refactor: 统一调用调度并安全化 IC 缓存

crates/oxide_vm/src/builtins/set.rs

@@ -9,6 +9,15 @@ use crate::vm::Vm;
 
 const SET_PROP_INDEX: u8 = 0;
 
+macro_rules! native_try {
+    ($expr:expr) => {
+        match $expr {
+            Ok(value) => value,
+            Err(err) => return NativeResult::Err(err),
+        }
+    };
+}
+
 #[derive(Clone, Copy)]
 pub struct SetKey(pub JsValue);
 
@@ -25,6 +34,7 @@ impl PartialEq for SetKey {
             }
             return a == b;
         }
+        // SAFETY: JsValue is an 8-byte NaN-boxed Copy value; raw bits define non-double identity here.
         unsafe { std::mem::transmute::<JsValue, u64>(self.0) == std::mem::transmute::<JsValue, u64>(other.0) }
     }
 }
@@ -43,11 +53,21 @@ impl Hash for SetKey {
                 d.to_bits().hash(state);
             }
         } else {
+            // SAFETY: JsValue is an 8-byte NaN-boxed Copy value; hashing raw bits matches equality above.
             unsafe { std::mem::transmute::<JsValue, u64>(self.0).hash(state) }
         }
     }
 }
 
+/// Retrieve the `IndexSet` pointer stored at `SET_PROP_INDEX` of a Set object.
+///
+/// # Safety contract maintained by callers
+///
+/// The pointer is valid as long as the Set `JsObject` itself is alive. The `JsObject`
+/// lives in the current `Epoch` arena and `Epoch::reset()` is never called while a
+/// native builtin is executing. The `Box<IndexSet>` is allocated in `new_set_inner()`
+/// and is never freed during the Set's lifetime. Only one live `*mut` alias exists per
+/// Set object at a time because native calls are single-threaded.
 fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexSet<SetKey>, JsValue> {
     if !this_val.is_object() {
         return Err(crate::builtins::error::create_type_error(vm, "called on non-Set object"));
@@ -56,11 +76,24 @@ fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexS
     if set_ptr.is_null() {
         return Err(crate::builtins::error::create_type_error(vm, "Set internal state invalid"));
     }
+    // SAFETY: set_ptr is a non-null, aligned pointer to a JsObject bump-allocated in the
+    // current Epoch. Remains valid for the duration of this call.
     let set_obj = unsafe { &*set_ptr };
+    if !set_obj.is_set() {
+        return Err(crate::builtins::error::create_type_error(
+            vm,
+            "Set.prototype.add called on incompatible receiver",
+        ));
+    }
     let inner_val = set_obj.get_prop_at(SET_PROP_INDEX);
     if !inner_val.is_object() {
         return Err(crate::builtins::error::create_type_error(vm, "Set internal state invalid"));
     }
+    // SAFETY: inner_val holds the raw pointer written by `alloc_set` as
+    // `JsValue::object(Box::into_raw(Box::new(IndexSet::new())) as *mut u8)`.
+    // The pointer is a valid, heap-allocated `Box<IndexSet<SetKey>>` and is never freed
+    // during the Set object's lifetime (see module safety contract above).
+    // Alignment: IndexSet requires at most 8-byte alignment; the global allocator satisfies this.
     let inner_ptr = inner_val.as_js_object_ptr() as *mut indexmap::IndexSet<SetKey>;
     if inner_ptr.is_null() {
         return Err(crate::builtins::error::create_type_error(vm, "Set internal state invalid"));
@@ -68,6 +101,9 @@ fn get_set_inner(vm: &mut Vm, this_val: JsValue) -> Result<*mut indexmap::IndexS
     Ok(inner_ptr)
 }
 
+/// Allocate a new `IndexSet` on the global heap.
+/// The caller is responsible for storing the pointer in the Set `JsObject` at `SET_PROP_INDEX`
+/// via `JsValue::object(ptr as *mut u8)` and ensuring it is never double-freed.
 fn new_set_inner() -> *mut indexmap::IndexSet<SetKey> {
     Box::into_raw(Box::new(indexmap::IndexSet::new()))
 }
@@ -75,6 +111,9 @@ fn new_set_inner() -> *mut indexmap::IndexSet<SetKey> {
 fn alloc_set(vm: &mut Vm) -> *mut JsObject {
     let set_proto = vm.kernel().builtin_world().set_proto.as_ptr() as *mut JsObject;
     let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(set_proto));
+    obj.set_set(true);
+    // SAFETY: new_set_inner() returns a valid Box<IndexSet> pointer; stored as a JsValue
+    // object tag so get_set_inner() can retrieve and cast it back (same provenance).
     let inner = new_set_inner();
     obj.set_prop_at(SET_PROP_INDEX, JsValue::object(inner as *mut u8));
     vm.epoch().alloc(obj)
@@ -82,46 +121,46 @@ fn alloc_set(vm: &mut Vm) -> *mut JsObject {
 
 pub fn set_constructor(vm: &mut Vm, _args: &[u8]) -> NativeResult {
     let set_obj = alloc_set(vm);
-    Ok(JsValue::from_js_object(set_obj))
+    NativeResult::Ok(JsValue::from_js_object(set_obj))
 }
 
 pub fn set_add(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let inner = get_set_inner(vm, this_val)?;
+    let inner = native_try!(get_set_inner(vm, this_val));
     let val = vm.reg(if args.len() > 1 { args[1] } else { 0 });
     unsafe {
         (*inner).insert(SetKey(val));
     }
-    Ok(this_val)
+    NativeResult::Ok(this_val)
 }
 
 pub fn set_has(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let inner = get_set_inner(vm, this_val)?;
+    let inner = native_try!(get_set_inner(vm, this_val));
     let val = vm.reg(if args.len() > 1 { args[1] } else { 0 });
     let found = unsafe { (*inner).contains(&SetKey(val)) };
-    Ok(JsValue::bool(found))
+    NativeResult::Ok(JsValue::bool(found))
 }
 
 pub fn set_delete(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let inner = get_set_inner(vm, this_val)?;
+    let inner = native_try!(get_set_inner(vm, this_val));
     let val = vm.reg(if args.len() > 1 { args[1] } else { 0 });
     let removed = unsafe { (*inner).shift_remove(&SetKey(val)) };
-    Ok(JsValue::bool(removed))
+    NativeResult::Ok(JsValue::bool(removed))
 }
 
 pub fn set_clear(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let inner = get_set_inner(vm, this_val)?;
+    let inner = native_try!(get_set_inner(vm, this_val));
     unsafe {
         (*inner).clear();
     }
-    Ok(JsValue::undefined())
+    NativeResult::Ok(JsValue::undefined())
 }
 
 pub fn set_size(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let inner = get_set_inner(vm, this_val)?;
-    Ok(JsValue::float(unsafe { (*inner).len() } as f64))
+    let inner = native_try!(get_set_inner(vm, this_val));
+    NativeResult::Ok(JsValue::float(unsafe { (*inner).len() } as f64))
 }