@gjsify/napi 0.22.0

package/src/cc/env.cc

@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: MIT
+// @gjsify/napi — env lifecycle, handle arena, GC tracer, handle scopes.
+//
+// Reference: refs/node/src/js_native_api_v8.{h,cc} (Node.js contributors,
+// MIT) for the napi_env/handle-scope semantics; tracer pattern adapted from
+// GJS's own context tracer (refs/gjs/gjs/context.cpp:343-353,689 —
+// JS_AddExtraGCRootsTracer + JS::TraceEdge; GNOME contributors, MIT/LGPLv2+).
+
+#include "common.h"
+
+namespace gjsify_napi {
+
+// ---- HandleArena ----
+
+JS::Heap<JS::Value>* HandleArena::slotAt(size_t index) {
+    return &chunks_[index / kArenaChunkSlots]->slots[index % kArenaChunkSlots];
+}
+
+JS::Heap<JS::Value>* HandleArena::push(const JS::Value& value) {
+    if (top_ == chunks_.size() * kArenaChunkSlots) {
+        chunks_.push_back(std::make_unique<ArenaChunk>());
+    }
+    JS::Heap<JS::Value>* slot = slotAt(top_);
+    *slot = value;  // JS::Heap assignment runs the post barrier
+    top_++;
+    return slot;
+}
+
+void HandleArena::popTo(size_t mark) {
+    for (size_t i = mark; i < top_; i++) {
+        // Immediate release, matching V8 handle-scope close semantics; the
+        // JS::Heap assignment runs the pre barrier for the vacated value.
+        *slotAt(i) = JS::UndefinedValue();
+    }
+    top_ = mark;
+}
+
+void HandleArena::trace(JSTracer* trc) {
+    for (size_t i = 0; i < top_; i++) {
+        // Marks AND relocates: a moving GC updates the slot in place, so
+        // every outstanding napi_value pointer stays valid.
+        JS::TraceEdge(trc, slotAt(i), "gjsify-napi arena slot");
+    }
+}
+
+void HandleArena::clearAll() {
+    popTo(0);
+    chunks_.clear();
+}
+
+// ---- env tracer ----
+
+// Walk a RefTracker list, invoking the virtual Trace (Reference traces its
+// strong slot; weak slots are deliberately NOT traced — the sweep callback
+// owns them).
+static void trace_ref_list(JSTracer* trc, const RefTracker* head) {
+    for (RefTracker* t = head->next(); t != nullptr; t = t->next()) {
+        t->Trace(trc);
+    }
+}
+
+void trace_env(JSTracer* trc, void* data) {
+    auto* env = static_cast<napi_env>(data);
+    env->arena.trace(trc);
+    trace_ref_list(trc, &env->reflist);
+    trace_ref_list(trc, &env->finalizing_reflist);
+}
+
+napi_value arena_push(napi_env env, const JS::Value& value) {
+    return reinterpret_cast<napi_value>(env->arena.push(value));
+}
+
+}  // namespace gjsify_napi
+
+// ---- napi_env lifecycle ----
+
+napi_env__::napi_env__(JSContext* cx_in, GjsContext* gjs, int32_t api_version,
+                       void* handle, std::string file)
+    : cx(cx_in),
+      gjs_context(gjs),
+      module_api_version(api_version),
+      dl_handle(handle),
+      filename(std::move(file)),
+      exports(cx_in),
+      global(cx_in, JS::CurrentGlobalOrNull(cx_in)),
+      // MUST be ctor-initialized with the context: a default-constructed
+      // PersistentRooted is NOT registered with the runtime — assigning to
+      // it later stores the pointer UNROOTED and the map dies at the next
+      // GC (found by the P0.3 gate: SetWeakMapEntry crashed in the dead
+      // map's zone-tracked allocator).
+      wrap_map(cx_in) {
+    JS_AddExtraGCRootsTracer(cx, gjsify_napi::trace_env, this);
+}
+
+napi_env__::~napi_env__() {
+    teardown();
+    // Free any async_work the addon never deleted (its completion already ran,
+    // or it was created-but-never-queued). Self-deleted works are already
+    // unlinked, so this cannot double-free. Runs at context dispose, no JS.
