@sproutboat/toolchain 0.4.21 → 0.4.23

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @sproutboat/toolchain
 
+## 0.4.23
+
+### Patch Changes
+
+- a479611: Typed-array writes outside the array are ignored, as the spec requires, instead of overwriting the next allocation in memory (baronunread/sproutboat#241). `a[length] = x`, `a[-1] = x` (which wrote `a[0]`) and `a[1.5] = x` no longer touch any memory. The check uses the same index validation as reads and applies to user code; Porffor's own builtins write within bounds.
+
+## 0.4.22
+
+### Patch Changes
+
+- 184fa15: Two more spec fixes for uuid (baronunread/sproutboat#238):
+  - **Unary `~`** now applies ToInt32 (wrapping modulo 2^32) instead of a saturating conversion. `~x` for `x >= 2^31`, the `~~x` truncation idiom and `~Infinity` were all wrong, which broke uuid's SHA-1.
+  - **Typed-array reads** with an index outside the array, or a negative or fractional index, return `undefined` instead of reading neighbouring memory. uuid's v5 UUIDs used to change from run to run because its SHA-1 reads past its buffer. The check applies to user code; Porffor's own precompiled builtins keep their reads.
+- d03abed: `TypedArray.prototype.set(source)` without an offset copies to index 0 (part of baronunread/sproutboat#238). Porffor computed the offset as `Math.trunc(undefined)`, which is NaN, so a same-type copy wrote nothing where it should and went to the wrong place in memory instead. This dropped HMAC keys in @noble/hashes and killed the process after the first request. The offset now goes through `ToIntegerOrInfinity` as the spec says. @noble/hashes' SHA-256 and HMAC match Node and keep serving.
+
 ## 0.4.21
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/acquire.test.ts

@@ -40,6 +40,7 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins_precompiled.js": "fixture:precompiled\n",
     "compiler/builtins/date.ts": "export const __ecma262_ParseDTSF = (string: string) => {\n  let n: number = 0;\n  let nInd: number = 0;\n\n  const len: i32 = string.length;\n  const endPtr: i32 = Porffor.IR.ptr(string) + len;\n  let ptr: i32 = Porffor.IR.ptr(string);\n\n  while (ptr <= endPtr) { // <= to include extra null byte to set last n\n    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);\n    if (Porffor.fastAnd(chr >= 48, chr <= 57)) { // 0-9\n      n *= 10;\n      n += chr - 48;\n      continue;\n    }\n\n    if (chr == 45) { // -\n      if (Porffor.fastOr(ptr == Porffor.IR.ptr(string), nInd == 7)) n = -n;\n    }\n\n    if (n > 0) {\n      if (nInd == 0) y = n;\n        else if (nInd == 1) m = n - 1;\n        else if (nInd == 2) dt = n;\n        else if (nInd == 3) h = n;\n        else if (nInd == 4) min = n;\n        else if (nInd == 5) s = n;\n        else if (nInd == 6) milli = n;\n        else if (nInd == 7) tzHour = n;\n        else if (nInd == 8) tzMin = n;\n\n      n = 0;\n      nInd++;\n    }\n  }\n\n  h += tzHour;\n  min += tzMin;\n};\n// RFC 7231 or Date.prototype.toString() parser\n",
     "compiler/builtins/typedarray.js":
+      "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');\n" +
       "export const __${name}_from = (arg: any, mapFn: any): ${name} => {\n" +
       "  const arr: any[] = Porffor.array.new(4);\n" +
       "  let len: i32 = 0;\n" +
@@ -121,7 +122,13 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins/json.ts": "// sb_json_utf16_v1\n",
     "runtime/fetch-globals.js": "// sb_text_encoder_scalar_v1\n",
     "compiler/codegen.js":
-      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));\n",
+      "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, f) : Convert(T.u32, f, 0)));\n" +
+      "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));\n" +
+      "  const taGet = (ctype, size, signed = true) => () => {\n" +
+      "    const loaded = Load(ctype, taAddr(size), 4);\n" +
+      "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+      "    return Box(f, Const(T.i32, TYPES.number));\n" +
+      "  };\n",
     "compiler/builtins/string.ts":
       "export const __Porffor_string_replaceAll = (str: any, searchValue: any, replaceValue: any) => {\n" +
       "  let out: any = __Porffor_string_emptyLike(str);\n  let appendIndex: i32 = 0;\n  let searchIndex: i32 = 0;\n  let matched: boolean = false;\n" +
@@ -210,6 +217,16 @@ test("the default call (no url/expectedSha256 override) never touches the networ
     },
   });
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
+  // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
+  expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
+    "offset = ecma262.ToIntegerOrInfinity(offset);",
+  );
+  // #238: ~ wraps (ToInt32), and out-of-range typed-array reads are undefined.
+  const codegen = await readFile(join(dir, "compiler/codegen.js"), "utf8");
+  expect(codegen).toContain("Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED)");
+  expect(codegen).toContain("Box(f, Const(T.i32, TYPES.number)), valUndefined());");
+  // #241: out-of-range typed-array writes are ignored in user code.
+  expect(codegen).toContain("if (globalThis.precompile) store();");
   // #238: integer typed-array stores wrap modulo 2^n instead of saturating.
   expect(await readFile(join(dir, "compiler/codegen.js"), "utf8")).toContain(
     "signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)",

