String storage can hold bytes that are not well-formed UTF-8: an HTTP
header value keeps the raw bytes a client sent. Encoding such a string
read past its end.
- scr_bytes_next_cp decoded any high byte as the lead of a sequence and
read up to three bytes after it without a bound. It now takes the
storage length, decodes only complete, well-formed sequences, and
returns any other byte as U+0000..U+00FF, advancing by one. That is
each such byte's value in Node, which decodes header values as latin1.
This covers latin1, ascii, binary and utf16le encoding, hex and base64
of non-ASCII text (which narrow through latin1), Buffer#write and
TextEncoder#encodeInto.
- base64 decoding read one byte past its input when the eight-character
groups ended exactly at the end.
The runtime's bytes unit test (built with ASan) encodes ill-formed
storage at every offset within a word and random high bytes, and
compares latin1, ascii and utf16le with a scalar reference. A corpus
program sends such header bytes to a server and encodes them as Node
does.
An intersection that restates an optional member as required with a
separately written element type (`Opts & { files: Array<{ path: string }> }`
over `files?: Array<{ path: string }>`) gives the member the type
`A[] & B[]`. The checker keeps both element literals, and no intersection
rule mapped an intersection of arrays, so the record was refused (SC2009).
When every constituent maps to one IR type that is not the dynamic value,
the intersection now maps to it. The rule runs only after every other
intersection rule declined, so intersections that already mapped keep their
mapping.
pi's NormalizedBuildSystemPromptOptions is such an intersection; it sits on
the chain from main()'s options to the extension API and refused main().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`length` and `byteLength` loaded the typed array's header with
`!invariant.load` (#2016). LLVM may move such a load down to its use,
past the release that frees the view, so `const slots = this.slots;
this.slots = next; return slots.length` returned a garbage number in
release builds. These reads are now ordinary loads that keep the
header's alias tag. Header loads that only bound or address an element
access stay invariant: their values reach only that access, which runs
while the view is alive, so typed-array loops still hoist the length
and data pointer.
Corpus typed-array-length-after-release covers a replaced field, a
deleted map entry and a rebound global.
`f!()`, `t[k]!()` and `o.cb!()` on a value that holds undefined threw
scriptc's checked-extraction message ("undefined is not representable in
the target union …"). The non-null assertion is erased in JavaScript, so
Node throws the call's own "<callee> is not a function". The checked
extraction behind an asserted callee now carries that message, with
V8's spelling of the callee: parentheses and non-null assertions dropped
and call results printed as `f(...)`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The comments on net.sockWrite and net.sockWritableLength still described
the unsent bytes; the runtime counts each write not yet completely sent in
full.
The close step drops a socket's listener lists so that a listener which
captures its socket does not keep it alive; the 'drain' list was not
among them. A once('drain') listener still pending when the peer
disconnected, or an on('drain') listener, held its socket and the
socket's buffers after 'close'. The close step now drops the 'drain'
listeners with the others.
A loop to a typed array's length reads the length again on every
iteration, so a body that assigns the array's binding changes the limit
for the next iteration. The strip-mined form took the length once per
block of 64 iterations, and after the body assigned a shorter array it
ran on to the block's end, reading past the new length.
The loop to a typed array's length is now strip-mined only when the
array is a local of the function that the body never assigns
(stableReceiver on the match); others keep the budget and test the
length on every iteration.
New corpus program: native-worker-length-loop-reassign.ts.
RSA_PSS_SALTLEN_AUTO recovers the salt length from the signature and
does not enforce the key's minimum salt length, as in Node (OpenSSL).
The runtime's exemption now says so, and corpus 8178's header, which
said the minimum was still enforced, describes what it checks.
Untyped functions built each member of an object literal with
scr_dyn_key_set: a lookup of the key in the new object, a walk of its
empty prototype chain, a second lookup before the append, and a hash of
the key to share its bytes. The first cached read of the object then
computed its shape from its keys, hashing each key again.
A member whose key is a constant string other than __proto__ now owns a
store cache site and calls scr_js_store_probe, which appends the member
through the cached shape transition, takes the key bytes from the shape,
and leaves the object shaped. Members the probe does not take (Error
field names, members past the 64th, a site's first object of a shape)
keep scr_dyn_key_set, as do computed keys and literals in module
initializers.
push() of an empty Buffer outside object mode put a zero-length entry
into the read buffer, and the chunks pushed after it stalled behind it:
a 'data' listener saw nothing more and a readline interface never
closed. Node's readableAddChunk adds no empty chunk outside object mode;
it clears the reading flag and may read more. The runtime now does the
same, as it already did for an encoded push that decodes to nothing.
A typed-array loop version in a worker program tested its bounds and
its views' ownership together: every view had to have no shared
storage. A loop over views of a SharedArrayBuffer always failed that
guard and ran the checked copy, testing every element's index.
The guard now tests the bounds first and the ownership after. When the
bounds hold and every view is unshared, the loop runs the owned copy as
before. When a view is shared, it runs a new third copy whose accesses
skip their bounds checks and keep the shared-or-local path, without
alias scopes. Versions with a UTF-16 units copy, and programs without
workers, are unchanged.
