@sproutboat/toolchain 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @sproutboat/toolchain
 
+## 0.4.1
+
+### Patch Changes
+
+- 969add9: Fix (baronunread/sproutboat#168): a `fetch` handler that resolves a promise
+  with a plain object — the common shape for a JSON response — could wedge a
+  standalone/native-fetch build at 100% CPU after a handful of requests, with no
+  error and no log line. Root cause: `__Porffor_promise_resolve`'s duck-typing
+  probe for `.then` walks the value's prototype chain with no termination
+  guard, and under certain allocator conditions the walk hits a fixed point
+  instead of `null`/`undefined`, spinning forever.
+  
+  `patchPromiseTs` now guards the probe the same way `_internal_object.ts`'s own
+  prototype-chain walks already do elsewhere in the runtime: track the previous
+  prototype and stop once the "next" pointer stops advancing, reading a
+  fixed-point chain as "no `.then` found" instead of spinning. Not specific to
+  `Date.prototype.toISOString()` — an earlier note wrongly correlated the bug
+  with that one call; see `sproutboat-cli/patches/UPSTREAM.md`.
+
 ## 0.4.0
 
 ### Minor Changes

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "license": "MIT",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/baronunread/sproutboat-packages.git",
+    "directory": "packages/toolchain"
+  },
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "exports": {

package/src/acquire.test.ts

@@ -94,6 +94,21 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "\n" +
       "  if (body_owned) free(body_owned);\n" +
       "}\n",
+    "compiler/builtins/promise.ts":
+      "export const __Porffor_promise_resolve = (value: any, promise: any): void => {\n" +
+      "  if (Porffor.type(value) == Porffor.TYPES.object) {\n" +
+      "    const thenHash: i32 = __Porffor_object_hash('then');\n" +
+      "    let probe: any = value;\n" +
+      "    while (Porffor.type(probe) == Porffor.TYPES.object) {\n" +
+      "      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) break;\n" +
+      "      probe = __Porffor_object_getPrototype(probe);\n" +
+      "    }\n" +
+      "    if (Porffor.type(probe) != Porffor.TYPES.object) {\n" +
+      "      __ecma262_FulfillPromise(promise, value);\n" +
+      "      return;\n" +
+      "    }\n" +
+      "  }\n" +
+      "};\n",
   };
   for (const [file, contents] of Object.entries(files)) {
     const path = join(source, file);

package/src/patch.test.ts

@@ -2,7 +2,7 @@ import { expect, test } from "bun:test";
 import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { patchRenderJs, patchUwebsockets } from "./patch";
+import { patchPromiseTs, patchRenderJs, patchUwebsockets } from "./patch";
 
 // The parts of Porffor's compiler/render.js the patch anchors to.
 const RENDER = `void porf_native_fetch_runtime_init(void) {
@@ -240,3 +240,60 @@ test("#165: render.js routes console output to stderr, unbuffered, idempotently"
     await rm(root, { recursive: true, force: true });
   }
 });
+
+// The part of Porffor's compiler/builtins/promise.ts the #168 patch anchors to.
+const PROMISE_TS = `export const __Porffor_promise_resolve = (value: any, promise: any): void => {
+  if (Porffor.type(value) == Porffor.TYPES.object) {
+    // cheap prototype-chain probe for 'then' before the expensive Get below, does not invoke getters
+    const thenHash: i32 = __Porffor_object_hash('then');
+    let probe: any = value;
+    while (Porffor.type(probe) == Porffor.TYPES.object) {
+      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) break;
+      probe = __Porffor_object_getPrototype(probe);
+    }
+    if (Porffor.type(probe) != Porffor.TYPES.object) {
+      __ecma262_FulfillPromise(promise, value);
+      return;
+    }
+  }
+};
+`;
+
+test("#168: promise-resolve's then-probe gets a fixed-point guard, idempotently", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-patch-promise-"));
+  try {
+    await mkdir(join(root, "compiler/builtins"), { recursive: true });
+    await writeFile(join(root, "compiler/builtins/promise.ts"), PROMISE_TS);
+    await patchPromiseTs(root);
+    const once = await readFile(join(root, "compiler/builtins/promise.ts"), "utf8");
+
+    expect(once).toContain("sproutboat #168");
+    expect(once).toContain("let probeFound: boolean = false;");
+    expect(once).toContain("if (Porffor.object.lookup(probe, 'then', thenHash) != 0) { probeFound = true; break; }");
+    // The fixed-point guard mirrors _internal_object.ts's lastProto idiom.
+    expect(once).toContain("Porffor.fastOr(probe == null, Porffor.IR.ptr(probe) == Porffor.IR.ptr(lastProto))");
+    expect(once).toContain("if (!probeFound) {");
+    // Belt-and-suspenders: a hard iteration cap terminates the loop even if
+    // some other corruption shape (a drifting pointer, a longer cycle) defeats
+    // the fixed-point check above.
+    expect(once).toContain("if (probeSteps > 64) break;");
+    // The old type-check-only exit condition is gone.
+    expect(once).not.toContain("if (Porffor.type(probe) != Porffor.TYPES.object) {");
+
+    await patchPromiseTs(root);
+    expect(await readFile(join(root, "compiler/builtins/promise.ts"), "utf8")).toBe(once);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("#168: a drifted promise builtin fails loudly instead of silently no-op'ing", async () => {
+  const root = await mkdtemp(join(tmpdir(), "sb-patch-promise-drift-"));
+  try {
+    await mkdir(join(root, "compiler/builtins"), { recursive: true });
+    await writeFile(join(root, "compiler/builtins/promise.ts"), "// nothing the patch recognizes\n");
+    await expect(patchPromiseTs(root)).rejects.toThrow(/anchor not found/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/patch.ts