package/src/patch.ts

@@ -305,6 +305,75 @@ const TA_STORE_INJECT =
   "      // sproutboat #238: typed-array stores wrap modulo 2^n (ToUint32), not saturate.\n" +
   "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
 const TA_STORE_MARKER = "sproutboat #238: typed-array stores wrap";
+// baronunread/sproutboat#238: unary `~` had the same saturating conversion, so
+// ~x for x >= 2^31 (or ~~x, the common truncation idiom) clamped to
+// +/-2147483648, and ~Infinity gave -2147483648 instead of -1. uuid's SHA-1
+// computes `x & y ^ ~x & z` on words above 2^31, so every v5 UUID was wrong.
+const BITNOT_ANCHOR =
+  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, numValue(toNumeric())))), Const(T.i32, TYPES.number));";
+const BITNOT_INJECT =
+  "      // sproutboat #238: ~ applies ToInt32 (wrap modulo 2^32), not a saturating cast.\n" +
+  "      return Box(Convert(T.f64, Un('~', T.i32, Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED))), Const(T.i32, TYPES.number));";
+const BITNOT_MARKER = "sproutboat #238: ~ applies ToInt32";
+// baronunread/sproutboat#238: typed-array element reads and writes had no
+// bounds check. A read past the end returned whatever sat in the next
+// allocation instead of undefined (uuid's SHA-1 reads past its buffer, so v5
+// UUIDs changed run to run) and a[-1] / a[1.5] broke outright. Reuse the
+// plain-array index check and compare against the typed array's length.
+// Builtins keep the unchecked read: they index within bounds, and the check
+// broke typed-array join/toString when compiled into them. Writes need the same
+// guard, but builtins such as the constructor and fill() store elements before
+// they set the length, so that is left for a follow-up.
+const TA_GET_ANCHOR =
+  "  const taGet = (ctype, size, signed = true) => () => {\n" +
+  "    const loaded = Load(ctype, taAddr(size), 4);\n" +
+  "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+  "    return Box(f, Const(T.i32, TYPES.number));\n" +
+  "  };";
+const TA_GET_INJECT =
+  "  const taGet = (ctype, size, signed = true) => () => {\n" +
+  "    // sproutboat #238: only a valid in-range integer index reads; anything else is undefined.\n" +
+  "    // User code only: builtins (precompiled) index within bounds themselves and\n" +
+  "    // typed-array join/toString misbehave with the extra check.\n" +
+  "    if (globalThis.precompile) {\n" +
+  "      const raw = Load(ctype, taAddr(size), 4);\n" +
+  "      return Box(ctype === 'f32' || ctype === 'f64' ? raw : Convert(T.f64, raw, signed ? CONVERT_SIGNED : 0), Const(T.i32, TYPES.number));\n" +
+  "    }\n" +
+  "    const { idx, valid } = denseArrayIndexKey(scope, prop);\n" +
+  "    const loaded = Load(ctype, Bin('+', T.u32, Load('u32', JvPtr(obj), 4), size === 1 ? idx : Bin('*', T.u32, idx, Const(T.u32, size))), 4);\n" +
+  "    const f = ctype === 'f32' || ctype === 'f64' ? loaded : Convert(T.f64, loaded, signed ? CONVERT_SIGNED : 0);\n" +
+  "    return Select(Bin('&&', T.i32, valid, Bin('<', T.i32, idx, Load('u32', JvPtr(obj), 0))),\n" +
+  "      Box(f, Const(T.i32, TYPES.number)), valUndefined());\n" +
+  "  };";
+const TA_GET_MARKER = "sproutboat #238: only a valid in-range integer index reads";
+// baronunread/sproutboat#241: a typed-array write outside the array stored into
+// whatever memory followed it (and a[-1] = x wrote a[0], via the saturating
+// index conversion). ECMA-262 ignores the write. Same check as taGet, in user
+// code only: builtins such as the constructor store elements before they set
+// the length, and they only write in bounds anyway. Applies after TA_STORE,
+// whose output line is the anchor.
+const TA_SET_BOUNDS_ANCHOR =
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
+const TA_SET_BOUNDS_INJECT =
+  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));\n" +
+  "      // sproutboat #241: a write outside the array is ignored, not stored into the next allocation.\n" +
+  "      if (globalThis.precompile) store();\n" +
+  "      else {\n" +
+  "        const { idx: sbIdx, valid: sbValid } = denseArrayIndexKey(scope, prop);\n" +
+  "        emitIf(scope, Bin('&&', T.i32, sbValid, Bin('<', T.i32, sbIdx, Load('u32', JvPtr(obj), 0))), store);\n" +
+  "      }";
+const TA_SET_BOUNDS_MARKER = "sproutboat #241: a write outside the array is ignored";
+
+// baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
+// ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
+// then copied to `base + NaN * BYTES_PER_ELEMENT`: nothing landed where it
+// should (noble's HMAC lost its key in `pad.set(key)`), and the write went
+// somewhere else in memory. ECMA-262 uses ToIntegerOrInfinity, which maps
+// undefined and NaN to 0; subarray right below already does.
+const TA_SET_OFFSET_ANCHOR = "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
+const TA_SET_OFFSET_INJECT =
+  "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
+const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
 
