Stage S4 of the two-tier design: dynamic-tier code reads, writes and
calls properties through per-site inline caches keyed on hidden-class
shapes.
- Runtime: scr_js_object.c (dynTier) attaches shapes to the existing
checked objects: a shape is a node of the thread's transition tree
over key sequences, computed on an object's first cache miss, and
objects past 64 keys stay unshaped (dictionary mode). Attributes and
the prototype are tested live on every hit. The dyn-tier build of
scr_json.c (SCR_JS_TIER) resets a shape on every key-set change;
typed programs keep linking the ordinary build.
- Sites: ir/js-ic.ts recognizes the lowering's property helpers by
structure; calls to them from dynamic-tier functions, and method
dispatch outside module initializers, become sites with a zeroed
thread-local ScrJsIc. backend/llvm/js-ic.ts tests entry 0 inline
(own property or one prototype link), probes out of line, and keeps
the helper as the noinline cold slow path. Array length and dense
number-key element reads are inline.
- Numbers: jsval reads of number properties are immediates, and a jsval
number stored over an unshared number cell updates it in place; the
jsval pass feeds cache stores jsvals and stops boxing discarded
compound-assignment results. `%` and bitwise operators get integer
paths.
Static functions are untouched: typed programs compile to byte-identical
LLVM and executables, and every static function of programs with
dynamic code is byte-identical.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fixture builds and serializes an IR module by hand. Since IR version
17 serializes function tiers instead of deriving them on load, the loaded
module's main, which performs dynamic operations, validated as a static
function. Assign tiers as lowering does before serializing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch lowers toPrecision statically, but STATIC_NUMBER_METHODS still
lacked it, so the regenerated manifest kept stdlib.number.toPrecision as
unsupported/SC2012 and a determinism fence on it had no reach detector.
List it with its num.toPrecision witness and 0 to 1 arguments, like
toFixed, and regenerate the manifest; the compatibility outputs are
unchanged.
library-profile's remediation test used that id as its SC2012 fence;
it now names the SC2012 code family (diagnostic.sc2012), so the explicit
remediations key still competes with fence-supplied SC2012 text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
toPrecision lowers statically on this branch, so the two K14 tests that
needed a surface whose own refusal fires compiled instead. Use
zlib.brotliCompressSync: it has its own manifest id, the fallback types
declare it, and it refuses with SC2020 because the static runtime vendors
no Brotli codec. The id-keyed teaching and the fence teaching ride that
refusal as the note, as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A build now translates every WebAssembly module whose bytes it can see
(W2's discovery) into LLVM IR with a TypeScript translator
(packages/compiler/src/wasm/module.ts, translate.ts) and appends it to the
program module, so the existing LLVM helper optimizes, partitions and
caches it with the program. The program also emits scr_wasm_registry, a
portable table of module descriptors (scr_wasm_abi.h). At run time,
WebAssembly.compile, instantiate, validate, new Module and new Instance
find the translated module by the SHA-256 of its bytes; bytes the build did
not see reject with a CompileError. There is no interpreter and no JIT.
The runtime (scr_wasm.c, link-gated by the new `wasm` feature, handle tags
inside W0's headroom) implements the JavaScript API once, over
descriptors, with Node's semantics and messages: exports (functions,
memories, tables, globals), imports (functions, immutable globals, and
memories, tables and globals other instances export), every trap as
WebAssembly.RuntimeError, the CompileError, LinkError and RuntimeError
classes, compile and instantiate settling on a later turn, and
globalThis.WebAssembly as a value. On 64-bit Linux and macOS, memories sit
in 8 GiB guard reservations and a SIGSEGV/SIGBUS handler turns faults into
traps or stack exhaustion; async fibers get a guard page on first use.
Sanitizer builds and Windows check bounds and the stack explicitly. A
WebAssembly.Module crosses to workers through W0's transfer hook (W4).
W1's refusals become lowerings; the Memory, Table and Global constructors,
Module.imports/exports/customSections and the streaming functions still
refuse with SC2020. The globals: WebAssembly compatibility row moves to
partial.
