fix(string): make codePointAt and slice linear on non-ASCII strings — native tsc 658 s -> 7.8 s (#10656, #10685)

changelog.d/10656-codepointat-linear.md

@@ -0,0 +1,5 @@
+`String.prototype.codePointAt` is no longer O(n) per call on strings containing
+non-ASCII characters. It now uses the same lazy UTF-16 index `charCodeAt` and
+bracket indexing were moved to in #10067, so a sequential scan is linear rather
+than quadratic. A natively compiled `tsc` goes from 658 s to 85 s on a two-line
+input (#10656).

changelog.d/10685-slice-linear.md

@@ -0,0 +1,5 @@
+`String.prototype.substring` / `slice` / `substr` no longer walk from byte 0 to
+resolve their start offset on strings containing non-ASCII characters. They now
+use the same lazy UTF-16 index the other accessors use, so slicing at increasing
+offsets — every tokenizer's access pattern — is linear rather than quadratic. A
+natively compiled `tsc` goes from 85 s to 7.8 s (#10685).

changelog.d/10688-per-string-index.md

@@ -0,0 +1,6 @@
+The UTF-16 index no longer lives in a fixed four-slot cache that evicted
+round-robin. Interleaving indexed access across more strings than it held
+rebuilt the index from scratch on every access — 1,224x slower from the fifth
+string onward, as a step function. Entries now live until their string dies and
+are reclaimed by the collector's existing prune hook, so the cliff cannot occur
+at any number of strings (#10688).

changelog.d/10694-array-index-gate.md

@@ -0,0 +1,5 @@
+Plain-array element reads and writes no longer probe the buffer and typed-array
+registries. A `GC_TYPE_ARRAY` header can never be either, and the iteration
+helpers already gated on that; the indexing path did not. On a `tsc --noEmit`
+of a two-line file this halves `is_registered_buffer` probes, 79.7M to 39.8M
+(#10694).

