poe-code 14.0.79 → 14.0.81

package/packages/safe-js/dist/interp/interpreter.js

@@ -29,17 +29,18 @@ import { getPromiseMember } from "./promise.js";
 import { acquireSandboxIterator, closeIterator, readIteratorResult, restoreSandboxIterator } from "./iteration.js";
 import { assertCollectionMutable } from "./running-state.js";
 import { getGeneratorMember } from "./methods/generator.js";
+import { getGeneratorProperties } from "./generator-properties.js";
 import { getRegexMember, setRegexMember } from "./methods/regex.js";
 import { bindPattern } from "./patterns.js";
 import { callStringMethod, getStringMember, isStringMethodName, validateStringMethodArguments } from "./methods/string.js";
 import { callSetMethod, getSetMember, isSetMethodName } from "./methods/set.js";
-import { isSandboxErrorConstructorInstance } from "./globals/error.js";
+import { evaluateInstanceof } from "./instanceof.js";
 import { hasOwnSandboxProperty } from "./globals/object.js";
 import { collectionIteratorState, isSandboxCollectionIterator } from "./collection-iterator.js";
 import { getCollectionIteratorMember } from "./methods/collection-iterator.js";
 import { isSandboxRegExpIterator, regexpIteratorState } from "./regexp-iterator.js";
 import { getRegExpIteratorMember } from "./methods/regexp-iterator.js";
-import { getFloat32Member, isFloat32ArrayConstructor, setFloat32Member } from "./globals/float32array.js";
+import { getFloat32Member, setFloat32Member } from "./globals/float32array.js";
 import { isFloat32Array } from "./float32.js";
 import { dateString, dateTime, isSandboxDate } from "./date.js";
 import { createSandboxRegex, allocateProducedSandboxValue, ownEnumerableSandboxKeys, isSandboxClosure, isSandboxGenerator, isSandboxMap, isSandboxPromise, getPromiseProperties, isSandboxRegex, getRegexProperties, getCollectionProperties, isSandboxSet, reconcileCompiledValues } from "./values.js";
@@ -1494,7 +1495,7 @@ function forInKeys(object, budget) {
         if (depth > 0)
             budget.visitNode();
         assertSandboxDataDepth(depth++);
-        const properties = isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : isSandboxRegex(current) ? getRegexProperties(current) : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
+        const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : isSandboxRegex(current) ? getRegexProperties(current) : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
         for (const key of Object.getOwnPropertyNames(properties)) {
             if (seen.has(key))
                 continue;
@@ -1515,7 +1516,7 @@ function hasForInProperty(object, key, budget) {
         if (depth > 0)
             budget.visitNode();
         assertSandboxDataDepth(depth++);
-        const properties = isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : isSandboxRegex(current) ? getRegexProperties(current) : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
+        const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxPromise(current) ? getPromiseProperties(current) : isGuestClosure(current) ? materializeFunctionProperties(current) : isSandboxClosure(current) ? current.properties ?? {} : isSandboxRegex(current) ? getRegexProperties(current) : isSandboxMap(current) || isSandboxSet(current) ? getCollectionProperties(current) : current;
         if (Object.hasOwn(properties, key))
             return true;
     }
@@ -2097,7 +2098,8 @@ function getPropertyValue(target, property, context, receiver = target) {
     if (isSandboxCollectionIterator(target))
         return getCollectionIteratorMember(target, property, context.budget);
     if (isSandboxGenerator(target))
-        return getGeneratorMember(target, property, context.budget);
+        return hasExplicitSandboxPrototype(target)
+            ? undefined : getGeneratorMember(target, property, context.budget);
     if (isSandboxClosure(target))
         return getClosureMemberValue(target, property, context);
     if (isSandboxPromise(target))
@@ -2384,7 +2386,7 @@ async function evaluateMemberCallExpression(node, context) {
             return evaluatePrimitiveMemberCall(node, "Set", member.property, getSetMember(member.object, member.property, createSetMethodOptions(context)), context);
         }
         if (isSandboxGenerator(member.object)) {
-            const memberValue = getGeneratorMember(member.object, member.property, context.budget);
+            const memberValue = await getPropertyValue(member.object, member.property, context);
             if (memberValue === undefined) {
                 throw new TypeError(`Generator#${String(member.property)} is not a supported method.`);
             }
@@ -2602,48 +2604,11 @@ function applyBinaryOperator(node, left, right, context) {
         case ">>>":
             return toNumber(left) >>> toNumber(right);
         case "instanceof":
-            return evaluateInstanceof(left, right, context);
+            return evaluateInstanceof(left, right, context.budget, createCoercionContext(context));
         case "in":
             return hasSandboxProperty(right, left, context);
     }
 }
-async function evaluateInstanceof(left, right, context) {