+    gjsify_napi::destroy_env_async_works(this);
+    // Bundle memory is freed HERE, not in teardown(): function objects
+    // created by this env keep the bundle pointer in their reserved slot,
+    // and JS may still call them after an early teardown — the trampoline
+    // bails on env->torn_down, dereferencing only the still-live bundle.
+    // The destructor runs at context dispose, when no JS runs anymore.
+    for (gjsify_napi::CallbackBundle* bundle : bundles) {
+        delete bundle;
+    }
+    bundles.clear();
+}
+
+void napi_env__::teardown() {
+    // §5e order — the node-gi SIGSEGV lesson. Steps 1-4 run with JS fully
+    // callable (finalizers may call napi and create values, so the arena,
+    // tracer and can_call_into_js MUST stay live until step 5).
+    if (tearing_down || torn_down) {
+        return;
+    }
+    tearing_down = true;
+
+    // 1. env cleanup hooks, LIFO (napi_add_env_cleanup_hook — the
+    //    better-sqlite3 Addon::Cleanup slot).
+    while (!cleanup_hooks.empty()) {
+        CleanupHook hook = cleanup_hooks.back();
+        cleanup_hooks.pop_back();
+        hook.fn(hook.arg);
+    }
+
+    // 1b. finalize threadsafe functions (§7): a release/abort issued by a
+    //     cleanup hook above scheduled a JS-thread finalize dispatch that can
+    //     never run — the main context stops iterating once GjsContext
+    //     dispose began — so it is executed synchronously here, while JS is
+    //     still fully callable. Never-released tsfns are force-closed too.
+    gjsify_napi::finalize_env_tsfns(this);
+
+    // 1c. drain pending async_work completions (§?): a work queued in the last
+    //     tick before dispose has a g_idle completion that can no longer fire —
+    //     run it here, JS still callable, exactly like the tsfn finalize above.
+    gjsify_napi::drain_env_async_works(this);
+
+    // 2. drain finalizers already queued by earlier GC deaths.
+    gjsify_napi::drain_finalizer_queue(this);
+
+    // 3. finalize the ref lists: finalizing refs FIRST (their finalizers
+    //    may still delete plain refs — js_native_api_v8.h:121-130), then
+    //    plain refs. Instance data is linked in finalizing_reflist like
+    //    Node's TrackedFinalizer, so it finalizes here too. Deaths queued
+    //    by GC during these callbacks are drained afterwards.
+    gjsify_napi::RefTracker::FinalizeAll(&finalizing_reflist);
+    gjsify_napi::RefTracker::FinalizeAll(&reflist);
+    gjsify_napi::drain_finalizer_queue(this);
+
+    // 4. (instance data handled in step 3 — see TrackedFinalizer::Finalize.)
+
+    // 5. block further calls into JS through this env.
+    can_call_into_js = false;
+    torn_down = true;
+
+    // 6. drop every root this env owns — all before JS_DestroyContext;
+    //    a live PersistentRooted/JS::Heap past that point is the UAF class.
+    //    (GJS removes its own tracer the same way before destroying the
+    //    context, refs/gjs/gjs/context.cpp:457.)
+    JS_RemoveExtraGCRootsTracer(cx, gjsify_napi::trace_env, this);
+    exports.reset();
+    global.reset();
+    wrap_map.reset();
+    arena.clearAll();
+    scopes.clear();
+    weak_refs.clear();
+    pending_finalizers.clear();
+}
+
+// ---- handle scopes (js_native_api_v8.cc:2927-2953 semantics) ----
+
+napi_status NAPI_CDECL napi_open_handle_scope(napi_env env,
+                                              napi_handle_scope* result) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    env->scopes.push_back({env->arena.top()});
+    // Encode the 1-based depth: no allocation, close validates LIFO order.
+    *result = reinterpret_cast<napi_handle_scope>(
+        static_cast<uintptr_t>(env->scopes.size()));
+    return gjsify_napi::clear_last_error(env);
+}
+
+namespace gjsify_napi {
+
+// Shared close path: LIFO validation + escapable-type matching (stricter
+// than Node's count-only check — a type-confused close is caught, correct
+// matched-pair usage is unaffected).
