@sproutboat/toolchain 0.4.22 → 0.4.24

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sproutboat/toolchain
 
+## 0.4.24
+
+### Patch Changes
+
+- 9225026: `join()` and `toString()` work on typed arrays (baronunread/sproutboat#242). Porffor generates typed-array methods from the Array ones by replacing `any[]` with the array's type, which also retyped `join`'s internal helper array. `new Uint8Array([1,2]).join("-")` returned garbage, and a three-element `Uint16Array.join` crashed. The generator now keeps that helper a plain array.
+
+## 0.4.23
+
+### Patch Changes
+
+- a479611: Typed-array writes outside the array are ignored, as the spec requires, instead of overwriting the next allocation in memory (baronunread/sproutboat#241). `a[length] = x`, `a[-1] = x` (which wrote `a[0]`) and `a[1.5] = x` no longer touch any memory. The check uses the same index validation as reads and applies to user code; Porffor's own builtins write within bounds.
+
 ## 0.4.22
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/toolchain",
-  "version": "0.4.22",
+  "version": "0.4.24",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/acquire.test.ts

@@ -40,6 +40,7 @@ async function fixture(): Promise<{ archive: string; sha256: string }> {
     "compiler/builtins_precompiled.js": "fixture:precompiled\n",
     "compiler/builtins/date.ts": "export const __ecma262_ParseDTSF = (string: string) => {\n  let n: number = 0;\n  let nInd: number = 0;\n\n  const len: i32 = string.length;\n  const endPtr: i32 = Porffor.IR.ptr(string) + len;\n  let ptr: i32 = Porffor.IR.ptr(string);\n\n  while (ptr <= endPtr) { // <= to include extra null byte to set last n\n    const chr: i32 = Porffor.IR.loadU8(ptr++, 4);\n    if (Porffor.fastAnd(chr >= 48, chr <= 57)) { // 0-9\n      n *= 10;\n      n += chr - 48;\n      continue;\n    }\n\n    if (chr == 45) { // -\n      if (Porffor.fastOr(ptr == Porffor.IR.ptr(string), nInd == 7)) n = -n;\n    }\n\n    if (n > 0) {\n      if (nInd == 0) y = n;\n        else if (nInd == 1) m = n - 1;\n        else if (nInd == 2) dt = n;\n        else if (nInd == 3) h = n;\n        else if (nInd == 4) min = n;\n        else if (nInd == 5) s = n;\n        else if (nInd == 6) milli = n;\n        else if (nInd == 7) tzHour = n;\n        else if (nInd == 8) tzMin = n;\n\n      n = 0;\n      nInd++;\n    }\n  }\n\n  h += tzHour;\n  min += tzMin;\n};\n// RFC 7231 or Date.prototype.toString() parser\n",
     "compiler/builtins/typedarray.js":
+      "${typedArrayFuncs.reduce((acc, x) => acc + x.replace('// @porf-typed-array\\n', '').replaceAll('Array', name).replaceAll('any[]', name) + '\\n\\n', '')}`;\n" +
       "  offset = Math.trunc(offset);\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');\n" +
       "export const __${name}_from = (arg: any, mapFn: any): ${name} => {\n" +
       "  const arr: any[] = Porffor.array.new(4);\n" +
@@ -217,6 +218,10 @@ test("the default call (no url/expectedSha256 override) never touches the networ
     },
   });
   expect(await readFile(join(dir, "runtime/index.js"), "utf8")).not.toBe("");
+  // #242: generated typed-array join/toString keep a plain-array `parts`.
+  expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
+    ".replaceAll('const parts: ' + name + ' =', 'const parts: any[] =')",
+  );
   // #238: TypedArray.prototype.set(source) with no offset copies to index 0.
   expect(await readFile(join(dir, "compiler/builtins/typedarray.js"), "utf8")).toContain(
     "offset = ecma262.ToIntegerOrInfinity(offset);",
@@ -225,6 +230,8 @@ test("the default call (no url/expectedSha256 override) never touches the networ
   const codegen = await readFile(join(dir, "compiler/codegen.js"), "utf8");
   expect(codegen).toContain("Convert(T.i32, toUint32(scope, numValue(toNumeric())), CONVERT_RANGE_KNOWN | CONVERT_SIGNED)");
   expect(codegen).toContain("Box(f, Const(T.i32, TYPES.number)), valUndefined());");
+  // #241: out-of-range typed-array writes are ignored in user code.
+  expect(codegen).toContain("if (globalThis.precompile) store();");
   // #238: integer typed-array stores wrap modulo 2^n instead of saturating.
   expect(await readFile(join(dir, "compiler/codegen.js"), "utf8")).toContain(
     "signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)",