-    while (true) {
-        if (right === null || (typeof right !== "object" && typeof right !== "function"))
-            throw new TypeError("Right-hand side of 'instanceof' must be an object.");
-        const method = await getPropertyValue(right, Symbol.hasInstance, context);
-        if (method !== undefined && method !== null) {
-            if (!isSandboxClosure(method))
-                throw new TypeError("Symbol.hasInstance must be callable.");
-            return Boolean(await invokeSandboxClosure(method, [left], context, context.callStack, undefined, right));
-        }
-        if (!isSandboxClosure(right))
-            throw new TypeError("Right-hand side of 'instanceof' is not a function.");
-        if (right.boundTarget === undefined)
-            break;
-        context.budget.visitNode();
-        right = right.boundTarget;
-    }
-    if (isFloat32ArrayConstructor(right))
-        return isFloat32Array(left);
-    if (isSandboxErrorConstructorInstance(left, right))
-        return true;
-    if (isGuestClosure(right)) {
-        if (typeof left !== "object" || left === null)
-            return false;
-        const prototype = await getPropertyValue(right, "prototype", context);
-        if (typeof prototype !== "object" || prototype === null)
-            throw new TypeError("Function has a non-object prototype in instanceof check.");
-        let depth = 0;
-        for (let current = getSandboxPrototype(left, context.budget); current !== null; current = getSandboxPrototype(current, context.budget)) {
-            context.budget.visitNode();
-            assertSandboxDataDepth(depth++);
-            if (current === prototype)
-                return true;
-        }
-    }
-    return false;
-}
 export function createCoercionContext(context) {
     return {
         stack: context.callStack,
@@ -2662,7 +2627,7 @@ function hasSandboxProperty(value, key, context) {
             return typeof key === "symbol" ? false : hasHostObjectMember(current, String(key));
         if (hasOwnSandboxProperty(current, key, false))
             return true;
-        if (!isSandboxDate(current) && !isSandboxRegex(current) && !isSandboxMap(current) && !isSandboxSet(current) && !((isGuestClosure(current) || Array.isArray(current)) && hasExplicitSandboxPrototype(current)) &&
+        if (!isSandboxDate(current) && !isSandboxRegex(current) && !isSandboxMap(current) && !isSandboxSet(current) && !((isGuestClosure(current) || isSandboxGenerator(current) || Array.isArray(current)) && hasExplicitSandboxPrototype(current)) &&
             (Array.isArray(current) || !isPlainSandboxObject(current) ||
                 isSandboxDate(current) || isFloat32Array(current) || isSandboxGenerator(current) || isSandboxCollectionIterator(current) || isSandboxRegExpIterator(current))) {
             return getPropertyValue(current, key, context) !== undefined;
@@ -2941,6 +2906,8 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
         target = materializeFunctionProperties(target);
     if (isSandboxPromise(target))
         target = getPromiseProperties(target);
+    if (isSandboxGenerator(target))
+        target = getGeneratorProperties(target);
     if (isSandboxMap(target) || isSandboxSet(target))
         target = getCollectionProperties(target);
     if (isFloat32Array(target)) {
@@ -2977,7 +2944,7 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
             for (let prototype = getSandboxPrototype(prototypeOwner, budget); prototype !== null; prototype = getSandboxPrototype(prototype, budget)) {
                 budget.visitNode();
                 assertSandboxDataDepth(depth++);
-                const properties = isSandboxClosure(prototype) ? prototype.properties : prototype;
+                const properties = isSandboxGenerator(prototype) ? getGeneratorProperties(prototype) : isSandboxClosure(prototype) ? prototype.properties : prototype;
                 const inherited = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
                 if (inherited === undefined)
                     continue;
@@ -2997,7 +2964,7 @@ function setSuperProperty(base, receiver, key, value, context) {
     for (let current = base; current !== null; current = getSandboxPrototype(current, budget)) {
         budget.visitNode();
         assertSandboxDataDepth(depth++);
-        const properties = isSandboxClosure(current) ? current.properties : current;
+        const properties = isSandboxGenerator(current) ? getGeneratorProperties(current) : isSandboxClosure(current) ? current.properties : current;
         const descriptor = properties === undefined ? undefined : Object.getOwnPropertyDescriptor(properties, key);
         if (descriptor === undefined)
             continue;
@@ -3020,6 +2987,8 @@ export function deleteSandboxProperty(target, property) {
         target = getRegexProperties(target);
     if (isSandboxPromise(target))
         target = getPromiseProperties(target);
+    if (isSandboxGenerator(target))
+        target = getGeneratorProperties(target);
     if (isSandboxMap(target) || isSandboxSet(target))
         target = getCollectionProperties(target);
     if (Array.isArray(target)) {