+static napi_status close_scope(napi_env env, uintptr_t depth,
+                               bool expect_escapable) {
+    if (env->scopes.empty() || depth != env->scopes.size() ||
+        env->scopes.back().escapable != expect_escapable) {
+        return set_last_error(env, napi_handle_scope_mismatch);
+    }
+    env->arena.popTo(env->scopes.back().mark);
+    env->scopes.pop_back();
+    return clear_last_error(env);
+}
+
+}  // namespace gjsify_napi
+
+napi_status NAPI_CDECL napi_close_handle_scope(napi_env env,
+                                               napi_handle_scope scope) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, scope);
+    return gjsify_napi::close_scope(env, reinterpret_cast<uintptr_t>(scope),
+                                    /* expect_escapable = */ false);
+}
+
+// ---- escapable handle scopes (js_native_api_v8.cc:2955-3002 semantics) ----
+
+napi_status NAPI_CDECL napi_open_escapable_handle_scope(
+    napi_env env, napi_escapable_handle_scope* result) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    // Reserve the escape slot in the PARENT region first; the scope's mark
+    // then sits ABOVE it, so closing releases everything but the slot.
+    JS::Heap<JS::Value>* escape_slot = env->arena.push(JS::UndefinedValue());
+    gjsify_napi::HandleScopeRec rec;
+    rec.mark = env->arena.top();
+    rec.escapable = true;
+    rec.escape_slot = escape_slot;
+    env->scopes.push_back(rec);
+    *result = reinterpret_cast<napi_escapable_handle_scope>(
+        static_cast<uintptr_t>(env->scopes.size()));
+    return gjsify_napi::clear_last_error(env);
+}
+
+napi_status NAPI_CDECL napi_close_escapable_handle_scope(
+    napi_env env, napi_escapable_handle_scope scope) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, scope);
+    return gjsify_napi::close_scope(env, reinterpret_cast<uintptr_t>(scope),
+                                    /* expect_escapable = */ true);
+}
+
+napi_status NAPI_CDECL napi_escape_handle(napi_env env,
+                                          napi_escapable_handle_scope scope,
+                                          napi_value escapee,
+                                          napi_value* result) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, scope);
+    GJSIFY_NAPI_CHECK_ARG(env, escapee);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    const size_t depth = reinterpret_cast<uintptr_t>(scope);
+    if (depth == 0 || depth > env->scopes.size()) {
+        return gjsify_napi::set_last_error(env, napi_handle_scope_mismatch);
+    }
+    gjsify_napi::HandleScopeRec& rec = env->scopes[depth - 1];
+    if (!rec.escapable) {
+        return gjsify_napi::set_last_error(env, napi_handle_scope_mismatch);
+    }
+    if (rec.escape_called) {
+        return gjsify_napi::set_last_error(env, napi_escape_called_twice);
+    }
+    *rec.escape_slot = gjsify_napi::napi_value_to_js(escapee);
+    rec.escape_called = true;
+    *result = reinterpret_cast<napi_value>(rec.escape_slot);
+    return gjsify_napi::clear_last_error(env);
+}

package/src/cc/error.cc

@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: MIT
+// @gjsify/napi — napi_status bookkeeping + exception mapping (§6).
+//
+// Design: SpiderMonkey's own pending-exception slot IS the env exception
+// state — no env-side mirror, no TryCatch dance. V8-Node needs the mirror
+// because v8::TryCatch swallows the engine state at each napi boundary and
+// rethrows at CallIntoModule exit; on SM a pending exception set on the
+// JSContext simply stays there across C calls until cleared.
+//
+// Reference: refs/node/src/js_native_api_v8.cc (Node.js contributors, MIT) —
+// error_messages table (cc:889-914, copied verbatim), napi_get_last_error_info
+// (cc:916-939), napi_throw (cc:2219-2229), napi_is_exception_pending
+// (cc:3064-3072), napi_get_and_clear_last_exception (cc:3074-3090).
