Store typed array metadata in internal slots

Author: Lewin671

crates/qjs-runtime/src/typed_array.rs

@@ -29,16 +29,32 @@ pub(crate) use ordering::*;
 
 const MAX_TYPED_ARRAY_LENGTH: usize = 1_000_000;
 
-/// Internal slot naming the concrete TypedArray kind (e.g. `"Uint8Array"`).
-pub(crate) const TYPED_ARRAY_KIND_PROPERTY: &str = "\0TypedArrayKind";
-/// Internal slot referencing the backing `ArrayBuffer` object.
-pub(crate) const TYPED_ARRAY_BUFFER_PROPERTY: &str = "\0TypedArrayBuffer";
-/// Internal slot holding the byte offset of the view into its buffer.
-pub(crate) const TYPED_ARRAY_BYTE_OFFSET_PROPERTY: &str = "\0TypedArrayByteOffset";
-/// Internal slot holding the element count of the view.
-pub(crate) const TYPED_ARRAY_LENGTH_PROPERTY: &str = "\0TypedArrayArrayLength";
-/// Internal slot marking views whose length tracks a resizable ArrayBuffer.
-pub(crate) const TYPED_ARRAY_LENGTH_TRACKING_PROPERTY: &str = "\0TypedArrayLengthTracking";
+#[derive(Clone)]
+pub(crate) struct TypedArraySlots {
+    kind: NativeFunction,
+    buffer: ObjectRef,
+    byte_offset: usize,
+    fixed_length: usize,
+    length_tracking: bool,
+}
+
+impl TypedArraySlots {
+    pub(crate) fn new(
+        kind: NativeFunction,
+        buffer: ObjectRef,
+        byte_offset: usize,
+        fixed_length: usize,
+        length_tracking: bool,
+    ) -> Self {
+        Self {
+            kind,
+            buffer,
+            byte_offset,
+            fixed_length,
+            length_tracking,
+        }
+    }
+}
 
 /// Whether `object` carries the TypedArray brand.
 pub(crate) fn is_typed_array_object(object: &ObjectRef) -> bool {
@@ -378,10 +394,7 @@ pub(crate) fn native_typed_array_prototype_buffer(
     this_value: Value,
 ) -> Result<Value, RuntimeError> {
     let object = typed_array_receiver(&this_value)?;
-    match object.own_property(TYPED_ARRAY_BUFFER_PROPERTY) {
-        Some(Property { value, .. }) => Ok(value),
-        None => Ok(Value::Undefined),
-    }
+    Ok(typed_array_buffer(&object).map_or(Value::Undefined, Value::Object))
 }
 
 /// `get %TypedArray.prototype%[Symbol.toStringTag]`: the kind name, or
@@ -390,15 +403,11 @@ pub(crate) fn native_typed_array_prototype_to_string_tag(
     this_value: Value,
 ) -> Result<Value, RuntimeError> {
     match this_value {
-        Value::Object(object) if is_typed_array_object(&object) => {
-            match object.own_property(TYPED_ARRAY_KIND_PROPERTY) {
-                Some(Property {
-                    value: Value::String(name),
-                    ..
-                }) => Ok(Value::String(name)),
-                _ => Ok(Value::Undefined),
-            }
-        }
+        Value::Object(object) if is_typed_array_object(&object) => Ok(Value::String(
+            typed_array_name(typed_array_kind(&object))
+                .to_owned()
+                .into(),
+        )),
         _ => Ok(Value::Undefined),
     }
 }
@@ -605,13 +614,9 @@ fn is_object_like(value: &Value) -> bool {
 // --- Internal-slot helpers ---------------------------------------------------
 
 pub(crate) fn typed_array_kind(object: &ObjectRef) -> NativeFunction {
-    match object.own_property(TYPED_ARRAY_KIND_PROPERTY) {
-        Some(Property {
-            value: Value::String(name),
-            ..
-        }) => native_for_name(&name),
-        _ => NativeFunction::Uint8Array,
-    }
+    object
+        .typed_array_slots()
+        .map_or(NativeFunction::Uint8Array, |slots| slots.kind)
 }
 
 pub(crate) fn typed_array_length(object: &ObjectRef) -> usize {
@@ -628,13 +633,10 @@ pub(super) fn typed_array_length_for_buffer_byte_length(
     object: &ObjectRef,
     buffer_byte_length: usize,
 ) -> usize {
-    let fixed_length = match object.own_property(TYPED_ARRAY_LENGTH_PROPERTY) {
-        Some(Property {
-            value: Value::Number(length),
-            ..
-        }) => length as usize,
-        _ => return 0,
+    let Some(slots) = object.typed_array_slots() else {
+        return 0;
     };
+    let fixed_length = slots.fixed_length;
     let offset = typed_array_byte_offset(object);
     let element = bytes_per_element(typed_array_kind(object));
     if typed_array_is_length_tracking(object) {
@@ -657,23 +659,13 @@ pub(super) fn typed_array_length_for_buffer_byte_length(
 }
 
