@sproutboat/toolchain 0.4.20 → 0.4.22

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @sproutboat/toolchain
 
+## 0.4.22
+
+### Patch Changes
+
+- 184fa15: Two more spec fixes for uuid (baronunread/sproutboat#238):
+  - **Unary `~`** now applies ToInt32 (wrapping modulo 2^32) instead of a saturating conversion. `~x` for `x >= 2^31`, the `~~x` truncation idiom and `~Infinity` were all wrong, which broke uuid's SHA-1.
+  - **Typed-array reads** with an index outside the array, or a negative or fractional index, return `undefined` instead of reading neighbouring memory. uuid's v5 UUIDs used to change from run to run because its SHA-1 reads past its buffer. The check applies to user code; Porffor's own precompiled builtins keep their reads.
+- d03abed: `TypedArray.prototype.set(source)` without an offset copies to index 0 (part of baronunread/sproutboat#238). Porffor computed the offset as `Math.trunc(undefined)`, which is NaN, so a same-type copy wrote nothing where it should and went to the wrong place in memory instead. This dropped HMAC keys in @noble/hashes and killed the process after the first request. The offset now goes through `ToIntegerOrInfinity` as the spec says. @noble/hashes' SHA-256 and HMAC match Node and keep serving.
+
+## 0.4.21
+
+### Patch Changes
+
+- 1b80c4b: Integer typed-array stores wrap modulo 2^n as the spec requires, instead of saturating (part of baronunread/sproutboat#238). Porffor converted the stored value with a saturating float-to-int conversion, so `uint32[i] = x | 0` stored 0 for any negative `x`, `int32[i] = 4e9` stored 2147483647, and `fill`/`set`/`from` had the same bug. This broke pure-JS hashing such as @noble/hashes' SHA-256, which now matches Node.
+
 ## 0.4.20
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/acquire.test.ts

@@ -40,6 +40,7 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins_precompiled.js": "fixture:precompiled\n",
     "compiler/builtins/date.ts": "export const __ecma262_ParseDTSF = (string: string) => {\n  let n: number = 0;\n  let nInd: number = 0;\n\n  const len: i32 = string.length;\n  const endPtr: i32 = Porffor.IR.ptr(string) + len;\n  let ptr: i32 = Porffor.IR.ptr(string);\n\n  while (ptr <= endPtr) { // <= to include extra null byte to set last n\n    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);\n    if (Porffor.fastAnd(chr >= 48, chr <= 57)) { // 0-9\n      n *= 10;\n      n += chr - 48;\n      continue;\n    }\n\n    if (chr == 45) { // -\n      if (Porffor.fastOr(ptr == Porffor.IR.ptr(string), nInd == 7)) n = -n;\n    }\n\n    if (n > 0) {\n      if (nInd == 0) y = n;\n        else if (nInd == 1) m = n - 1;\n        else if (nInd == 2) dt = n;\n        else if (nInd == 3) h = n;\n        else if (nInd == 4) min = n;\n        else if (nInd == 5) s = n;\n        else if (nInd == 6) milli = n;\n        else if (nInd == 7) tzHour = n;\n        else if (nInd == 8) tzMin = n;\n\n      n = 0;\n      nInd++;\n    }\n  }\n\n  h += tzHour;\n  min += tzMin;\n};\n// RFC 7231 or Date.prototype.toString() parser\n",
     "compiler/builtins/typedarray.js":
+      "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');\n" +
       "export const __${name}_from = (arg: any, mapFn: any): ${name} => {\n" +
       "  const arr: any[] = Porffor.array.new(4);\n" +
       "  let len: i32 = 0;\n" +
@@ -120,6 +121,14 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
       "}\n",
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
+    "compiler/codegen.js":
+      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));\n" +
+      "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));\n" +
+      "  const taGet = (ctype, size, signed = true) => () => {\n" +
+      "    const loaded = Load(ctype, taAddr(size), 4);\n" +
+      "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+      "    return Box(f, Const(T.i32, TYPES.number));\n" +
+      "  };\n",
     "compiler/builtins/string.ts":
       "export const __Porffor_string_replaceAll = (str: any, searchValue: any, replaceValue: any) => {\n" +
       "  let out: any = __Porffor_string_emptyLike(str);\n  let appendIndex: i32 = 0;\n  let searchIndex: i32 = 0;\n  let matched: boolean = false;\n" +
@@ -208,6 +217,18 @@ test("the default call (no url/expectedSha256 override) never touches the networ
     },
   });
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
+  // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
+  expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
+    "offset = ecma262.ToIntegerOrInfinity(offset);",
+  );
+  // #238: ~ wraps (ToInt32), and out-of-range typed-array reads are undefined.
+  const codegen = await readFile(join(dir, "compiler/codegen.js"), "utf8");
+  expect(codegen).toContain("Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED)");
+  expect(codegen).toContain("Box(f, Const(T.i32, TYPES.number)), valUndefined());");
+  // #238: integer typed-array stores wrap modulo 2^n instead of saturating.
+  expect(await readFile(join(dir, "compiler/codegen.js"), "utf8")).toContain(
+    "signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)",
+  );
   // #237: replaceAll joins its pieces once instead of a strcat per match.
   expect(await readFile(join(dir, "compiler/builtins/string.ts"), "utf8")).toContain(
     "return Porffor.callThis(__Array_prototype_join, pieces, '');",