package/packages/safe-js/dist/interp/iteration.js

@@ -14,6 +14,7 @@ import { suspendJob } from "./jobs.js";
 import { invokeBuiltinClosure } from "./builtin-call.js";
 import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype } from "./object-model.js";
 import { getIntrinsicIdentity } from "./intrinsics.js";
+import { readPropertyDescriptor } from "./accessors.js";
 export function mapIteratorSnapshot(snapshot, map) {
     if (snapshot.kind === "unsupported")
         throw new TypeError("Host-owned iterator cannot be portably snapshotted.");
@@ -31,8 +32,9 @@ export async function restoreSandboxIterator(snapshot, budget, context, signal)
         return asyncFromSyncIterator(await restoreSandboxIterator(snapshot.inner, budget, context, signal), budget, signal, context);
     if (Array.isArray(snapshot.value))
         return arrayIterator(snapshot.value, context, budget, snapshot.index);
-    const iterator = isSandboxGenerator(snapshot.value) && snapshot.value.async
-        ? getSandboxAsyncIterator(snapshot.value, budget, context, signal)
+    const iterator = isSandboxGenerator(snapshot.value)
+        ? { ...generatorObjectIterator(snapshot.value, budget, context),
+            ...(snapshot.value.async ? { asyncProtocol: true } : {}) }
         : getSandboxIterator(snapshot.value, budget, context);
     if (iterator === undefined)
         throw new TypeError("Invalid builtin iterator snapshot.");
@@ -49,11 +51,15 @@ export async function acquireSandboxIterator(value, budget, context, asyncProtoc
             : getSandboxIterator(value, budget, context);
     if (getSandboxPropertyDescriptor(value, key, budget) === undefined &&
         !(isSandboxRegExpIterator(value) && !asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)) {
+        if (isSandboxGenerator(value)) {
+            if (!hasExplicitSandboxPrototype(value) && (value.async === true) === asyncProtocol && getSandboxPropertyDescriptor(value, "next", budget) !== undefined)
+                return guestIterator(value, await context.getProperty(value, "next"), asyncProtocol, budget, context, signal);
+        }
         if (!asyncProtocol && Array.isArray(value) && getSandboxPrototype(value, budget) !== null)
             return undefined;
         if (!asyncProtocol)
             return getSandboxIterator(value, budget, context);
-        if (isSandboxGenerator(value) && value.async)
+        if (isSandboxGenerator(value) && value.async && !hasExplicitSandboxPrototype(value))
             return getSandboxAsyncIterator(value, budget, context, signal);
         const iterator = await acquireSandboxIterator(value, budget, context);
         return iterator === undefined ? undefined : asyncFromSyncIterator(iterator, budget, signal, context);
@@ -130,7 +136,9 @@ export async function readIteratorResult(iterator, result, property) {
 }
 export function getSandboxAsyncIterator(value, budget, context, signal) {
     if (isSandboxGenerator(value) && value.async) {
-        return { ...generatorIterator(value, budget, context), asyncProtocol: true };
+        return hasExplicitSandboxPrototype(value) ? context?.getProperty === undefined
+            ? generatorProtocolAdapter(value, budget, context, true, signal) : undefined
+            : { ...generatorObjectIterator(value, budget, context), asyncProtocol: true };
     }
     if (value !== null &&
         (typeof value === "object" || typeof value === "function") &&
@@ -288,7 +296,12 @@ export function getSandboxIterator(value, budget, context) {
         return syncIterator(Float32Array.prototype.values.call(value));
     }
     if (isSandboxGenerator(value)) {
-        return value.async ? undefined : generatorIterator(value);
