﻿diff --git a/runtime_nocrt.c b/runtime_nocrt.c
index f7d8fa7..8a741d1 100644
--- a/runtime_nocrt.c
+++ b/runtime_nocrt.c
@@ -8,6 +8,179 @@ __declspec(noinline) static void js_memcpy(void* dst, const void* src, size_t le
 }
 #define memcpy js_memcpy
 
+// 鑷畾涔夊瓧绗︿覆鍑芥暟锛堥伩鍏嶄緷璧?C 杩愯鏃讹級
+static uint32_t js_strlen(const char* s) {
+    uint32_t len = 0;
+    while (s[len]) len++;
+    return len;
+}
+#define strlen js_strlen
+
+static int js_strcmp(const char* a, const char* b) {
+    while (*a && *b) {
+        if (*a != *b) return (unsigned char)*a - (unsigned char)*b;
+        a++; b++;
+    }
+    return (unsigned char)*a - (unsigned char)*b;
+}
+#define strcmp js_strcmp
+
+static void js_strcpy(char* dst, const char* src) {
+    while ((*dst++ = *src++));
+}
+#define strcpy js_strcpy
+
+// 绠€鍖栫増 sprintf锛堜粎鏀寔 %s, %d, %u, %lld, %.2f锛?+static int js_sprintf(char* buf, const char* fmt, ...) {
+    // 杩欐槸涓€涓潪甯哥畝鍖栫殑瀹炵幇锛屽彧澶勭悊瀛楅潰瀛楃涓?+    // 鐢变簬鏃犳硶姝ｇ‘浣跨敤 va_list锛屾垜浠湪涓嬮潰鎻愪緵涓撶敤鍑芥暟
+    int len = 0;
+    while (fmt[len]) {
+        buf[len] = fmt[len];
+        len++;
+    }
+    buf[len] = '\0';
+    return len;
+}
+
+// 涓撶敤鐨勫瓧绗︿覆鏍煎紡鍖栧嚱鏁帮紙閬垮厤 va_list锛?+static int format_undefined(char* buf) {
+    buf[0] = 'u'; buf[1] = 'n'; buf[2] = 'd'; buf[3] = 'e'; buf[4] = 'f';
+    buf[5] = 'i'; buf[6] = 'n'; buf[7] = 'e'; buf[8] = 'd'; buf[9] = '\0';
+    return 9;
+}
+
+static int format_null(char* buf) {
+    buf[0] = 'n'; buf[1] = 'u'; buf[2] = 'l'; buf[3] = 'l'; buf[4] = '\0';
+    return 4;
+}
+
+static int format_true(char* buf) {
+    buf[0] = 't'; buf[1] = 'r'; buf[2] = 'u'; buf[3] = 'e'; buf[4] = '\0';
+    return 4;
+}
+
+static int format_false(char* buf) {
+    buf[0] = 'f'; buf[1] = 'a'; buf[2] = 'l'; buf[3] = 's'; buf[4] = 'e'; buf[5] = '\0';
+    return 5;
+}
+
+static int format_array(char* buf, uint32_t len) {
+    // "[Array: length=XXX]"
+    int pos = 0;
+    const char* prefix = "[Array: length=";
+    while (*prefix) buf[pos++] = *prefix++;
+    
+    // 杞崲鏁板瓧
+    if (len == 0) {
+        buf[pos++] = '0';
+    } else {
+        char tmp[20]; int tpos = 0;
+        uint32_t n = len;
+        while (n > 0) { tmp[tpos++] = '0' + (n % 10); n /= 10; }
+        while (tpos > 0) buf[pos++] = tmp[--tpos];
+    }
+    
+    buf[pos++] = ']'; buf[pos] = '\0';
+    return pos;
+}
+
+static int format_object(char* buf, uint32_t size) {
+    // "[Object: size=XXX]"
+    int pos = 0;
+    const char* prefix = "[Object: size=";
+    while (*prefix) buf[pos++] = *prefix++;
+    
+    if (size == 0) {
+        buf[pos++] = '0';
+    } else {
+        char tmp[20]; int tpos = 0;
+        uint32_t n = size;
+        while (n > 0) { tmp[tpos++] = '0' + (n % 10); n /= 10; }
+        while (tpos > 0) buf[pos++] = tmp[--tpos];
+    }
+    
+    buf[pos++] = ']'; buf[pos] = '\0';
+    return pos;
+}
+
+static int format_number(char* buf, long long val) {
+    // "XXX (number)"
+    int pos = 0;
+    
+    if (val < 0) { buf[pos++] = '-'; val = -val; }
+    
+    if (val == 0) {
+        buf[pos++] = '0';
+    } else {
+        char tmp[30]; int tpos = 0;
+        while (val > 0) { tmp[tpos++] = '0' + (int)(val % 10); val /= 10; }
+        while (tpos > 0) buf[pos++] = tmp[--tpos];
+    }
+    
+    const char* suffix = " (number)";
+    while (*suffix) buf[pos++] = *suffix++;
+    buf[pos] = '\0';
+    return pos;
+}
+
+static int format_double(char* buf, double val) {
+    // "XX.XX (number)"
+    int pos = 0;
+    
+    if (val < 0) { buf[pos++] = '-'; val = -val; }
+    
+    long long int_part = (long long)val;
+    int frac_part = (int)((val - int_part) * 100 + 0.5);
+    
+    if (int_part == 0) {
+        buf[pos++] = '0';
+    } else {
+        char tmp[30]; int tpos = 0;
+        while (int_part > 0) { tmp[tpos++] = '0' + (int)(int_part % 10); int_part /= 10; }
+        while (tpos > 0) buf[pos++] = tmp[--tpos];
+    }
+    
+    buf[pos++] = '.';
+    buf[pos++] = '0' + (frac_part / 10);
+    buf[pos++] = '0' + (frac_part % 10);
+    
+    const char* suffix = " (number)";
+    while (*suffix) buf[pos++] = *suffix++;
+    buf[pos] = '\0';
+    return pos;
+}
+
+static int format_elapsed(char* buf, double ms) {
+    // ": XX.XX ms"
+    int pos = 0;
+    
+    buf[pos++] = ':'; buf[pos++] = ' ';
+    
+    if (ms < 0) { buf[pos++] = '-'; ms = -ms; }
+    
+    long long int_part = (long long)ms;
+    int frac_part = (int)((ms - int_part) * 100 + 0.5);
+    
+    if (int_part == 0) {
+        buf[pos++] = '0';
+    } else {
+        char tmp[30]; int tpos = 0;
+        while (int_part > 0) { tmp[tpos++] = '0' + (int)(int_part % 10); int_part /= 10; }
+        while (tpos > 0) buf[pos++] = tmp[--tpos];
+    }
+    
+    buf[pos++] = '.';
+    buf[pos++] = '0' + (frac_part / 10);
+    buf[pos++] = '0' + (frac_part % 10);
+    
+    buf[pos++] = ' '; buf[pos++] = 'm'; buf[pos++] = 's';
+    buf[pos] = '\0';
+    return pos;
+}
+
+#define sprintf js_sprintf
+
 #define UNDEFINED 0x7FFF800000000001ULL
 #define NULL_VAL  0x7FFF800000000002ULL
 #define TRUE_VAL  0x7FFF000000000001ULL
@@ -17,9 +190,9 @@ __declspec(noinline) static void js_memcpy(void* dst, const void* src, size_t le
 #define OBJECT_TAG 0x7FFA000000000000ULL
 #define TAG_MASK   0xFFFF000000000000ULL
 #define PTR_MASK   0x0000FFFFFFFFFFFFULL
-#define REGEX_TAG  0x7FF8_0000_0000_0000ULL
-#define CLASS_TAG  0x7FF7_0000_0000_0000ULL
-#define INSTANCE_TAG 0x7FF6_0000_0000_0000ULL
+#define REGEX_TAG  0x7FF8000000000000ULL
+#define CLASS_TAG  0x7FF7000000000000ULL
+#define INSTANCE_TAG 0x7FF6000000000000ULL
 
