- `%dyn.class.call` dispatch answers a promise for an untyped async method whose signature keeps the promise's payload. An async generator method also has the async flag, but its signature already returns the generator object, so the call now keeps that type. Before, a call from untyped code (`schema.issues(values)` over an `async *issues` method) failed IR validation with "type promise != return generator".
- thunkAsyncSlot keeps an async generator method's slot type the same way.
- Corpus 6419 adds an async generator method that the package's own untyped helper iterates with `next()`.
An untyped JavaScript async method whose result the compiler keeps as
`dyn` (its storage passes through untyped helpers) has a `dyn` return
on its signature: the promise's payload, not the promise. Two call paths
took that as the call's own type and failed the IR check ("call … type
dyn != return promise"):
- thunkAsyncSlot's `$own` adapter, made when a TypeScript override of
such a method keeps the inherited slot (an async-sema `acquire`
override). The slot's ABI is now the body's promise.
- `%dyn.class.call` dispatch from untyped callers (zod's `parseAsync`
and `safeParseAsync` through checked-dynamic receivers), which now
answers the promise.
Prototype data slots also skip method values that have no checked-
dynamic form (an async method's promise-returning signature) instead of
building an invalid slot.
From the int/bc round-5 build of the build-container entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With checked-dynamic stream slots, readable.unpipe() also unpipes every
JavaScript destination stream.pipeDyn registered from the source, oldest
pipe first. Each destination hears 'unpipe' and the source pauses, as in
Node's unpipe(), which empties every pipe. Before, those pipes stayed
attached and later chunks still reached them.
readMemargFlags took its reader as a `{ u32(): number }` record, and the
validator (Reader) and translator (WasmCursor) pass class instances. The
self-hosted compiler refuses a class instance in a record-typed parameter
(SC2002), so the self-hosted LLVM emitter, the native frontend programs
and the bootstrap seed builds failed. readMemargFlags now takes the
reader's u32 function, and each caller passes `() => r.u32()`.
Object.fromEntries(...) as T passed the entries through the
checked-dynamic bridge, which copies native arrays and records: an array
shared by two entries, or held elsewhere, became separate copies, and
writes through the asserted object no longer reached it. The bridge now
applies only when the entries' values are scalars or checked-dynamic
values, which pass by value or by identity; other entries keep the
exact-shape fence (SC2002). Corpus 6467 checks that entries held as
unknown keep their identity; diagnostics fixture
fromentries-aliased-entries.ts pins the fence.
The bakeability check tracks the unions it is inside as well as the
records, so a union reachable from itself through an array
(`type Tree = number | Tree[]`) reports SC1090 instead of recursing without
end. The message names both recursive records and recursive unions.
- Merge origin/main (e9fb01603); the import lines at the top of
lowerer.ts conflicted and both are kept.
- Corpus 6385 gains a wrapper whose block-local `args` alias shadows an
outer one in the same function; each call forwards its own arguments.
- EventEmitter.defaultMaxListeners on the untyped constructor is Node's
accessor over the default the typed EventEmitter reads: assignments
validate as validateNumber(arg, 'defaultMaxListeners', 0) does, and
getMaxListeners() of emitters without their own limit answers the new
value.
- dyn.builtinInstanceOf and dyn.functionInstanceOf link the
constructor-function unit and the units it calls (dyn-invoke, inspect,
symbol, emitter), so a program whose only use is `this instanceof F`
links.
- The legacy pipe's cleanup runs once: when the destination emits
'close' from end(), the cleanup still queued on the source's 'end'
finds the listeners removed and emit('end') answers true.
pipe() called from untyped JavaScript on a native stream went through
scr_stream_pipe directly, so a helper that piped into the converted
process.stdout or process.stderr ended it at the source's end, and later
writes through the program's NodeJS.WritableStream slots failed. The
stream view's pipe now calls scr_stream_pipe_general, which keeps end off
for those Writables, as Node's pipe() does for process.stdout and
process.stderr.
Adds corpus 6469.
A method call declared to return `this`, such as setEncoding, resolves to
its receiver's access path, so a 'data' listener on the stream that
`const out = child.stdout.setEncoding("utf8")` returns receives strings.
