@tishlang/tish-lint 3.10.4 → 3.10.9

package/crates/tish/src/main.rs

@@ -57,13 +57,17 @@ fn vm_capabilities_for_cli_run(cli_features: &[String]) -> HashSet<String> {
 /// `--feature` list for `tish build --target native`: same default as `tish run` (all linked-in caps).
 fn native_build_features_from_cli(cli_features: &[String]) -> Vec<String> {
     let mut v: Vec<String> = if cli_features.is_empty() {
-        tishlang_vm::all_compiled_capabilities().into_iter().collect()
+        tishlang_vm::all_compiled_capabilities()
+            .into_iter()
+            .collect()
     } else {
         // Normalize exactly like `tish run`: split comma-separated values (`--feature http,timers`)
         // and expand `full`. Without this, a value like "http,timers,process" was treated as one
         // opaque feature name, so `has_feature("http")` was false and the http runtime imports were
         // never emitted — async `fetch` then failed to compile (issue #209).
-        normalize_capability_flags(cli_features).into_iter().collect()
+        normalize_capability_flags(cli_features)
+            .into_iter()
+            .collect()
     };
     v.sort();
     v
@@ -73,8 +77,15 @@ fn native_build_features_from_cli(cli_features: &[String]) -> Vec<String> {
 fn argv_with_implicit_run(mut argv: Vec<String>) -> Vec<String> {
     if argv.len() >= 2 {
         let first = argv[1].as_str();
-        const SUBCOMMANDS: &[&str] =
-            &["run", "repl", "test", "build", "compile-module", "resolve-id", "dump-ast"];
+        const SUBCOMMANDS: &[&str] = &[
+            "run",
+            "repl",
+            "test",
+            "build",
+            "compile-module",
+            "resolve-id",
+            "dump-ast",
+        ];
         let looks_like_file = !first.starts_with('-') && !SUBCOMMANDS.contains(&first);
         if looks_like_file {
             argv.insert(1, "run".to_string());
@@ -112,19 +123,26 @@ fn main() {
             // Expose a node-shaped `process.argv` to the script: `[tish-exe, <file>, args...]`,
             // so `tish run main.tish a b` gives the script `["…/tish", "main.tish", "a", "b"]`
             // (not the `run` subcommand). Interp/VM read this via `tishlang_core::process_argv`. #88
-            let exe = std::env::args().next().unwrap_or_else(|| "tish".to_string());
+            let exe = std::env::args()
+                .next()
+                .unwrap_or_else(|| "tish".to_string());
             let mut argv = Vec::with_capacity(a.script_args.len() + 2);
             argv.push(exe);
             argv.push(a.file.clone());
             argv.extend(a.script_args.iter().cloned());
             tishlang_core::set_process_argv(argv);
-            run_file(&a.file, &a.backend, &a.features, a.no_optimize || no_opt_env)
+            run_file(
+                &a.file,
+                &a.backend,
+                &a.features,
+                a.no_optimize || no_opt_env,
+            )
         }
         Some(Commands::Test(a)) => {
             #[cfg(feature = "test-runner")]
             {
-                use tishlang_test::{run_tests, TestOptions};
                 use tishlang_test::report::ReporterKind;
+                use tishlang_test::{run_tests, TestOptions};
 