crates/perry-runtime/src/array/indexing.rs

@@ -86,8 +86,9 @@ pub(crate) fn array_iteration_is_exotic(arr: *const ArrayHeader) -> bool {
     if arr.is_null() {
         return false;
     }
-    if crate::buffer::is_registered_buffer(arr as usize)
-        || crate::typedarray::lookup_typed_array_kind(arr as usize).is_some()
+    if super::header::receiver_may_be_registered_exotic(arr as *const ArrayHeader)
+        && (crate::buffer::is_registered_buffer(arr as usize)
+            || crate::typedarray::lookup_typed_array_kind(arr as usize).is_some())
     {
         return true;
     }
@@ -119,8 +120,9 @@ pub(crate) unsafe fn array_iteration_is_exotic_cleaned(
     arr: *const ArrayHeader,
     flags: u16,
 ) -> bool {
-    if crate::buffer::is_registered_buffer(arr as usize)
-        || crate::typedarray::lookup_typed_array_kind(arr as usize).is_some()
+    if super::header::receiver_may_be_registered_exotic(arr as *const ArrayHeader)
+        && (crate::buffer::is_registered_buffer(arr as usize)
+            || crate::typedarray::lookup_typed_array_kind(arr as usize).is_some())
     {
         return true;
     }
@@ -606,18 +608,30 @@ pub extern "C" fn js_array_get_f64(arr: *const ArrayHeader, index: u32) -> f64 {
         return f64::NAN;
     }
     let arr = cleaned;
-    // Check if this is actually a TypedArray — dispatch through typed array helper
-    if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
-        return crate::typedarray::js_typed_array_get(
-            arr as *const crate::typedarray::TypedArrayHeader,
-            index as i32,
-        );
-    }
-    // Check if this is actually a buffer (Uint8Array) — read individual bytes
-    if crate::buffer::is_registered_buffer(arr as usize) {
-        let byte_val =
-            crate::buffer::js_buffer_get(arr as *const crate::buffer::BufferHeader, index as i32);
-        return byte_val as f64;
+    // #10694: a `GC_TYPE_ARRAY` header can never be a registered buffer or
+    // typed array — every registration carries its own GC object type — so a
+    // plain array must not pay the thread-local registry probes. The
+    // iteration helpers already gate on this; the indexing path did not, and
+    // on a `tsc --noEmit` of a two-line file that cost **79.7 M**
+    // `is_registered_buffer` probes for a process that registers **9**
+    // buffers, hitting 90 times. One already-warm GC-header byte read and an
+    // integer compare replace them.
+    if super::header::receiver_may_be_registered_exotic(arr) {
+        // Check if this is actually a TypedArray — dispatch through typed array helper
+        if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
+            return crate::typedarray::js_typed_array_get(
+                arr as *const crate::typedarray::TypedArrayHeader,
+                index as i32,
+            );
+        }
+        // Check if this is actually a buffer (Uint8Array) — read individual bytes
+        if crate::buffer::is_registered_buffer(arr as usize) {
+            let byte_val = crate::buffer::js_buffer_get(
+                arr as *const crate::buffer::BufferHeader,
+                index as i32,
+            );
+            return byte_val as f64;
+        }
     }
     // The usual case cleans to the same address, so reuse the header tag read
     // above. A forwarded Array resolves to a different address and needs its
@@ -794,23 +808,33 @@ pub extern "C" fn js_array_set_f64(arr: *mut ArrayHeader, index: u32, value: f64
     if arr.is_null() {
         return;
     }
-    // Check if this is actually a buffer (Uint8Array) — write individual bytes
-    if crate::buffer::is_registered_buffer(arr as usize) {
-        crate::buffer::js_buffer_set(
-            arr as *mut crate::buffer::BufferHeader,
-            index as i32,
-            value as i32,
-        );
-        return;
-    }
-    // Check if this is a typed array — route through per-kind store.
-    if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
-        crate::typedarray::js_typed_array_set(
-            arr as *mut crate::typedarray::TypedArrayHeader,
-            index as i32,
-            value,
-        );
-        return;
+    // #10694: a `GC_TYPE_ARRAY` header can never be a registered buffer or
+    // typed array — every registration carries its own GC object type — so a
+    // plain array must not pay the thread-local registry probes. The
+    // iteration helpers already gate on this; the indexing path did not, and
+    // on a `tsc --noEmit` of a two-line file that cost **79.7 M**
+    // `is_registered_buffer` probes for a process that registers **9**
+    // buffers, hitting 90 times. One already-warm GC-header byte read and an
+    // integer compare replace them.
+    if super::header::receiver_may_be_registered_exotic(arr) {
+        // Check if this is actually a buffer (Uint8Array) — write individual bytes
+        if crate::buffer::is_registered_buffer(arr as usize) {
+            crate::buffer::js_buffer_set(
+                arr as *mut crate::buffer::BufferHeader,
+                index as i32,
+                value as i32,
+            );
+            return;
+        }
+        // Check if this is a typed array — route through per-kind store.
+        if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
+            crate::typedarray::js_typed_array_set(
+                arr as *mut crate::typedarray::TypedArrayHeader,
+                index as i32,
+                value,
+            );
+            return;
+        }
     }
     // SAFETY: the clean above resolved this exact plain-array head; the
     // Buffer/TypedArray exits precede this direct header read.
@@ -857,8 +881,9 @@ pub extern "C" fn js_array_set_f64(arr: *mut ArrayHeader, index: u32, value: f64
 pub(crate) fn array_strict_index_write_guard(arr: *mut ArrayHeader, index: u32) {
     let clean = clean_arr_ptr_mut(arr);
     if clean.is_null()
-        || crate::buffer::is_registered_buffer(clean as usize)
-        || crate::typedarray::lookup_typed_array_kind(clean as usize).is_some()
+        || (super::header::receiver_may_be_registered_exotic(clean as *const ArrayHeader)
+            && (crate::buffer::is_registered_buffer(clean as usize)
+                || crate::typedarray::lookup_typed_array_kind(clean as usize).is_some()))
     {
         return;
     }
@@ -1236,8 +1261,9 @@ fn js_array_set_f64_extend_strict_impl(
     }
     let clean = clean_arr_ptr_mut(arr);
     if clean.is_null()
-        || crate::buffer::is_registered_buffer(clean as usize)
-        || crate::typedarray::lookup_typed_array_kind(clean as usize).is_some()
+        || (super::header::receiver_may_be_registered_exotic(clean as *const ArrayHeader)
+            && (crate::buffer::is_registered_buffer(clean as usize)
+                || crate::typedarray::lookup_typed_array_kind(clean as usize).is_some()))
     {
         // Preserve the existing polymorphic/subclass behavior on receivers
         // that are not live plain arrays. These are cold and cannot use the
@@ -1463,23 +1489,27 @@ pub extern "C" fn js_array_set_f64_extend(
         return js_array_alloc(0);
     }
     let arr = cleaned;
-    // Check if this is actually a buffer (Uint8Array) — write individual bytes
-    if crate::buffer::is_registered_buffer(arr as usize) {
-        crate::buffer::js_buffer_set(
-            arr as *mut crate::buffer::BufferHeader,
-            index as i32,
-            value as i32,
-        );
-        return arr;
-    }
-    // Check if this is a typed array — route through per-kind store (no extension).
-    if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
-        crate::typedarray::js_typed_array_set(
-            arr as *mut crate::typedarray::TypedArrayHeader,
-            index as i32,
-            value,
-        );
-        return arr;
+    // #10694: skip both registry probes for a `GC_TYPE_ARRAY` header, which
+    // can never be a registered buffer or typed array.
+    if super::header::receiver_may_be_registered_exotic(arr) {
+        // Check if this is actually a buffer (Uint8Array) — write individual bytes
+        if crate::buffer::is_registered_buffer(arr as usize) {
+            crate::buffer::js_buffer_set(
+                arr as *mut crate::buffer::BufferHeader,
+                index as i32,
+                value as i32,
+            );
+            return arr;
+        }
+        // Check if this is a typed array — route through per-kind store (no extension).
+        if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
+            crate::typedarray::js_typed_array_set(
+                arr as *mut crate::typedarray::TypedArrayHeader,
+                index as i32,
+                value,
+            );
+            return arr;
+        }
     }
     // SAFETY: the clean above resolved this live plain-array head, and the
     // compatible Buffer/TypedArray receivers have exited.