 fn typed_array_fixed_length(object: &ObjectRef) -> Option<usize> {
-    match object.own_property(TYPED_ARRAY_LENGTH_PROPERTY) {
-        Some(Property {
-            value: Value::Number(length),
-            ..
-        }) => Some(length as usize),
-        _ => None,
-    }
+    object.typed_array_slots().map(|slots| slots.fixed_length)
 }
 
 pub(crate) fn typed_array_is_length_tracking(object: &ObjectRef) -> bool {
-    matches!(
-        object.own_property(TYPED_ARRAY_LENGTH_TRACKING_PROPERTY),
-        Some(Property {
-            value: Value::Boolean(true),
-            ..
-        })
-    )
+    object
+        .typed_array_slots()
+        .is_some_and(|slots| slots.length_tracking)
 }
 
 pub(crate) fn typed_array_is_out_of_bounds(object: &ObjectRef) -> bool {
@@ -687,13 +679,7 @@ pub(crate) fn typed_array_is_out_of_bounds(object: &ObjectRef) -> bool {
     if typed_array_is_length_tracking(object) {
         typed_array_byte_offset(object) > buffer_byte_length
     } else {
-        let fixed_length = match object.own_property(TYPED_ARRAY_LENGTH_PROPERTY) {
-            Some(Property {
-                value: Value::Number(length),
-                ..
-            }) => length as usize,
-            _ => 0,
-        };
+        let fixed_length = typed_array_fixed_length(object).unwrap_or(0);
         let element = bytes_per_element(typed_array_kind(object));
         let byte_length = fixed_length.checked_mul(element);
         byte_length.is_none_or(|byte_length| {
@@ -705,23 +691,13 @@ pub(crate) fn typed_array_is_out_of_bounds(object: &ObjectRef) -> bool {
 }
 
 pub(crate) fn typed_array_byte_offset(object: &ObjectRef) -> usize {
-    match object.own_property(TYPED_ARRAY_BYTE_OFFSET_PROPERTY) {
-        Some(Property {
-            value: Value::Number(offset),
-            ..
-        }) => offset as usize,
-        _ => 0,
-    }
+    object
+        .typed_array_slots()
+        .map_or(0, |slots| slots.byte_offset)
 }
 
 pub(crate) fn typed_array_buffer(object: &ObjectRef) -> Option<ObjectRef> {
-    match object.own_property(TYPED_ARRAY_BUFFER_PROPERTY) {
-        Some(Property {
-            value: Value::Object(buffer),
-            ..
-        }) => Some(buffer),
-        _ => None,
-    }
+    object.typed_array_slots().map(|slots| slots.buffer.clone())
 }
 
 pub(crate) fn typed_array_buffer_detached(object: &ObjectRef) -> bool {
@@ -878,14 +854,6 @@ pub(crate) fn typed_array_name(native: NativeFunction) -> &'static str {
     }
 }
 
-fn native_for_name(name: &str) -> NativeFunction {
-    TYPED_ARRAY_KINDS
-        .iter()
-        .find(|(kind, _)| *kind == name)
-        .map(|(_, native)| *native)
-        .unwrap_or(NativeFunction::Uint8Array)
-}
-
 #[cfg(test)]
 mod base64_tests;
 #[cfg(test)]

crates/qjs-runtime/src/typed_array/construct.rs

@@ -7,10 +7,8 @@ use crate::{
 
 use super::element::write_element;
 use super::{
-    MAX_TYPED_ARRAY_LENGTH, TYPED_ARRAY_BUFFER_PROPERTY, TYPED_ARRAY_BYTE_OFFSET_PROPERTY,
-    TYPED_ARRAY_KIND_PROPERTY, TYPED_ARRAY_LENGTH_PROPERTY, TYPED_ARRAY_LENGTH_TRACKING_PROPERTY,
-    bytes_per_element, coerce_element, is_big_int_kind, is_typed_array_object,
-    to_typed_array_length, typed_array_kind, typed_array_name,
+    MAX_TYPED_ARRAY_LENGTH, TypedArraySlots, bytes_per_element, coerce_element, is_big_int_kind,
+    is_typed_array_object, to_typed_array_length, typed_array_kind, typed_array_name,
 };
 use crate::CallEnv;
 
