In JavaScript, a Response or Request body answered getReader, cancel and
locked, and every other ReadableStream member was undefined: tee,
pipeTo, pipeThrough, values and for await threw TypeErrors where Node's
body is a ReadableStream.
In programs that link the web stream classes, the body's handle now
stands for a ReadableStream once any other member is used
(sf_stream_web_view): a stream with a zero high-water mark whose native
source reads the body (scr_webstream_readable_over). From then on every
member goes to it, the class's method values and getters run on it
through the alias's view (scr_dyn_handle_class_receiver), and text(),
clone(), new Response(body) and fetch uploads read the body through it,
so its lock and bodyUsed follow it as in Node. A body locked when the
view is made keeps the view locked until the lock is released. Once
only the view's source holds the body, the body lets the view go.
The compiler links the classes into a program whose JavaScript reads a
ReadableStream member that the fetch profile lists as unsupported by the
native stream, or iterates a ReadableStream with for await, and that
names none of the classes: %main calls webstream.install first.
Programs without web streams build to the same binaries as before.
Adds corpus programs fetch-body-web-stream-linked.mjs,
fetch-body-web-stream-unlinked.mjs and fetch-body-web-stream-network.mjs,
with their corpus costs and preflight/order baselines.
A JavaScript function that never refers to `this` no longer reads the
call receiver at entry. The coverage report counted that read as the
statement's dynamic operation, so these fixtures now report fewer
statements in the dynamic tier: in js-gap/gap.js, the JSDoc-typed
`typed` and `untyped` were both dynamic only through the read, and
`untyped` is now dynamic through its arithmetic alone.
A `for (k in o)` or `for (k of a)` whose head is an expression stores into
it on every iteration. The strict-mode check of constructor and method
bodies now treats such a head like the target of `=`: a property store
not made through `this`, a store into a read-only global, and a store into
an undeclared name keep the constructor function, since sloppy mode drops
or completes those stores where a class body throws.
The static-objects-order fixture gains loops.js, whose methods store from
a for-in head into an undeclared name and from a for-of head into a
property of a string.
An element write of a `T | undefined` binding holds a computed index in a
temporary ahead of its two stores, which then read the receiver after the
index. When the index can rebind the receiver (`a[(a = b, 0)] = u`), the
write now keeps reading the receiver first, so it stores into the array
the receiver held before the index ran.
The key conversion of a union index (a sequence that declares a temporary
and may read the constant "undefined" key) no longer counts as running
other code, so such an index is still held.
A union local that is copied to another local (`const t = pp[p0]; p0 = t`)
was a whole-value use, so both locals held heap boxes: every number[]
read held in such a local allocated a `%ScrUnion`, and every copy
retained and released it.
Call lifetimes now record statement copies between union locals
(copiedLocals) instead of rejecting the source. Local union storage
takes a copied local when every local it is copied to also has private
storage, so the copy snapshots the tag and bits and the source's box
stays private. Copies in expression position and copies of parameters
keep the heap path.
An element assignment of a `T | undefined` binding with a computed index
holds the index in one temporary ahead of its two stores, so the key
conversion of a union index declares its temporary once.
g05-zlib starts a zlib.gzip from a 0 ms island timer and arms a 2 ms
timer on the native side. The 0 ms timer's callback runs before the 2 ms
timer is due, so the gzip job races that timer: if the job completes on
libuv's thread pool before the timer's turn, its callback runs first.
Node orders the two the other way only because its first gzip usually
takes longer than the wait. With zlib already loaded and the thread pool
started, Node prints i-zlib first in about a quarter of runs. On fast
macOS hosts the native runs took the other order.
Mark it `// @order: race`, as g01 (fs), g03 (child process) and g04
(dns) already are, so its native runs must produce the lines of one of
Node's outputs in any order, and name thread-pool work among the races
the harness describes.
The backend declares scr_unwind_resume, so scr_exception.h carries its
prototype, as the runtime ABI test requires. The unwind-ABI pattern names
both entry points in full, so the test reads no partial symbol from it.
A new plan was copied into its slot as a whole struct, which wrote the
slot's pc with a plain store while other threads' lookups read it
atomically: a data race. The insert now copies the fields after pc and
publishes pc only with the release store.
The unwinder test also runs its threaded cases under ThreadSanitizer,
which reports the race without this change.
text(), json(), bytes() and the other body readers of a Response or
Request whose body is a ReadableStream asked the stream's source for more
chunks after draining its queue only when the stream had a zero
high-water mark. When the queue had filled before the read began (a timer
ran after the Response was made), the reader took the queued chunk and
then waited for a close that no pull would bring, and the read never
settled. The reader now pulls whenever it empties the queue, so it reads
to the end, as Node does. This applies to streams from ReadableStream.from,
from an underlying source, and to JavaScript ReadableStreams.