                 let reporter = match a.reporter.as_str() {
                     "dots" => ReporterKind::Dots,
@@ -169,7 +187,9 @@ fn main() {
                     } else {
                         "`--backend native` is not implemented yet"
                     };
-                    eprintln!("error: unsupported --backend `{backend}` for tish test (use `vm`); {hint}");
+                    eprintln!(
+                        "error: unsupported --backend `{backend}` for tish test (use `vm`); {hint}"
+                    );
                     std::process::exit(2);
                 }
                 let opts = TestOptions {
@@ -219,10 +239,9 @@ fn main() {
             if let Some(mode) = &a.check {
                 std::env::set_var("TISH_CHECK", mode);
             }
-            if let Err(e) = tishlang_compile::apply_resolve_env(
-                a.platform.as_deref(),
-                a.surface.as_deref(),
-            ) {
+            if let Err(e) =
+                tishlang_compile::apply_resolve_env(a.platform.as_deref(), a.surface.as_deref())
+            {
                 eprintln!("Error: {}", e);
                 std::process::exit(1);
             }
@@ -241,10 +260,9 @@ fn main() {
             )
         }
         Some(Commands::CompileModule(a)) => {
-            if let Err(e) = tishlang_compile::apply_resolve_env(
-                a.platform.as_deref(),
-                a.surface.as_deref(),
-            ) {
+            if let Err(e) =
+                tishlang_compile::apply_resolve_env(a.platform.as_deref(), a.surface.as_deref())
+            {
                 eprintln!("Error: {}", e);
                 std::process::exit(1);
             }
@@ -371,7 +389,14 @@ fn run_file(
         .parent()
         .map(|p| p.to_path_buf())
         .unwrap_or_else(|| std::path::PathBuf::from("."));
-    run_program(&program, &ffi_base, backend, no_optimize, features, Some(path))
+    run_program(
+        &program,
+        &ffi_base,
+        backend,
+        no_optimize,
+        features,
+        Some(path),
+    )
 }
 
 /// Load every `ffi:<path>` cdylib the program imports, resolving each path relative to `base_dir`
@@ -382,6 +407,8 @@ fn load_ffi_modules(
     base_dir: &Path,
 ) -> Result<Vec<(String, tishlang_core::ObjectMap)>, String> {
     let mut out = Vec::new();
+    // `ffi_native_specs` yields each spec once (deduplicated in first-seen order); distinct
+    // spellings of the same library collapse inside `load_module`'s resolved-path cache (#711).
     for spec in tishlang_compile::ffi_native_specs(program) {
         let rel = spec.strip_prefix("ffi:").unwrap_or(spec.as_str());
         let lib_path = base_dir.join(rel);
@@ -804,17 +831,27 @@ fn compile_to_js_esm(
                 .into(),
         );
     }
-    let modules =
-        tishlang_compile_js::compile_project_esm(input_path, project_root, optimize, jsx_import_source)
-            .map_err(|e| format!("{}", e))?;
+    let modules = tishlang_compile_js::compile_project_esm(
+        input_path,
+        project_root,
+        optimize,
+        jsx_import_source,
+    )
+    .map_err(|e| format!("{}", e))?;
     let out_dir = Path::new(output_path);
-    fs::create_dir_all(out_dir)
-        .map_err(|e| format!("Cannot create output directory {}: {}", out_dir.display(), e))?;
+    fs::create_dir_all(out_dir).map_err(|e| {
+        format!(
+            "Cannot create output directory {}: {}",
+            out_dir.display(),
+            e
+        )
+    })?;
     for module in &modules {
         let out = out_dir.join(&module.relative_path);
         if let Some(parent) = out.parent() {
-            fs::create_dir_all(parent)
-                .map_err(|e| format!("Cannot create output directory {}: {}", parent.display(), e))?;
+            fs::create_dir_all(parent).map_err(|e| {
+                format!("Cannot create output directory {}: {}", parent.display(), e)
+            })?;
         }
         fs::write(&out, &module.js)
             .map_err(|e| format!("Cannot write {}: {}", out.display(), e))?;
@@ -1195,7 +1232,10 @@ mod cli_tests {
         // `full` expands to every capability, matching `tish run`.
         let full = native_build_features_from_cli(&["full".to_string()]);
         for cap in ["http", "timers", "fs", "process", "regex", "ws", "tty"] {
-            assert!(full.iter().any(|s| s == cap), "`full` missing `{cap}` in {full:?}");
+            assert!(
+                full.iter().any(|s| s == cap),
+                "`full` missing `{cap}` in {full:?}"
+            );
         }
     }
 