+        if (value.async)
+            return undefined;
+        if (hasExplicitSandboxPrototype(value))
+            return context?.getProperty === undefined
+                ? generatorProtocolAdapter(value, budget ?? new Budget(), context, false) : undefined;
+        return generatorObjectIterator(value, budget, context);
     }
     if (typeof value === "string") {
         const iterator = value[Symbol.iterator]();
@@ -373,6 +386,64 @@ function collectionIterator(collection, value) {
     return adapter;
 }
 const asyncGeneratorRequests = new WeakMap();
+function generatorProtocolAdapter(value, budget, context, asyncProtocol, signal) {
+    // Direct host adapters still need guest property reads, receiver binding and
+    // cached next methods, but retain their asynchronous generator result channel.
+    const bridge = {
+        ...context,
+        stack: context?.stack ?? [],
+        thisValue: value,
+        invokeClosure: (closure, args, receiver, construct) => invokeBuiltinClosure(closure, args, budget, context, receiver, construct),
+        getProperty: (target, key) => {
+            const descriptor = getSandboxPropertyDescriptor(target, key, budget);
+            return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, target, bridge, true);
+        }
+    };
+    let resolved;
+    let pending;
+    const initialize = () => pending ??= acquireSandboxIterator(value, budget, bridge, asyncProtocol, signal).then(iterator => {
+        if (iterator === undefined)
+            throw new TypeError("Generator does not provide an iterator protocol.");
+        return resolved = iterator;
+    });
+    return {
+        asynchronous: true,
+        ...(asyncProtocol ? { asyncProtocol: true } : {}),
+        get retainedValue() { return [value, resolved?.retainedValue]; },
+        snapshot: () => resolved?.snapshot?.() ?? { kind: "unsupported" },
+        next: async (...args) => (await initialize()).next(...args),
+        getOperation: async (method) => {
+            const iterator = await initialize();
+            return iterator.getOperation === undefined ? iterator[method] : iterator.getOperation(method);
+        },
+        readResultProperty: async (result, property) => readIteratorResult(await initialize(), result, property)
+    };
+}
+function generatorObjectIterator(generator, budget, context) {
+    const iterator = generatorIterator(generator, budget, context);
+    if (context?.getProperty === undefined)
+        return iterator;
+    return {
+        ...iterator,
+        getOperation: async (method) => {
+            if (method === "next" || (!hasExplicitSandboxPrototype(generator) &&
+                getSandboxPropertyDescriptor(generator, method, budget) === undefined))
+                return iterator[method];
+            const operation = await context.getProperty(generator, method);
+            if (operation === undefined || operation === null)
+                return undefined;
+            if (!isSandboxClosure(operation))
+                throw new TypeError("Iterator operation must be callable.");
+            return async (...args) => {
+                const result = await invokeBuiltinClosure(operation, args, budget ?? new Budget(), context, generator);
+                return (generator.async ? await awaitSandboxValue(result, undefined, budget, context) : result);
+            };
+        },
+        readResultProperty: async (result, property) => ({
+            value: await context.getProperty(result, property)
+        })
+    };
+}
 export function generatorIterator(generator, budget, context) {
     const invoke = async (method, value) => {
         const leaveRunning = enterRunningState(generator);

