@swf2es/runtime 0.1.18 → 0.1.20

package/src/avm2/natives/bytearray.ts

@@ -529,16 +529,27 @@ export class Bytes {
    * it by default, at the position; the length grows to the position after.
    */
   write(source: Uint8Array, offset = 0, count = source.length): void {
+    // Before the buffer is read: making room may replace it.
+    const at = this.claim(count);
+    copyBytes(this.buffer, at, source, offset, count);
+  }
+
+  /**
+   * As ByteArray::Write but for the bytes, which the caller writes itself:
+   * room for `count` at the position, which moves past them, the length
+   * growing to it. Where in the buffer they start.
+   */
+  claim(count: number): number {
     if (count > 0xffffffff - this.position) {
       throw this.rt.error("flash.errors::MemoryError", 1000);
     }
 
-    const end = (this.position + count) >>> 0;
+    const at = this.position;
+    const end = (at + count) >>> 0;
     if (end > this.buffer.length) {
       this.ensure(end, false);
     }
 
-    copyBytes(this.buffer, this.position, source, offset, count);
     this.position = end;
     if (this.length < end) {
       if (this.shared === null) {
@@ -549,6 +560,7 @@ export class Bytes {
     }
 
     this.notify();
+    return at;
   }
 
   /** As ByteArray's operator[] for a write: the length grows to hold `index`. */

package/src/avm2/natives/object.ts

@@ -2,6 +2,7 @@
 // calling or constructing Object, Namespace, QName or Function does.
 
 import type { AsObject, Value } from "../descriptors.js";
+import { forgetStep } from "../enumeration.js";
 import type { ClassHook } from "../hooks.js";
 import { formatClassName, Namespace, prefixOf, publicQname } from "../names.js";
 import { NOT_FOUND, type Runtime } from "../runtime.js";
@@ -51,7 +52,11 @@ export const objectNatives: Natives = {
         o.$d.allHidden = false;
       }
     } else {
-      o.$dontEnum ??= new Set();
+      if (o.$dontEnum === undefined) {
+        o.$dontEnum = new Set();
+        forgetStep(o);
+      }
+
       o.$dontEnum.add(name);
     }
   },

package/src/avm2/natives/vector.ts

@@ -76,7 +76,7 @@ for (const [kind, , , elementsOf, store] of VECTORS) {
         a.length = length;
       } else if (length === 0) {
         // A new array: V8 empties one by a call into its runtime.
-        this.$a = elementsOf(0);
+        rt.setElements(this, elementsOf(0));
       } else if (length < a.length) {
         a.length = length;
       } else if (length > a.length) {

package/src/avm2/runtime.ts

@@ -39,13 +39,17 @@ import {
   continues,
   dictionaryAt,
   type Enumeration,
+  elementName,
   elementsAt,
   enumerated,
+  forgetStep,
   INT_ATOM_LIMIT,
   nextIndex,
   ownNames,
   pairIndex,
   pairOf,
+  sparseElement,
+  traitsAt,
   walkless,
 } from "./enumeration.js";
 import { AsError, describe, detailOf, errorMessage, stackOf, UnsupportedError } from "./errors.js";
@@ -2519,9 +2523,18 @@ export class Runtime {
     return this.array(values);
   }
 
+  /**
+   * Give `o`, which has elements, the storage `elements` in place of its
+   * own, so that a for-in under way over it goes on over them.
+   */
+  setElements(o: AsObject, elements: Value[]): void {
+    o.$a = elements;
+    forgetStep(o);
+  }
+
   /** An Array holding `values`. */
   array(values: Value[]): AsObject {
-    const o = this.builtinTraits("Array").instance();
+    const o = (this.arrayTraits ?? this.builtinTraits("Array")).instance();
     o.$a = values;
     return o;
   }
@@ -3349,7 +3362,7 @@ export class Runtime {
     }
 
     // As avmplus' ArrayObject and TypedVectorObject: the elements, then the other names.
-    const length = elementsAt(o, index);
+    const length = elementsAt(o, index)?.length ?? 0;
     if (index > 0 && index <= length) {
       const element = index - 1;
       return element < INT_ATOM_LIMIT ? element : String(element);
@@ -3366,7 +3379,7 @@ export class Runtime {
   }
 
   nextValue(o: Value, index: number): Value {
-    const traits: Traits | undefined = o?.$traits;
+    const traits: Traits | undefined = traitsAt(o, index);
     if (!continues(o, index)) {
       const properties = traits?.properties;
       if (properties) {
@@ -3386,7 +3399,8 @@ export class Runtime {
       }
     }
 
-    const length = elementsAt(o, index);
+    const a = elementsAt(o, index);
+    const length = a?.length ?? 0;
     if (index > 0 && index <= length) {
       const element = index - 1;
       if (traits?.getIndex) {
@@ -3395,8 +3409,8 @@ export class Runtime {
 
       if (traits === this.arrayTraits) {
         // A hole reads undefined too: only then is `in` asked.
-        const value = o.$a[element];
-        if (value !== undefined || element in o.$a) {
+        const value = (a as Value[])[element];
+        if (value !== undefined || element in (a as Value[])) {
           return value;
         }
       }
@@ -3410,12 +3424,22 @@ export class Runtime {
     }
 
     // Else a Dictionary's slot holds a dynamic property's name.
-    const name =
-      keys !== null
-        ? (keys.nameAt(index - length) as string)
-        : index <= length
-          ? String(index - 1)
-          : enumerated(o, index - length, index);
+    let name: string;
+    if (keys !== null) {
+      name = keys.nameAt(index - length) as string;
+    } else if (index <= length) {
+      // A step by a sparse Array's indices reads its element here, off the path of every other.
+      if (index < 0) {
+        const value = sparseElement(o, index, traits === this.arrayTraits, NOT_FOUND);
+        if (value !== NOT_FOUND) {
+          return value;
+        }
+      }
+
+      name = elementName(index);
+    } else {
+      name = enumerated(o, index - length, index) as string;
+    }
 
     // A dynamic property's value, as avmplus' nextValue reads its slot's:
     // no binding has its name, which setting it would have gone to.