jz 0.8.0 → 0.9.0

package/interop.js

@@ -49,14 +49,25 @@ const envFuncNames = (mod) =>
 // threads must share a pointer cell in linear memory). 8-byte aligned bump on
 // the JS side; wasm `_alloc` takes over if exported.
 
+// Every i32 heap address that crosses the wasm boundary — a `$__heap` Global's `.value`,
+// or a DataView 32-bit read — comes back through JS as a SIGNED int32 (WebAssembly JS API
+// spec: i32 is observable as ToInt32, range -2^31..2^31-1), regardless of what the address
+// actually represents (offsets are conceptually unsigned, 0..4GiB). `>>> 0` reinterprets
+// the bit pattern back to unsigned. Skipping this is harmless below 2 GiB (same value
+// either way) and silently wrong past it — a "negative" address then poisons every
+// downstream `+`/comparison, and a DataView write at a negative offset throws RangeError.
 const makeJsAllocator = (mem, heapGlobal) => {
   const dv = () => new DataView(mem.buffer)
-  const getPtr = heapGlobal ? () => heapGlobal.value : () => dv().getInt32(HEAP.PTR_ADDR, true)
+  const getPtr = heapGlobal ? () => heapGlobal.value >>> 0 : () => dv().getUint32(HEAP.PTR_ADDR, true)
   const setPtr = heapGlobal ? v => { heapGlobal.value = v } : v => dv().setInt32(HEAP.PTR_ADDR, v, true)
   // Rewind target: the global's post-static-init value, else the fixed start.
-  const base = heapGlobal ? heapGlobal.value : HEAP.START
+  const base = heapGlobal ? (heapGlobal.value >>> 0) : HEAP.START
   const alloc = (bytes) => {
-    const aligned = (getPtr() + 7) & ~7
+    // Align up to 8 without `& ~7` — a JS bitwise op ToInt32-truncates its RESULT too,
+    // so `(x + 7) & ~7` would re-introduce the same sign flip past 2 GiB even with a
+    // correctly-unsigned `getPtr()`. Plain arithmetic has no such ceiling.
+    const ptr = getPtr()
+    const aligned = ptr - (ptr % 8)
     const next = aligned + bytes
     if (next > mem.buffer.byteLength)
       mem.grow(Math.ceil((next - mem.buffer.byteLength) / 65536))
@@ -69,7 +80,7 @@ const makeJsAllocator = (mem, heapGlobal) => {
   const initHeapPtr = () => {
     if (heapGlobal) return
     const d = dv()
-    if (d.getInt32(HEAP.PTR_ADDR, true) < HEAP.START) d.setInt32(HEAP.PTR_ADDR, HEAP.START, true)
+    if (d.getUint32(HEAP.PTR_ADDR, true) < HEAP.START) d.setInt32(HEAP.PTR_ADDR, HEAP.START, true)
   }
   return { alloc, reset, initHeapPtr }
 }
@@ -241,7 +252,11 @@ export const memory = (src) => {
   // Allocator scaffold: bumps the exported `$__heap` global (or memory[1020] for
   // shared memory). Wasm `_alloc` takes over when exported; `_clear`/jsReset rewinds.
   const { alloc: jsAlloc, reset: jsReset, initHeapPtr } = makeJsAllocator(mem, wasmExports?.__heap)
-  let alloc = wasmExports?._alloc || jsAlloc
+  // `_alloc`'s i32 result crosses the wasm→JS boundary SIGNED (same ToInt32 rule as any
+  // other i32 — see makeJsAllocator's comment); `>>> 0` restores the true unsigned address
+  // once the heap grows past 2 GiB, matching jsAlloc's own already-unsigned return.
+  const wasmAlloc = wasmExports?._alloc && (bytes => wasmExports._alloc(bytes) >>> 0)
+  let alloc = wasmAlloc || jsAlloc
   initHeapPtr()
 
