mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-11-03 07:54:40 +08:00
Chris Tate
d64f18d2a8
`new kinds[i](args)` over an array of class values read the element and narrowed it to the class value before the arguments ran, so an index past the end threw "is not a constructor" without evaluating them. JavaScript evaluates the arguments first: the construction is now a call of a lifted helper (checkedElementConstruction) that takes the element read and the arguments, in that order, then runs the check and constructs. Keeping the arguments in one call also keeps a spread's argument pack alive until every argument has read it. A checked class-value boundary accepted every subclass's class value into a base class's slot, so construction through the slot could call a subclass constructor that takes different arguments with the base constructor's. It now accepts only the subclasses whose class-value constructor takes the same arguments (classValueAbiEquals, the rule the classval upcast validator already applied); any other subclass fails the check with a TypeError.