@tishlang/tish-lint 2.12.0 → 2.35.0

package/crates/tish_core/src/json.rs

@@ -80,10 +80,31 @@ pub fn json_parse(json: &str) -> Result<Value, String> {
 /// per-node `String` only to copy + drop it on the way back up. For a
 /// 20-row TFB `/queries` response (~40 numbers, 2 keys × 20 = ~80 string
 /// ops) that saves dozens of small allocations per request.
+fn json_stringify_capacity_hint(value: &Value) -> usize {
+    match value {
+        Value::Array(arr) => {
+            let n = arr.borrow().len();
+            if n > 64 {
+                // json_roundtrip / large API payloads: ~80–100 B per row is typical.
+                n.saturating_mul(96).max(256)
+            } else {
+                256
+            }
+        }
+        Value::Object(obj) => {
+            let n = obj.borrow().strings.len();
+            if n > 32 {
+                n.saturating_mul(128).max(256)
+            } else {
+                256
+            }
+        }
+        _ => 256,
+    }
+}
+
 pub fn json_stringify(value: &Value) -> String {
-    // 256 B is enough for typical TFB responses (`/db` is 31 B,
-    // `/queries=20` is ~700 B). Larger payloads reallocate normally.
-    let mut buf = String::with_capacity(256);
+    let mut buf = String::with_capacity(json_stringify_capacity_hint(value));
     json_stringify_into(&mut buf, value);
     buf
 }
@@ -91,7 +112,39 @@ pub fn json_stringify(value: &Value) -> String {
 /// Append a JSON-stringified `value` to `buf`. Used by JSON.stringify for
 /// the recursive case so we don't pay for an intermediate `String` per
 /// node.
+///
+/// Cyclic object graphs (`a.self = a`) are detected and — matching JS, which throws
+/// `TypeError: Converting circular structure to JSON` — set a pending throw and emit `null` for the
+/// back-reference instead of recursing forever (#381: this was an unrecoverable thread hang, directly
+/// reachable from HTTP response serialization).
 pub fn json_stringify_into(buf: &mut String, value: &Value) {
+    // Track the CURRENT ancestor path only (not all-visited): a node repeated across sibling branches
+    // is a legal DAG and must serialize twice; only a back-edge to an ancestor is a cycle.
+    let mut ancestors: Vec<*const ()> = Vec::new();
+    json_stringify_into_guarded(buf, value, &mut ancestors);
+}
+
+/// Set the JS "circular structure" TypeError as the pending throw (once). The `{ name, message }`
+/// shape matches node (`e.name === "TypeError"`, `e.message === "Converting circular structure to
+/// JSON"`) and tish's own thrown-error convention (`construct_builtin::error_object`, the recursion
+/// `RangeError` from [`crate::stack_overflow_error`]) — the previous `{ error: <msg> }` shape left
+/// `e.name` null in a catch block, diverging from node.
+fn signal_circular_json_throw() {
+    if !crate::has_pending_throw() {
+        crate::set_pending_throw(Value::object_from_pairs([
+            (
+                std::sync::Arc::from("name"),
+                Value::String("TypeError".into()),
+            ),
+            (
+                std::sync::Arc::from("message"),
+                Value::String("Converting circular structure to JSON".into()),
+            ),
+        ]));
+    }
+}
+
+fn json_stringify_into_guarded(buf: &mut String, value: &Value, ancestors: &mut Vec<*const ()>) {
     match value {
         Value::Null => buf.push_str("null"),
         Value::Bool(true) => buf.push_str("true"),
@@ -103,15 +156,24 @@ pub fn json_stringify_into(buf: &mut String, value: &Value) {
             buf.push('"');
         }
         Value::Array(arr) => {
+            let ptr = arr.as_ptr();
+            if ancestors.contains(&ptr) {
+                signal_circular_json_throw();
+                buf.push_str("null");
+                return;
+            }
+            ancestors.push(ptr);
             let borrowed = arr.borrow();
             buf.push('[');
             for (i, item) in borrowed.iter().enumerate() {
                 if i > 0 {
                     buf.push(',');
                 }
-                json_stringify_into(buf, item);
+                json_stringify_into_guarded(buf, item, ancestors);
             }
             buf.push(']');
+            drop(borrowed);
+            ancestors.pop();
         }
         Value::NumberArray(arr) => {
             let borrowed = arr.borrow();
@@ -125,6 +187,13 @@ pub fn json_stringify_into(buf: &mut String, value: &Value) {
             buf.push(']');
         }
         Value::Object(obj) => {
+            let ptr = obj.as_ptr();
+            if ancestors.contains(&ptr) {
+                signal_circular_json_throw();
+                buf.push_str("null");
+                return;
+            }
+            ancestors.push(ptr);
             let borrowed = obj.borrow();
             // Iterate in insertion order (PropMap preserves it) — matches JS/Node
             // and `Object.keys`. No intermediate key Vec, no sort: one fewer
@@ -137,9 +206,11 @@ pub fn json_stringify_into(buf: &mut String, value: &Value) {
                 buf.push('"');
                 escape_json_string_into(buf, key);
                 buf.push_str("\":");
-                json_stringify_into(buf, val);
+                json_stringify_into_guarded(buf, val, ancestors);
             }
             buf.push('}');
+            drop(borrowed);
+            ancestors.pop();
         }
         Value::Function(_) | Value::Promise(_) | Value::Opaque(_) | Value::Symbol(_) => {
             buf.push_str("null");
@@ -153,7 +224,11 @@ pub fn json_stringify_into(buf: &mut String, value: &Value) {
 /// to `buf`. Optimised for the common case where the input is ASCII and
 /// contains no characters that need escaping — we fast-pass the bytes
 /// straight through, only falling into the per-char path on a hit.
-fn escape_json_string_into(buf: &mut String, s: &str) {
+/// Append `s` to `buf` as a JSON string body (WITHOUT the surrounding quotes), escaping `"`, `\`,
+/// and every control char < 0x20 (`\n \r \t \b \f`, else `\u00xx`). The single source of truth for
+/// JSON string escaping, shared by the vm/native path here and the interpreter's `JSON.stringify`
+/// (which otherwise hand-rolled an escaper that missed `\b`/`\f`/`\u00xx` and emitted invalid JSON).
+pub fn escape_json_string_into(buf: &mut String, s: &str) {
     let bytes = s.as_bytes();
     let mut start = 0usize;
     for (i, &b) in bytes.iter().enumerate() {
@@ -477,6 +552,34 @@ fn parse_object<'a>(
 mod tests {
     use super::*;
 