Evidence: differential corpus programs for the API, TypeScript use and the
codemode worker shape, plus five programs executing about 9,300 commands
of the WebAssembly 2.0 spec suite; all match Node in the plain and
sanitized lanes. quickjs-wasi runs through its own glue, matching Node
(apart from a pre-existing non-wasm fence) and on par with or faster than
V8. The zero-cost gate leaves every non-wasm program byte-identical.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The frontend's node lists become node lists, { pos, end, nodes }, the
shape of tsc-ts's NodeList, so that the frontend can later read tsc-ts's
own nodes. AstNode's list getters return an AstNodeList, ts.NodeArray<T>
is that class, and the frontend reads a list's elements through nodes.
The lists already carried their positions on the wire.
The class is the type, not a structural interface, because native code
represents a class and a record differently.
A decoded file keeps each list's nodes array, as before, and each read
of a list field returns a new AstNodeList over it, so the file holds no
more objects than before. nodes keeps its identity; a list object is not
the same object on each read.
The change is mechanical: a type-aware rewrite of each list field read,
plus hand edits where lists are read through casts, generic accessors
or test mocks. The generated getters and types follow from
generate-ts7-ast-schema.mjs. AstFile and Ts7Session drop their unused
listMetadata hook.
node:test changes, matching Node 24.22:
- getTestContext() returns the context of the test, suite or hook whose
code is running: undefined at module top level, the root's context in
module-level hooks, the suite's in a suite body and in the suite's
hooks, and the test's in its body. In the afterEach and t.after hooks
of a subtest cancelled by its parent's timeout, it returns each hook's
owner.
- The context rides the AsyncLocalStorage snapshot under a reserved id,
so it follows a test across its awaits, into the async functions,
promise callbacks, timers and other callbacks it schedules, and into
concurrent subtests, which each see their own.
- The root's fullName is "<root>", as its name is.
- Optional chains over a test context, such as getTestContext()?.name,
lower.
AsyncLocalStorage enter and restore move into the always-linked async
core so the test runner can use them. The snapshot holds the node's
index in a table of live nodes, so a snapshot that outlives its node
answers undefined.
The get-test-context and get-test-context-cancelled fixtures compare
the contexts seen at each point with Node, plain and with SCRIPTC_SAN=1.
unshareNodes gives every occurrence of a repeated node its own object.
Nodes with children are copied by mapExprChildren and mapStmtChildren,
which spread the node and keep its type and location objects. Childless
nodes were copied by reparseExpr and reparseStmt, which stringify the
node and parse the text, copying the type and location objects as well;
on the three.js nodes fixture that took about 6 s.
Childless nodes are now spread too. Analyses key their facts by node
identity, which each copy still has of its own. The type and location
objects are shared as they already are in every copied node with
children and in every function without a repeated node. The emitted IR
is unchanged for every corpus program.
unshareNodes takes about 2 s on the three.js nodes fixture instead of
8 s, and compiling it to LLVM text takes 171 s instead of 178 s (median
of five interleaved runs).
everyExprChild, everyStmtChild, mapExprChildren and mapStmtChildren
switch over the node kind: 96 expression and 26 statement string cases,
which the engine tests one after another in source order. Every analysis
and rewrite walks the IR through them, and some of the most common kinds
were near the end: in the three.js nodes module, dynFrom, libCall and
dynCheck make up 27% of expression nodes and were the 64th, 94th and
96th cases.
The cases for the most common kinds now come first, in the order of how
often they occur in the three.js nodes and Effect fixtures. All other
cases keep their order, and no case changes. In those fixtures, seven
expression kinds make up 89% of expression nodes and four statement
kinds make up 88% of statements.
A full child walk of the three.js nodes module takes about 108 ns per
node instead of 154 ns. Compiling it to LLVM text takes 161 s instead
of 180 s (median of five interleaved runs), and the Effect schema
fixture 64 s instead of 69 s. The emitted IR is unchanged.