Corpus 8350 runs such loops over shared, unshared and mixed views, to
counts within and past the views and over subarrays, with a worker
writing through shared views. The emission test checks the split guard
and the shared copy's accesses.
Once a program creates a weak collection, every object freed afterwards
called into the weak-key table to remove entries keyed by it, although
almost none are keys: zod's validation freed 16.6 million objects against
23 keys. A per-thread bit filter indexed by the object's address now marks
every address that entered the table (cleared when the table empties),
and the free paths test it inline, so an object whose bit is clear makes
no call.
Since the probes began caching absent properties (#2186), an untyped
property read that reaches the load or get probe costs more than before:
- Receivers that are not ordinary objects, such as class instances, have
no shape and always miss, but they set up the probe's frame first. The
exported probes now return the miss for them before calling the probe
body, which stays out of line.
- Each matching entry was answered through an out-of-line call
(scr_js_entry_answer). It is inlined into the probe again.
dynamic-properties executed 3.1% more instructions than before #2186; it
now executes 0.4% fewer.
The fixture's loop iterated `[6, 7] as (number | undefined)[]` so that
its binding kept the union layout the LLDB check reads through
`item->tag` and `item->slot.arm0`. Since (T | undefined)[] stores T
elements, an array that never holds undefined gives a `number` binding,
and the check failed with "item is not a pointer".
The loop now iterates `[6, 7, undefined]`, whose binding needs the
union, and the check also reads the undefined arm's tag.
A versioned loop over a non-ASCII string passes the range of indexes it
reads: a counted loop's start and limit, or a while loop's counter and
bound. The runtime converts the string at once when that range has at
least one unit per 16 bytes of it, and otherwise counts the loop as one
indexed read, so a loop over a line of a long source text no longer
keeps a UTF-16 copy of all of it. The publish call is weighted as
unlikely, since loops re-entered over one string skip it.
Its replace callbacks receive checked-dynamic values where the lib types
their parameters any: captures a match can leave unset, and results the
checker types any.
The native frontend cache key included every SCRIPTC_* variable, so
turning SCRIPTC_TIMING on or off, or changing SCRIPTC_CACHE_DIR,
SCRIPTC_CACHE_MAX_MB, SCRIPTC_EMIT_WORKERS or
SCRIPTC_EMIT_WORKER_FUNCTIONS, reran the frontend on an unchanged
program. The frontend's output does not depend on these variables, so
the key now leaves them out. Every other SCRIPTC_* variable still keys
the entry.
parseFloat and the text of parseInt take a string, and the radix of parseInt
takes a number. An unannotated offset passed as their text, or a capture passed
as the radix, is no longer bound to its value's type; it stays checked-dynamic,
so the call compiles as it did before the binding.
Every file tsc-ts reads goes through scriptc's file system callbacks,
including the ~80 files of tsc-ts's own default library directory: one
round trip from the checker to the compiler and back for each. Those
files belong to the installed tsc-ts (the build caches key on its
executable's identity), and no build serves them differently.
When tsc-ts takes --default-libraries-from-disk, the native compiler
passes it to the checker it starts and to the shared checker server, so
tsc-ts reads those files itself; every other path keeps the callbacks.
Released tsc-ts versions reject the flag, so checker-features.ts asks
each tsc-ts executable once (tsc-ts --api --default-libraries-from-disk
with an empty input exits with 0 only when it knows the flag) and keeps
the answer in the native cache, keyed by the executable's identity. With
a tsc-ts that does not know the flag, builds run as before.
Edit builds of small programs through the shared checker server are
about 18 ms faster, and 6-9 ms faster without it.
TypeScript types the parameters of an inline replace callback after the
match `any`. An unannotated parameter that is never reassigned, whose
every read means the same for a string or number as for `any`, and that
receives a capture every match sets, the offset or the subject now takes
that value's type. String-search callbacks get the same treatment for the
offset and the subject.
scr_regex_replace_fn calls the closure directly in more cases:
- checked-dynamic parameters, which receive the boxed value Node passes at
their position (a capture or undefined, the offset, the subject, the
groups object, then undefined);
- `string | undefined` capture parameters, which receive NULL when the
match leaves the capture unset;
- a checked-dynamic result, converted with ToString;
- up to six parameters.
Callbacks of the earlier typed form compile to the same call, with a
kinds argument of 0, and run the same per-match work.
- fill with a string or Buffer value longer than one byte: writes the
value once, then doubles the filled prefix with memcpy, as Node does.
The value is copied with memmove, so a value that is a view of the
buffer being filled gives Node's result; the previous per-byte loop
read such a view while overwriting it. The loop also computed a
division per byte.
- swap16, swap32 and swap64: one load, byte swap and store per group,
through a local data pointer.
- toString("utf16le" | "ucs2"): four units below 0x80 copy as four bytes,
and other units outside the surrogate range are written inline (a
three-byte sequence as one four-byte store). Surrogates keep the
previous path. The result records its UTF-16 length (one unit per
input unit), or is marked ASCII, so `.length` does not walk it.
A number-keyed Map or Set with keys the direct index allows now moves to it
at its second entry rather than its fifth, so a map over a few small
integer keys (a histogram over 0..3) reads through the inline direct index
instead of the out-of-line linear scan.
Chris Tate