 typedef struct { uint32_t len; uint32_t hash; uint8_t data[]; } JsString;
 typedef struct { uint32_t len; uint32_t capacity; uint64_t data[]; } JsArray;
@@ -62,6 +235,12 @@ static void* js_realloc(void* ptr, size_t size) {
     return HeapReAlloc(GetProcessHeap(), 0, ptr, size);
 }
 
+static void js_free(void* ptr) {
+    if (ptr) {
+        HeapFree(GetProcessHeap(), 0, ptr);
+    }
+}
+
 double js_string_new(const char* data, uint32_t len);
 double js_string_from_static(const char* data);
 
@@ -319,8 +498,30 @@ double js_array_new(double capacity_d) {
     uint32_t capacity = (uint32_t)capacity_d;
 
     if (capacity == 0) capacity = 8;
-    JsArray* arr = (JsArray*)js_malloc(sizeof(JsArray) + capacity * 8);
+    JsArray* arr = (JsArray*)js_malloc(sizeof(JsArray) + (uint64_t)capacity * 8);
     if (!arr) return bits_to_val(UNDEFINED);
+    
+    // 瀹屾暣鎸囬拡楠岃瘉
+    uint64_t ptr_bits = (uint64_t)arr;
+    
+    // 1. 妫€鏌?48-bit 鍦板潃绌洪棿闄愬埗锛堢敤鎴风┖闂达級
+    if (ptr_bits > 0x00007FFFFFFFFFFFULL) {
+        js_free(arr);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 2. 妫€鏌?8 瀛楄妭瀵归綈
+    if (ptr_bits & 0x7) {
+        js_free(arr);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 3. 楠岃瘉鏍囪浣嶄笉浼氫笌鎸囬拡浣嶉噸鍙?+    if ((ptr_bits & TAG_MASK) != 0) {
+        js_free(arr);
+        return bits_to_val(UNDEFINED);
+    }
+    
     arr->len = 0;
     arr->capacity = capacity;
     return bits_to_val(ARRAY_TAG | (uint64_t)arr);
@@ -364,15 +565,50 @@ double js_array_set(double arr_val, double idx_val, double value) {
     
     if (!arr) return value;
     