In a fused helper chain, take(n) sets the chain's done flag as it
delivers its nth value, so nothing is pulled after it. A flatMap later in
the chain tested the same flag in its inner walk and stopped after the
first flattened value: gen().take(2).flatMap((x) => [x, x + 10]) gave
[0, 10] where Node gives [0, 10, 1, 11].
A flatMap stage after a take now holds the flag while it walks its inner
iterable, and sets it again afterwards. A terminal that short-circuits or
a take later in the chain still stops the inner walk.
A compiled generator that reached an untyped value, as in
`function f(it) { return it.map(g) } f(gen())`, refused its iterator
helper calls with SC1071 at run time: the runtime's helpers could not
step a generator's capsule. Array destructuring of untyped values only
handled arrays, strings and bytes, so `const [a, b] = it` threw "is not
iterable" for generators, iterators, Maps and Sets.
Programs that box a synchronous generator and call a helper method or
destructure an untyped value now register, first thing in %main, the
checked getters that read a generator capsule's next and return methods
(scr_dyn_set_generator_members). With them:
- helper calls on a generator capsule run the runtime's helpers, which
step and close the generator through its own next() and return();
- reads of a helper name answer the runtime's helper function, so
`typeof it.map` is "function" and `it.reduce.call(it, f, init)` works;
- destructuring of any other iterable steps it through the iterator
protocol (scr_dyn_iter_take, and rest elements through
scr_dyn_iter_pack), closing an iterator that has values left.
A return() through an untyped value with no argument, or with undefined,
now completes with undefined as the typed .return() does, instead of
converting undefined to the generator's return type. This also fixes
for-of loops over untyped generators with a typed return value that exit
early.
Object.defineProperty with an object-literal descriptor that declares get
or set for a declared class field is refused at compile time with SC2020,
naming the field. JavaScript sources report it as a deferred fence, so
coverage lists the call. Other accessor descriptors still throw SC2020
when the call runs.
The native descriptor test now compiles a data descriptor change on a
declared field and compares the output with Node, and checks that an
accessor descriptor stays fenced.
`function make(C: typeof EventEmitter) { return new C(); }`,
`const kinds: ErrorConstructor[] = [TypeError, RangeError]` and
`(typeof Readable)[]` stopped at SC2020 (the type has no mapping) or
SC1090 (builtin classes as values). These classes are now class values:
the name in a TypeScript file (or a const alias of it) is the class
object, `typeof EventEmitter`, `typeof Readable` and ErrorConstructor-
style types map to class values, and parameters, arrays, Map values and
object fields hold them.
Construction through a value calls %C.construct, which builds the
instance with the runtime constructor the direct `new` uses (emitter.new,
a stream's newDyn without options, error.newOptions for Error and its
six standard subclasses). instanceof, typeof, .name and === answer as in
Node. A Duplex value widens into a `typeof Readable` slot, and stream
values widen into `typeof EventEmitter` slots, as the constructor ABIs
match; a union of such class values (`const kinds = [Readable,
Writable]`) is a value of their nearest common ancestor, and `new K()`
through it answers the checker's union of instances. `instanceof`
through a value that may be Writable keeps the Duplex rule at run time.
EventEmitter and stream values constructed with options, runtime class
values stored as untyped values or printed, statics read through a value,
and DOMException, AggregateError, AssertionError and SuppressedError
values report SC1090. The existing static lowerings
(`EventEmitter.setMaxListeners`, `Error.stackTraceLimit`, the events
module) are unchanged. JavaScript files keep the identity token.
Object.freeze, Object.seal and Object.preventExtensions accept a class
instance whose static type names the class, and Object.isFrozen,
Object.isSealed and Object.isExtensible answer for it as Node does.
Object.defineProperty with a string-literal key changes the value and
the writable, enumerable and configurable attributes of a declared
field, with Node's validation and errors.
