The epoll timer heap test recorded a key's deadline from a clock read taken
before scrp_timer_arm, but the poller reads the clock again inside the call.
A loaded runner that paused the test between the two reads for more than a
millisecond made the poller's deadline later than the recorded one, and the
test's deadline-order check failed although the heap delivered every timer
in order.
The test now records the clock before and after each arm call and checks
order against those bounds, which hold however long the test is paused and
need no slack. A mutated heap that skips sifting down still fails the check.
An executable's LLVM text was divided into one partition per 4 MiB, so a
program under 4 MiB was optimized and compiled on one thread, and one of
up to 32 MiB used fewer than eight cores. A module over 1 MiB now gets at
least eight partitions of 512 KiB or more: four up to 2 MiB, and eight up
to 32 MiB. Larger modules keep one partition per 4 MiB. The count still
depends only on the module's size.
existsSync and the fs.promises functions accept a file: URL wherever
they accept a path. They convert it after their arguments are evaluated,
and a URL that does not convert gives false from existsSync and a promise
rejected with fileURLToPath's error from fs.promises, as in Node.
copyFileSync and renameSync check a string source for null bytes before
they convert a URL destination, and readFileSync checks a runtime
encoding before it converts a URL path, so the error Node reports first
is the one thrown.
Refs #1616
Co-authored-by: jlucaso1 <55464917+jlucaso1@users.noreply.github.com>
#1999 let a record channel keep its own type beside a dyn one, for the
yields of an IterableIterator<Row>. It applied to the return channel too,
so a generator typed with a dyn yield and a record return converted its
return value into that record. Effect.gen's generators are typed that way:
`yield* RpcTest.makeClient(group)` answered the client converted to a
record without its methods, and `client.double(...)` threw. Only a record
yield channel now keeps its type beside a dyn return.
A sum or product of exact integers whose result range is not proven, such
as `child + 1` of a speculated loop counter, computes its double and, beside
it, an i64 wide view (`wideArithmetic`). Array indexes already used that
view, but number compares and typed-array indexes did not:
`child + 1 < end` compared doubles, and `a[child + 1]` converted the double
back to an integer and tested the round trip before its bounds compare.
`alwaysExactInteger` gives a value's exact integer, or its wide view when
the view's magnitude bound is within the magnitude below which the view
equals the double. A number compare whose two operands both have one
compares the i64s, and a typed-array index uses it directly. Views that
may differ from their double, such as `2 * root + 1` of a counter that may
reach 2^53, keep the double compare.
Five gaps in the shape analysis let values escape or change unnoticed:
- A store to a named property of an array was dropped, so a value read
back from it and leaked did not escape.
- Named loads on instances, classes and functions ignored values written
under unknown keys. They now read that field once it exists, without
creating it for atoms that have none.
- JSON.parse never ran its reviver, and JSON.stringify never ran its
replacer or the toJSON methods of the values it serializes. The reviver
now runs with untracked values, the replacer with every serialized value
(the holder as `this`), and toJSON on each value that has one. Their
results are serialized in turn.
- `new Proxy` and `Proxy.revocable` record a proxy operation on the target,
and Reflect.deleteProperty records a delete, so those literals are G.
- A tagged template now calls its tag with the strings array (with its
`raw` array) and the substitutions, which were not evaluated before.
The declaration-typed boundary already reaches zod 4 schemas and hono's
c.req.valid(): zod 4's z.infer and hono's validator Input generics resolve
to plain object types in the declaration world. Three gaps remained:
- Boolean literal types printed as `false` (the TS7 facade leaves
intrinsicName unset), so `{ ok: true } | { ok: false }` lost its true
arm and `boolean | undefined` became `undefined | false`. The printer
reads the literal's value.
- `r.data` after `const r = S.safeParse(x); if (r.success)` never
crossed: zod 4's result union is not data (its error arm is a class),
and reads on projectable receivers were skipped on the assumption that
something else types the receiver. Such reads now cross when the
receiver is a package call whose type does not project, or a const
bound to one.
- Reads through bindings annotated with a projected type no longer get a
redundant cast, and aliases are named only for casts that survive.
