zod 4 probes `navigator?.userAgent?.includes("Cloudflare")`. Node's
navigator global is never nullish and has no value form here, so the
optional step is the plain member read: `navigator?.userAgent` folds to
the same `Node.js/<major>` literal as `navigator.userAgent`, instead of
lowering the navigator object as a value and refusing at run time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zod 4 saves and restores the limit through an alias,
`const E = "captureStackTrace" in Error ? Error : null`. The interned
Error constructor value now answers `stackTraceLimit` from the same limit
the static member and stack capture use, and numeric writes set it, so
`E.stackTraceLimit` reads 10 instead of undefined and `E.stackTraceLimit = 0`
reaches `Error.stackTraceLimit`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
emitInlineAtomicsOp read its typed array with emitExpr, so every Atomics
call on a local array retained the array before the atomic instruction and
released it after, two out-of-line calls around one instruction. The
array now goes through emitBorrowedInput: an unchanged, unboxed local owns
it across the later operands and the operation, and the instruction and
scr_atomics_op only read it. Fields, globals, captures and bindings an
operand can reassign keep their own reference.
The charCodeAt reads that stand for rewritten charAt reads (one-unit
tests and switches) recorded the charAt each stands for in a
module-level WeakMap. Compiler sources keep such caches on their
owners: the map now belongs to the emitter (charAtUnitReads), and
charAtUnitRead takes it.
A local number[] that only compiled element operations reach, and whose
every stored element the int32 slot analysis proves an int32 (never -0),
is now stored as SCR_ELEM_I32: 4-byte int32 slots, with state bytes once
it holds a hole or undefined, as for every array. Element reads give
consumers an exact int32, so indexing with an element skips the double
round trip, and the slots take half the memory.
The runtime's dense slot accessors convert between the int32 slot and the
double, so its double-valued entry points serve int32 arrays unchanged;
growth, copies, fill and length changes use the 4-byte width.
ir/int32-arrays.ts proposes the candidates and inlines their element-reader
helper calls; the int32 slot analysis keeps the proven ones, and
selectInt32Arrays rewrites the module for exactly those, so a program
without an int32 array emits the same LLVM IR as before.
The LLVM emitter builds a module as parts and joined them into one
string: on a large program such as tsc-ts the parts and the 150 MB joined
text were live together at the end of emission. The native compiler only
writes, escapes and hashes the text, so it now takes the emitter's parts
(emitLlvmModuleParts) and never joins them. Consecutive small parts are
joined into batches of about 1 MiB as they are written, escaped or hashed
(joinedParts), so the many small parts cost few calls. A frontend cache
hit reads the text back as one part. The three emission entry points
share one module pipeline (moduleEmitter).
A JavaScript `var` took the checker's type of its initializer, which no
later write is checked against in a JavaScript file. js-yaml 4.1.1 failed
on every timestamp with "a 'string' value is not representable in the
target union": its `var fraction = 0` holds the fraction's digits as a
string while it pads them (`fraction = match[7].slice(0, 3)`). Every YAML
error also threw the "assignment to non-variables" fence instead of the
YAMLException, because its error mark is a `var` object literal that
gains a member (`mark.snippet = snippet(mark)`).
- A `var` whose writes the declared type cannot hold is checked-dynamic,
by the rules `let` already uses (jsBindingHasOpenWrites), and so is a
`var` whose object literal gains members or carries methods
(jsDeclarationExpandsObject, shared with `let` and `const`).
- `+=` of a string onto a number or boolean binding (`width += "px"`)
counts as such a write, for `var` and `let`.
- A JavaScript function that returns such a binding returns a
checked-dynamic value (an async one a promise of one) instead of the
initializer's type. A string binding that is only appended to stays a
string.
A record or class instance converted to a string-keyed dictionary type
(`Record<string, V>`, `{ [key: string]: V }`) was copied field by field
into a native dictionary record, directly, through a dictionary parameter,
or through a `{}`, `object` or `unknown` binding or parameter. Writes
through the dictionary missed the original object, and the dictionary was
never `===` to it, where under Node it is the same object.