+    /// #381: a self-referential array must NOT loop forever — `JSON.stringify` terminates, emits a
+    /// finite string, and (matching JS) leaves a pending TypeError. The test *completing* is itself
+    /// the assertion that the former infinite hang is gone.
+    #[test]
+    fn json_stringify_cyclic_array_terminates_and_throws() {
+        let _ = crate::take_pending_throw(); // isolate from any prior thread-local throw
+        let a = Value::Array(crate::VmRef::new(Vec::new()));
+        if let Value::Array(inner) = &a {
+            inner.borrow_mut().push(a.clone()); // a = [a]
+        }
+        let s = json_stringify(&a);
+        assert_eq!(s, "[null]", "back-reference serializes as null, finite output");
+        assert!(crate::has_pending_throw(), "cyclic stringify must set a pending TypeError");
+        let _ = crate::take_pending_throw(); // clean up thread-local for other tests
+    }
+
+    /// A shared (non-cyclic) node repeated across sibling branches is a legal DAG and must serialize
+    /// twice — the ancestor-only tracking must NOT misflag it as a cycle.
+    #[test]
+    fn json_stringify_shared_dag_node_is_not_a_cycle() {
+        let _ = crate::take_pending_throw();
+        let shared = Value::Array(crate::VmRef::new(vec![Value::Number(1.0)]));
+        let root = Value::Array(crate::VmRef::new(vec![shared.clone(), shared.clone()]));
+        let s = json_stringify(&root);
+        assert_eq!(s, "[[1],[1]]", "a shared node is a DAG, not a cycle");
+        assert!(!crate::has_pending_throw(), "a DAG must NOT throw");
+    }
+
     #[test]
     fn test_parse_primitives() {
         assert!(matches!(json_parse("null").unwrap(), Value::Null));

package/crates/tish_core/src/lib.rs

@@ -12,9 +12,11 @@ mod value;
 mod vmref;
 