Only hierarchies passed to these calls pay for them: they get a
per-instance integrity word and an attribute word per redefined field,
and each write to a declared field checks them first. A write to a
read-only field throws Node's TypeError in strict mode code and leaves
the field unchanged in sloppy mode code; a class field initializer on a
non-extensible instance throws "Cannot define property x, object is not
extensible". The instance's checked view carries the attributes, so
Object.keys, JSON.stringify, util.inspect and getOwnPropertyDescriptor
follow them. Readonly<C> over a class maps to the class.
Through an untyped value, freezing, sealing or preventing extensions of
a class instance throws SC2020 instead of doing nothing. The runtime's
"Cannot redefine property" and "Cannot add property" errors name the
property, as Node does.
moveTemp, retainValue and releaseValue are replaced by forms that state
where a reference goes or comes from: toHeap and toFrame, retainHeap and
retainFrame, releaseHeap and releaseFrame. A heap reference is one that
heap memory holds: a field, an array or map element, a capture box, a
union box, a module global, a promise or generator slot, the exception
cell or another runtime structure. A frame reference is one that a
local, a parameter, a return value, a stack object or a temporary holds.
Sites whose destination depends on the binding (a local or a module
global) or on the function (a coroutine's return fulfills its promise)
choose at emission time.
adoptHeap marks the runtime results whose +1 the runtime made from heap
memory and that become frame values: capture box reads, generator in and
out slots, and await results. The statement-frame release is renamed
releaseTemps.
Both forms of each operation emit what the old call emitted, so the
generated IR is unchanged.
console.log and util.inspect of a class instance list the properties
added to it after construction, after its declared fields. JavaScript
classes print their own properties in creation order: a field first
assigned in a method or under a condition appears only once it exists.
Such instances render through their checked-dynamic view when the class
has a property bag or is a JavaScript class; other classes keep the
generated inspect helper.
The runtime inspector detects cycles through the class instances it
reaches through views, so a cycle prints [Circular *N] instead of
expanding to the depth limit. A circular target's <ref *N> prefix counts
toward the 80-column line width, as in Node.
Capsules of a recursive class type carry the class's view operations,
so a nested instance prints with its class name.
A thread's default region asked for huge pages from its first chunk and
gave every class a 16 KiB segment, so in a program that only references
LifetimeRegion each thread committed whole 2 MiB pages and per-class
segment space for a few instances of each class. Default regions now use
small pages, and a class's segments in a default region start at 1 KiB
and double up to 16 KiB. Freeable regions keep their page and segment
policy.
A test name computed at run time took the function's name when it was
empty, which needs that name at compile time. For a function the
program received as a parameter, such as a helper that registers
`test(\`case ${label}\`, body)` for its callers, the call was refused,
where it compiled before. The name is now used as given in that case,
and the limitations page notes that an empty one stays empty, where
Node uses the function's name.
The test-name-forms fixture registers tests through such a helper and
compares them with Node, plain and with SCRIPTC_SAN=1. Without this
change it fails to compile.
Node 24's http.Agent installs a read guard on each socket it puts in
freeSockets: bytes that arrive while the socket is idle destroy it, so
they are never read as the response to the next request that reuses the
socket. scriptc discarded the bytes and kept the socket in the pool, so
the next request reused it (reusedSocket true, one connection) where
Node dials a new one.
The client connection's data hook now destroys the socket when it is in
an agent's free list. The socket leaves freeSockets and
totalSocketCount, and the next request through the agent opens a new
connection, as in Node.
Corpus 6200 covers an idle socket that receives a stray response.
scr_json.c and scr_inspect.c called scr_gen_tag, which lives in
scr_async.c. Libraries and the runtime's unit tests link those units
without scr_async.c, so their links failed on the undefined symbol.
Both now read the tag through scr_gen_tag_reader, defined in scr_json.c
and set at startup by scr_async.c. A generator capsule only exists when
the generator runtime is linked, so the pointer is always set when read.