A setEncoding call that a preceding statement always evaluates (its
expression, a variable initializer, or the receiver of a method chain in
one of those) counts as preceding the listener. Only `new` and the
child_process factories (spawn, fork, exec, execFile) count as creating a
separate stream; any other call result may be a stream another binding
already holds.
Externrefs a guest holds are borrowed pointers. An import's result was
kept only until the outermost call returned, which was before the export
call converted its results to JavaScript, so a result created by an
import was freed before conversion. A table or global slot released the
reference it replaced at once, although the guest may still hold it in a
local after reading the slot. The kept references are now released after
the outermost caller has converted its results (scr_wasm_leave), and a
table or global store during a call keeps the reference it replaces until
then.
Checked memories (explicit bounds checks: sanitized builds, Windows)
grew with realloc, which can move the storage that memory.buffer and its
views alias. They now reserve the address space for their largest size
(mmap on POSIX hosts, VirtualAlloc on Windows) and commit pages as they
grow, so the base never moves. Hosts without address-space reservation
grow in place only until a buffer has been handed out; after that,
growth that would move the storage fails.
Tests: webassembly-externref-lifetimes.mjs (import results through an
export, table and global references replaced by the guest and by
JavaScript), webassembly-memory-growth.test.ts (views written after
growth from JavaScript and from the guest), and translate.test.ts cases
for memargs naming memory 0 explicitly and for local.tee operand types,
which b3bcbaaf7 made consistent with validation. Under SCRIPTC_SAN=1 the
two runtime tests report heap-use-after-free without these changes.
Merges main; internal/compatibility/generated/node-v24-backlog.json is
regenerated with pnpm node-compat.
- matchInferSignature reads a fixed-tuple rest as its positions, so
(...args: [string, number]) needs two arguments, and a positional
any[] pattern parameter matches only when the function's parameter
there accepts an array, as TypeScript's assignability does
(corpus 6398).
- Merge origin/main (200fe8d22); node-v24-backlog.json regenerated.
`totals[side] += n`, where `side` is a union of string literals naming
declared fields of one type, now dispatches over those fields: the
receiver and key evaluate once, the old value is read from the field the
key names, then the right side, then the write to that same field. Every
compound operator, prefix and postfix ++/--, and ??=/||=/&&= share the
path. A single literal key (spelled at the site or carried by a const)
reads and writes the field directly. A key smuggled outside its literal
type throws the fixed-shape TypeError of a keyed write miss.
A string key into a pure index-signature record (`counts[name] += 1`,
`counts[name]++`) reads the entry, NaN for a missing one under numeric
operators, and inserts or replaces it.
Keys naming fields of different types, class instances and JavaScript
sources keep their refusals.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- http.request, https.request and get validate each name and value of a
flat [name, value, ...] headers array, as Node's _storeHeader does: a
name that is not an HTTP token throws ERR_INVALID_HTTP_TOKEN, a value
with an invalid character throws ERR_INVALID_CHAR, and an odd length
throws ERR_INVALID_ARG_VALUE with the inspected array. The
[[name, value], ...] entry form throws the options fence.
- A closing socket drops its 'lookup' listeners with its other listeners,
so a listener that holds the socket no longer keeps it alive.
- The options-record diagnostics snapshot no longer expects the
socketPath refusal.
The export-alias rewrite skipped a whole function when a let or const
anywhere inside it declared the alias's name, so the function's other
references to the alias kept the alias name after its declaration was
removed. A function now shadows the alias only through its parameters,
its own name, its vars and the declarations directly in its body; a
block, case block, catch clause or for loop shadows it through its own
declarations, and the walk skips just that scope.
- A checked-dynamic entry of a tuple Promise.all goes through
PromiseResolve (`dyn.promiseResolve`): a native promise is itself, a
thenable adopts its settlement through its resolve job, and any other
value fulfills. Before, a thenable fulfilled the slot with the object.
- Tuple fields read their entry by position. Shape fields are sorted by
name, so tuples of more than ten entries paired fields with the wrong
entries.
- Merge origin/main (e1c27176a).
- matchInferSignature answers false when a function needs more arguments
than a fixed-parameter pattern passes, as TypeScript's assignability
does (corpus 6398).
- Record corpus costs for the programs this change adds.
Chris Tate