 pub use console_style::{format_value_styled, format_values_for_console, use_console_colors};
-pub use json::{json_parse, json_stringify, json_stringify_into, write_json_number};
+pub use json::{
+    escape_json_string_into, json_parse, json_stringify, json_stringify_into, write_json_number,
+};
 pub use shape::{ShapeId, DICT_SHAPE, EMPTY_SHAPE};
-pub use uri::{percent_decode, percent_encode};
+pub use uri::{percent_decode, percent_decode_component, percent_encode, percent_encode_component};
 pub use arcstr::ArcStr;
 pub use value::*;
 pub use vmref::{VmReadGuard, VmRef, VmWriteGuard};
@@ -40,3 +42,221 @@ pub fn process_argv() -> Vec<String> {
         None => std::env::args().collect(),
     }
 }
+
+/// #303 — a thrown JS value parked while it unwinds across a boundary that can't carry a `Result`.
+///
+/// The native value-fn ABI is `Fn(&[Value]) -> Value`, and `Callable::call` likewise returns a bare
+/// `Value`, so a `throw` crossing such a boundary can't ride a `Result`. It is parked here and picked
+/// up at the next checkpoint: native codegen checks it after each call; the VM checks it after each
+/// `Callable::call`; and the shared array builtins (`forEach`/`map`/`sort`/…) check it between
+/// elements so they stop iterating promptly instead of running the callback for the rest of the
+/// array. The slot lives in `tishlang_core` (rather than `tishlang_runtime`) so `tishlang_builtins`
+/// can poll it without a `builtins -> runtime` dependency cycle; `tishlang_runtime` and `tishlang_vm`
+/// share this one slot. First-throw-wins; drained exactly once by [`take_pending_throw`] at the frame
+/// that converts it back into a `Result`.
+thread_local! {
+    static PENDING_THROW: std::cell::RefCell<Option<Value>> = const { std::cell::RefCell::new(None) };
+}
+
+/// Park a thrown value to propagate across a non-`Result` boundary. First-throw-wins: if one is
+/// already pending (an erroneous continuation reached a second throw before the slot was drained),
+/// keep the first — that is the throw JS would have raised.
+pub fn set_pending_throw(v: Value) {
+    PENDING_THROW.with(|c| {
+        let mut slot = c.borrow_mut();
+        if slot.is_none() {
+            *slot = Some(v);
+        }
+    });
+}
+
+/// Is a thrown value waiting to propagate?
+pub fn has_pending_throw() -> bool {
+    PENDING_THROW.with(|c| c.borrow().is_some())
+}
+
+/// Take the parked thrown value, clearing the slot (drains it exactly once).
+pub fn take_pending_throw() -> Option<Value> {
+    PENDING_THROW.with(|c| c.borrow_mut().take())
+}
+
+thread_local! {
+    /// Current user-function call depth for the bytecode VM. The VM's recursive path builds a fresh
+    /// `Vm` per call (so no shared struct field can accumulate) and its `Callable::call` signature is
+    /// fixed — a thread-local is the VM's equivalent of the interpreter's shared `Rc<Cell>` counter.
+    /// Lives here (not `tish_vm`) beside `PENDING_THROW` for the same layering reason. #381
+    static CALL_DEPTH: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// Enter one VM call frame; returns the new depth. Pair every call with [`dec_call_depth`].
+#[inline]
+pub fn inc_call_depth() -> usize {
+    CALL_DEPTH.with(|c| {
+        let d = c.get() + 1;
+        c.set(d);
+        d
+    })
+}
+
+/// Leave one VM call frame.
+#[inline]
+pub fn dec_call_depth() {
+    CALL_DEPTH.with(|c| c.set(c.get().saturating_sub(1)));
+}
+
+/// Default recursion ceiling shared by every backend that counts call depth (#381). Chosen with the
+/// interpreter: comfortably deep for real programs, but reached long before counted recursion can
+/// exhaust memory or the stack.
+pub const DEFAULT_MAX_CALL_DEPTH: usize = 20_000;
+
+thread_local! {
+    // The recursion ceiling, lazily initialized from `TISH_MAX_CALL_DEPTH` (0 = uninitialized). A
+    // thread-local Cell (not OnceLock) so tests can override it per-thread without racing the
+    // process-wide env. Shared by the VM's guard and the native backend's boxed-call guard. #381
+    static MAX_CALL_DEPTH: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+/// The recursion ceiling for depth-counting guards: user-fn calls deeper than this raise a catchable
+/// `RangeError` instead of overflowing the native stack. `TISH_MAX_CALL_DEPTH` overrides (default
+/// [`DEFAULT_MAX_CALL_DEPTH`]). #381
+pub fn max_call_depth() -> usize {
+    MAX_CALL_DEPTH.with(|c| {
+        let v = c.get();
+        if v != 0 {
+            return v;
+        }
+        let init = std::env::var("TISH_MAX_CALL_DEPTH")
+            .ok()
+            .and_then(|s| s.parse::<usize>().ok())
+            .filter(|&n| n > 0)
+            .unwrap_or(DEFAULT_MAX_CALL_DEPTH);
+        c.set(init);
+        init
+    })
+}
+
+/// Test hook: pin the ceiling for the current thread (bypasses the env read).
+pub fn set_max_call_depth_for_test(n: usize) {
+    MAX_CALL_DEPTH.with(|c| c.set(n));
+}