   // Write 16-byte header matching WASM `__alloc_hdr`:
@@ -282,7 +297,7 @@ export const memory = (src) => {
   // If already enhanced, just update bindings (new module compiled into same memory)
   if (_enhanced.has(mem)) {
     mem.schemas = schemas
-    if (wasmExports?._alloc) { alloc = wasmExports._alloc; mem.alloc = alloc }
+    if (wasmAlloc) { alloc = wasmAlloc; mem.alloc = alloc }
     mem.reset = jsReset   // post-init rewind — see the note at the first-enhance path
     if (extMap) mem._extMap = extMap
     return mem
@@ -355,6 +370,53 @@ export const memory = (src) => {
     return ptr(11, 0, id)
   }
 
+  // First-class jz HASH from a plain JS object — the schema-less marshal. Builds the
+  // kernel's exact open-addressed table ([seq<<32|hash:i64][key:f64][val:f64] × cap,
+  // home slot = hash & (cap-1), linear probe, len/cap header at -8/-4) so every
+  // wasm-side dyn op — reads, writes, NEW props, growth, delete, iteration — runs
+  // natively with stable identity. The External reflection path decodes/re-marshals
+  // per access, so nested container mutation (`params.P[i][j] = …`) lands on
+  // marshaling copies and silently vanishes — a params-bag must be a real hash.
+  // Hash twins of module/collection.js (clampHash / ssoMix / byteFnv) — MUST agree
+  // with __str_hash or wasm probes start at the wrong home slot and miss.
+  const clampHash = (h) => (h <= 1 ? (h + 2) | 0 : h)
+  const jzStrHash = (box) => {
+    const b = bits(box)
+    if ((b >> 32n) & BigInt(LAYOUT.SSO_BIT)) {   // SSO: fixed-cost mix over payload
+      const lo = Number(b & 0xFFFFFFFFn) | 0
+      const hi = Number((b >> 32n) & 0x1FFFn) | 0
+      let h = Math.imul(hi ^ 0x9E3779B9, 0x85EBCA6B)
+      h = Math.imul(lo ^ h, 0xC2B2AE35)
+      h = (h ^ (h >>> 15)) | 0
+      return clampHash(h) >>> 0
+    }
+    const off = Number(b & 0xFFFFFFFFn), m = dv()
+    const len = m.getInt32(off - 4, true)
+    let h = 0x811c9dc5 | 0
+    for (let i = 0; i < len; i++) h = Math.imul(h ^ m.getUint8(off + i), 0x01000193) | 0
+    return clampHash(h) >>> 0
+  }
+  mem.Hash = function(obj) {
+    const entries = Object.entries(obj)
+    let cap = 8
+    while (entries.length * 4 >= cap * 3) cap <<= 1   // stay under the 75% grow trigger
+    const off = hdr(entries.length, cap, cap * 24)
+    // Stage every slot as i64 bits (empty = 0) — same NaN-canonicalization dodge as mem.Array.
+    const staged = new BigInt64Array(cap * 3)
+    entries.forEach(([k, v], seq) => {
+      const keyBox = mem.String(k)
+      const h = jzStrHash(keyBox)
+      let idx = h & (cap - 1)
+      while (staged[idx * 3] !== 0n) idx = (idx + 1) & (cap - 1)
+      staged[idx * 3] = (BigInt(seq) << 32n) | BigInt(h >>> 0)
+      staged[idx * 3 + 1] = bits(keyBox)