When the last running worker parks, the trim helper now waits
SCR_SA_DISCARD_DELAY_MS (100 by default) before it returns the parked
workers' pages, and stops if a worker starts meanwhile. A program that
exits within the delay, such as a one-shot type check whose checkers finish
just before it reports and exits, no longer returns pages during its last
milliseconds. A thread that finds every arena claimed discards one waiting
arena and claims it, instead of running every waiting discard.
console.log and util.inspect of a generator object, an iterator helper,
or an array or string iterator were refused, and printing a Map or Set
iterator threw "util.inspect of a dynamic Array Iterator is not
supported yet".
Compiled generators now carry the tag their object prints with:
"Generator" or "AsyncGenerator" by default, "Iterator Helper" for the
helpers, "Array Iterator" and "String Iterator" for the iterators the
compiler builds as generators. The spawn wrapper sets it through the new
scr_gen_set_tag; an adapter over another generator copies that
generator's tag (scr_gen_copy_tag), and generators that stand in for an
object of another class, such as a Set iterator adapted into an
iterator-typed slot, keep refusing to print. They print as Node's
Object [<tag>] {} at any depth, and Object.prototype.toString answers
[object <tag>].
The runtime's native iterators print as Node does: Object [Array
Iterator] {} and Object [String Iterator] {}, and for Map and Set
iterators the entries the next steps would produce, without advancing,
under [Set Iterator], [Set Entries], [Map Iterator] or [Map Entries],
as [Object [Set Iterator]] past the depth limit and { } when none are
left. Object.prototype.toString answers [object Set Iterator] and the
other tags.
node:test changes, matching Node 24.22:
- test, it, describe, suite, their skip/todo/only twins and t.test take
Node's (name?, options?, fn?) forms: test(fn), test(options, fn),
test(options) and test() compile, as does describe(fn) and
describe(options, fn). The fallback declarations add the overloads.
- A missing or empty name is the function's name, or "<anonymous>", as
Node's Test constructor completes it. The name is the function
expression's or declaration's own name, or the binding name of a
const arrow or anonymous function; a name that is empty at run time
takes the same default.
- With both skip and todo, the test is skipped, and the directive message
is the skip string, else the todo string. The skip and todo method
twins override the option of the same name, so test.skip("x",
{ skip: "msg" }) reports a bare SKIP and it.skip("x", { todo: "msg" })
reports "msg". Before, the last option set the mode.
The limitations page notes that a thrown object or array that is not an
Error reports [object Object] in the failing section.
The test-name-forms fixture compares the names, directives and counts
with Node, plain and with SCRIPTC_SAN=1.
The runtime feature scanner's result is serialized as JSON, and the
self-hosted scanner lays its record out in the interface's field order.
asyncContext was initialized before dynAsync, while the interface declares
it after, so the self-hosted scanner's JSON put the key elsewhere than the
TypeScript one. The initializer now follows the interface order.
Changes that add a backend host hook or a lowering option appended it at
the end of ShapeHost, LowererMode and the Lowerer constructor's option
assignments, so concurrent additions edited the same lines. ShapeHost's
and LowererMode's members are now sorted by name with their comments, and
the constructor assigns the plain mode options in name order, followed by
the values derived from them in their previous order. Type-only and
reordering changes: the emitted LLVM is unchanged.
Each limitations partial held its whole text on one line (map-and-set.mdx
was a single 1,080-character line), so any two edits to the same partial
conflicted. The partials now put one sentence per line, with a bullet's
continuation lines indented two spaces. Markdown joins the lines, so the
rendered pages are unchanged.
scripts/limitations-partials.mjs reads a labeled bullet's indented
continuation lines as part of the bullet when it splits and joins the page,
and AGENTS.md states the convention.
scanRuntimeFeatures matched libCall names with long `fn === "a" ||
fn === "b"` chains. Adding a case at the end edited the previous last line
to add `||`, so changes that added cases to the same chain always
conflicted. Each chain is now a sorted module-level set (typed as IrLibFn,
so a misspelled name fails to compile), with prefix lists where a chain
also matched by prefix. The intrinsic method chains become sets too.
The features are unchanged: for every libCall in LIB_FN_SIGS and each
string, array and typed-array method the scan tests, the old and new
moduleRuntimeFeatures agree.