+
+/// The catchable `RangeError` raised when a recursion guard trips. Built by hand (`tishlang_core`
+/// sits below `tishlang_builtins`) but shape-identical to `construct_builtin::error_object`:
+/// a `{ name, message }` object — keep the two in lock-step.
+pub fn stack_overflow_error() -> Value {
+    let mut e = ObjectMap::default();
+    e.insert(
+        std::sync::Arc::from("name"),
+        Value::String("RangeError".into()),
+    );
+    e.insert(
+        std::sync::Arc::from("message"),
+        Value::String("Maximum call stack size exceeded".into()),
+    );
+    Value::object(e)
+}
+
+/// A catchable `TypeError` for calling a non-callable value — the `{ name, message }` shape matches
+/// the VM/interpreter/node (`e.name === "TypeError"`). Used to PARK a pending throw (#381) instead of
+/// aborting the process, so `value_call` on a non-function surfaces as a catchable error at the next
+/// pending-throw checkpoint rather than an uncatchable native panic.
+pub fn not_a_function_error(message: impl Into<String>) -> Value {
+    let mut e = ObjectMap::default();
+    e.insert(
+        std::sync::Arc::from("name"),
+        Value::String("TypeError".into()),
+    );
+    e.insert(
+        std::sync::Arc::from("message"),
+        Value::String(message.into().into()),
+    );
+    Value::object(e)
+}
+
+/// A catchable `TypeError` with an arbitrary message (`{ name: "TypeError", message }`), matching the
+/// VM/interpreter/node shape. Used to PARK a pending throw from a shared builtin that returns a plain
+/// `Value` and so cannot signal an error with `Result` (e.g. `[].reduce(fn)` with no initial value).
+pub fn type_error(message: impl Into<String>) -> Value {
+    let mut e = ObjectMap::default();
+    e.insert(
+        std::sync::Arc::from("name"),
+        Value::String("TypeError".into()),
+    );
+    e.insert(
+        std::sync::Arc::from("message"),
+        Value::String(message.into().into()),
+    );
+    Value::object(e)
+}
+
+/// A string key names a canonical array index iff it is a non-negative integer whose decimal form
+/// round-trips and is below the array-index ceiling (`2³²−1`): `"0"`, `"12"` → `Some`; `"01"`, `"-1"`,
+/// `"1.5"`, `"foo"`, `" 1"`, `""` → `None`. Shared so `arr["0"] === arr[0]` on every backend (#432).
+pub fn str_to_array_index(s: &str) -> Option<usize> {
+    let i: usize = s.parse().ok()?;
+    if i < 4_294_967_295 && i.to_string() == s {
+        Some(i)
+    } else {
+        None
+    }
+}
+
+/// A catchable `RangeError` with an arbitrary message (`{ name: "RangeError", message }`), matching the
+/// VM/interpreter/node shape. Used to PARK a pending throw from a shared builtin that returns a plain
+/// `Value` (e.g. `[1,2].with(5, x)` with an out-of-range index).
+pub fn range_error(message: impl Into<String>) -> Value {
+    let mut e = ObjectMap::default();
+    e.insert(
+        std::sync::Arc::from("name"),
+        Value::String("RangeError".into()),
+    );
+    e.insert(
+        std::sync::Arc::from("message"),
+        Value::String(message.into().into()),
+    );
+    Value::object(e)
+}
+
+/// A catchable `TypeError` for reading a property/index of the nullish value — the `{ name, message }`
+/// shape matches the VM/interpreter/node (`e.name === "TypeError"`). Used to PARK a pending throw in
+/// the native/runtime `get_prop`/`get_index` null arm (#425), so `null.length` / `null[0]` surface a
+/// catchable error at the next pending-throw checkpoint instead of silently reading back `null`.
+pub fn cannot_read_property_error(prop: &str) -> Value {
+    let mut e = ObjectMap::default();
+    e.insert(
+        std::sync::Arc::from("name"),
+        Value::String("TypeError".into()),
+    );
+    e.insert(
+        std::sync::Arc::from("message"),
+        Value::String(format!("Cannot read property '{}' of null", prop).into()),
+    );
+    Value::object(e)
+}
+
+/// RAII frame for the depth-counting recursion guard: holding one means the depth was incremented;
+/// dropping it decrements, so early returns in generated code can't leak a level. #381
+pub struct CallDepthGuard(());
+
+impl Drop for CallDepthGuard {
+    #[inline]
+    fn drop(&mut self) {
+        dec_call_depth();
+    }
+}
+
+/// Enter a counted user-fn call frame, or trip the recursion guard: past [`max_call_depth`] this
+/// parks the catchable stack-overflow `RangeError` in the pending-throw slot and returns `None` —
+/// the caller just returns its frame's dummy value (`Value::Null`) and the throw surfaces at the
+/// next pending-throw checkpoint. The native backend emits this at the top of every boxed user-fn
+/// closure. #381
+#[inline]
+pub fn enter_call_guarded() -> Option<CallDepthGuard> {
+    let depth = inc_call_depth();
+    if depth > max_call_depth() {
+        dec_call_depth();
+        set_pending_throw(stack_overflow_error());
+        return None;
+    }
+    Some(CallDepthGuard(()))
+}