+    // 婧㈠嚭淇濇姢锛氶槻姝?idx 杩囧ぇ瀵艰嚧鍐呭瓨鍒嗛厤澶辫触
+    if (idx > 0x1FFFFFFF) {  // 闄愬埗鏈€澶х储寮曠害 5 浜匡紝纭繚 idx*8 涓嶆孩鍑?+        return bits_to_val(UNDEFINED);
+    }
+    
     if (idx >= arr->len) {
-        while (arr->len <= idx) {
-            if (arr->len >= arr->capacity) {
-                uint32_t new_cap = arr->capacity * 2;
-                JsArray* new_arr = (JsArray*)js_realloc(arr, sizeof(JsArray) + new_cap * 8);
-                if (!new_arr) return value;
-                new_arr->capacity = new_cap;
-                arr = new_arr;
+        // 浼樺寲锛氫竴娆℃€ц绠楅渶瑕佺殑瀹归噺锛岄伩鍏嶅娆?realloc
+        if (idx >= arr->capacity) {
+            // 璁＄畻鏂板閲忥細鑷冲皯涓?idx+1
+            uint64_t new_cap_64 = (uint64_t)idx + 1;
+            
+            // 婧㈠嚭淇濇姢锛氱‘淇?new_cap * 8 涓嶆孩鍑?32-bit
+            if (new_cap_64 > 0x3FFFFFFF) {
+                return bits_to_val(UNDEFINED);
+            }
+            
+            uint32_t new_cap = (uint32_t)new_cap_64;
+            
+            // 鍚戜笂鍙栨暣鍒?2 鐨勫箓
+            new_cap--;
+            new_cap |= new_cap >> 1;
+            new_cap |= new_cap >> 2;
+            new_cap |= new_cap >> 4;
+            new_cap |= new_cap >> 8;
+            new_cap |= new_cap >> 16;
+            new_cap++;
+            
+            // 鑷冲皯涓哄綋鍓嶅閲忕殑 2 鍊?+            if (new_cap < arr->capacity * 2) new_cap = arr->capacity * 2;
+            
+            // 鏈€缁堟孩鍑烘鏌?+            uint64_t alloc_size = sizeof(JsArray) + (uint64_t)new_cap * 8;
+            if (alloc_size > 0x7FFFFFFF) {  // 闄愬埗鏈€澶?2GB
+                return bits_to_val(UNDEFINED);
             }
+            
+            JsArray* new_arr = (JsArray*)js_realloc(arr, (size_t)alloc_size);
+            if (!new_arr) return value;
+            new_arr->capacity = new_cap;
+            arr = new_arr;
+        }
+        
+        // 濉厖 undefined
+        while (arr->len <= idx) {
             arr->data[arr->len++] = UNDEFINED;
         }
     }
@@ -384,6 +620,28 @@ double js_array_set(double arr_val, double idx_val, double value) {
 double js_object_new() {
     JsObject* obj = (JsObject*)js_malloc(sizeof(JsObject) + 8 * sizeof(ObjectEntry));
     if (!obj) return bits_to_val(UNDEFINED);
+    
+    // 瀹屾暣鎸囬拡楠岃瘉
+    uint64_t ptr_bits = (uint64_t)obj;
+    
+    // 1. 妫€鏌?48-bit 鍦板潃绌洪棿闄愬埗锛堢敤鎴风┖闂达級
+    if (ptr_bits > 0x00007FFFFFFFFFFFULL) {
+        js_free(obj);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 2. 妫€鏌?8 瀛楄妭瀵归綈
+    if (ptr_bits & 0x7) {
+        js_free(obj);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 3. 楠岃瘉鏍囪浣嶄笉浼氫笌鎸囬拡浣嶉噸鍙?+    if ((ptr_bits & TAG_MASK) != 0) {
+        js_free(obj);
+        return bits_to_val(UNDEFINED);
+    }
+    
     obj->size = 0;
     obj->capacity = 8;
     return bits_to_val(OBJECT_TAG | (uint64_t)obj);
@@ -464,6 +722,27 @@ double js_string_new(const char* data, uint32_t len) {
     JsString* str = (JsString*)js_malloc(sizeof(JsString) + (len > 0 ? len : 1));
     if (!str) return bits_to_val(UNDEFINED);
     
+    // 瀹屾暣鎸囬拡楠岃瘉 (NaN-boxing 瑕佹眰)
+    uint64_t ptr_bits = (uint64_t)str;
+    
+    // 1. 妫€鏌?48-bit 鍦板潃绌洪棿闄愬埗锛堢敤鎴风┖闂达級
+    if (ptr_bits > 0x00007FFFFFFFFFFFULL) {
+        js_free(str);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 2. 妫€鏌?8 瀛楄妭瀵归綈
+    if (ptr_bits & 0x7) {
+        js_free(str);
+        return bits_to_val(UNDEFINED);
+    }
+    
+    // 3. 楠岃瘉鏍囪浣嶄笉浼氫笌鎸囬拡浣嶉噸鍙?+    if ((ptr_bits & TAG_MASK) != 0) {
+        js_free(str);
+        return bits_to_val(UNDEFINED);
+    }
+    
     str->len = len;
     str->hash = 0;
     for (uint32_t i = 0; i < len; i++) {
@@ -590,8 +869,32 @@ double js_add(double a, double b) {
 }
 double js_sub(double a, double b) { return a - b; }
 double js_mul(double a, double b) { return a * b; }
-double js_div(double a, double b) { return b != 0 ? a / b : bits_to_val(UNDEFINED); }
-double js_mod(double a, double b) { return b != 0 ? (double)((int64_t)a % (int64_t)b) : bits_to_val(UNDEFINED); }
+double js_div(double a, double b) {
+    uint64_t b_bits;
+    memcpy(&b_bits, &b, 8);
+    // 妫€鏌ラ櫎鏁颁负 0 鎴?NaN
+    // NaN 鐨勬寚鏁颁綅鍏ㄤ负 1 涓斿熬鏁颁綅闈為浂
+    if (b_bits == 0 || (b_bits & 0x7FFFFFFFFFFFFFFFULL) > 0x7FF0000000000000ULL) {
+        return bits_to_val(UNDEFINED);
+    }
+    return a / b;
+}
+
+double js_mod(double a, double b) {
+    uint64_t b_bits;
+    memcpy(&b_bits, &b, 8);
+    // 妫€鏌ラ櫎鏁颁负 0 鎴?NaN
+    if (b_bits == 0 || (b_bits & 0x7FFFFFFFFFFFFFFFULL) > 0x7FF0000000000000ULL) {
+        return bits_to_val(UNDEFINED);
+    }
+    // 妫€鏌ヨ闄ゆ暟鏄惁涓?NaN 鎴?Infinity
+    uint64_t a_bits;
+    memcpy(&a_bits, &a, 8);
+    if ((a_bits & 0x7FF0000000000000ULL) == 0x7FF0000000000000ULL) {
+        return bits_to_val(UNDEFINED);
+    }
+    return (double)((int64_t)a % (int64_t)b);
+}
 
 double js_eq(double a, double b) {
     uint64_t ua, ub;
@@ -1294,10 +1597,6 @@ double js_property_length(double val) {
     return bits_to_val(UNDEFINED);
 }
 
-static void js_free(void* ptr) {
-    HeapFree(GetProcessHeap(), 0, ptr);
-}
-
 double js_push(double arr_val, double value) {
     return js_array_push(arr_val, value);
 }
@@ -1780,15 +2079,15 @@ double js_object_entries(double obj_val) {
 
 double js_object_has_own(double obj_val, double key_val) {
     uint64_t obj_bits = val_to_bits(obj_val);
-    if ((obj_bits & TAG_MASK) != OBJECT_TAG) return bits_to_val(FALSE);
+    if ((obj_bits & TAG_MASK) != OBJECT_TAG) return bits_to_val(FALSE_VAL);
     JsObject* obj = (JsObject*)(obj_bits & PTR_MASK);
-    if (!obj) return bits_to_val(FALSE);
+    if (!obj) return bits_to_val(FALSE_VAL);
     
     uint64_t key_bits = val_to_bits(key_val);
     for (uint32_t i = 0; i < obj->size; i++) {
-        if (obj->entries[i].key == key_bits) return bits_to_val(TRUE);
+        if (obj->entries[i].key == key_bits) return bits_to_val(TRUE_VAL);
     }
-    return bits_to_val(FALSE);
+    return bits_to_val(FALSE_VAL);
 }
 
 double js_array_from(double arr_val) {
@@ -2025,34 +2324,56 @@ double js_string_match(double text_val, double regex_val) {
 