package/src/patch.ts

@@ -346,6 +346,23 @@ const TA_GET_INJECT =
   "      Box(f, Const(T.i32, TYPES.number)), valUndefined());\n" +
   "  };";
 const TA_GET_MARKER = "sproutboat #238: only a valid in-range integer index reads";
+// baronunread/sproutboat#241: a typed-array write outside the array stored into
+// whatever memory followed it (and a[-1] = x wrote a[0], via the saturating
+// index conversion). ECMA-262 ignores the write. Same check as taGet, in user
+// code only: builtins such as the constructor store elements before they set
+// the length, and they only write in bounds anyway. Applies after TA_STORE,
+// whose output line is the anchor.
+const TA_SET_BOUNDS_ANCHOR =
+  "      stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));";
+const TA_SET_BOUNDS_INJECT =
+  "      const store = () => stmt(scope, Store(ctype, addr, 4, ctype === 'f64' || ctype === 'f32' ? f : signed ? Convert(T.i32, toUint32(scope, f), CONVERT_RANGE_KNOWN | CONVERT_SIGNED) : toUint32(scope, f)));\n" +
+  "      // sproutboat #241: a write outside the array is ignored, not stored into the next allocation.\n" +
+  "      if (globalThis.precompile) store();\n" +
+  "      else {\n" +
+  "        const { idx: sbIdx, valid: sbValid } = denseArrayIndexKey(scope, prop);\n" +
+  "        emitIf(scope, Bin('&&', T.i32, sbValid, Bin('<', T.i32, sbIdx, Load('u32', JvPtr(obj), 0))), store);\n" +
+  "      }";
+const TA_SET_BOUNDS_MARKER = "sproutboat #241: a write outside the array is ignored";
 
 // baronunread/sproutboat#238: TypedArray.prototype.set(source) with no offset
 // ran `offset = Math.trunc(undefined)`, which is NaN. The same-type fast path
@@ -358,6 +375,17 @@ const TA_SET_OFFSET_INJECT =
   "  offset = ecma262.ToIntegerOrInfinity(offset); // sproutboat #238: undefined offset is 0, not NaN\n  if (Porffor.fastOr(offset < 0, offset > len)) throw new RangeError('Offset out of bounds');";
 const TA_SET_OFFSET_MARKER = "sproutboat #238: undefined offset is 0";
 
+// baronunread/sproutboat#242: typedarray.js generates each TypedArray method
+// from array.ts with `.replaceAll('any[]', name)`. That also retyped join's and
+// toString's internal `const parts: any[]` helper as e.g. a Uint8Array, so the
+// joined strings were stored into a "typed array": Uint8Array join returned
+// garbage and Uint16Array join crashed. Put `parts` back to a plain array after
+// the replacement; map/filter's intentionally typed `out` is untouched.
+const TA_JOIN_ANCHOR = ".replaceAll('Array', name).replaceAll('any[]', name) + '\\n\\n'";
+const TA_JOIN_INJECT =
+  ".replaceAll('Array', name).replaceAll('any[]', name).replaceAll('const parts: ' + name + ' =', 'const parts: any[] =') /* sproutboat #242 */ + '\\n\\n'";
+const TA_JOIN_MARKER = "sproutboat #242";
+
 // Porffor's TypedArray.from only handles iterables. An array-like input such
 // as { length: 16 } silently becomes an empty typed array, including HMAC
 // keys made with Uint8Array.from({ length: 16 }, mapFn). The compiler uses a
@@ -1184,6 +1212,7 @@ export async function patchTypedArrayStore(root: string): Promise<void> {
     [TA_STORE_MARKER, TA_STORE_ANCHOR, TA_STORE_INJECT, "typed-array store conversion"],
     [BITNOT_MARKER, BITNOT_ANCHOR, BITNOT_INJECT, "bitwise NOT conversion"],
     [TA_GET_MARKER, TA_GET_ANCHOR, TA_GET_INJECT, "typed-array read bounds"],
+    [TA_SET_BOUNDS_MARKER, TA_SET_BOUNDS_ANCHOR, TA_SET_BOUNDS_INJECT, "typed-array write bounds"],
   ] as const) {
     if (src.includes(marker)) continue;
     if (!src.includes(anchor)) throw new Error(`could not patch Porffor's ${what}: anchor not found in ${file}`);
@@ -1201,6 +1230,11 @@ export async function patchTypedArrayFrom(root: string): Promise<void> {
   }
   let edited = src;
   if (!edited.includes(TYPED_ARRAY_FROM_MARKER)) edited = edited.replace(TYPED_ARRAY_FROM_ANCHOR, TYPED_ARRAY_FROM_INJECT);
+  if (!edited.includes(TA_JOIN_MARKER)) {
+    if (!edited.includes(TA_JOIN_ANCHOR))
+      throw new Error(`could not patch Porffor's typed-array method generator: anchor not found in ${file}`);
+    edited = edited.replace(TA_JOIN_ANCHOR, TA_JOIN_INJECT);
+  }
   if (!edited.includes(TA_SET_OFFSET_MARKER)) {
     if (!edited.includes(TA_SET_OFFSET_ANCHOR))
       throw new Error(`could not patch Porffor's TypedArray.prototype.set offset: anchor not found in ${file}`);