@@ -410,6 +410,75 @@ const WRITE_RESPONSE_INJECT =
   "}";
 const WRITE_RESPONSE_MARKER = "porf_native_fetch_read_raw_bytes(body_value";
 
+/**
+ * baronunread/sproutboat#168 — `__Porffor_promise_resolve`'s duck-typing probe
+ * for `.then` walks a value's prototype chain with no termination guard. Under
+ * certain allocator conditions `__Porffor_object_getPrototype` returns a stale
+ * "object" jsval instead of the `null`/`undefined` that should end the chain,
+ * so the walk never bottoms out — a true infinite spin (100% CPU, no error, no
+ * log line) that wedges the whole process, since native-fetch serves one
+ * request at a time on a single event loop. Hits any handler whose `fetch`
+ * resolves a promise with a plain object — the common shape for a JSON
+ * response — so this is not a rare pattern; onset is nondeterministic
+ * (allocator/pool reuse), typically after a handful of requests.
+ *
+ * `_internal_object.ts`'s own prototype-chain walks already guard against
+ * exactly this failure mode: track the previous prototype and stop once the
+ * "next" pointer stops advancing (a fixed point reads the same as reaching the
+ * end). This probe has no such guard. Mirror the same idiom here: an explicit
+ * `probeFound` flag (so a fixed-point break reads as "no `.then` found",
+ * matching how a legitimate null-terminated chain is read) plus the
+ * `lastProto` pointer comparison used everywhere else in the runtime.
+ *
+ * A hard iteration cap rides alongside the fixed-point check, not instead of
+ * it: the lldb trace showed the *same* stale pointer on every sample, which
+ * the fixed-point check alone catches on its very next iteration, but that's
+ * one observed corruption shape, not a guarantee about every allocator state
+ * that can produce this bug. A cap makes termination unconditional regardless
+ * of whether some other corrupted state instead drifts (a different bad
+ * pointer each time) or cycles across more than one node — real prototype
+ * chains are a handful of links deep, so 64 iterations is generous headroom
+ * with no risk of cutting off a legitimate lookup.
+ */
+const THEN_PROBE_ANCHOR =
+  "    const thenHash: i32 = __Porffor_object_hash('then');\n" +
+  "    let probe: any = value;\n" +
+  "    while (Porffor.type(probe) == Porffor.TYPES.object) {\n" +
+  "      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) break;\n" +
+  "      probe = __Porffor_object_getPrototype(probe);\n" +
+  "    }\n" +
+  "    if (Porffor.type(probe) != Porffor.TYPES.object) {\n";
+const THEN_PROBE_INJECT =
+  "    const thenHash: i32 = __Porffor_object_hash('then');\n" +
+  "    let probe: any = value;\n" +
+  "    let lastProto: any = probe;\n" +
+  "    let probeFound: boolean = false; // sproutboat #168: fixed-point chain reads as \"not found\", not a spin\n" +
+  "    let probeSteps: i32 = 0; // sproutboat #168: hard cap, belt-and-suspenders alongside the fixed-point check\n" +
+  "    while (Porffor.type(probe) == Porffor.TYPES.object) {\n" +
+  "      if (Porffor.object.lookup(probe, 'then', thenHash) != 0) { probeFound = true; break; }\n" +
+  "      probe = __Porffor_object_getPrototype(probe);\n" +
+  "      if (Porffor.fastOr(probe == null, Porffor.IR.ptr(probe) == Porffor.IR.ptr(lastProto))) break;\n" +
+  "      lastProto = probe;\n" +
+  "      probeSteps++;\n" +
+  "      if (probeSteps > 64) break;\n" +
+  "    }\n" +
+  "    if (!probeFound) {\n";
+const THEN_PROBE_MARKER = "sproutboat #168";
+
+/** The promise builtin: the #168 `.then`-probe livelock fix. Exported for tests. */
+export async function patchPromiseTs(root: string): Promise<void> {
+  const file = resolve(root, "compiler/builtins/promise.ts");
+  let src = await readFile(file, "utf8");
+  if (src.includes(THEN_PROBE_MARKER)) return;
+  if (!src.includes(THEN_PROBE_ANCHOR)) {
+    throw new Error(
+      "could not patch Porffor's promise-resolve then-probe (#168): anchor not found in " +
+        `${file}. Porffor's promise builtin changed — check patches/UPSTREAM.md.`,
+    );
+  }
+  await writeFile(file, src.replace(THEN_PROBE_ANCHOR, THEN_PROBE_INJECT));
+}
+
 const done = new Set<string>();
 
 /** Edits to Porffor's uWebSockets shim: `[marker, anchor, inject, what]`. */
@@ -520,5 +589,6 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchCompilerArgs(root);
   await patchUwebsockets(root);
   await patchRenderJs(root);
+  await patchPromiseTs(root);
   done.add(root);
 }