package/packages/safe-js/dist/interp/methods/function.d.ts

@@ -1,7 +1,10 @@
-import { type SandboxClosure, type SandboxValue } from "../values.js";
-import type { Budget } from "../budget.js";
+import { type SandboxCallContext, type SandboxClosure, type SandboxValue } from "../values.js";
+import { Budget } from "../budget.js";
 export type FunctionMethodOptions = {
     budget?: Budget;
     callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue: SandboxValue, construct?: boolean, newTarget?: SandboxClosure) => Promise<SandboxValue> | SandboxValue;
 };
+type FunctionMethodName = "apply" | "bind" | "call" | "toString";
 export declare function getFunctionMember(target: SandboxClosure, property: string | number, options: FunctionMethodOptions): SandboxValue | undefined;
+export declare function callFunctionMethod(target: SandboxValue, methodName: FunctionMethodName, args: readonly SandboxValue[], options: FunctionMethodOptions, stack: readonly string[], context?: SandboxCallContext): Promise<SandboxValue> | SandboxValue;
+export {};

package/packages/safe-js/dist/interp/methods/function.js

@@ -1,8 +1,12 @@
 import { createSandboxClosure, isSandboxClosure } from "../values.js";
-import { getGuestFunctionProperty, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure, setSandboxPrototype } from "../object-model.js";
+import { getGuestFunctionProperty, getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure, setSandboxPrototype } from "../object-model.js";
 import { assertSandboxDataDepth } from "../../graph-depth.js";
+import { Budget } from "../budget.js";
 import { functionString } from "../function-string.js";
-import { runResources } from "../resources.js";
+import { retainValues, runResources } from "../resources.js";
+import { createBoundFunction } from "../bound-function.js";
+import { sandboxNumber } from "../string-coercion.js";
+import { readPropertyDescriptor } from "../accessors.js";
 const functionMethodNames = new Set(["apply", "bind", "call", "toString"]);
 export function getFunctionMember(target, property, options) {
     let current = target;
@@ -22,7 +26,7 @@ export function getFunctionMember(target, property, options) {
         else if (Object.hasOwn(current, String(property))) {
             return current[String(property)];
         }
-        if (isSandboxClosure(current) && !hasExplicitSandboxPrototype(current))
+        if (isSandboxClosure(current) && !hasExplicitSandboxPrototype(current) && getSandboxPrototype(current, options.budget) === null)
             break;
         current = getSandboxPrototype(current, options.budget);
         if (current !== null) {
@@ -47,7 +51,7 @@ export function getFunctionMember(target, property, options) {
 function isFunctionMethodName(property) {
     return typeof property === "string" && functionMethodNames.has(property);
 }
-function callFunctionMethod(target, methodName, args, options, stack, context) {
+export function callFunctionMethod(target, methodName, args, options, stack, context) {
     if (!isSandboxClosure(target)) {
         throw new TypeError(`Function#${methodName} requires a callable receiver.`);
     }
@@ -58,40 +62,36 @@ function callFunctionMethod(target, methodName, args, options, stack, context) {
     const thisValue = args[0];
     if (methodName === "bind") {
         const boundArgs = args.slice(1);
+        const explicitPrototype = hasExplicitSandboxPrototype(target);
+        const prototype = getSandboxPrototype(target, options.budget);
         const bind = (length, name) => {
-            const bound = createSandboxClosure({
-                guest: true,
-                sandbox: true,
-                name: `bound ${name}`,
-                length,
-                boundTarget: target,
-                retainedValues: () => [target, thisValue, ...boundArgs, bound.name],
-                call: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], thisValue),
-                ...(target.construct === undefined
-                    ? {}
-                    : {
-                        construct: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], undefined, true, context?.newTarget === bound ? target : context?.newTarget)
-                    })
-            });
-            if (hasExplicitSandboxPrototype(target))
-                setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+            const bound = createBoundFunction({ target, thisValue, args: boundArgs }, `bound ${name}`, length, options.callClosure);
+            if (explicitPrototype)
+                setSandboxPrototype(bound, prototype, options.budget);