package/src/patch.ts

@@ -291,6 +291,73 @@ const REPLACE_ALL_EDITS = [
 ] as const;
 const REPLACE_ALL_MARKER = "sproutboat #237: pieces joined once";
 
+// baronunread/sproutboat#238: an integer typed-array element store converted
+// its value with a saturating f64 -> int Convert, so a negative value stored
+// into a Uint32Array became 0 and 4e9 into an Int32Array became 2147483647.
+// ECMA-262 (IntegerIndexedElementSet -> ToUint32 / ToInt32 / ToUint16 ...) wraps
+// modulo 2^n instead. noble-hashes' SHA-256 stores `x | 0` into a Uint32Array,
+// so every negative schedule word was zeroed and the digest came out wrong.
+// Route the store through codegen's own modular toUint32 (what bitwise ops use);
+// narrower stores keep the low bits, which is exactly the modular result.
+const TA_STORE_ANCHOR =
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));";
+const TA_STORE_INJECT =
+  "      // sproutboat #238: typed-array stores wrap modulo 2^n (ToUint32), not saturate.\n" +
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
+const TA_STORE_MARKER = "sproutboat #238: typed-array stores wrap";
+// baronunread/sproutboat#238: unary `~` had the same saturating conversion, so
+// ~x for x >= 2^31 (or ~~x, the common truncation idiom) clamped to
+// +/-2147483648, and ~Infinity gave -2147483648 instead of -1. uuid's SHA-1
+// computes `x & y ^ ~x & z` on words above 2^31, so every v5 UUID was wrong.
+const BITNOT_ANCHOR =
+  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));";
+const BITNOT_INJECT =
+  "      // sproutboat #238: ~ applies ToInt32 (wrap modulo 2^32), not a saturating cast.\n" +
+  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED))), Const(T.i32, TYPES.number));";
+const BITNOT_MARKER = "sproutboat #238: ~ applies ToInt32";
+// baronunread/sproutboat#238: typed-array element reads and writes had no
+// bounds check. A read past the end returned whatever sat in the next
+// allocation instead of undefined (uuid's SHA-1 reads past its buffer, so v5
+// UUIDs changed run to run) and a[-1] / a[1.5] broke outright. Reuse the
+// plain-array index check and compare against the typed array's length.
+// Builtins keep the unchecked read: they index within bounds, and the check
+// broke typed-array join/toString when compiled into them. Writes need the same
+// guard, but builtins such as the constructor and fill() store elements before
+// they set the length, so that is left for a follow-up.
+const TA_GET_ANCHOR =
+  "  const taGet = (ctype, size, signed = true) => () => {\n" +
+  "    const loaded = Load(ctype, taAddr(size), 4);\n" +
+  "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+  "    return Box(f, Const(T.i32, TYPES.number));\n" +
+  "  };";
+const TA_GET_INJECT =
+  "  const taGet = (ctype, size, signed = true) => () => {\n" +
+  "    // sproutboat #238: only a valid in-range integer index reads; anything else is undefined.\n" +
+  "    // User code only: builtins (precompiled) index within bounds themselves and\n" +
+  "    // typed-array join/toString misbehave with the extra check.\n" +
+  "    if (globalThis.precompile) {\n" +
+  "      const raw = Load(ctype, taAddr(size), 4);\n" +
+  "      return Box(ctype === 'f32' || ctype === 'f64' ? raw : Convert(T.f64, raw, signed ? CONVERT_SIGNED : 0), Const(T.i32, TYPES.number));\n" +
+  "    }\n" +
+  "    const { idx, valid } = denseArrayIndexKey(scope, prop);\n" +
+  "    const loaded = Load(ctype, Bin('+', T.u32, Load('u32', JvPtr(obj), 4), size === 1 ? idx : Bin('*', T.u32, idx, Const(T.u32, size))), 4);\n" +
+  "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+  "    return Select(Bin('&&', T.i32, valid, Bin('<', T.i32, idx, Load('u32', JvPtr(obj), 0))),\n" +
+  "      Box(f, Const(T.i32, TYPES.number)), valUndefined());\n" +
+  "  };";
+const TA_GET_MARKER = "sproutboat #238: only a valid in-range integer index reads";
+
+// baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
+// ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
+// then copied to `base + NaN * BYTES_PER_ELEMENT`: nothing landed where it
+// should (noble's HMAC lost its key in `pad.set(key)`), and the write went
+// somewhere else in memory. ECMA-262 uses ToIntegerOrInfinity, which maps
+// undefined and NaN to 0; subarray right below already does.
+const TA_SET_OFFSET_ANCHOR = "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
+const TA_SET_OFFSET_INJECT =
+  "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
+const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
+
 // Porffor's TypedArray.from only handles iterables. An array-like input such
 // as { length: 16 } silently becomes an empty typed array, including HMAC
 // keys made with Uint8Array.from({ length: 16 }, mapFn). The compiler uses a
@@ -1108,14 +1175,38 @@ export async function patchReplaceAll(root: string): Promise<void> {
   await writeFile(file, src);
 }
 