package/crates/tish_builtins/src/globals.rs

@@ -436,9 +436,9 @@ pub fn object_assign(args: &[Value]) -> Value {
         };
         if let Value::Object(src) = source {
             let src_borrow = src.borrow();
-            for (k, v) in src_borrow.strings.iter() {
-                target_mut.strings.insert(Arc::clone(k), v.clone());
-            }
+            // merge_from propagates dictionary-ness: copying from a DICT_SHAPE source (whose
+            // stored key order is not meaningful) must not re-mint tracked shape chains (#708).
+            target_mut.strings.merge_from(&src_borrow.strings);
             if let Some(ss) = &src_borrow.symbols {
                 if target_mut.symbols.is_none() {
                     target_mut.symbols = Some(Default::default());

package/crates/tish_builtins/src/symbol.rs

@@ -2,7 +2,14 @@
 
 #[cfg(feature = "portable")]
 #[allow(unused_imports)]
-use alloc::{borrow::ToOwned, boxed::Box, format, string::{String, ToString}, vec, vec::Vec};
+use alloc::{
+    borrow::ToOwned,
+    boxed::Box,
+    format,
+    string::{String, ToString},
+    vec,
+    vec::Vec,
+};
 
 use tishlang_core::sync::{Mutex, OnceLock};
 use tishlang_core::{alloc_symbol_id, AHashMap, Arc, ObjectMap, TishSymbol, Value};
@@ -33,7 +40,9 @@ fn symbol_new(args: &[Value]) -> Value {
         if matches!(v, Value::Null) {
             None
         } else {
-            Some(v.to_display_string().into())
+            // ECMAScript ToString of the description (`Symbol({})` → "[object Object]"), not the
+            // console-inspect form (#715). Conformance-only here: unique symbols are refcounted.
+            Some(v.to_js_string().into())
         }
     });
     Value::Symbol(TishSymbol::new_unique(desc))
@@ -54,10 +63,16 @@ fn symbol_key_for_impl(args: &[Value]) -> Value {
 pub fn symbol_object() -> Value {
     let call = Value::native(symbol_new);
     let for_fn = Value::native(|args: &[Value]| {
+        // The registry key is the ECMAScript ToString of the argument (spec: `Symbol.for`
+        // coerces with ToString), NOT the console-inspect form (#715): every object keys the
+        // single "[object Object]" entry and an array keys its comma-joined form, exactly as
+        // in JS. The inspect form turned the immortal registry's program-text-bounded key set
+        // into a data-driven one — `Symbol.for({id: n})` interned one permanent entry per
+        // distinct rendered object. A missing argument keys "undefined" (ToString(undefined)).
         let key = args
             .first()
-            .map(|v| v.to_display_string())
-            .unwrap_or_default();
+            .map(|v| v.to_js_string())
+            .unwrap_or_else(|| "undefined".to_string());
         symbol_for_impl(&key)
     });
     let key_for = Value::native(symbol_key_for_impl);
@@ -80,4 +95,71 @@ mod tests {
         let r = value_call(&o, &[Value::String("hi".into())]);
         assert!(matches!(r, Value::Symbol(_)));
     }
+
+    fn member(o: &Value, name: &str) -> Value {
+        match o {
+            Value::Object(obj) => obj
+                .borrow()
+                .strings
+                .get(name)
+                .cloned()
+                .unwrap_or_else(|| panic!("missing member {name}")),
+            other => panic!("expected object, got {other:?}"),
+        }
+    }
+
+    fn as_symbol(v: Value) -> Arc<TishSymbol> {
+        match v {
+            Value::Symbol(s) => s,
+            other => panic!("expected symbol, got {other:?}"),
+        }
+    }
+
+    fn test_object(n: f64) -> Value {
+        let mut m = ObjectMap::default();
+        m.insert(Arc::from("id"), Value::Number(n));
+        Value::object(m)
+    }
+
+    // #715: the registry keys on ToString, so two DISTINCT objects intern the SAME entry
+    // ("[object Object]") — previously each distinct inspect string ("{id: 1}", "{id: 2}", …)
+    // interned one immortal registry entry per call.
+    #[test]
+    fn symbol_for_keys_objects_by_tostring() {
+        let for_fn = member(&symbol_object(), "for");
+        let a = as_symbol(value_call(&for_fn, &[test_object(1.0)]));
+        let b = as_symbol(value_call(&for_fn, &[test_object(2.0)]));
+        assert!(
+            Arc::ptr_eq(&a, &b),
+            "distinct objects must intern one shared '[object Object]' registry entry"
+        );
+        assert_eq!(a.registry_key.as_deref(), Some("[object Object]"));
+    }
+
+    // String and number args keep their (spec-shaped) keys; ToString makes Symbol.for(1) and
+    // Symbol.for("1") the same symbol, as in JS.
+    #[test]
+    fn symbol_for_string_and_number_keys_unchanged() {
+        let for_fn = member(&symbol_object(), "for");
+        let s1 = as_symbol(value_call(&for_fn, &[Value::String("sym.key.715".into())]));
+        let s2 = as_symbol(value_call(&for_fn, &[Value::String("sym.key.715".into())]));
+        assert!(Arc::ptr_eq(&s1, &s2));
+        assert_eq!(s1.registry_key.as_deref(), Some("sym.key.715"));
+
+        let n = as_symbol(value_call(&for_fn, &[Value::Number(1.0)]));
+        let n_str = as_symbol(value_call(&for_fn, &[Value::String("1".into())]));
+        assert_eq!(n.registry_key.as_deref(), Some("1"));
+        assert!(
+            Arc::ptr_eq(&n, &n_str),
+            "Symbol.for(1) === Symbol.for(\"1\")"
+        );
+    }
+
+    // A missing argument keys "undefined" (ToString(undefined)), not "".
+    #[test]
+    fn symbol_for_missing_arg_keys_undefined() {
+        let for_fn = member(&symbol_object(), "for");
+        let s = as_symbol(value_call(&for_fn, &[]));
+        assert_eq!(s.registry_key.as_deref(), Some("undefined"));
+    }
 }