@@ -340,28 +338,14 @@ fn install_view_slots(
     length_tracking: bool,
 ) {
     let name = typed_array_name(native);
-    object.mark_typed_array_exotic();
+    object.install_typed_array_slots(TypedArraySlots::new(
+        native,
+        buffer,
+        byte_offset,
+        length,
+        length_tracking,
+    ));
     object.set_to_string_tag(name);
-    object.define_property(
-        TYPED_ARRAY_KIND_PROPERTY.to_owned(),
-        Property::non_enumerable(Value::String(name.to_owned().into())),
-    );
-    object.define_property(
-        TYPED_ARRAY_BUFFER_PROPERTY.to_owned(),
-        Property::non_enumerable(Value::Object(buffer.clone())),
-    );
-    object.define_property(
-        TYPED_ARRAY_BYTE_OFFSET_PROPERTY.to_owned(),
-        Property::non_enumerable(Value::Number(byte_offset as f64)),
-    );
-    object.define_property(
-        TYPED_ARRAY_LENGTH_PROPERTY.to_owned(),
-        Property::non_enumerable(Value::Number(length as f64)),
-    );
-    object.define_property(
-        TYPED_ARRAY_LENGTH_TRACKING_PROPERTY.to_owned(),
-        Property::non_enumerable(Value::Boolean(length_tracking)),
-    );
 }
 
 // --- static methods (%TypedArray%.from / %TypedArray%.of) --------------------

crates/qjs-runtime/src/typed_array/tests.rs

@@ -39,12 +39,14 @@ fn concrete_constructor_requires_new() {
 fn typed_array_brand_is_not_a_string_keyed_property() {
     assert_eq!(
         eval(
-            "let array = new Uint8Array(1); \
+            "let array = new Int16Array([258]); \
              delete array['\\0TypedArrayKind']; \
+             array['\\0TypedArrayBuffer'] = null; \
              let fake = { '\\0TypedArrayKind': 'Uint8Array' }; \
-             ArrayBuffer.isView(array) + ':' + ArrayBuffer.isView(fake);"
+             ArrayBuffer.isView(array) + ':' + ArrayBuffer.isView(fake) + ':' + \
+               array[0] + ':' + array.BYTES_PER_ELEMENT;"
         ),
-        Ok(Value::String("true:false".to_owned().into()))
+        Ok(Value::String("true:false:258:2".to_owned().into()))
     );
 }
 

crates/qjs-runtime/src/value/object.rs

@@ -239,6 +239,10 @@ struct ObjectColdData {
     /// remains a hidden property; bytes live here so typed-array element access
     /// does not have to encode and decode a string on every read or write.
     internal_bytes: RefCell<Option<Vec<u8>>>,
+    /// TypedArray internal slots. Keeping these out of string-keyed property
+    /// storage avoids repeated hashing on every indexed access and prevents
+    /// guessed property names from mutating spec-internal view metadata.
+    typed_array_slots: OnceCell<crate::typed_array::TypedArraySlots>,
     /// Iterator.zip helper internal state. Ordinary objects hold `None`; zip
     /// helpers store their records here so advancement does not round-trip
     /// through observable-looking property storage.
@@ -844,10 +848,25 @@ impl ObjectRef {
         self.0.array_prototype_exotic.get()
     }
 
-    pub(crate) fn mark_typed_array_exotic(&self) {
+    fn mark_typed_array_exotic(&self) {
         self.0.typed_array_exotic.set(true);
     }
 
+    pub(crate) fn install_typed_array_slots(&self, slots: crate::typed_array::TypedArraySlots) {
+        self.mark_typed_array_exotic();
+        let installed = self.0.cold().typed_array_slots.set(slots);
+        debug_assert!(
+            installed.is_ok(),
+            "TypedArray internal slots must only be installed once"
+        );
+    }
+
+    pub(crate) fn typed_array_slots(&self) -> Option<&crate::typed_array::TypedArraySlots> {
+        self.0
+            .cold_if_present()
+            .and_then(|cold| cold.typed_array_slots.get())
+    }
+
     pub(crate) fn is_typed_array_exotic(&self) -> bool {
         self.0.typed_array_exotic.get()
     }

tasks/T018-broad-performance.md

@@ -2467,6 +2467,68 @@ SHA-256: `e71b97feb3314937dccf318007df67a4adc38bad11ad24b5f43548015d9f62b7`.
 This unit materially improves multiple independent external sources while
 keeping the internal regression guard neutral; B4 and B5 remain active.
 
