A child spawned from a listener that runs during a poll pass, such as a
'close' listener, can exit before the next pass fires its 'spawn'
listeners. The same pass's waitpid loop then settled it with 'spawn' never
emitted. Settling an exited child now fires its pending 'spawn' listeners
first, before its stream data and 'exit', as Node emits them.
A per-class field-creation helper creates an instance's property bag with
the class's recorded initializer. A class can carry several: three.js's
Material bag is created with Material's own prototype for Material
instances and through the per-instance prototype dispatch for subclass
instances, and the first one was recorded. MeshStandardMaterial instances
then got bags with Material's prototype, and writes to their own fields
(roughness, metalness, color) through setValues stored into the bag. The
initializer is now recorded only when every branch's initializer is the
same; other classes create their bags through the class tables.
Object.freeze of an array that another reference may still hold stopped at
compile time with SC2020, and freezing an array, Map or Set held in an
untyped value threw SC2020 at run time. Node freezes the object itself: a
frozen array refuses every later write through any reference with the
TypeError of the operation's first write, and a frozen Map or Set only
stops being extensible, since its entries are not properties.
- An array a program may freeze keeps a frozen bit in its storage flags.
An array type is freezable when a typed Object.freeze names it, or, in a
program that freezes untyped values, when a value of it can be held as a
live untyped reference. The writes of those types test the bit with the
guard published arrays already use; other array types are unchanged.
- The guard's errors follow Node for every operation: splice, fill,
copyWithin, sort and reverse throw at their first write, and do not
throw when they would write nothing. Published arrays get the same
errors, and a statement splice of a published array is now guarded.
- A Map or Set records that it is not extensible, for Object.freeze, seal
and preventExtensions, typed or untyped. Object.isFrozen, isSealed and
isExtensible report it, and its entries stay writable.
- Writes to a frozen array through an untyped value are refused with the
same errors, as are writes to frozen checked arrays and objects, which
now name the property and the object as Node does.
- Programs that neither freeze nor publish arrays compile to the same IR
and LLVM.
Corpus 7406 covers typed and untyped freezes of arrays, Maps and Sets,
every array write on frozen arrays of zero, one and three elements,
comparator sorts, nested arrays, and frozen arrays that are released, and
matches Node.
Refs #1374
Co-authored-by: blurname <50226652+blurname@users.noreply.github.com>
`other.#x ??= value` (and `||=`, `&&=`) on a receiver JavaScript leaves
untyped read and wrote an ordinary property named "#x" instead of the
brand-checked private field, so the field kept its old value. Hono's
RegExpRouter numbers its parameter nodes with `next.#varIndex ??=
context.varIndex++`; without the stored index its regular expression lost
every parameter capture, and `c.req.param("id")` answered undefined.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A literal that starts by spreading a value of its own type, such as
`{ ...current, ...patch, updatedAt }`, made the key-order witness give up
on the type: the copy's source order was the type's own order, seeded
with the declared table, so it conflicted with the literals that build
the values. While no checked conversion builds the type, every value has
the one chosen order and the copy adds no witness.
Checked conversions also counted as builders of records they cannot
create: a class instance's field records, a checked function's record
parameters, a boxed primitive (the undefined a dynamic construction
passes for a missing argument), and the result of a typed call of a
method the program may replace on its instance, which without a
replacement is the method's own native value boxed and checked back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
generateKeyPair tested its callback, and a function in the options
position, by the checked-dynamic kind, so a Proxy whose target is a
function threw ERR_INVALID_ARG_TYPE. Node checks typeof, which answers
"function" for such a Proxy. Both tests now ask whether the value is
callable.
A JavaScript class's prototype method called with a receiver that is not an
instance of its class (`C.prototype.m.call(other)`, or an object that
inherits the method) now behaves as in Node when it uses private members or
calls super methods, instead of throwing "expected C" for the receiver.
- Private fields keep their brand check: reading or writing `this.#x` throws
"Cannot read private member #x from an object whose class did not declare
it" (or the write message), and `#x in this` answers false.
- `this.#m()` brand-checks the receiver through a new `call` use of the
private brand helpers and throws "Receiver must be an instance of class C"
(V8's wording: the class's own identifier, "anonymous" without one, and
"Cannot read properties of undefined (reading 'C')" for a nullish
receiver). It also applies to private method calls on other
checked-dynamic values.
