- The native toolchain test's fixture runtime pack hard-coded ABI v37, so
with this branch's marker (v40) the toolchain refused the pack and the
test saw exit status 1. It now takes RUNTIME_ABI_VERSION and
RUNTIME_ABI_MARKER from runtime-abi.ts, as the native driver test does.
TypedArray.prototype.set with a SharedArrayBuffer view as its source or
target converted every element through a double, even when both arrays
had the same element kind. That cost about 5 ns per byte, and it changed
NaN payloads: a Float32Array signaling NaN came back quieted (7fa00001
became 7fe00001), where Node copies the bytes.
The same element kind now copies the source's bytes with the relaxed
shared stores. A source that overlaps the target range, a view of the
same buffer in a program without workers, is copied out first. Different
element kinds still convert each element.
In Node, `decoder.decode(undefined)` returns "" like `decode()`, and
flushes bytes pending from streamed input. scriptc refused a statically
undefined argument and an argument typed `Uint8Array | undefined` with
SC2020, and `decode(x!)` on an undefined value threw a TypeError.
The decode input lowering now evaluates a statically undefined argument
for its effects and decodes an empty Uint8Array, and reads the undefined
arm of `Uint8Array | undefined` as an empty Uint8Array, in both the
decoder-value and the `new TextDecoder(label).decode(...)` paths. A
non-null assertion passed to decode keeps the undefined it removes,
instead of the checked narrowing other optional standard library
parameters keep. Inputs that may be null are refused as before (`decode(null)`
throws a TypeError in Node).
assert.sameValue, assert.notSameValue and assert.compareArray elements treat identical references as the same value and a reference as different from every primitive. Only two distinct references still refuse, because a conversion at the native boundary can copy a reference but never merge two. Assertion messages may be any value and convert with String, as in the upstream helpers.
An arm's field check can run a getter that changes the discriminant. The
checked cast now reads the discriminant again after each failed arm;
when its case changed, the tests continue arm by arm after the failed
arm, so the cast picks the arm the arm-by-arm tests pick.
A Date local kept as its time value was read as toJSON's receiver
before the arguments ran, so a setter in an argument
(d.toJSON(d.setTime(0))) did not change the result. Such a local now
keeps its Date object, and toJSON reads it after its arguments, as in
Node.
A units copy reads the receiver's UTF-16 units through the pointer its
guard took, which stays valid only while nothing indexes another
non-ASCII string: that evicts the receiver's index entry and frees the
units. The classifier admitted every typed-array and Buffer method, so a
loop that sorted a typed array with a comparator function value, or
copied an untyped source into one (`ta.set(source)`, whose element reads
can run getters), got a units copy, and a comparator or getter that
indexed other strings made the loop read freed memory.
The units copy now admits only the typed-array and Buffer methods that
call no program code and read no checked-dynamic value or string. Corpus
7307 sorts with such a comparator and copies from such a source inside
scans of a warmed non-ASCII text; the sanitized build of the previous
commit reports a heap-use-after-free on it.
A constructor read on a class instance through an untyped value answered
the class itself whenever the class's prototype object did not hold an own
`constructor`. After `delete Object.getPrototypeOf(new Middle()).constructor`,
Node reads the property the base class's prototype holds, and past the last
class's prototype Object.prototype's.
The read now checks the instance's own property, then walks the class's
prototypes: each answers its own `constructor`; a prototype without one
answers its class unless reflection had populated it, in which case the
program deleted the property and the read continues to the base class's
prototype, and from the last one to Object.prototype. Reflection sets a
per-class flag when the prototype initializes, so the answer does not
depend on whether the reflection was compiled before the read.
Corpus 8260 gains the deletion case.
A frozen class instance kept its symbol-keyed fields writable through
typed references, and Object.isFrozen, isSealed and isExtensible reported
it unfrozen, because the field write checks and the instance's checked
view covered its string-keyed fields only. This held for Object.freeze
through an untyped value and for a typed Object.freeze alike.
- Writes to a symbol-keyed field of a hierarchy with an integrity word are
checked like other field writes, and throw Node's TypeError naming the
symbol ("Cannot assign to read only property 'Symbol(tag)' ...").
- The checked view applies the instance's integrity state to its
symbol-keyed properties too, and the commit of an untyped freeze, seal
or preventExtensions counts them.
- The commit removes a symbol-keyed field's entry from the property bag
whatever its attributes (scr_dyn_obj_delete_symbol_field), as it does
for string-keyed fields, so a sealed view no longer leaves the field's
old value in the bag.
Corpus 7407 covers freeze and seal of symbol-keyed fields through unknown
and through typed calls, on a class and a subclass, and matches Node.
The sanitized self-hosting native-frontend build needs about 15 GB by
itself: its clang compile of the whole frontend under ASan peaks at
10.5 GB beside a 3.8 GB compile in Node. In the 14 GB scope, with the
shard's other work running beside it, the kernel killed that clang
intermittently, so SC5004 reported clang's warnings and no error (SAN
16/20 and 19/20). The scope now caps RAM at 15 GB, still below the
runner's 16 GB, and may still swap past it.
A union parameter's proof covered the union, not its payload: narrowing it
and storing, returning or pushing the result, a narrowed nullish read, and a
store into a nullable-pointer field all counted as projections. That holds
for a boxed union, whose payload is a separate object. A record passed
through a nullable-pointer union is that payload, so forwarding it to such a
callee let a record in its caller's frame escape the frame.