package/crates/tish_core/src/shape.rs

@@ -12,7 +12,6 @@
 //! `PropMap` on a cache miss). Phase 1b will attach the ordered key list to each shape so objects can
 //! drop per-object key storage entirely (the butterfly representation).
 
-use std::collections::HashMap;
 use std::sync::{Arc, OnceLock, RwLock};
 
 /// Identity of an object's ordered key-set.
@@ -27,9 +26,12 @@ pub const EMPTY_SHAPE: ShapeId = 0;
 pub const DICT_SHAPE: ShapeId = u32::MAX;
 
 /// One node in the structure-transition tree: from this shape, adding a given key yields a child shape.
+/// Edges are keyed by an `ahash` map, not the default SipHash one: `transition` is on the hot path of
+/// every object construction (and `JSON.parse` — profiled as ~16% of parse, almost all SipHash), and
+/// ahash is ~2–3× faster on short string keys. Random-seeded per process, so no HashDoS regression.
 #[derive(Default)]
 struct ShapeNode {
-    transitions: HashMap<Arc<str>, ShapeId>,
+    transitions: ahash::AHashMap<Arc<str>, ShapeId>,
 }
 
 struct Registry {

package/crates/tish_core/src/uri.rs

@@ -88,6 +88,51 @@ pub fn percent_encode(input: &str) -> String {
     result
 }
 
+/// Percent-DECODE for `decodeURIComponent` — decodes EVERY `%XX` (unlike `percent_decode`/`decodeURI`,
+/// which preserves the reserved delimiters). Bytes are collected then UTF-8 decoded, so multi-byte
+/// escapes (`%E2%82%AC` → `€`) round-trip. Errors on a malformed `%` sequence (JS `URIError`).
+pub fn percent_decode_component(input: &str) -> Result<String, String> {
+    let bytes = input.as_bytes();
+    let mut out: Vec<u8> = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%' {
+            if i + 2 < bytes.len() {
+                if let Some(b) = std::str::from_utf8(&bytes[i + 1..i + 3])
+                    .ok()
+                    .and_then(|s| u8::from_str_radix(s, 16).ok())
+                {
+                    out.push(b);
+                    i += 3;
+                    continue;
+                }
+            }
+            return Err("URIError: malformed URI sequence".to_string());
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8(out).map_err(|_| "URIError: malformed URI sequence".to_string())
+}
+
+/// Percent-encode for `encodeURIComponent` — escapes everything except the unreserved set
+/// `A-Za-z0-9 - _ . ! ~ * ' ( )` (stricter than `encodeURI`, which also preserves the URI reserved
+/// delimiters `; / ? : @ & = + $ , #`).
+pub fn percent_encode_component(input: &str) -> String {
+    const UNRESERVED: &[char] = &['-', '_', '.', '!', '~', '*', '\'', '(', ')'];
+    let mut result = String::with_capacity(input.len());
+    for c in input.chars() {
+        if c.is_ascii_alphanumeric() || UNRESERVED.contains(&c) {
+            result.push(c);
+        } else {
+            for byte in c.to_string().as_bytes() {
+                result.push_str(&format!("%{:02X}", byte));
+            }
+        }
+    }
+    result
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;