New npm cases zod4-boundary and hono-zod-validator run real zod 4.6.7,
hono 4.13.13 and @hono/zod-validator 0.9.1 (vendored file closures) under
Node and natively; decl-boundary.test.ts checks that c.req.valid() is a
checked cast with a path TypeError.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
X25519 KeyObjects come from generateKeyPair(Sync)("x25519"), which keeps
the private key clamped as OpenSSL does, and from createPrivateKey and
createPublicKey of PKCS#8, SubjectPublicKeyInfo, JWK (OKP, X25519) and
raw keys. They export in the same forms. sign, verify, createSign and
createVerify throw OpenSSL's "operation not supported for this keytype",
with its library, reason and code properties. X25519 uses mbedTLS's
Curve25519 group.
crypto.diffieHellman({ privateKey, publicKey }[, callback]) computes the
X25519 and ECDH secrets of two keys of one type, given as KeyObjects or
in any form createPrivateKey and createPublicKey read. The checks run in
Node's order: the options, the callback, both keys present, the key types
when both are KeyObjects ("Incompatible key types for Diffie-Hellman"),
then the public and private key inputs. Mismatched curves, a small-order
X25519 point and key types other than EC and X25519 throw OpenSSL's
errors. The callback form passes the secret, or the error without the
OpenSSL properties, in a later macrotask, as Node's DHBitsJob does.
createPublicKey also reads a private key's DER encodings (pkcs8 and
sec1), which Node accepts there.
SCRIPTC_DEBUG_SHAPES=1 runs a whole-program allocation-site points-to
analysis over opted-in npm packages' JavaScript and the user files that
call into them, and prints which object and array literals a native
record would represent exactly, the inferred class field types, the
census of writes and reflection on untracked receivers, and the hot
functions' parameter and return types. Report only: nothing reaches the
lowering, and the analysis runs only when the variable is set.
Design: results/design-shape-inference/DESIGN.md (scriptc-perf).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TypeScript keys a symbol table entry whose name starts with `__` with an
extra `_` (`__x` is stored as `___x`; `symbolName` removes it). Native ESM
link checking looked an import up by its own spelling, so a program that
imports such an export compiled to Node's startup SyntaxError:
// dep.ts
export const __x = 1;
// main.ts
import { __x } from "./dep.ts"; // The requested module './dep.ts'
// does not provide an export named '__x'
`escapedSymbolName`, the inverse of `symbolName`, gives a name's table key.
Link checking, external type lookups, CommonJS export lookups and the
`this` check of ES module exports now look names up through it. `Object.keys`
over a module namespace skipped every key starting with `__` to drop
TypeScript's internal names, so it also dropped these exports; it now
skips only internal names and lists exports by their own names.
Closes#1582.
Co-authored-by: thekevinbrown <1531750+thekevinbrown@users.noreply.github.com>
Blocks above 512 bytes come from glibc, which serves each worker thread
from a 64 MiB heap of its own and makes it accessible with mprotect a
page-rounded step at a time. Every 2 MiB range of a heap is first touched
while part of it is still inaccessible, so the heaps never get transparent
huge pages: on a 16-checker type check of VS Code they hold about 0.9 GB on
small pages, close to half of the process's page faults.
Once a worker thread has allocated 16 MiB of large blocks, the heap of each
large block it gets is made accessible whole and advised MADV_HUGEPAGE,
once per heap. glibc's calloc still clears only what lies below its own
high-water mark, so no page is touched early. glibc's mmap and trim
thresholds are set to 4 MiB and 8 MiB, so that the largest blocks get
mappings of their own and a heap's free top goes back to the system: with
huge pages, a heap otherwise keeps resident memory it never writes. The brk
heap policy's own thresholds take precedence once it switches on.
The policy is off unless THP is in madvise mode and malloc is glibc's, and
when the glibc.malloc.hugetlb tunable is set or the system forbids
overcommit. A heap is advised only when /proc/self/maps shows anonymous
mappings covering exactly its range. Library archives leave their
embedder's heaps alone.
The Linux test shards run their suites in a transient systemd scope with
MemoryMax=13G and no swap, below the runner's 16 GB. A process tree that
grows past the cap loses its largest process to the kernel, and the job
log names the failing test, where the runner itself ran out of memory
and left no log. Hosts without systemd run the suites directly.
The side-queue balancer also takes a table of memory-heavy files, with
their measured peak. They run whole in the cost-balanced task, and each
goes to the shard with the least memory-heavy work so far, after the
time-balanced files. decl-boundary.test.ts, which peaks at about 1.8 GB
alone and had no time measurement, so vitest's file sharding put it in
shard 11, is the first entry. It now runs in shard 1 (plain) and 6 (san).
An early exit from a loop over an iterator-typed Map or Set method parks
the iterator with a second yield of the current entry. That yield read the
entry again by its index, which aborted with a map iteration error when
the loop had deleted the entry. Each step now reads the entry once into a
local that both yields answer.
`entries()` takes the typed walk only for a slot whose yield type is the
key and value pair record. Other yield types, such as
`IterableIterator<any>` or `<unknown>`, keep the checked adapter instead of
failing to compile.
Property helpers now start with an exit for values no class table
matches: if the receiver is neither a class capsule nor a function, they
run the generic read or write on it directly. The inline-cache
recognizer accepted only capsule branches and the subclass normalization
before a helper's generic tail, so these helpers stopped being cache
sites. It now also accepts that exit when its operation is the one the
site caches: a read or write of the same key on the receiver.
Chris Tate