+      staged[idx * 3 + 2] = bits(mem.wrapVal(v))
+    })
+    const dst = new BigInt64Array(mem.buffer, off, cap * 3)
+    dst.set(staged)
+    return ptr(7, 0, off)
+  }
+
   mem.Object = function(obj) {
     const objKeys = Object.keys(obj)
     const key = objKeys.join(',')
@@ -365,8 +427,7 @@ export const memory = (src) => {
         (s.length === objKeys.length && objKeys.every(k => s.includes(k)) ? a.concat(i) : a), [])
       if (matches.length === 1) sid = matches[0]
       else if (matches.length > 1) throw Error(`Ambiguous schema for {${key}} — pass keys in schema order`)
-      else if (mem._extMap) return mem.External(obj)
-      else throw Error(`No schema for {${key}}`)
+      else return mem.Hash(obj)   // no compiled schema: first-class hash (External loses nested-mutation identity)
     }
     const schema = schemas[sid], n = schema.length, raw = alloc(n * 8)
     // Stage as i64 bits so V8 can't canonicalize NaN-payload pointers across
@@ -554,7 +615,7 @@ export const memory = (src) => {
  * Wrap raw WASM exports with JS calling convention adaptation.
  * Handles: undefined → sentinel NaN for defaults, rest-param array packing.
  */
-export const wrap = (memSrc, inst) => {
+export const wrap = (memSrc, inst, state) => {
   const restFuncs = new Map()
   const mod = inst ? memSrc : memSrc.module || memSrc
   const realInst = inst || memSrc.instance || memSrc
@@ -595,6 +656,66 @@ export const wrap = (memSrc, inst) => {
     catch { /* ignore */ }
   }
   const mem = memory(memSrc)
+  // Async boundary: a module compiled from async source exports __mt_drain /
+  // __p_state / __p_value (the jzify-injected runtime). Every export call ends
+  // the "turn" — the microtask queue drains — and a promise-shaped return
+  // adopts into a HOST Promise: settled ones immediately, pending ones (parked
+  // on a timer) settle from the after-tick sweep. Sync modules: finishRet is
+  // pass-through, zero overhead beyond one truthiness check.
+  const mtDrain = realInst.exports.__mt_drain
+  const pState = realInst.exports.__p_state
+  const pValue = realInst.exports.__p_value
+  const asyncMod = !!(mtDrain && pState && pValue)
+  const pending = []
+  // Match the raw ret's carrier to the reader's param lane (i64Exp filled
+  // below); a reader's own result may ride the i64 lane too — __p_state's
+  // NUMBER comes back as f64 bits (reinterpret), __p_value's BOX stays raw
+  // bits for mem.read.
+  const pcall = (fn, name, raw) => {
+    const lane = i64Exp.get(name)
+    return fn(typeof raw === 'bigint' ? (lane?.p?.has(0) ? raw : i64ToF64(raw)) : (lane?.p?.has(0) ? bits(raw) : raw))
+  }
+  const pStateOf = (raw) => {
+    const r = pcall(pState, '__p_state', raw)
+    return typeof r === 'bigint' ? i64ToF64(r) : r