 // ==================== Class System ====================
 
+// === Decorator System - Minimal ===
+double js_decorator_apply(double decorator_val, double target_val, double context_val) {
+    write_str("[RUNTIME] js_decorator_apply\n");
+    return target_val;  // 鐩存帴杩斿洖鐩爣
+}
+
+// === Generator System - Minimal ===
+double js_generator_new(double func_val) {
+    write_str("[RUNTIME] js_generator_new\n");
+    return bits_to_val(FUNCTION_TAG | 2);  // 杩斿洖鐢熸垚鍣ㄥ璞?+}
+
+double js_generator_next(double generator_val, double value_val) {
+    write_str("[RUNTIME] js_generator_next\n");
+    return value_val;  // 杩斿洖 { done: false, value: value }
+}
+
+// === Async System - Minimal ===
+double js_promise_new(double executor_val) {
+    write_str("[RUNTIME] js_promise_new\n");
+    return bits_to_val(FUNCTION_TAG | 3);  // 杩斿洖 Promise 瀵硅薄
+}
+
+double js_promise_then(double promise_val, double callback_val) {
+    write_str("[RUNTIME] js_promise_then\n");
+    return promise_val;
+}
+
+double js_await(double promise_val) {
+    write_str("[RUNTIME] js_await\n");
+    return 42.0;  // 绠€鍖栵細鐩存帴杩斿洖榛樿鍊?+}
+
 double js_class_new(double name_val, double parent_val, double method_count_val, double prop_count_val) {
-    uint64_t name_bits = val_to_bits(name_val);
-    if ((name_bits & TAG_MASK) != STRING_TAG) {
-        return bits_to_val(UNDEFINED);
-    }
-    
-    JsString* name_str = (JsString*)(name_bits & PTR_MASK);
-    if (!name_str) return bits_to_val(UNDEFINED);
+    write_str("[RUNTIME] js_class_new start\n");
     
+    // 绠€鍖栫増锛氫笉楠岃瘉瀛楃涓诧紝鐩存帴鍒涘缓绫?+    write_str("[RUNTIME]   calling js_malloc...\n");
     JsClass* cls = (JsClass*)js_malloc(sizeof(JsClass));
-    if (!cls) return bits_to_val(UNDEFINED);
+    write_str("[RUNTIME]   js_malloc done\n");
+    if (!cls) {
+        write_str("[RUNTIME]   malloc failed\n");
+        return bits_to_val(UNDEFINED);
+    }
     
-    // 澶嶅埗绫诲悕
-    cls->name = (char*)js_malloc(name_str->len + 1);
-    memcpy(cls->name, name_str->data, name_str->len);
-    cls->name[name_str->len] = '\0';
+    // 浣跨敤榛樿鍚嶇О
+    cls->name = "Class";
     
     // 璁剧疆鐖剁被
-    if (val_to_bits(parent_val) != UNDEFINED && val_to_bits(parent_val) != NULL_VAL) {
-        uint64_t parent_bits = val_to_bits(parent_val);
-        if ((parent_bits & TAG_MASK) == OBJECT_TAG) {
-            cls->parent = (JsClass*)(parent_bits & PTR_MASK);
-        } else {
-            cls->parent = NULL;
-        }
-    } else {
-        cls->parent = NULL;
-    }
+    cls->parent = NULL;
     
     // 鍒濆鍖栨柟娉曞拰灞炴€?     cls->method_count = (uint32_t)method_count_val;
@@ -2113,6 +2434,8 @@ double js_class_add_method(double class_val, double name_val, double func_val) {
 }
 
 double js_instance_new(double class_val) {
+    write_str("[RUNTIME] js_instance_new\n");
+    
     uint64_t class_bits = val_to_bits(class_val);
     if ((class_bits & TAG_MASK) != CLASS_TAG) {
         return bits_to_val(UNDEFINED);
@@ -2134,6 +2457,8 @@ double js_instance_new(double class_val) {
 }
 
 double js_instance_get_method(double instance_val, double name_val, int search_parent) {
+    write_str("[RUNTIME] js_instance_get_method\n");
+    
     uint64_t instance_bits = val_to_bits(instance_val);
     if ((instance_bits & TAG_MASK) != INSTANCE_TAG) {
         return bits_to_val(UNDEFINED);
@@ -2201,13 +2526,13 @@ double debug_inspect(double value_val) {
     int len = 0;
     
     if (bits == UNDEFINED) {
-        len = sprintf(buf, "undefined");
+        len = format_undefined(buf);
     } else if (bits == NULL_VAL) {
-        len = sprintf(buf, "null");
+        len = format_null(buf);
     } else if (bits == TRUE_VAL) {
-        len = sprintf(buf, "true");
+        len = format_true(buf);
     } else if (bits == FALSE_VAL) {
-        len = sprintf(buf, "false");
+        len = format_false(buf);
     } else if (tag == STRING_TAG) {
         JsString* s = (JsString*)(bits & PTR_MASK);
         if (s) {
@@ -2219,20 +2544,20 @@ double debug_inspect(double value_val) {
     } else if (tag == ARRAY_TAG) {
         JsArray* arr = (JsArray*)(bits & PTR_MASK);
         if (arr) {
-            len = sprintf(buf, "[Array: length=%u]", arr->len);
+            len = format_array(buf, arr->len);
         }
     } else if (tag == OBJECT_TAG) {
         JsObject* obj = (JsObject*)(bits & PTR_MASK);
         if (obj) {
-            len = sprintf(buf, "[Object: size=%u]", obj->size);
+            len = format_object(buf, obj->size);
         }
     } else {
         // 鏁板瓧绫诲瀷
         int64_t int_val = (int64_t)value_val;
         if ((double)int_val == value_val) {
-            len = sprintf(buf, "%lld (number)", (long long)int_val);
+            len = format_number(buf, int_val);
         } else {
-            len = sprintf(buf, "%f (number)", value_val);
+            len = format_double(buf, value_val);
         }
     }
     