A pointer-wrapped argument now needs a second fact from the callee's union
parameter: its payload stays in place too. The payload is in place when it
is only tested, narrowed for a field read (directly or through the checked
narrowing a field read of a `T | undefined` parameter compiles to), or passed
on to a parameter that is proved in turn. The facts that other arguments use
are unchanged.
Corpus 7663 has callees that push (directly and through a non-null
assertion), default, store in a global record field or a class field, or
pass on the narrowed record, and one that only reads it.
In a JavaScript file, `const m = new Map()`, `new Set()` and `[]` type as
Map<any, any>, Set<any> and any[], so every use lowered to the
checked-dynamic collection operations: boxed keys and values, generic
method dispatch, and dynamic arithmetic on what they returned.
js-collection-types.ts proves types for such bindings from their uses.
A `const` qualifies when every reference is a direct use of the
collection:
- for a Map: get/has/delete/clear, size, and set as a statement;
- for a Set: has/delete/clear, size, and add as a statement;
- for an array: push/pop/shift/at/includes/indexOf/join and length.
The value then never leaves the binding. Its key, value or element type
is the one primitive (string, number or boolean) of every expression the
program writes. That is found by a fixed point that types `m.get(k) ?? d`,
arithmetic, comparisons and constants defined from them, and it requires
lookups of the same type. Any other reference (passing, returning,
storing, exporting, iterating, inspecting, an optional call), a direct
`eval` in the file, or any doubt keeps the binding untyped.
A proven binding answers the lowerer's typeOf with a carrier type
declared in scriptc-overrides.d.ts, which only the lowering program
includes. `new Map()` and `new Set()` adopt it, so the binding lowers as
the typed Map<K, V>, Set<K> or T[], as a JSDoc @type would make it.
7985 covers the typed cases and every refusal.
A JavaScript module binding whose initializer joins an untyped value with
a string, number or boolean through `||`, `&&`, `??` or `?:`
(`export const APP_NAME = pkg.appConfig?.name || "app"`) stayed a local of
the module's initializer, so reads from other modules and functions
failed with "a binding form with no lowering". Such initializers now
register the binding in checked-dynamic module storage, like the untyped
initializers they combine.
pi-coding-agent's config.js declares APP_NAME, APP_TITLE and isBundledNode
this way.
Refs #1777.
An untyped call of an array method went through the whole dispatch ladder
on every call: the receiver-kind tests for handles, proxies, typed refs,
objects, functions and primitives, then the array section's prologue
(the hole scan and the frozen, sealed and extensibility tables) before
the method itself.
A dense array without holes, named properties or a prototype of its
own, whose length and elements are writable, now runs push, pop, shift,
at, includes and indexOf directly from the call site's cached method id.
An argument that could run user code (a non-number index, a fromIndex)
still takes the ladder, as does every other receiver. A statement-position
push calls an entry that does not box the new length.
Calls on arrays that the direct path refuses now also follow Node:
- an array's own method, or one on its custom prototype chain
(Object.setPrototypeOf), runs instead of the builtin;
- push on a sealed or non-extensible array throws "Cannot add property
N, object is not extensible", and pop or shift on a sealed array
"Cannot delete property 'N' of [object Array]".
tests/node-parallel/run.mjs builds files from a Node.js checkout's
test/parallel with scriptc, runs each executable in that directory, and
compares its exit status with Node's, writing a pass, fail or refused
verdict and the first error line per file (results.json, results.md).
--common minimal (the default) runs the files against a minimal
test/common (common/index.cjs, common/wpt.cjs) whose helpers keep Node's
semantics, so a verdict measures the module under test; --common node
uses Node's own test/common.
An `export * from` declaration binds each re-exported name to the binding
of the module that declares it, like a named re-export, so it has no
initialization state of its own. Import cycles whose modules re-export
another member of the cycle this way now compile with the exact cycle
initialization: re-exported names read the same values, and throw the
same temporal dead zone errors, as in Node. `export * as ns` of a cycle
member keeps the SC1016 refusal.
pi-coding-agent's sdk.js (sdk.js → agent-session-runtime.js →
agent-session-services.js → sdk.js) has this shape.
Refs #1777.
A number[], string[] or boolean[] seen as (T | undefined)[] through a
cast, a binding or a parameter is the same array in Node: undefined
written through either name is visible through both. The type mapper
now stores (T | undefined)[] of a number, string or boolean T as T
elements, which hold a present undefined by their slot state, so the
wider name shares the storage instead of converting to a separate
union array.
Writers of these arrays store undefined as a present undefined:
element writes, push, unshift and splice, literals, Array.from (with a
length or a mapper), Array.of, generator drains, flatMap, rest packs,
copies from Map and Set values and Object.values, and checked
conversions from dynamic values. Promise.all over Promise<T |
undefined>[] fills the result inside the combinator's settlement, so it
settles on Node's turn. The element-state analysis counts callbacks and
iterables whose checker type admits undefined.
Readers keep their optional reads: index reads through a union of
arrays, searches with a direct needle, and asserted reads, which throw
a TypeError for undefined. Comparators and callbacks that receive
present elements take the element type, without an adapter.
Chris Tate