 // Porffor's TypedArray.from only handles iterables. An array-like input such
 // as { length: 16 } silently becomes an empty typed array, including HMAC
@@ -1126,11 +1195,20 @@ export async function patchReplaceAll(root: string): Promise<void> {
 /** #238: modular typed-array stores. Before the precompile so builtins get it too. */
 export async function patchTypedArrayStore(root: string): Promise<void> {
   const file = resolve(root, "compiler/codegen.js");
-  const src = await readFile(file, "utf8");
-  if (src.includes(TA_STORE_MARKER)) return;
-  if (!src.includes(TA_STORE_ANCHOR))
-    throw new Error(`could not patch Porffor's typed-array store conversion: anchor not found in ${file}`);
-  await writeFile(file, src.replace(TA_STORE_ANCHOR, TA_STORE_INJECT));
+  let src = await readFile(file, "utf8");
+  let changed = false;
+  for (const [marker, anchor, inject, what] of [
+    [TA_STORE_MARKER, TA_STORE_ANCHOR, TA_STORE_INJECT, "typed-array store conversion"],
+    [BITNOT_MARKER, BITNOT_ANCHOR, BITNOT_INJECT, "bitwise NOT conversion"],
+    [TA_GET_MARKER, TA_GET_ANCHOR, TA_GET_INJECT, "typed-array read bounds"],
+    [TA_SET_BOUNDS_MARKER, TA_SET_BOUNDS_ANCHOR, TA_SET_BOUNDS_INJECT, "typed-array write bounds"],
+  ] as const) {
+    if (src.includes(marker)) continue;
+    if (!src.includes(anchor)) throw new Error(`could not patch Porffor's ${what}: anchor not found in ${file}`);
+    src = src.replace(anchor, inject);
+    changed = true;
+  }
+  if (changed) await writeFile(file, src);
 }
 
 export async function patchTypedArrayFrom(root: string): Promise<void> {
@@ -1139,8 +1217,14 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
   if (!src.includes(TYPED_ARRAY_FROM_MARKER) && !src.includes(TYPED_ARRAY_FROM_ANCHOR)) {
     throw new Error(`could not patch Porffor's TypedArray.from: anchor not found in ${file}`);
   }
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER))
-    await writeFile(file, src.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT));
+  let edited = src;
+  if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
+  if (!edited.includes(TA_SET_OFFSET_MARKER)) {
+    if (!edited.includes(TA_SET_OFFSET_ANCHOR))
+      throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);
+    edited = edited.replace(TA_SET_OFFSET_ANCHOR, TA_SET_OFFSET_INJECT);
+  }
+  if (edited !== src) await writeFile(file, edited);
   const table = resolve(root, "compiler/builtins_precompiled.js");
   const before = await readFile(table);
   // Porffor only writes the table when import.meta.url matches argv[1].
@@ -1157,7 +1241,7 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
     new Response(child.stderr).text(),
   ]);
   if (code !== 0) throw new Error(`could not precompile Porffor's TypedArray.from: ${stderr || stdout}`);
-  if (!src.includes(TYPED_ARRAY_FROM_MARKER) && before.equals(await readFile(table)))
+  if (edited !== src && before.equals(await readFile(table)))
     throw new Error(`Porffor precompile did not update ${table}`);
 }