package/crates/tish_bytecode/src/compiler.rs

@@ -2056,12 +2056,28 @@ impl<'a> Compiler<'a> {
                 self.emit(Opcode::LoadConst);
                 let idx = self.constant_idx(Constant::Closure(nested_idx));
                 self.chunk.write_u16(idx);
-                let idx = self.name_idx(name);
-                self.emit_u16(Opcode::DeclareVar, idx);
-                self.scope
-                    .last_mut()
-                    .unwrap()
-                    .insert(Arc::clone(name), false);
+                // #716: bind the function's NAME like any other local. `DeclareVar` inserts the
+                // closure into the very `local_scope` map the closure just captured (vm.rs
+                // `Constant::Closure` → `VmClosure.enclosing`), minting a deterministic
+                // closure→scope→closure cycle per call — refcount-only, so the whole frame leaked.
+                // In general slot mode an UNCAPTURED name gets a frame slot instead: the closure
+                // never enters the captured map, and the frame drops normally on return. A name
+                // referenced from inside ANY nested closure — the function's own body
+                // (self-recursion) or a sibling (mutual recursion) — is in `slot_captured`
+                // (`SlotScan` scans FunDecl bodies as closures) and stays on the `DeclareVar`
+                // path, exactly like a captured `let` (see `Statement::VarDecl` above).
+                // `TISH_VM_SLOTS=0` ⇒ `general_slots` is false ⇒ byte-identical output.
+                if self.general_slots && !self.slot_captured.contains(name.as_ref()) {
+                    let slot = self.declare_slot(name);
+                    self.emit_u16(Opcode::StoreLocal, slot);
+                } else {
+                    let idx = self.name_idx(name);
+                    self.emit_u16(Opcode::DeclareVar, idx);
+                    self.scope
+                        .last_mut()
+                        .unwrap()
+                        .insert(Arc::clone(name), false);
+                }
             }
             Statement::DoWhile { body, cond, .. } => {
                 let body_lets = Self::loop_body_block_lets(body);