- `super.m(...)` looks the method up on the base class's complete prototype
object and calls it with the receiver, as `super` reads
[[HomeObject]].[[Prototype]].
Methods that use `super` in other positions, static methods with private
names, and classes whose base chain includes a function-local, generic,
mixin, Date or runtime-provided class keep the native receiver check. The
receiver-independent method lowering and the prototype reflection now mark
their frames as `this` boundaries, so lowering one class's members on top of
another method's frames (a super call reflecting the base) never reaches the
caller's `this`.
- TypedArray indexOf, lastIndexOf and includes on every element kind, typed
and checked-dynamic: strict equality (SameValueZero for includes) and
fromIndex as ToIntegerOrInfinity. A Buffer reached through a Uint8Array
value keeps Buffer's search.
- process.stdin 'readable' with read() and read(size), including sizes
above the read-ahead mark and input a once('readable') listener leaves
for a later 'data' listener. for await over process.stdin yields Buffers.
- Module bindings holding `new F()` of a constructor function can be read
and reassigned from other functions.
child_process and http2 events ran with no store, or with the context of
whichever socket dispatch delivered them. Node runs them in the context
of the handle or request that produces them.
child_process: a child, its piped stdout, stderr and stdin, and its IPC
channel keep the context of the spawn() or fork() call. 'spawn',
'error', 'exit', 'close', stdout's and stderr's 'data' and 'end', and the
channel's 'message' and 'disconnect' run in it, in the POSIX and the
Windows implementations. stdin's 'drain' and 'error' run in the context
of the latest write() call, its 'finish' in the context of its end()
call, and a send() callback in the context of its send() call.
http2: a session keeps the context it was created in, the
http2.connect() call for a client and the server's listen() context for
a server session, and the session's socket callbacks and deferred emits
run in it. A client stream keeps the context of its request() call, and
the frames that drive a stream's events (DATA, WINDOW_UPDATE, RST_STREAM,
and a client's HEADERS) and its deferred emits run in the stream's
context. A session remembers the stream its last lookup by id found, so
the context lookup and the frame's own handling share one search.
A server stream and its compatibility request and response run with no
store, as Node's do. An accepted h2c socket's own events run with no
store, as an accepted net socket's do, so a server.close() that waits for
its sessions calls back with no store; a TLS server's sockets keep the
listen() context, as before.
Corpus 7385 to 7389.
scr_dyn_bag_create_field and scr_dyn_is_class_capsule are declared by
the LLVM backend; their prototypes move from scr_json.c into scr_dyn.h,
which llvm-runtime-abi.test.ts checks the backend's declares against.
dyn.classIs went through the generic library call: retain the receiver,
call scr_dyn_class_is_key, release it (and buffer it as a cycle candidate).
A class's static property bag dispatch (%dyn.class.staticProperties) runs
one probe per compiled class for every untyped property read, so this cost
about 500 instructions per read in a Hono app. The probe now tests the
value's function tag inline, as the capsule probes test theirs, so LLVM
skips the chain for every other value, and borrows the receiver across a
literal key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Untyped code calling a method on an instance of a compiled JavaScript class
whose own properties live in a property bag materialized the instance's
whole checked view on every call (copying the bag, boxing each field and
attaching the prototype) only to read one member. Hono's Context declares
its methods as arrow-function fields, so every c.header() or c.json() from
middleware rebuilt an 18-property view.
The materializer of such a class gives the view exactly the bag's
string-keyed properties, the declared fields among them with their native
slot values, and the class's prototype. The compiler now emits those parts
as ScrDynTypedBagClassOps (bag, prototype, declared field names, field
getter) and binds them to the class's capsules, and scr_dyn_invoke resolves
a member that is an ordinary data property, own or inherited, from them,
calling it with the capsule as this. Accessors, read-only fields, capsule
prototype links and everything else still build the view.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A class binding may hold a subclass of the class it was declared with.
When the declared class has subclasses, a caught payload of that class is
now tested against the class the binding holds, as for other operands, so
a base-class instance no longer passes a test against a subclass.
Methods of Web objects held in untyped code (Request, Response, Headers,
ReadableStream, its reader, AbortSignal) answered member calls only by
static name, so a property read such as hono's `raw[key]()` or
`typeof req.json` saw undefined. A handle class now lists the methods its
invoke answers; a read returns one shared function per method that calls
invoke on its `this` and raises Node's ERR_INVALID_THIS TypeError (or a
rejected promise for the async operations) on another receiver. The in
operator sees the methods and the modeled properties.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The emitter journal that forked workers merge (#1919) records each class
object entry whole, and the entries carry baseNameSym beside nameSym.