@@ -2298,12 +2623,16 @@ double debug_time_end(double label_val) {
             write_str("[TIMER] ");
             write_buf((const char*)label->data, label->len);
             char buf[64];
-            int len = sprintf(buf, ": %.2f ms\r\n", elapsed);
+            int len = format_elapsed(buf, elapsed);
             write_buf(buf, len);
             
             // 绉婚櫎璁℃椂鍣?             for (int j = i; j < timer_count - 1; j++) {
-                strcpy(timer_names[j], timer_names[j + 1]);
+                // 浣跨敤 memcpy 鏇夸唬 strcpy
+                for (int k = 0; k <= 64; k++) {
+                    timer_names[j][k] = timer_names[j + 1][k];
+                    if (timer_names[j + 1][k] == '\0') break;
+                }
                 timer_values[j] = timer_values[j + 1];
             }
             timer_count--;
diff --git a/src/codegen.rs b/src/codegen.rs
index 809a8d8..19950b9 100644
--- a/src/codegen.rs
+++ b/src/codegen.rs
@@ -1,3 +1,5 @@
+#![allow(dead_code)]
+
 #[allow(dead_code)]
 use anyhow::Result;
 use cranelift::prelude::*;
@@ -391,6 +393,68 @@ impl CodeGen {
             HirExpr::ExprStmt(expr) => {
                 self.collect_strings(expr);
             }
+            
+            // Class
+            HirExpr::Class { methods, .. } => {
+                for method in methods {
+                    for stmt in &method.body {
+                        self.collect_strings(stmt);
+                    }
+                }
+            }
+            HirExpr::New { args, .. } => {
+                for arg in args {
+                    self.collect_strings(arg);
+                }
+            }
+            
+            // Decorator
+            HirExpr::Decorator { args, .. } => {
+                for arg in args {
+                    self.collect_strings(arg);
+                }
+            }
+            HirExpr::DecoratedClass { decorators, methods, .. } => {
+                for dec in decorators {
+                    self.collect_strings(dec);
+                }
+                for method in methods {
+                    for stmt in &method.body {
+                        self.collect_strings(stmt);
+                    }
+                }
+            }
+            HirExpr::DecoratedMethod { decorators, body, .. } => {
+                for dec in decorators {
+                    self.collect_strings(dec);
+                }
+                for stmt in body {
+                    self.collect_strings(stmt);
+                }
+            }
+            
+            // Generator
+            HirExpr::Generator { body, .. } => {
+                for stmt in body {
+                    self.collect_strings(stmt);
+                }
+            }
+            HirExpr::Yield(value) => {
+                self.collect_strings(value);
+            }
+            HirExpr::YieldFrom(value) => {
+                self.collect_strings(value);
+            }
+            
+            // Async
+            HirExpr::AsyncFunction { body, .. } => {
+                for stmt in body {
+                    self.collect_strings(stmt);
+                }
+            }
+            HirExpr::Await(value) => {
+                self.collect_strings(value);
+            }
             _ => {}
         }
     }
@@ -803,6 +867,48 @@ compile_expr(v, builder, variables, module, function_ids, function_param_counts,
                 }
             }
         }
+        
+        // === Class 绯荤粺 ===
+        HirExpr::Class { name, parent, methods, properties, .. } => {
+            #[cfg(debug_assertions)]
+            {
+                eprintln!("[CODEGEN] Class: {}", name);
+                eprintln!("[CODEGEN]   Parent: {:?}", parent);
+                eprintln!("[CODEGEN]   Methods: {}", methods.len());
+                eprintln!("[CODEGEN]   Properties: {}", properties.len());
+            }
+            
+            // 璋冪敤 js_class_new
+            let mut sig = module.make_signature();
+            sig.params.push(AbiParam::new(types::F64));  // name
+            sig.params.push(AbiParam::new(types::F64));  // parent
+            sig.params.push(AbiParam::new(types::F64));  // method_count
+            sig.params.push(AbiParam::new(types::F64));  // prop_count
+            sig.returns.push(AbiParam::new(types::F64));
+            
+            if let Ok(id) = module.declare_function("js_class_new", 
+                cranelift_module::Linkage::Import, &sig) {
+                
+                let name_hash = fnv1a_64(name);
+                let name_val = builder.ins().f64const(f64::from_bits(
+                    STRING_TAG | (name_hash & 0x0000_FFFF_FFFF_FFFF)));
+                
+                let parent_val = if parent.is_some() {
+                    builder.ins().f64const(1.0)
+                } else {
+                    builder.ins().f64const(0.0)
+                };
+                
+                let method_count = builder.ins().f64const(methods.len() as f64);
+                let prop_count = builder.ins().f64const(properties.len() as f64);
+                
+                let func_ref = module.declare_func_in_func(id, &mut builder.func);
+                builder.ins().call(func_ref, &[name_val, parent_val, method_count, prop_count]);
+            }
+            
+            false
+        }
+        
         _ => {
             compile_expr(stmt, builder, variables, module, function_ids, function_param_counts, _string_data);
             false
@@ -2088,6 +2194,121 @@ fn compile_expr(
             }
         }
         