+
+#include "common.h"
+
+#include <cstdio>
+#include <cstring>
+
+namespace gjsify_napi {
+
+napi_status set_last_error(napi_env env, napi_status status,
+                           uint32_t engine_error_code, void* engine_reserved) {
+    env->last_error.error_code = status;
+    env->last_error.engine_error_code = engine_error_code;
+    env->last_error.engine_reserved = engine_reserved;
+    env->last_error.error_message = nullptr;  // filled lazily on request
+    return status;
+}
+
+napi_status clear_last_error(napi_env env) {
+    return set_last_error(env, napi_ok);
+}
+
+}  // namespace gjsify_napi
+
+// Copied verbatim from refs/node/src/js_native_api_v8.cc (error_messages).
+// Warning: keep in-sync with the napi_status enum.
+static const char* error_messages[] = {
+    nullptr,
+    "Invalid argument",
+    "An object was expected",
+    "A string was expected",
+    "A string or symbol was expected",
+    "A function was expected",
+    "A number was expected",
+    "A boolean was expected",
+    "An array was expected",
+    "Unknown failure",
+    "An exception is pending",
+    "The async work item was cancelled",
+    "napi_escape_handle already called on scope",
+    "Invalid handle scope usage",
+    "Invalid callback scope usage",
+    "Thread-safe function queue is full",
+    "Thread-safe function handle is closing",
+    "A bigint was expected",
+    "A date was expected",
+    "An arraybuffer was expected",
+    "A detachable arraybuffer was expected",
+    "Main thread would deadlock",
+    "External buffers are not allowed",
+    "Cannot run JavaScript",
+};
+
+napi_status NAPI_CDECL napi_get_last_error_info(
+    node_api_basic_env basic_env, const napi_extended_error_info** result) {
+    napi_env env = const_cast<napi_env>(basic_env);
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+
+    // Must reference the LAST message in napi_status (no napi_status_last in
+    // the ABI — mirror of js_native_api_v8.cc:925-930).
+    constexpr int last_status = napi_cannot_run_js;
+    static_assert(sizeof(error_messages) / sizeof(*error_messages) ==
+                      last_status + 1,
+                  "Count of error messages must match count of error values");
+
+    const napi_status code = env->last_error.error_code;
+    env->last_error.error_message =
+        (code >= 0 && code <= last_status) ? error_messages[code] : nullptr;
+    if (code == napi_ok) {
+        gjsify_napi::clear_last_error(env);
+    }
+    *result = &env->last_error;
+    return napi_ok;
+}
+
+napi_status NAPI_CDECL napi_throw(napi_env env, napi_value error) {
+    GJSIFY_NAPI_PREAMBLE(env);
+    GJSIFY_NAPI_CHECK_ARG(env, error);
+    // ANY value may be thrown, including null/undefined (the contract
+    // better-sqlite3 depends on — never normalize, never abort).
+    JS::RootedValue v(env->cx, gjsify_napi::napi_value_to_js(error));
+    JS_SetPendingException(env->cx, v);  // ExceptionStackBehavior::Capture
+    return napi_ok;  // preamble already cleared last_error
+}
+
+napi_status NAPI_CDECL napi_is_exception_pending(napi_env env, bool* result) {
+    // No preamble — must work WHILE an exception is pending.
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    *result = JS_IsExceptionPending(env->cx);
+    return gjsify_napi::clear_last_error(env);
+}
+
+napi_status NAPI_CDECL napi_get_and_clear_last_exception(napi_env env,
+                                                         napi_value* result) {
+    // No preamble — must work WHILE an exception is pending.
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    if (!JS_IsExceptionPending(env->cx)) {
+        *result = gjsify_napi::arena_push(env, JS::UndefinedValue());
+    } else {
+        JS::RootedValue exc(env->cx);
+        JS_GetPendingException(env->cx, &exc);
+        JS_ClearPendingException(env->cx);
+        *result = gjsify_napi::arena_push(env, exc);
+    }
+    return gjsify_napi::clear_last_error(env);
+}
+
+// ---- error construction (§6) ----
+//
+// The create_* family has NO preamble and must work WHILE an exception is
+// pending (better-sqlite3 builds SqliteErrors on error paths). JS::CreateError
+// (js/ErrorReport.h:553) constructs the error object directly — no JS runs,
+// so pending state is never disturbed.