package/crates/tish_bytecode/tests/fundecl_slot_binding.rs

@@ -0,0 +1,115 @@
+//! #716: how a body-level `function NAME` binds its name in general slot mode.
+//!
+//! An UNCAPTURED name must be slot-bound (`StoreLocal`) — `DeclareVar` would insert the
+//! closure into the very `local_scope` map the closure captured, minting a per-call
+//! closure→scope→closure cycle that leaks the whole frame (refcount-only runtime, no
+//! cycle collector). A name referenced from inside ANY nested closure — the function's
+//! own body (self-recursion) or a sibling (mutual recursion) — is in the captured set
+//! and must STAY on the `DeclareVar` scope path, or the recursive name lookup breaks.
+
+use tishlang_bytecode::{compile, Chunk, Opcode};
+
+/// Count occurrences of `target` in `chunk.code`, walking real instruction boundaries.
+fn count_opcode(chunk: &Chunk, target: Opcode) -> usize {
+    let code = &chunk.code;
+    let mut ip = 0usize;
+    let mut n = 0usize;
+    while ip < code.len() {
+        let op = Opcode::from_u8(code[ip]).expect("valid opcode");
+        if op == target {
+            n += 1;
+        }
+        ip += op.instruction_size(code, ip).expect("sized instruction");
+    }
+    n
+}
+
+fn compile_src(src: &str) -> Chunk {
+    let program = tishlang_parser::parse(src).expect("parse");
+    compile(&program).expect("compile")
+}
+
+/// These tests assert slot-mode emission; running the suite with `TISH_VM_SLOTS=0`
+/// deliberately exercises the legacy name-based path, where they do not apply.
+fn slots_disabled() -> bool {
+    std::env::var("TISH_VM_SLOTS")
+        .map(|v| v == "0")
+        .unwrap_or(false)
+}
+
+#[test]
+fn uncaptured_body_level_fn_is_slot_bound() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer() {
+  function helper(a) { return a + 1 }
+  return helper(41)
+}
+console.log(outer())
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert!(
+        outer.slot_based,
+        "outer should compile in general slot mode"
+    );
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        0,
+        "uncaptured `function helper` must not DeclareVar into the captured scope (#716 cycle)"
+    );
+    assert!(
+        count_opcode(outer, Opcode::StoreLocal) >= 1,
+        "uncaptured `function helper` should be stored to a frame slot"
+    );
+}
+
+#[test]
+fn self_recursive_body_level_fn_stays_on_scope_path() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer() {
+  function fact(k) { if (k < 2) { return 1 } return k * fact(k - 1) }
+  return fact(5)
+}
+console.log(outer())
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        1,
+        "self-recursive `fact` references its own name from inside its body — that IS a \
+         capture, and the name must stay DeclareVar-bound in `local_scope`"
+    );
+}
+
+#[test]
+fn mutually_recursive_body_level_fns_stay_on_scope_path() {
+    if slots_disabled() {
+        return;
+    }
+    let chunk = compile_src(
+        r#"
+function outer(n) {
+  function isEven(k) { if (k === 0) { return true } return isOdd(k - 1) }
+  function isOdd(k) { if (k === 0) { return false } return isEven(k - 1) }
+  return isEven(n)
+}
+console.log(outer(10))
+"#,
+    );
+    let outer = &chunk.nested[0];
+    assert_eq!(
+        count_opcode(outer, Opcode::DeclareVar),
+        2,
+        "mutually recursive names are captured by the sibling closure and must both stay \
+         DeclareVar-bound"
+    );
+}