+        // === Class 琛ㄨ揪寮?===
+        HirExpr::New { class_name, args } => {
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN] New: {} with {} args", class_name, args.len());
+            
+            // 缂栬瘧鍙傛暟
+            let _arg_vals: Vec<Value> = args.iter().map(|arg| {
+                compile_expr(arg, builder, variables, module, function_ids, function_param_counts, _string_data)
+            }).collect();
+            
+            // 璋冪敤 js_instance_new
+            let mut sig = module.make_signature();
+            sig.params.push(AbiParam::new(types::F64));  // class
+            sig.returns.push(AbiParam::new(types::F64));  // instance
+            
+            if let Ok(id) = module.declare_function("js_instance_new", 
+                cranelift_module::Linkage::Import, &sig) {
+                
+                let class_hash = fnv1a_64(class_name);
+                let class_val = builder.ins().f64const(f64::from_bits(
+                    STRING_TAG | (class_hash & 0x0000_FFFF_FFFF_FFFF)));
+                
+                let func_ref = module.declare_func_in_func(id, &mut builder.func);
+                let call = builder.ins().call(func_ref, &[class_val]);
+                builder.inst_results(call)[0]
+            } else {
+                builder.ins().f64const(f64::from_bits(UNDEFINED))
+            }
+        }
+        
+        HirExpr::This => {
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN] This");
+            // 杩斿洖褰撳墠瀹炰緥锛堜粠灞€閮ㄥ彉閲忚幏鍙栵級
+            if let Some(&var) = variables.get("this") {
+                builder.use_var(var)
+            } else {
+                builder.ins().f64const(f64::from_bits(UNDEFINED))
+            }
+        }
+        
+        // === Decorator 琛ㄨ揪寮?===
+        HirExpr::Decorator { name, args, .. } => {
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN] Decorator: {} with {} args", name, args.len());
+            
+            // 缂栬瘧鍙傛暟
+            let _arg_vals: Vec<Value> = args.iter().map(|arg| {
+                compile_expr(arg, builder, variables, module, function_ids, function_param_counts, _string_data)
+            }).collect();
+            
+            // 璋冪敤 js_decorator_apply
+            let mut sig = module.make_signature();
+            sig.params.push(AbiParam::new(types::F64));  // decorator
+            sig.params.push(AbiParam::new(types::F64));  // target
+            sig.params.push(AbiParam::new(types::F64));  // context
+            sig.returns.push(AbiParam::new(types::F64));  // result
+            
+            if let Ok(id) = module.declare_function("js_decorator_apply", 
+                cranelift_module::Linkage::Import, &sig) {
+                
+                let dec_hash = fnv1a_64(name);
+                let dec_val = builder.ins().f64const(f64::from_bits(
+                    STRING_TAG | (dec_hash & 0x0000_FFFF_FFFF_FFFF)));
+                let target_val = builder.ins().f64const(0.0);
+                let context_val = builder.ins().f64const(0.0);
+                
+                let func_ref = module.declare_func_in_func(id, &mut builder.func);
+                let call = builder.ins().call(func_ref, &[dec_val, target_val, context_val]);
+                builder.inst_results(call)[0]
+            } else {
+                builder.ins().f64const(f64::from_bits(UNDEFINED))
+            }
+        }
+        
+        // === Generator 琛ㄨ揪寮?===
+        HirExpr::Yield(value) => {
+            #[cfg(debug_assertions)]
+            {
+                eprintln!("[CODEGEN] Yield");
+            }
+            let val = compile_expr(value, builder, variables, module, function_ids, function_param_counts, _string_data);
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN]   Value compiled");
+            val  // 鐩存帴杩斿洖鍊?+        }
+        
+        HirExpr::YieldFrom(value) => {
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN] YieldFrom");
+            compile_expr(value, builder, variables, module, function_ids, function_param_counts, _string_data)
+        }
+        
+        // === Async 琛ㄨ揪寮?===
+        HirExpr::Await(promise) => {
+            #[cfg(debug_assertions)]
+            eprintln!("[CODEGEN] Await");
+            let promise_val = compile_expr(promise, builder, variables, module, function_ids, function_param_counts, _string_data);
+            
+            // 璋冪敤 js_await
+            let mut sig = module.make_signature();
+            sig.params.push(AbiParam::new(types::F64));  // promise
+            sig.returns.push(AbiParam::new(types::F64));  // result
+            
+            if let Ok(id) = module.declare_function("js_await", 
+                cranelift_module::Linkage::Import, &sig) {
+                
+                let func_ref = module.declare_func_in_func(id, &mut builder.func);
+                let call = builder.ins().call(func_ref, &[promise_val]);
+                builder.inst_results(call)[0]
+            } else {
+                builder.ins().f64const(f64::from_bits(UNDEFINED))
+            }
+        }
+        
         _ => builder.ins().f64const(f64::from_bits(UNDEFINED)),
     }
 }
diff --git a/src/runtime.rs b/src/runtime.rs
index b97ee8d..de1c782 100644
--- a/src/runtime.rs
+++ b/src/runtime.rs
@@ -1,6 +1,9 @@
+#![allow(dead_code)]
+
 #[allow(dead_code)]
-use std::alloc::{alloc, realloc, Layout};
+use std::alloc::{alloc, dealloc, realloc, Layout};
 use std::ptr::NonNull;
+use std::sync::atomic::{AtomicU32, Ordering};
 
 // NaN-boxing relies on 48-bit virtual address space (x86-64, ARM64 with 48-bit VA).
 // ARM64 with 52-bit PA or PAC pointer auth would break the PTR_MASK approach.
@@ -18,6 +21,7 @@ const OBJECT_TAG: u64 = 0x7FFA_0000_0000_0000;
 pub struct JsString {
     pub len: u32,
     pub hash: u32,
+    pub ref_count: AtomicU32,  // 鍘熷瓙寮曠敤璁℃暟锛岄槻姝㈡暟鎹珵浜?     pub data: [u8; 0],
 }
 
@@ -33,8 +37,12 @@ impl JsString {
         
         unsafe {
             let ptr = alloc(layout) as *mut JsString;
+            if ptr.is_null() {
+                panic!("JsString allocation failed");
+            }
             (*ptr).len = len;
             (*ptr).hash = hash;
+            (*ptr).ref_count = AtomicU32::new(1);  // 鍒濆寮曠敤璁℃暟涓?1
             std::ptr::copy_nonoverlapping(
                 s.as_ptr(),
                 (*ptr).data.as_mut_ptr(),
@@ -44,9 +52,20 @@ impl JsString {
         }
     }
     