+
+namespace gjsify_napi {
+
+static napi_status create_error_object(napi_env env, JSExnType type,
+                                       napi_value code, napi_value msg,
+                                       napi_value* result) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, msg);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    JS::Value msg_v = napi_value_to_js(msg);
+    GJSIFY_NAPI_RETURN_STATUS_IF_FALSE(env, msg_v.isString(),
+                                       napi_string_expected);
+    // `code` must be a string when given (set_error_code, cc:2231-2260).
+    JS::Value code_v = JS::UndefinedValue();
+    if (code != nullptr) {
+        code_v = napi_value_to_js(code);
+        GJSIFY_NAPI_RETURN_STATUS_IF_FALSE(env, code_v.isString(),
+                                           napi_string_expected);
+    }
+
+    JS::RootedString msg_str(env->cx, msg_v.toString());
+    JS::RootedObject stack(env->cx);
+    // fileName must be a real (empty) string — ErrorObject::create
+    // dereferences it (null handle segfaults, mozjs-140 finding).
+    JS::RootedString file_name(env->cx, JS_GetEmptyString(env->cx));
+    JS::Rooted<mozilla::Maybe<JS::Value>> cause(env->cx, mozilla::Nothing());
+    JS::RootedValue error(env->cx);
+    if (!JS::CreateError(env->cx, type, stack, file_name, 0,
+                         JS::ColumnNumberOneOrigin(), nullptr, msg_str, cause,
+                         &error)) {
+        // OOM: don't clobber a pending exception the caller may hold.
+        return set_last_error(env, napi_generic_failure);
+    }
+    if (code != nullptr) {
+        JS::RootedObject error_obj(env->cx, &error.toObject());
+        JS::RootedValue code_rooted(env->cx, code_v);
+        // Plain data property on a fresh error object — no JS runs
+        // (assignment-equivalent attributes: enumerable+writable+configurable).
+        if (!JS_DefineProperty(env->cx, error_obj, "code", code_rooted,
+                               JSPROP_ENUMERATE)) {
+            return set_last_error(env, napi_generic_failure);
+        }
+    }
+    *result = arena_push(env, error);
+    return clear_last_error(env);
+}
+
+// throw_* helpers build the message/code from C strings (lossy UTF-8) and
+// set the pending exception; PREAMBLE applies (throwing over a pending
+// exception is an error, matching Node).
+static napi_status throw_error_with_code(napi_env env, JSExnType type,
+                                         const char* code, const char* msg) {
+    GJSIFY_NAPI_PREAMBLE(env);
+    GJSIFY_NAPI_CHECK_ARG(env, msg);
+    JSString* msg_str = new_string_utf8_lossy(env->cx, msg, strlen(msg));
+    if (msg_str == nullptr) {
+        return set_last_error(env, napi_generic_failure);
+    }
+    napi_value msg_v = arena_push(env, JS::StringValue(msg_str));
+    napi_value code_v = nullptr;
+    if (code != nullptr) {
+        JSString* code_str = new_string_utf8_lossy(env->cx, code, strlen(code));
+        if (code_str == nullptr) {
+            return set_last_error(env, napi_generic_failure);
+        }
+        code_v = arena_push(env, JS::StringValue(code_str));
+    }
+    napi_value error = nullptr;
+    napi_status status = create_error_object(env, type, code_v, msg_v, &error);
+    if (status != napi_ok) {
+        return status;
+    }
+    JS::RootedValue error_v(env->cx, napi_value_to_js(error));
+    JS_SetPendingException(env->cx, error_v);
+    return napi_ok;
+}
+
+}  // namespace gjsify_napi
+
+napi_status NAPI_CDECL napi_create_error(napi_env env, napi_value code,
+                                         napi_value msg, napi_value* result) {
+    return gjsify_napi::create_error_object(env, JSEXN_ERR, code, msg, result);
+}
+
+napi_status NAPI_CDECL napi_create_type_error(napi_env env, napi_value code,
+                                              napi_value msg,
+                                              napi_value* result) {