The replay cast named only nameSym, which the native compiler refuses
(SC1090), so the self-hosted LLVM emitter did not build.
- An inspection refusal (the 'not supported yet' Error of insp.dyn)
propagates out of the emitted inspect helpers before they close their
frames and before util.inspect's layout options are restored. The open
frames, their indentation and the custom layout then shaped every later
console.log and util.inspect. A top-level render through helpers that
can reach a checked-dynamic view, a generator or a class instance now
runs in a lifted wrapper that takes insp.mark first and calls
insp.unwind in a finally. A render under breakLength, compact or sorted
restores the default layout in a finally the same way.
- A non-enumerable accessor that %o shows, and any accessor of a
checked-dynamic object, renders as [Getter], [Setter] or
[Getter/Setter], as Node prints it, instead of its value slot.
- Under %o, an array's non-enumerable own properties follow its named
ones in brackets (`[ 1, 2, [length]: 2, foo: 'x', [hid]: 3 ]`), as Node
prints them; corpus 6357 covers [length] ahead of named properties.
date.fromTime makes a Date from the time value a Date local holds and
reads no ambient state. The local's initializer is the Date expression
the fences witness.
The reflection gate turned on only for an untyped or Error-shaped
defineProperty target, so a helper taking `target: object` (or `{}`,
`Object`, a weak type, or a type parameter) installed a message or name
accessor that typed Error reads then skipped, returning the old slot
value. The gate now turns on for any target an Error may flow into: an
untyped or generic type, a type Error is assignable to, or an
Error-shaped type, alone or in a union or intersection.
e instanceof E where e is a catch binding and E a binding holding a class expression (var E = class extends Error {}) refused with "'instanceof' right-hand sides other than classes declared in the program". The binding holds exactly that class, so the test is the class's caught test (hono's SmartRouter fallback on UnsupportedPathError).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
entries(), keys() and values() on a checked-dynamic Headers value threw 'is not a function'. They now return live native iterators over the sorted header list, re-read on every step with set-cookie values one by one, as Node's Headers iterator does (hono's Context copies response headers this way).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Worklist passes that transform every function (the class-construction dispatch rewriting dyn.classBasePrototype) rebuild statement objects, so a recorded lazy bag store could be a detached copy. When the class gained prototype data later, only the copy was upgraded and the live store kept creating a bare {} bag: inherited methods read as undefined through the property bag (hono's SmartRouter.match once zod was in the program). Upgrades now also reach the stores as they stand in the generated bodies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An implicit-any package function specialized for a string argument lowered base?.[0] to the element-access refusal: the checker types the receiver any, so only the lowered string reached the string-index path. Hono's mergePath failed at startup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
s.match(p) and s.search(p) with an untyped pattern now choose at run time, as Node does: a RegExp is used as is (with its lastIndex state), any other value builds new RegExp(value). The checked-dynamic receiver form previously threw 'method calls like path.match on a string are not supported yet' (hono's RegExpRouter matcher).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Converting a header value to a ByteString read it one UTF-16 code unit at a
time through scr_str_char_code_at into a fresh buffer. An all-ASCII value,
which nearly every header is, is already its own ByteString, so it is now
returned as is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Finished fiber stacks went back to a spare pool that the event loop
unmapped whenever it was about to sleep. A server's loop sleeps between
nearly every pair of requests, so each request that awaited mapped, faulted
in and unmapped a fresh 512 KiB stack: on a Hono server mmap, munmap and the
page faults were about a fifth of its CPU time. Spares now outlive short
sleeps. At most once a second a sleep unmaps the spares that no fiber took
since the previous trim, and a sleep longer than two seconds unmaps them
all, so an idle program still returns the memory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Materializing the checked view of a JavaScript class instance copies its
property bag through scr_dyn_copy_property_descriptors, which built a key
string and a descriptor object per property and defined each through
scr_dyn_define_property (about 2k instructions per property). Plain objects
on both sides now copy each entry directly with the attributes, value or
accessor pair and own-key order the definition gives; properties the target
already has, non-extensible targets and other receivers keep the general
path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chris Tate