-    pub fn as_str(&self) -> &str {
+    pub fn as_str(&self) -> Result<&str, std::str::Utf8Error> {
         unsafe {
-            std::str::from_utf8_unchecked(std::slice::from_raw_parts(
+            std::str::from_utf8(std::slice::from_raw_parts(
+                self.data.as_ptr(),
+                self.len as usize,
+            ))
+        }
+    }
+    
+    /// Safe version that replaces invalid UTF-8
+    #[allow(clippy::len_without_is_empty)]
+    pub fn as_str_lossy(&self) -> std::borrow::Cow<'_, str> {
+        unsafe {
+            String::from_utf8_lossy(std::slice::from_raw_parts(
                 self.data.as_ptr(),
                 self.len as usize,
             ))
@@ -67,11 +86,41 @@ impl JsString {
         result.push_str(b);
         Self::new(&result)
     }
+    
+    /// 澧炲姞寮曠敤璁℃暟
+    pub unsafe fn retain(ptr: NonNull<Self>) {
+        let string = ptr.as_ref();
+        string.ref_count.fetch_add(1, Ordering::Relaxed);
+    }
+    
+    /// 鍑忓皯寮曠敤璁℃暟锛屽鏋滀负 0 鍒欓噴鏀惧唴瀛?+    /// 杩斿洖 true 琛ㄧず宸查噴鏀?+    pub unsafe fn release(ptr: NonNull<Self>) -> bool {
+        let string = ptr.as_ref();
+        // fetch_sub 杩斿洖鏃у€硷紝濡傛灉鏃у€间负 1 琛ㄧず鐜板湪鏄?0
+        if string.ref_count.fetch_sub(1, Ordering::AcqRel) == 1 {
+            Self::free(ptr);
+            true
+        } else {
+            false
+        }
+    }
+    
+    /// Free the string memory
+    pub unsafe fn free(ptr: NonNull<Self>) {
+        let string = ptr.as_ref();
+        let layout = Layout::from_size_align(
+            std::mem::size_of::<JsString>() + string.len as usize,
+            8,
+        ).unwrap();
+        dealloc(ptr.as_ptr() as *mut u8, layout);
+    }
 }
 
 pub struct JsArray {
     pub len: u32,
     pub capacity: u32,
+    pub ref_count: AtomicU32,  // 鍘熷瓙寮曠敤璁℃暟
     pub data: [u64; 0],
 }
 
@@ -85,8 +134,12 @@ impl JsArray {
         
         unsafe {
             let ptr = alloc(layout) as *mut JsArray;
+            if ptr.is_null() {
+                panic!("JsArray allocation failed");
+            }
             (*ptr).len = 0;
             (*ptr).capacity = cap;
+            (*ptr).ref_count = AtomicU32::new(1);  // 鍒濆寮曠敤璁℃暟涓?1
             NonNull::new_unchecked(ptr)
         }
     }
@@ -118,8 +171,13 @@ impl JsArray {
             old_layout,
             std::mem::size_of::<JsArray>() + new_cap as usize * 8,
         ) as *mut JsArray;
-        debug_assert!(!new_ptr.is_null(), "JsArray realloc failed");
+        if new_ptr.is_null() {
+            panic!("JsArray realloc failed");
+        }
         (*new_ptr).capacity = new_cap;
+        // 淇濇寔寮曠敤璁℃暟锛堜娇鐢?load/store锛?+        let old_ref_count = old.as_ref().ref_count.load(Ordering::Relaxed);
+        (*new_ptr).ref_count = AtomicU32::new(old_ref_count);
         NonNull::new_unchecked(new_ptr)
     }
     
@@ -147,11 +205,40 @@ impl JsArray {
         let arr = ptr.as_mut();
         *arr.data.as_mut_ptr().add(index as usize) = value;
     }
+    
+    /// 澧炲姞寮曠敤璁℃暟
+    pub unsafe fn retain(ptr: NonNull<Self>) {
+        let arr = ptr.as_ref();
+        arr.ref_count.fetch_add(1, Ordering::Relaxed);
+    }
+    
+    /// 鍑忓皯寮曠敤璁℃暟锛屽鏋滀负 0 鍒欓噴鏀惧唴瀛?+    pub unsafe fn release(ptr: NonNull<Self>) -> bool {
+        let arr = ptr.as_ref();
+        // fetch_sub 杩斿洖鏃у€硷紝濡傛灉鏃у€间负 1 琛ㄧず鐜板湪鏄?0
+        if arr.ref_count.fetch_sub(1, Ordering::AcqRel) == 1 {
+            Self::free(ptr);
+            true
+        } else {
+            false
+        }
+    }
+    
+    /// Free the array memory
+    pub unsafe fn free(ptr: NonNull<Self>) {
+        let arr = ptr.as_ref();
+        let layout = Layout::from_size_align(
+            std::mem::size_of::<JsArray>() + arr.capacity as usize * 8,
+            8,
+        ).unwrap();
+        dealloc(ptr.as_ptr() as *mut u8, layout);
+    }
 }
 
 pub struct JsObject {
     pub size: u32,
     pub capacity: u32,
+    pub ref_count: AtomicU32,  // 鍘熷瓙寮曠敤璁℃暟锛岄槻姝㈡暟鎹珵浜?     pub entries: [ObjectEntry; 0],
 }
 