ClassProtocols now marks a dictionary value type when a dictionary of that
value type receives an existing object (a binding, member, element or
`this` whose type is a program class instance, a record with declared
properties, or a `{}`, `object` or `unknown` binding or parameter that
holds one), and the program writes through, compares or passes to a
whole-object observer a dictionary of that value type. usesCheckedIdentity
answers true for those dictionaries, so they lower to checked-dynamic
storage, which holds the original object. Dictionaries of `unknown` or
`any` values are checked-dynamic already and are not marked.
The dictionary case of SC6001 is removed, since these conversions now keep
the object.
`C.call(...)` through a class value typed as `Base` may run a subclass's own
static `call`, which Node calls instead of the class constructor. The
constructor-call lowering now applies only when no class the receiver can
hold declares a static `call` or `apply`: the class and its bases (any
static member of that name, including accessors, fields without
initializers and computed names), and, for a receiver that may hold a
subclass, every subclass. Otherwise the call keeps its existing
diagnostic.
A Date is a refcounted object holding its time value, shared with the
checked-dynamic Date handle, so it keeps its identity through unknown.
Dates compile in arrays (includes, indexOf, lastIndexOf, join, default
sort by toString() text), in Date | undefined and Date | null slots, as
Map and Set keys and values, in index signatures, and in records, tuples,
class fields, closures, promises and generators. === compares identity,
relational operators compare time values, new Date(date) makes a new
Date, and JSON.stringify writes toJSON().
Closes#225
Co-authored-by: Max B <max@tfq.at>
Merged with current main, the hole fact for stores through dynamic views
fired on the emitter's per-feature state (`states[slot] = create(emitter)`
in emitter-state.ts writes past the end of `emitter.moduleStates`, an
`unknown[]`). The viewed element types then widened reads of the IR
function arrays, and the object spreads of `IrFunction | undefined` in
unshare.ts, callback-specialization.ts and constant-globals.ts were
refused when the LLVM emitter bootstraps.
A receiver that only holds the array its declaration creates (a const
binding or a readonly property whose initializer is an array literal,
`new Array` or `Array.of`/`Array.from`, possibly through further such
bindings) is never a view of a typed array, so stores through it add no
hole fact.
Converting a dynamic value into a union (`JSON.parse(text) as T`, a cast
from `any`) tries the arms in order and builds the first arm whose literal
discriminator and whole structure match. The builder of that arm converts
its members, and a member typed as another union matched its arm's
structure again. Every value was matched once per union around it, so
converting a tree of depth d cost about d times as much as a flat one.
The arm a union matched now builds as a trusted conversion
(scr_dyn_trust_enter). Inside it, a nested union picks an arm without
matching the arm's structure, which the enclosing match already checked,
when the value's arm is known: a plain object's arm by its literal, when
the arms' literals are disjoint and no arm without a literal takes plain
objects, or the only arm that takes plain objects (a record) or arrays (an
array), as in an optional or nullable member. Other unions, and values that
are not plain objects or arrays, match as before. Getters and proxy traps
run outside the trusted conversion. Failed conversions throw the same
TypeError with the same path.
Arrays the checker types with unknown elements are stored checked-dynamic,
and their methods dispatch on the runtime array. splice was missing from
that dispatch table, so unknown[] receivers refused it, including generic
bodies instantiated at unknown (pool.splice(i, 1) in a sample<T> helper
gets such an instantiation once a program has a dynamic tier). The
runtime's dynInvoke already implements splice; the table now names it,
and arrays of unknown elements take the dispatch from the array-method
lowering.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every evaluation of `globalThis` as a value built an array literal of
every name the global type declares (hundreds of strings) and registered
each one in the known-name table again. A server that reads a singleton
through `globalThis` per request spent about a tenth of its time there.
Emit the name table as one immortal static array per program (the
tagged-template site array, keyed by its contents), and return the
global object at once when the runtime sees a table it has already
registered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The cycle walk resolved only identifiers, so a static field initializer or static block that called a method through 'this' did not reach the method, and its reads of a cycle binding declared later lost their temporal-dead-zone checks. 'this' in static code now reaches the class's stored unit, as naming the class does.
The poller test recorded every initial deadline as the same start time
plus the delay, while the poller reads the clock at each arm call; when
arming the 2,000 timers took over 1 ms, the recorded order could differ
from the delivered one by more than the assertion's slack. Each deadline
now counts from the time read just before its scrp_timer_arm call, as
the re-arm loop's do, and a 3 ms pause halfway through arming keeps the
test exercising that case.