             return bound;
         };
         if (context?.getProperty === undefined)
             return bind(target.length === undefined ? undefined : Math.max(0, target.length - boundArgs.length), target.name ?? "");
         return (async () => {
-            const properties = target.properties;
-            const defaultName = target.name;
-            const hasLength = !isGuestClosure(target) ||
-                target.properties === undefined ||
-                Object.hasOwn(target.properties, "length");
-            const length = hasLength ? await context.getProperty(target, "length") : undefined;
-            const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name")
-                ? defaultName
-                : await context.getProperty(target, "name");
-            return bind(typeof length === "number" && !Number.isNaN(length)
-                ? Math.max(0, Math.trunc(length) - boundArgs.length)
-                : 0, typeof name === "string" ? name : "");
+            const release = options.budget !== undefined && explicitPrototype && prototype !== null
+                ? retainValues(options.budget, () => [prototype]) : undefined;
+            try {
+                const properties = target.properties;
+                const defaultName = target.name;
+                const hasLength = !isGuestClosure(target) ||
+                    target.properties === undefined ||
+                    Object.hasOwn(target.properties, "length");
+                const length = hasLength ? await context.getProperty(target, "length") : undefined;
+                const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name")
+                    ? defaultName
+                    : await context.getProperty(target, "name");
+                return bind(typeof length === "number" && !Number.isNaN(length)
+                    ? Math.max(0, Math.trunc(length) - boundArgs.length)
+                    : 0, typeof name === "string" ? name : "");
+            }
+            finally {
+                release?.();
+            }
         })();
     }
     if (methodName === "call") {
@@ -101,26 +101,39 @@ function callFunctionMethod(target, methodName, args, options, stack, context) {
     if (applyArgs === null || applyArgs === undefined) {
         return options.callClosure(target, [], stack, thisValue);
     }
-    if (!Array.isArray(applyArgs)) {
-        throw new TypeError("Function#apply requires an array or nullish arguments value.");
+    if (typeof applyArgs !== "object") {
+        throw new TypeError("Function#apply requires an object or nullish arguments value.");
     }
-    if (context?.getProperty === undefined)
+    if (context?.getProperty === undefined && Array.isArray(applyArgs))
         return options.callClosure(target, applyArgs, stack, thisValue);
     return (async () => {
+        const budget = options.budget ?? new Budget();
+        const invocationContext = {
+            ...context,
+            stack,
+            thisValue: context?.thisValue,
+            invokeClosure: context?.invokeClosure ?? ((callee, values, receiver) => Promise.resolve(options.callClosure(callee, values, stack, receiver)))
+        };
+        const read = (value, key) => {
+            if (context?.getProperty !== undefined)
+                return context.getProperty(value, key);
+            const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+            return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, invocationContext);
+        };
         const values = [];
-        const length = applyArgs.length;
-        options.budget?.allocateArrayLength(length);
-        const retained = {};
-        options.budget?.setRetainedValues(retained, () => values);
+        const release = retainValues(budget, () => [applyArgs, ...values]);
         try {
+            const number = await sandboxNumber(await read(applyArgs, "length"), budget, invocationContext);
+            const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
+            budget.allocateArrayLength(length);
             for (let index = 0; index < length; index++) {
-                options.budget?.visitNode();
-                values.push(await context.getProperty(applyArgs, index));
+                budget.visitNode();
+                values.push(await read(applyArgs, String(index)));
             }
             return await options.callClosure(target, values, stack, thisValue);
         }
         finally {
-            options.budget?.setRetainedValues(retained, undefined);
+            release();
         }
     })();
 }