+  }
+  const readSettled = (raw) => {
+    const v = pcall(pValue, '__p_value', raw)
+    return mem ? mem.read(v) : decode(v)
+  }
+  const sweep = () => {
+    mtDrain()
+    for (let i = pending.length - 1; i >= 0; i--) {
+      const e = pending[i]
+      const st = pStateOf(e.raw)
+      if (st < 1) continue
+      pending.splice(i, 1)
+      st === 1 ? e.resolve(readSettled(e.raw)) : e.reject(readSettled(e.raw))
+    }
+  }
+  const adopt = (raw, read) => {
+    mtDrain()
+    const st = pStateOf(raw)
+    if (st < 0) return read(raw)                    // not a promise — plain value
+    if (st === 1) return Promise.resolve(readSettled(raw))
+    if (st === 2) return Promise.reject(readSettled(raw))
+    return new Promise((resolve, reject) => pending.push({ raw, resolve, reject }))
+  }
+  if (asyncMod && state) {
+    state.afterTick = sweep
+    // Async host imports: a thenable returned by a host import becomes a jz
+    // promise (made + settled through the runtime's exports, lane-matched).
+    const mk = realInst.exports.__p_make, fin = realInst.exports.__p_finish
+    if (mk && fin) {
+      const lanes = i64Exp.get('__p_finish')
+      state.pmake = () => mk()
+      state.pfinish = (praw, st, vbits) => fin(
+        lanes?.p?.has(0) ? (typeof praw === 'bigint' ? praw : bits(praw)) : (typeof praw === 'bigint' ? i64ToF64(praw) : praw),
+        lanes?.p?.has(1) ? f64ToI64(st) : st,
+        lanes?.p?.has(2) ? vbits : i64ToF64(vbits))
+    }
+  }
+  const finishRet = (raw, read) => asyncMod ? adopt(raw, read) : read(raw)
   const lastErrBits = realInst.exports.__jz_last_err_bits
   const decodeThrown = error => {
     if (!(error instanceof WebAssembly.Exception) || !lastErrBits) throw error
@@ -669,7 +790,8 @@ export const wrap = (memSrc, inst) => {
         a.push(ie && ie.p.has(fixed) ? restArr : i64ToF64(restArr))
         try {
           const ret = fn.apply(null, a)
-          return typeof ret === 'bigint' && !(ie && ie.r) ? ret : mem.read(ret)
+          if (typeof ret === 'bigint' && !(ie && ie.r)) return ret
+          return finishRet(ret, r => mem.read(r))
         } catch (error) {
           decodeThrown(error)
         }
@@ -682,7 +804,8 @@ export const wrap = (memSrc, inst) => {
         while (args.length < len) args.push(undefined)
         try {
           const ret = fn.apply(null, args.map(i64Arg(ie, ext, memWrapVal)))
-          return typeof ret === 'bigint' && !(ie && ie.r) ? ret : mem.read(ret)
+          if (typeof ret === 'bigint' && !(ie && ie.r)) return ret
+          return finishRet(ret, r => mem.read(r))
         } catch (error) {
           decodeThrown(error)
         }
@@ -694,6 +817,26 @@ export const wrap = (memSrc, inst) => {
   return exports
 }
 
