[test] +fn boxed_number_fresh_box_has_no_index_payload() { + // fresh 盒无自有属性：0 键不存在、索引读 undefined、被包值经 Number 还原、 + // 自有属性名空。 + let mut vm = Vm::new(); + let r = eval( + &mut vm, + "[0 in Object(5), Object(5)[0], Number(Object(5)), Object.getOwnPropertyNames(Object(5)).length]", + ) + .unwrap(); + let v0 = elem(r, 0); + assert!(v0.is_bool() && !v0.as_bool(), "0 in Object(5) 应为 false"); + assert!(elem(r, 1).is_undefined(), "Object(5)[0] 应为 undefined"); + assert_eq!(elem(r, 2).as_int(), 5, "Number(Object(5)) 应为 5"); + assert_eq!(elem(r, 3).as_int(), 0, "自有属性名应为空"); +} + +#[test] +fn boxed_number_index_write_reads_written_value() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var o = Object(5); o[0] = 77; [0 in o, o[0], Number(o)]").unwrap(); + let v0 = elem(r, 0); + assert!(v0.is_bool() && v0.as_bool(), "写后 0 in o 应为 true"); + assert_eq!(elem(r, 1).as_int(), 77, "o[0] 应读回写入值 77"); + assert_eq!(elem(r, 2).as_int(), 5, "Number(o) 应保持被包值 5"); +} + +#[test] +fn boxed_number_repeated_index_write_keeps_payload() { + // 二次写命中同一键：读回最新写入值，被包基元不被覆写。 + let mut vm = Vm::new(); + let r = eval(&mut vm, "var o = Object(5); o[0] = 77; o[0] = 99; [o[0], Number(o)]").unwrap(); + assert_eq!(elem(r, 0).as_int(), 99, "o[0] 应读回 99"); + assert_eq!(elem(r, 1).as_int(), 5, "被包值应仍为 5"); +} + +#[test] +fn boxed_number_named_keys_not_shifted() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var o = Object(5); o.a = 1; o.b = 2; [o.a, o.b]").unwrap(); + assert_eq!(elem(r, 0).as_int(), 1, "o.a 应为 1"); + assert_eq!(elem(r, 1).as_int(), 2, "o.b 应为 2"); +} + +#[test] +fn boxed_number_non_index_key_read_write() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var o = Object(5); o.x = 1; o.x").unwrap(); + assert_eq!(r.as_int(), 1, "o.x 应读回 1"); +} + +#[test] +fn boxed_number_out_of_range_index_absent() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var o = Object(5); o[0] = 77; [1 in o, 5 in o]").unwrap(); + let v0 = elem(r, 0); + assert!(v0.is_bool() && !v0.as_bool(), "1 in o 应为 false"); + let v1 = elem(r, 1); + assert!(v1.is_bool() && !v1.as_bool(), "5 in o 应为 false"); +} + +#[test] +fn boxed_boolean_index_write_reads_written_value() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var t = Object(true); t[0] = 'x'; [t[0], Boolean(t)]").unwrap(); + assert_eq!(vm.lookup_str(elem(r, 0)).unwrap(), "x", "t[0] 应读回 'x'"); + assert!(elem(r, 1).as_bool(), "Boolean(t) 应保持 true"); +} + +#[test] +fn boxed_float_index_write_reads_written_value() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var f = Object(1.5); f[0] = 'x'; [f[0], Number(f)]").unwrap(); + assert_eq!(vm.lookup_str(elem(r, 0)).unwrap(), "x", "f[0] 应读回 'x'"); + assert_eq!(elem(r, 1).as_double(), 1.5, "Number(f) 应保持 1.5"); +} + +#[test] +fn boxed_bigint_index_write_reads_written_value() { + let mut vm = Vm::new(); + let r = eval(&mut vm, "var bb = Object(1n); bb[0] = 9; [bb[0], BigInt(bb)]").unwrap(); + assert_eq!(elem(r, 0).as_int(), 9, "bb[0] 应读回 9"); + assert!(elem(r, 1).is_bigint(), "BigInt(bb) 应为 BigInt"); + assert_eq!(vm.bigint_value(elem(r, 1)), &num_bigint::BigInt::from(1), "BigInt(bb) 应为 1n"); +} + +#[test] +fn boxed_symbol_index_write_reads_written_value() { + // Symbol 盒消费面（thisSymbolValue 解盒）同批切换，索引写读与其互不干扰。 + let mut vm = Vm::new(); + let r = eval( + &mut vm, + "var s = Object(Symbol('d')); s[0] = 7; [s[0], Symbol.prototype.toString.call(s)]", + ) + .unwrap(); + assert_eq!(elem(r, 0).as_int(), 7, "s[0] 应读回 7"); + assert_eq!(vm.lookup_str(elem(r, 1)).unwrap(), "Symbol(d)", "解盒 toString 应保持 Symbol(d)"); +} + +#[test] +fn boxed_primitive_existing_guards_hold() { + // 既有面守卫：构造器装箱、valueOf、typeof、toString tag 面不随本次机制变化。 + let mut vm = Vm::new(); + let r = eval( + &mut vm, + "[+new Number(1), new Number(5).valueOf(), typeof new Number(5), Object.prototype.toString.call(Object(5))]", + ) + .unwrap(); + // 一元 + 结果按引擎算术面为 double 表示（数值相等，显示同 int）。 + assert_eq!(elem(r, 0).as_double(), 1.0, "+new Number(1) 应为 1"); + assert_eq!(elem(r, 1).as_int(), 5, "valueOf 应返回 5"); + assert_eq!(vm.lookup_str(elem(r, 2)).unwrap(), "object", "typeof 应为 object"); + assert_eq!(vm.lookup_str(elem(r, 3)).unwrap(), "[object Number]", "toString tag 应为 [object Number]"); +}