package/packages/safe-js/dist/interp/methods/generator.d.ts

@@ -1,3 +1,6 @@
-import { type SandboxGenerator, type SandboxValue } from "../values.js";
+import { type SandboxCallContext, type SandboxGenerator, type SandboxValue } from "../values.js";
 import type { Budget } from "../budget.js";
+type GeneratorMethodName = "next" | "return" | "throw";
 export declare function getGeneratorMember(target: SandboxGenerator, property: string | number, budget: Budget): SandboxValue | undefined;
+export declare function callGeneratorMethod(target: SandboxValue, method: GeneratorMethodName, value: SandboxValue, budget: Budget, context: SandboxCallContext | undefined, async: boolean): SandboxValue | Promise<SandboxValue>;
+export {};

package/packages/safe-js/dist/interp/methods/generator.js

@@ -1,5 +1,5 @@
 import { generatorIterator } from "../iteration.js";
-import { allocateProducedSandboxValue, createSandboxClosure, createSandboxPromise } from "../values.js";
+import { allocateProducedSandboxValue, createSandboxClosure, createSandboxPromise, isSandboxGenerator } from "../values.js";
 const generatorMethodNames = new Set(["next", "return", "throw"]);
 export function getGeneratorMember(target, property, budget) {
     if (typeof property !== "string" || !generatorMethodNames.has(property)) {
@@ -8,10 +8,16 @@ export function getGeneratorMember(target, property, budget) {
     return createSandboxClosure({
         sandbox: true,
         name: property,
-        call: ([value], context) => {
-            const iterator = generatorIterator(target, budget, context);
-            const result = Promise.resolve(iterator[property](value)).then(result => allocateProducedSandboxValue({ value: result.value, done: result.done === true }, budget));
-            return target.async ? createSandboxPromise(result) : result;
-        }
+        call: ([value], context) => callGeneratorMethod(target, property, value, budget, context, target.async === true)
     });
 }
+export function callGeneratorMethod(target, method, value, budget, context, async) {
+    const result = (async () => {
+        if (!isSandboxGenerator(target) || (target.async === true) !== async)
+            throw new TypeError(`${async ? "AsyncGenerator" : "Generator"}.${method} requires a matching generator receiver.`);
+        const iterator = generatorIterator(target, budget, context);
+        const result = await iterator[method](value);
+        return allocateProducedSandboxValue({ value: result.value, done: result.done === true }, budget);
+    })();
+    return async ? createSandboxPromise(result) : result;
+}

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -7,6 +7,7 @@ export declare function getGuestFunctionProperties(closure: SandboxClosure): San
 export declare function materializeFunctionProperties(closure: SandboxClosure): SandboxObject;
 export declare function getGuestFunctionProperty(closure: SandboxClosure, key: PropertyKey): SandboxValue;
 export declare function installObjectPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;
+export declare function installFunctionPrototype(budget: Budget, prototype: SandboxClosure): void;
 export declare function installBoxedPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure, kind?: BoxedKind): void;
 export declare function getBoxedPrototype(value: BoxedPrimitive, budget: Budget): SandboxObject | undefined;
 export declare function installRegexPrototype(budget: Budget, prototype: SandboxObject, constructor: SandboxClosure): void;