+The exact-SHA hosted workflows for
+`d17cde1891f329debfeb023781ae13e3ae72318c` all completed successfully. CI
+passed the comparison, Test262 subset, and full check jobs. Exact Test262
+coverage remained 42,671 pass, one fail, zero timeout, and one actionable gap.
+The hosted broad preview retained 25/25 cases, 225/225 eligible measurements,
+and all 75 linearity pairs. Its 1.009458x candidate/base result was
+inconclusive on the variable hosted runner; candidate/QuickJS-NG was 0.357441x.
+The hosted external preview still failed B5 at 12.714481x QuickJS-NG for 5/5
+JetStream cases, 7.670607x for 10/14 Kraken cases, and 11.436771x for 23/26
+SunSpider cases. Hosted broad raw/report SHA-256 are
+`5c38f33d55998c24c791a86d0f16b522932423d005217780aa0ba96d42244e40`
+and `994c8f2464f94475266a4f46dfadc8b17dc88e9d98721105328c116879e4ea6a`;
+hosted external raw/report SHA-256 are
+`b8c64f9f8aa3c0b947a7462887168370c345597bc216b8068834d2fe989148a5`
+and `f48754941ee1ee3f89514ea295fbbe3443a40c7610c814f9b02499a99db986f3`.
+
+The forty-fifth v2 unit follows a fresh JetStream Gaussian Blur profile into
+TypedArray representation. The five spec-internal view slots for kind, backing
+buffer, byte offset, fixed length, and length tracking previously lived as
+hidden string-keyed object properties. Each indexed access therefore repeated
+property-map hashing and descriptor cloning before reading or writing bytes;
+scripts that guessed the NUL-prefixed keys could also delete or overwrite the
+metadata. Typed arrays now store one immutable slot record in the object's
+existing lazily allocated cold data. Ordinary objects gain no hot-layout field,
+while all TypedArray helpers read the record directly and continue to query the
+backing buffer for live detached and resizable state. A focused test proves
+that deleting or forging the old string keys cannot change a real Int16Array's
+brand, element value, or element width. No workload name, source path,
+iteration count, checksum, or expected benchmark value appears in the
+implementation.
+
+Against base binary SHA-256
+`aebef9ebc2a8805c530888ca412c9a21febf94e55350874ce1fefab1918f7680`,
+candidate binary SHA-256
+`d2bda569d41560a1e00607163a0fe5f258d2c46257b8ae362231d0e02fa093f7`
+cut JetStream `gaussian-blur` to 0.515644x base. Complete one-block candidate
+and same-window base external previews retained identical coverage at 5/5
+JetStream, 11/14 Kraken, and 23/26 SunSpider. Common-case candidate/base suite
+geometric means were 0.878084x, 1.004602x, and 1.000667x; the non-target suite
+movements were neutral, and the complete broad diagnostic below did not
+reproduce the short `json-parse-financial` outlier. Candidate/QuickJS-NG still
+failed B5 at 8.001698x, 4.671355x, and 6.202666x. Candidate external raw/report
+SHA-256 are
+`9c1153991587be3a76c1f06f22fe2a6c0084e892a7b42a2669d39fb5370c5f4e`
+and `7f51336e473b1a37b56917449c25c607e74e7fc893e7e6ebd0b27532709d9194`;
+base raw/report SHA-256 are
+`7ccd6895ac6437fdec87a2711d5ea8be2cf6339a242123cc48fe616208bada1f`
+and `c0a4d391b07a81935cc7bffab85ee20bc293d53b0fbce1d51d87498dde4b81ed`.
+
+The complete three-role broad development diagnostic produced 225/225
+eligible exact-checksum measurements, zero non-OK samples, and 600 linearity
+samples with all 75 engine/case pairs passing. Candidate/base was 0.999558x
+overall; family ratios ranged from 0.983997x for string through 1.003190x for
+allocation, and the worst case was 1.008119x. Candidate/QuickJS-NG was
+0.194814x overall, but allocation still failed B4 at 1.145679x. The strict
+analyzer correctly rejected the receipt-less dirty development binaries, so
+this is regression evidence rather than a fixed-hardware claim. Broad raw
+SHA-256: `d42ede2ad98dd0866348e2c2b9a3007f35aeb276bd80cd6615dbb44816d477dd`.
+This representation change materially improves an external typed-array
+workload while preserving the non-target regression guard; B4 and B5 remain
+active.
+
 ## Historical Broad V1 Baseline
 
 The first complete baseline was recorded on 2026-07-15 at commit