Adds corpus programs fetch-body-queued-before-read.ts and
fetch-body-queued-before-read-untyped.mjs, with their corpus costs and
preflight/order baselines.
scr_unwind_raise walks the stack with plans cached per return address.
The first raise through a return address finds the function's FDE
through the .eh_frame_hdr of the object that contains it, runs the CFI
up to the call, and finds the call site's landing pad in the LSDA; the
plan records the frame's CFA rule, where its callee-saved registers are
saved, and the landing pad. Later raises look the plans up, restore the
registers, and jump to the first landing pad. Plans are inserted under
a lock and read without one.
Landing pads continue the unwind with scr_unwind_resume instead of
`resume`, so the walk goes on from their frame. A frame whose CFI,
pointer encodings or personality the plans do not express, or a return
address without an FDE, leaves the unwind to libgcc's forced unwind
from the frame the walk started at, as before. Other Linux targets keep
libgcc's unwinder; their scr_unwind_resume calls _Unwind_Resume.
bench:runtime gains layered-errors, a workload whose errors are thrown
below small functions that hold references and caught per entry in a
loop, and the corpus gains unwind-landing-pad-chains, which pins landing
pads that continue the unwind, including in frames LLVM inlines into a
caller whose handler takes the exception.
A sloppy-mode function called with undefined or null as this reads the
global object, which answers builtin globals through the program's lookup.
Modules whose sloppy-mode functions read builtin globals through this, or
through a variable it initializes, now install that lookup; it answers
those names, or every declared global when a module reads the global
object by computed names.
The runtime-unit helper now lists the functions the profile annotated and
the ones whose control flow changed since it was collected, each with the
sum of its counters in the profile. The Linux x64 pack manifest records the
counts on matched and on changed functions (flavors.speed.runtime_profile
annotated_counts and mismatched_counts) and names the changed functions
with the most counts. A function that one unit variant matches counts as
matched in the other variant too.
The runtime profile test fails when changed functions hold more than 5% of
the counts. RELEASING.md adds refreshing the runtime profile to the release
steps.
Typed records checked from frozen untyped values stay frozen, as the
objects they copy are. A sloppy-mode function called with undefined or null
as this receives the global object that globalThis reads.
The record check reads the source's integrity with a query that answers for
every value: a proxy answers as its target, and values without a modeled
integrity level, which Object.freeze refuses, are not frozen. Object.isFrozen
keeps its refusal of those values.
The island host replaced process.on, process.addListener and
process.prependListener with separate wrappers, and process.emit with its
own, as own enumerable properties of process. Island code could see the
difference: Object.keys(process) listed the four, process.on was no
longer process.addListener, prependListener was named addListener, and
each was an own property where Node inherits it.
One wrapper now serves on and addListener, and prependListener and emit
keep their names. They are defined on process's own prototype, which
Node gives process below EventEmitter.prototype, with
EventEmitter.prototype's attributes. process has no own property for
them, so Object.keys, Object.hasOwn and for...in see what they see in
Node. for...in lists a prototype's keys before its parent's, so the
keys EventEmitter.prototype lists before the wrapped ones (_events,
_eventsCount, _maxListeners, setMaxListeners, getMaxListeners) are
defined there too, with the same values, in their order.
6891 compares the identities, names, lengths, own-ness, Object.keys and
for...in over process against Node.
Native timers and an island's Node timers run on the hosted libuv loop but are not merged into one order, so callbacks from the two sides can run in a different order than in Node and the order can vary between runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`new Set([a, b])`, where `a` and `b` are reads of the same InlineArray
field, gave a Set of size 2 where Node gives size 1: each read may give
another array, and the source proof checked Set elements only when they
were added with `add`. It now reports SC7009 when the seed of a new Set,
or the values of a Map that become a Set (`new Set(map.values())`), may
hold a field's array.
The corpus case passed `new Swapper(tricky)` straight to `+`, which the
argument check already treated as effectful, so it never distinguished
the two lowerings. Bind the swapper to a local: an identifier is what
the old check called inert, and the program now prints "replaced
replaced" without the fix and matches Node with it. The class also used
a parameter property, which Node's strip-only mode rejects.
Co-Authored-By: Claude 5.5 <noreply@anthropic.com>
Chris Tate