+// Host-call return marshalling shared by opts.imports wrappers, __ext_call and
+// the auto-wired web globals: a thenable becomes a jz promise (awaitable in
+// the module — settled via the async runtime's exports, then drain + sweep);
+// everything else boxes through wrapVal.
+const hostRet = (state, ret) => {
+  if (ret != null && typeof ret.then === 'function' && state.pmake) {
+    const praw = state.pmake()
+    const box = (v) => bits(state.mem ? state.mem.wrapVal(v) : coerce(v))
+    ret.then(
+      (v) => { state.pfinish(praw, 1, box(v)); state.afterTick?.() },
+      (e) => { state.pfinish(praw, 2, box(e instanceof Error ? e.message : e)); state.afterTick?.() })
+    return typeof praw === 'bigint' ? praw : bits(praw)
+  }
+  return bits(state.mem ? state.mem.wrapVal(ret) : coerce(ret))
+}
+
+// Callable web globals auto-wired from globalThis when the module imports them
+// (module/web.js lowers bare `fetch(...)` etc. to env imports under host:'js').
+const WEB_GLOBALS = new Set(['fetch'])
+
 const prepareInterop = (opts) => {
   const state = { extMap: [null], mem: null }
   opts._interp = opts._interp || {}
@@ -710,14 +853,28 @@ const prepareInterop = (opts) => {
     return (state.mem.read(propBig) in state.extMap[offset(objBig)]) ? 1 : 0
   }
   opts._interp.__ext_set = (objBig, propBig, valBig) => {
-    state.extMap[offset(objBig)][state.mem.read(propBig)] = state.mem.read(valBig)
+    let v = state.mem.read(valBig)
+    // A TYPED value decodes to a LIVE VIEW into wasm's own linear memory
+    // (mem.read's t===3 branch: `new Ctor(mem.buffer, off, len)`) — sound for
+    // a value read-and-immediately-consumed inside one host call, but a host
+    // OBJECT PROPERTY is real, persistent JS state: any later Memory.grow()
+    // (the bump allocator never frees, so any sufficiently long-running
+    // program eventually grows) detaches/reallocates `mem.buffer`, silently
+    // invalidating every such view still held on the host side — the next
+    // access throws "detached ArrayBuffer" (or, for a stale non-typed read,
+    // would silently read zeros). A host object is host-owned persistent
+    // state: store an independent copy. `.slice()` is TypedArray's native
+    // same-ctor copy — exactly `new Ctor(view)` with no manual size/offset
+    // bookkeeping — and a no-op for every other decoded value shape.
+    if (ArrayBuffer.isView(v)) v = v.slice()
+    state.extMap[offset(objBig)][state.mem.read(propBig)] = v
     return 1
   }
   opts._interp.__ext_call = (objBig, propBig, argsBig) => {
     const obj = state.extMap[offset(objBig)]
     const prop = state.mem.read(propBig)
     const args = state.mem.read(argsBig)
-    return bits(state.mem.wrapVal(obj[prop].apply(obj, args)))
+    return hostRet(state, obj[prop].apply(obj, args))
   }
   return state
 }
@@ -729,6 +886,15 @@ const installDefaultEnvImports = (mod, imports, state) => {
   const envFns = envFuncNames(mod)
   if (!envFns.size) return
   if (!imports.env) imports.env = {}
+  // Web globals (fetch, …): the module imported them because bare calls were
+  // lowered by module/web.js — bind from globalThis with full marshalling;
+  // thenables adopt into jz promises. opts.imports.env overrides win.
+  for (const name of envFns) {
+    if (imports.env[name] || !WEB_GLOBALS.has(name)) continue
+    const host = globalThis[name]
+    if (typeof host !== 'function') continue
+    imports.env[name] = (...args) => hostRet(state, host(...args.map(a => state.mem ? state.mem.read(a) : decode(a))))
+  }
   if (envFns.has('print') && !imports.env.print) {
     const buf = ['', '', '']  // fd 0/1/2 line buffers
     const pending = []
@@ -791,7 +957,9 @@ const installDefaultEnvImports = (mod, imports, state) => {
     let nextId = 1
     if (envFns.has('setTimeout') && !imports.env.setTimeout) imports.env.setTimeout = (cbBig, delayMs, repeat) => {
       const id = nextId++
-      const fire = () => state.invoke?.(cbBig)
+      // after each timer callback: drain microtasks + settle host promises
+      // parked on async exports (state.afterTick set by wrap for async modules)
+      const fire = () => { state.invoke?.(cbBig); state.afterTick?.() }
       if (repeat) {
         const h = setInterval(fire, delayMs)
         cancel.set(id, () => clearInterval(h))
@@ -877,8 +1045,7 @@ const buildImports = (mod, opts, state) => {
           // i64 carrier: args arrive as BigInt bits (box) or number; decode with integer
           // ops — never materialize a box as f64. Return the i64 bits of the wrapped result.
           const decoded = args.map(a => state.mem ? state.mem.read(a) : decode(a))
-          const ret = fn.call(fns, ...decoded)
-          return bits(state.mem ? state.mem.wrapVal(ret) : coerce(ret))
+          return hostRet(state, fn.call(fns, ...decoded))
         }
     }
   }
@@ -910,6 +1077,11 @@ const buildImports = (mod, opts, state) => {
 