crates/perry-runtime/src/string/char_ops.rs

@@ -104,6 +104,14 @@ fn utf16_unit_at(s: *const StringHeader, idx: usize) -> Option<u16> {
     utf16_index::unit_at(s, idx)
 }
 
+/// Byte offset of the code point containing UTF-16 index `idx`, plus whether
+/// `idx` is its low surrogate half, resolved through the same cached index.
+/// `None` means the caller should fall back to its own walk (short payloads,
+/// `idx == 0`, or an index past the last decodable unit).
+pub(super) fn utf16_boundary_at(s: *const StringHeader, idx: usize) -> Option<(usize, bool)> {
+    utf16_index::boundary_at(s, idx)
+}
+
 /// SSO-safe `s[key]`: takes the receiver as a **NaN-boxed JSValue** rather than
 /// an already-unboxed `StringHeader*`.
 ///
@@ -695,26 +703,45 @@ pub extern "C" fn js_string_code_point_at(s: *const StringHeader, index: i32) ->
         }
     }
 
-    // Non-ASCII: bounded WTF-8 walk (#6085) — the old `str_data.chars()` loop
-    // read continuation bytes past an exact-sized payload ending in a truncated
-    // multi-byte lead. Allocation-free either way.
-    let bytes = unsafe { slice::from_raw_parts(string_data(s), (*s).byte_len as usize) };
-    let mut utf16_pos = 0usize;
-    let mut i = 0usize;
-    while i < bytes.len() {
-        let (advance, units, cp) = crate::string::wtf8_step(bytes, i);
-        if units > 0 && utf16_pos + units > idx {
-            if units == 1 || utf16_pos == idx {
-                // Either a BMP code point, or the START of a surrogate pair —
-                // which per spec is the whole code point.
-                return cp as f64;
-            }
-            // Index lands on the low surrogate half — return the bare unit.
-            let v = cp.wrapping_sub(0x10000);
-            return (0xDC00 + (v & 0x3FF)) as f64;
+    // Non-ASCII: go through the same lazy sparse index + cursor `charCodeAt`
+    // uses (#10055/#10067). This function used to walk the WTF-8 payload from
+    // byte 0 on every call, so a sequential scan over a string holding even one
+    // non-ASCII character was O(n^2) — #10656. `charCodeAt` and `s[i]` were
+    // moved off that walk by #10067; `codePointAt` was left on it, which is why
+    // a natively compiled `tsc` spent ~85% of its run in this function
+    // (`lib.dom.d.ts` carries 45 non-ASCII characters in 1.87 MB).
+    //
+    // No bespoke decoding is needed: `codePointAt` is *defined* on code units,
+    // so the spec algorithm is two indexed reads. `unit_at` keeps the bounded
+    // WTF-8 stepping that #6085 needs, so the truncated-payload guarantee is
+    // preserved — a missing continuation byte still decodes from what is
+    // present rather than over-reading.
+    let first = match utf16_unit_at(s, idx) {
+        Some(unit) => unit,
+        None => return f64::from_bits(crate::value::TAG_UNDEFINED),
+    };
+    // A lone/low surrogate, a BMP code point, or a leading surrogate with
+    // nothing after it: the unit is the answer.
+    if !is_leading_surrogate(first) || idx + 1 >= u16len {
+        return first as f64;
+    }
+    match utf16_unit_at(s, idx + 1) {
+        Some(second) if is_trailing_surrogate(second) => {
+            let high = (first as u32 - 0xD800) << 10;
+            let low = second as u32 - 0xDC00;
+            (0x10000 + high + low) as f64
         }
-        utf16_pos += units;
-        i += advance;
+        // Unpaired leading surrogate — per spec the code unit itself.
+        _ => first as f64,
     }
-    f64::from_bits(crate::value::TAG_UNDEFINED)
+}
+
+#[inline]
+fn is_leading_surrogate(unit: u16) -> bool {
+    (0xD800..0xDC00).contains(&unit)
+}
+
+#[inline]
+fn is_trailing_surrogate(unit: u16) -> bool {
+    (0xDC00..0xE000).contains(&unit)
 }