+    return gjsify_napi::create_error_object(env, JSEXN_TYPEERR, code, msg,
+                                            result);
+}
+
+napi_status NAPI_CDECL napi_create_range_error(napi_env env, napi_value code,
+                                               napi_value msg,
+                                               napi_value* result) {
+    return gjsify_napi::create_error_object(env, JSEXN_RANGEERR, code, msg,
+                                            result);
+}
+
+napi_status NAPI_CDECL node_api_create_syntax_error(napi_env env,
+                                                    napi_value code,
+                                                    napi_value msg,
+                                                    napi_value* result) {
+    return gjsify_napi::create_error_object(env, JSEXN_SYNTAXERR, code, msg,
+                                            result);
+}
+
+napi_status NAPI_CDECL napi_throw_error(napi_env env, const char* code,
+                                        const char* msg) {
+    return gjsify_napi::throw_error_with_code(env, JSEXN_ERR, code, msg);
+}
+
+napi_status NAPI_CDECL napi_throw_type_error(napi_env env, const char* code,
+                                             const char* msg) {
+    return gjsify_napi::throw_error_with_code(env, JSEXN_TYPEERR, code, msg);
+}
+
+napi_status NAPI_CDECL napi_throw_range_error(napi_env env, const char* code,
+                                              const char* msg) {
+    return gjsify_napi::throw_error_with_code(env, JSEXN_RANGEERR, code, msg);
+}
+
+napi_status NAPI_CDECL node_api_throw_syntax_error(napi_env env,
+                                                   const char* code,
+                                                   const char* msg) {
+    return gjsify_napi::throw_error_with_code(env, JSEXN_SYNTAXERR, code, msg);
+}
+
+napi_status NAPI_CDECL napi_is_error(napi_env env, napi_value value,
+                                     bool* result) {
+    // No preamble — must work while an exception is pending.
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, value);
+    GJSIFY_NAPI_CHECK_ARG(env, result);
+    JS::Value v = gjsify_napi::napi_value_to_js(value);
+    if (!v.isObject()) {
+        *result = false;
+        return gjsify_napi::clear_last_error(env);
+    }
+    JS::RootedObject obj(env->cx, &v.toObject());
+    js::ESClass cls = js::ESClass::Other;
+    if (!JS::GetBuiltinClass(env->cx, obj, &cls)) {
+        return gjsify_napi::set_last_error(env, napi_generic_failure);
+    }
+    *result = (cls == js::ESClass::Error);  // IsNativeError analog
+    return gjsify_napi::clear_last_error(env);
+}
+
+napi_status NAPI_CDECL napi_fatal_exception(napi_env env, napi_value err) {
+    GJSIFY_NAPI_CHECK_ENV(env);
+    GJSIFY_NAPI_CHECK_ARG(env, err);
+    // Node triggers 'uncaughtException' (default: process exit). We have no
+    // process-level handler chain in a GJS host — report loudly to stderr
+    // and keep the host alive (documented deviation; a GUI app should not
+    // die from an addon's background error).
+    JS::RootedValue v(env->cx, gjsify_napi::napi_value_to_js(err));
+    JSString* str = JS::ToString(env->cx, v);
+    if (str != nullptr) {
+        JS::UniqueChars utf8 = JS_EncodeStringToUTF8(
+            env->cx, JS::RootedString(env->cx, str));
+        fprintf(stderr, "[gjsify-napi] napi_fatal_exception: %s\n",
+                utf8 ? utf8.get() : "<unprintable>");
+    } else {
+        JS_ClearPendingException(env->cx);  // ToString threw — swallow
+        fprintf(stderr,
+                "[gjsify-napi] napi_fatal_exception: <unstringifiable>\n");
+    }
+    fflush(stderr);
+    return gjsify_napi::clear_last_error(env);
+}
+
+// The not-yet-implemented remainder of the ABI lives in stubs.cc (loud
+// napi_generic_failure + last_error for every declared symbol).