 const finishInstantiation = (mod, inst, imports, needsWasi, opts, state) => {
   if (needsWasi) imports._setMemory(inst.exports.memory)
+  // WASI reactor convention: a `host: 'wasi'` module ships its init as the standard
+  // `_initialize` export (never a wasm start section — WASI calls there would fire
+  // before _setMemory above). Called for ANY module exporting it, imports or not:
+  // a hostless wasi module (no console/Date use) still needs its init run.
+  inst.exports._initialize?.()
 
   // Trampoline used by env.setTimeout/clearTimeout to fire scheduled closures.
   state.invoke = inst.exports.__invoke_closure || null
@@ -927,7 +1099,7 @@ const finishInstantiation = (mod, inst, imports, needsWasi, opts, state) => {
   // its SSO/atom boundary values), but the result's `.memory` stays null — the
   // module genuinely exposes no linear memory. `jz.memory(result)` still hands back
   // a usable reader on demand.
-  return { exports: wrap(memSrc), memory: enhanced?.scalar ? null : enhanced, instance: inst, module: mod }
+  return { exports: wrap(memSrc, undefined, state), memory: enhanced?.scalar ? null : enhanced, instance: inst, module: mod }
 }
 
 /**

package/jzify/arguments.js

@@ -19,6 +19,24 @@ function usesArguments(node) {
   return false
 }
 
+// A parameter literally named `arguments` (or a destructure / default / rest that
+// binds it) SHADOWS the arguments object: every `arguments` in the body resolves to
+// that parameter, not the args array. So the args-object lowering must not fire —
+// `function f(arguments){ return arguments }` is just a one-param function, and `f()`
+// returns undefined (not the `[]` args object). Mirrors the spec's param-scope
+// shadowing of the implicit `arguments` binding (test262 13_A15_T3).
+function paramsBindArguments(params) {
+  const bound = (p) => {
+    if (p === 'arguments') return true
+    if (!Array.isArray(p)) return false
+    if (p[0] === '=' || p[0] === '...') return bound(p[1])
+    if (p[0] === '[]' || p[0] === '{}' || p[0] === ',') return p.slice(1).some(bound)
+    if (p[0] === ':') return bound(p[2])
+    return false
+  }
+  return paramList(params).some(bound)
+}
+
 function bindsArguments(body) {
   const isArgDecl = s => Array.isArray(s) && (s[0] === 'var' || s[0] === 'let' || s[0] === 'const') &&
     s.slice(1).some(d => d === 'arguments' || (Array.isArray(d) && d[0] === '=' && d[1] === 'arguments'))
@@ -56,6 +74,15 @@ function prependParamDecls(decl, body) {
 /** @param {ReturnType<import('./names.js').createNames>} names */
 export function createArgumentsLowering(names) {
   function lowerArguments(params, body) {
+    // A param named `arguments` shadows the implicit args object: rename it (and its
+    // in-scope body refs — renameArguments stops at nested `function`s, and arrows
+    // legitimately inherit the param) to a fresh binding, so it becomes an ordinary
+    // parameter. No args-object lowering fires, and the strict-subset
+    // `arguments`-unsupported guard never sees the name. (test262 13_A15_T3.)
+    if (paramsBindArguments(params)) {
+      const fresh = names.arg()
+      return lowerArguments(renameArguments(params, fresh), renameArguments(body, fresh))
+    }
     if (bindsArguments(body)) body = renameArguments(body, names.arg())
     const paramsNeedLowering = paramList(params).some(isDestructurePat)
     const usesArgsObj = usesArguments(params) || usesArguments(body)
@@ -68,7 +95,11 @@ export function createArgumentsLowering(names) {
         continue
       }
       if (Array.isArray(param) && param[0] === '=') {
-        decls.push(['=', param[1], ['??', ['[]', name, [null, idx]], renameArguments(param[2], name)]])
+        // Param default fires ONLY on undefined, not null — `??` would take the
+        // default for a passed null. The rest-array index read is idempotent
+        // and pure, so the ternary re-reads instead of spilling a temp.
+        const read = ['[]', name, [null, idx]]
+        decls.push(['=', param[1], ['?:', ['===', read, 'undefined'], renameArguments(param[2], name), read]])
         continue
       }
       decls.push(['=', param, ['[]', name, [null, idx]]])