perf: 数组元素独立存储区，push 改为摊销 O(1) 尾插

crates/oxide_builtins/src/function.rs

@@ -107,14 +107,12 @@ pub fn function_apply<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
                 let arr = unsafe { &*arr_ptr };
                 if arr.is_array() {
                     let max_args = 55usize; // base=200，255 号寄存器之前的安全上限。
-                    let n = arr.hash_props_vec().map_or(0, |v| v.len()).min(max_args);
+                    let n = arr.prop_count() as usize;
+                    let n = n.min(max_args);
                     let base = 200u8;
                     arg_regs = (0..n).map(|i| base + i as u8).collect();
                     for i in 0..n {
-                        let vec = arr.hash_props_vec();
-                        if let Some(v) = vec.and_then(|v| v.get(i)) {
-                            vm.set_reg(base + i as u8, *v);
-                        }
+                        vm.set_reg(base + i as u8, arr.get_prop_at(i));
                     }
                 } else {
                     arg_regs = Vec::new();

crates/oxide_builtins/src/json.rs

@@ -72,7 +72,7 @@ fn walk_reviver<H: VmHost>(
         if !obj_ptr.is_null() {
             let obj = unsafe { &*obj_ptr };
             if obj.is_array() {
-                let len = obj.prop_vec_len();
+                let len = obj.prop_count() as usize;
                 for i in 0..len {
                     let index_str = i.to_string();
                     let child_si = vm.kernel_core().perm_interner().intern(&index_str).0;
@@ -229,7 +229,7 @@ pub fn json_stringify<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
                 if robj.is_function() {
                     replacer_fn = Some(replacer_val);
                 } else if robj.is_array() {
-                    let len = robj.prop_vec_len();
+                    let len = robj.prop_count() as usize;
                     let mut whitelist = HashSet::new();
                     for i in 0..len {
                         let elem = robj.get_prop_at(i);
@@ -446,7 +446,7 @@ fn stringify_array<H: VmHost>(
     let has_space = !space.is_empty();
     out.push('[');
 
-    let len = obj.prop_vec_len();
+    let len = obj.prop_count() as usize;
     for i in 0..len {
         if i > 0 && !has_space {
             out.push(',');

crates/oxide_builtins/src/object.rs

@@ -223,7 +223,7 @@ pub fn delete_own_property<H: VmHost>(vm: &mut H, obj: &mut JsObject, key_si: u3
         Vec::new()
     };
     let saved_element_meta: Option<Vec<Option<PropMetaEntry>>> = if obj.is_array() {
-        obj.prop_meta_vec().map(|meta| meta[..obj.array_prop_count as usize].to_vec())
+        Some((0..obj.array_prop_count).map(|i| obj.prop_meta_at(i)).collect())
     } else {
         None
     };
@@ -259,9 +259,12 @@ pub fn delete_own_property<H: VmHost>(vm: &mut H, obj: &mut JsObject, key_si: u3
             obj.set_prop_at(i, val);
         }
         if let Some(saved_meta) = saved_element_meta {
-            let meta = obj.ensure_prop_meta();
+            let meta = obj.ensure_array_elements_meta();
             for (i, entry) in saved_meta.into_iter().enumerate() {
                 if let Some(entry) = entry {
+                    while meta.len() <= i {
+                        meta.push(None);
+                    }
                     meta[i] = Some(entry);
                 }
             }