package/crates/tish_core/src/shape.rs

@@ -31,10 +31,31 @@ pub const DICT_SHAPE: ShapeId = u32::MAX;
 /// Edges are keyed by an `ahash` map, not the default SipHash one: `transition` is on the hot path of
 /// every object construction (and `JSON.parse` — profiled as ~16% of parse, almost all SipHash), and
 /// ahash is ~2–3× faster on short string keys. Random-seeded per process, so no HashDoS regression.
+/// Growth backstops (#701/#706/#710). The registry has no eviction — a permanent `ShapeNode`
+/// plus an `Arc` clone of the key per distinct `(parent, key)` edge — so every mint site must be
+/// bounded. Three independent caps, all degrading to `DICT_SHAPE` (never an error):
+///
+/// - `MAX_TRANSITIONS_PER_NODE` bounds a node's fan-out. The hot pathology is node 0: every
+///   fresh `{}` that takes a data-dependent first key (`o[requestId] = …`) adds one edge to
+///   EMPTY_SHAPE's map, forever, under the global write lock.
+/// - `MAX_CHAIN_DEPTH` bounds a chain's length. A single object accumulating keys one at a time
+///   mints a linear chain (each node fan-out 1, so the fan-out cap never trips). `PropMap`
+///   promotion demotes to dictionary mode at 9 keys, but `with_capacity`-built maps skip
+///   promotion — the depth cap is their backstop.
+/// - `MAX_SHAPES` is the absolute registry ceiling; past it nothing new is ever interned.
+///
+/// Values are far above anything a program's TEXT can mint (shapes are meant to be bounded by
+/// code structure), and far below the ~750 GB where the u32 id-overflow guard would trip.
+const MAX_TRANSITIONS_PER_NODE: usize = 256;
+const MAX_CHAIN_DEPTH: u16 = 32;
+const MAX_SHAPES: usize = 1 << 18; // 262_144 nodes ≈ tens of MB worst-case, orders above real use
+
 #[cfg(not(feature = "portable"))]
 #[derive(Default)]
 struct ShapeNode {
     transitions: AHashMap<Arc<str>, ShapeId>,
+    /// Distance from EMPTY_SHAPE (== number of keys on the path). Bounds chain length.
+    depth: u16,
 }
 
 #[cfg(not(feature = "portable"))]
@@ -85,6 +106,8 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
         return DICT_SHAPE;
     }
     // Fast path: the edge already exists (the common case after the first object of this shape).
+    // The caps are ALSO checked here, read-only: a saturated node keeps answering DICT_SHAPE
+    // from the read lock instead of convoying every miss through the write lock below.
     {
         let reg = registry().read().unwrap();
         match reg.nodes.get(from as usize) {
@@ -92,6 +115,11 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
                 if let Some(&next) = node.transitions.get(key.as_ref()) {
                     return next;
                 }
+                if node.transitions.len() >= MAX_TRANSITIONS_PER_NODE
+                    || node.depth >= MAX_CHAIN_DEPTH
+                {
+                    return DICT_SHAPE;
+                }
             }
             None => return DICT_SHAPE, // out of range — should not happen; degrade safely
         }
@@ -102,13 +130,38 @@ fn transition_tracked(from: ShapeId, key: &Arc<str>) -> ShapeId {
     if let Some(&next) = reg.nodes[from as usize].transitions.get(key.as_ref()) {
         return next;
     }
+    // Re-check the caps under the write lock too (the read-path check can race).
+    let parent_depth = reg.nodes[from as usize].depth;
+    if reg.nodes[from as usize].transitions.len() >= MAX_TRANSITIONS_PER_NODE
+        || parent_depth >= MAX_CHAIN_DEPTH
+        || reg.nodes.len() >= MAX_SHAPES
+    {
+        return DICT_SHAPE;
+    }
     let new_id = reg.nodes.len();
     if new_id >= DICT_SHAPE as usize {
-        return DICT_SHAPE; // ran out of shape ids — extremely unlikely; degrade to dictionary mode
+        return DICT_SHAPE; // id-space overflow guard — prevents u32 truncation aliasing live ids
     }
-    reg.nodes.push(ShapeNode::default());
+    reg.nodes.push(ShapeNode {
+        transitions: AHashMap::default(),
+        depth: parent_depth + 1,
+    });
     reg.nodes[from as usize]
         .transitions
         .insert(Arc::clone(key), new_id as ShapeId);
     new_id as ShapeId
 }
+
+/// Number of interned shape nodes — for regression tests asserting that a workload does NOT
+/// grow the registry. Not part of the public surface.
+#[doc(hidden)]
+#[cfg(not(feature = "portable"))]
+pub fn shape_count() -> usize {
+    registry().read().unwrap().nodes.len()
+}
+
+#[doc(hidden)]
+#[cfg(feature = "portable")]
+pub fn shape_count() -> usize {
+    0
+}