+/** #238: modular typed-array stores. Before the precompile so builtins get it too. */
+export async function patchTypedArrayStore(root: string): Promise<void> {
+  const file = resolve(root, "compiler/codegen.js");
+  let src = await readFile(file, "utf8");
+  let changed = false;
+  for (const [marker, anchor, inject, what] of [
+    [TA_STORE_MARKER, TA_STORE_ANCHOR, TA_STORE_INJECT, "typed-array store conversion"],
+    [BITNOT_MARKER, BITNOT_ANCHOR, BITNOT_INJECT, "bitwise NOT conversion"],
+    [TA_GET_MARKER, TA_GET_ANCHOR, TA_GET_INJECT, "typed-array read bounds"],
+  ] as const) {
+    if (src.includes(marker)) continue;
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor's ${what}: anchor not found in ${file}`);
+    src = src.replace(anchor, inject);
+    changed = true;
+  }
+  if (changed) await writeFile(file, src);
+}
+
 export async function patchTypedArrayFrom(root: string): Promise<void> {
   const file = resolve(root, "compiler/builtins/typedarray.js");
   const src = await readFile(file, "utf8");
   if (!src.includes(TYPED_ARRAY_FROM_MARKER) && !src.includes(TYPED_ARRAY_FROM_ANCHOR)) {
     throw new Error(`could not patch Porffor's TypedArray.from: anchor not found in ${file}`);
   }
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER))
-    await writeFile(file, src.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT));
+  let edited = src;
+  if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
+  if (!edited.includes(TA_SET_OFFSET_MARKER)) {
+    if (!edited.includes(TA_SET_OFFSET_ANCHOR))
+      throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);
+    edited = edited.replace(TA_SET_OFFSET_ANCHOR, TA_SET_OFFSET_INJECT);
+  }
+  if (edited !== src) await writeFile(file, edited);
   const table = resolve(root, "compiler/builtins_precompiled.js");
   const before = await readFile(table);
   // Porffor only writes the table when import.meta.url matches argv[1].
@@ -1132,7 +1223,7 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
     new Response(child.stderr).text(),
   ]);
   if (code !== 0) throw new Error(`could not precompile Porffor's TypedArray.from: ${stderr || stdout}`);
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER) && before.equals(await readFile(table)))
+  if (edited !== src && before.equals(await readFile(table)))
     throw new Error(`Porffor precompile did not update ${table}`);
 }
 
@@ -1185,6 +1276,7 @@ export async function ensurePorfforPatched(root: string): Promise<void> {
   await patchDateParser(root);
   await patchPromiseResolveNull(root);
   await patchReplaceAll(root);
+  await patchTypedArrayStore(root);
   // Last of the builtin edits: its precompile picks up the date, promise and
   // replaceAll patches above too.
   await patchTypedArrayFrom(root);