@@ -159,6 +246,7 @@ pub struct JsObject {
 pub struct ObjectEntry {
     pub key: u64,
     pub value: u64,
+    pub hash: u32,  // 缂撳瓨 key 鐨勫搱甯屽€肩敤浜庡揩閫熸煡鎵? }
 
 impl JsObject {
@@ -170,8 +258,14 @@ impl JsObject {
         
         unsafe {
             let ptr = alloc(layout) as *mut JsObject;
+            if ptr.is_null() {
+                panic!("JsObject allocation failed");
+            }
             (*ptr).size = 0;
             (*ptr).capacity = 8;
+            (*ptr).ref_count = AtomicU32::new(1);  // 鍒濆寮曠敤璁℃暟涓?1
+            // 鍒濆鍖?entries 涓洪浂
+            std::ptr::write_bytes((*ptr).entries.as_mut_ptr() as *mut u8, 0, 8 * std::mem::size_of::<ObjectEntry>());
             NonNull::new_unchecked(ptr)
         }
     }
@@ -180,6 +274,9 @@ impl JsObject {
     /// The caller MUST use the returned NonNull if it's different from the original.
     pub unsafe fn set(ptr: &mut NonNull<JsObject>, key: u64, value: u64) {
         let obj = ptr.as_mut();
+        let key_hash = compute_object_key_hash(key);
+        
+        // 鍏堟煡鎵炬槸鍚﹀凡瀛樺湪
         for i in 0..obj.size {
             let entry = &mut *obj.entries.as_mut_ptr().add(i as usize);
             if entry.key == key {
@@ -188,6 +285,7 @@ impl JsObject {
             }
         }
         
+        // 鎵╁妫€鏌?         if ptr.as_ref().size >= ptr.as_ref().capacity {
             *ptr = Self::grow_raw(*ptr);
         }
@@ -196,6 +294,7 @@ impl JsObject {
         let entry = &mut *obj.entries.as_mut_ptr().add(obj.size as usize);
         entry.key = key;
         entry.value = value;
+        entry.hash = key_hash;
         obj.size += 1;
     }
     
@@ -213,22 +312,71 @@ impl JsObject {
             old_layout,
             std::mem::size_of::<JsObject>() + new_cap as usize * std::mem::size_of::<ObjectEntry>(),
         ) as *mut JsObject;
-        debug_assert!(!new_ptr.is_null(), "JsObject realloc failed");
+        if new_ptr.is_null() {
+            panic!("JsObject realloc failed");
+        }
         (*new_ptr).capacity = new_cap;
+        // 淇濇寔寮曠敤璁℃暟锛堜娇鐢?load/store锛?+        let old_ref_count = old.as_ref().ref_count.load(Ordering::Relaxed);
+        (*new_ptr).ref_count = AtomicU32::new(old_ref_count);
         NonNull::new_unchecked(new_ptr)
     }
     
     pub fn get(&self, key: u64) -> u64 {
+        let key_hash = compute_object_key_hash(key);
+        
+        // 浣跨敤鍝堝笇蹇€熸煡鎵撅紙濡傛灉鍝堝笇鍖归厤锛屽啀楠岃瘉 key锛?         for i in 0..self.size {
             unsafe {
                 let entry = &*self.entries.as_ptr().add(i as usize);
-                if entry.key == key {
+                // 鍏堟瘮杈冨搱甯岋紙蹇€熷け璐ワ級
+                if entry.hash == key_hash && entry.key == key {
                     return entry.value;
                 }
             }
         }
         super::codegen::UNDEFINED
     }
+    
+    /// 澧炲姞寮曠敤璁℃暟
+    pub unsafe fn retain(ptr: NonNull<Self>) {
+        let obj = ptr.as_ref();
+        obj.ref_count.fetch_add(1, Ordering::Relaxed);
+    }
+    
+    /// 鍑忓皯寮曠敤璁℃暟锛屽鏋滀负 0 鍒欓噴鏀惧唴瀛?+    pub unsafe fn release(ptr: NonNull<Self>) -> bool {
+        let obj = ptr.as_ref();
+        // fetch_sub 杩斿洖鏃у€硷紝濡傛灉鏃у€间负 1 琛ㄧず鐜板湪鏄?0
+        if obj.ref_count.fetch_sub(1, Ordering::AcqRel) == 1 {
+            Self::free(ptr);
+            true
+        } else {
+            false
+        }
+    }
+    
+    /// Free the object memory
+    pub unsafe fn free(ptr: NonNull<Self>) {
+        let obj = ptr.as_ref();
+        let layout = Layout::from_size_align(
+            std::mem::size_of::<JsObject>() + obj.capacity as usize * std::mem::size_of::<ObjectEntry>(),
+            8,
+        ).unwrap();
+        dealloc(ptr.as_ptr() as *mut u8, layout);
+    }
+}
+
+/// 璁＄畻 object key 鐨勫搱甯屽€硷紙鐢ㄤ簬蹇€熸煡鎵撅級
+fn compute_object_key_hash(key: u64) -> u32 {
+    // 绠€鍗曠殑浣嶆贩鍚堝搱甯?+    let mut h = key as u32;
+    h ^= h >> 16;
+    h = h.wrapping_mul(0x85ebca6b);
+    h ^= h >> 13;
+    h = h.wrapping_mul(0xc2b2ae35);
+    h ^= h >> 16;
+    h
 }
 
 pub fn nanbox_pointer(ptr: NonNull<()>) -> u64 {
diff --git a/start_nocrt.c b/start_nocrt.c
index 6ca4d20..4e84314 100644
--- a/start_nocrt.c
+++ b/start_nocrt.c
@@ -64,6 +64,29 @@ const double _fltused = 0;
 void _start() {
     SetConsoleOutputCP(65001);
     double result = main();
-    int exit_code = (int)result;
+    
+    // 姝ｇ‘澶勭悊 NaN-boxing 杩斿洖鍊?+    uint64_t bits = val_to_bits(result);
+    int exit_code;
+    
+    if (bits == UNDEFINED || bits == NULL_VAL) {
+        // undefined 鎴?null 杩斿洖 0
+        exit_code = 0;
+    } else if (bits == TRUE_VAL) {
+        // true 杩斿洖 1
+        exit_code = 1;
+    } else if (bits == FALSE_VAL) {
+        // false 杩斿洖 0
+        exit_code = 0;
+    } else if ((bits & TAG_MASK) == STRING_TAG || 
+               (bits & TAG_MASK) == ARRAY_TAG || 
+               (bits & TAG_MASK) == OBJECT_TAG) {
+        // 鎸囬拡绫诲瀷杩斿洖 0
+        exit_code = 0;
+    } else {
+        // 鏅€氭暟瀛楋紝鐩存帴杞崲
+        exit_code = (int)result;
+    }
+    
     ExitProcess(exit_code);
 }
