poe-code 14.0.80 → 14.0.81

package/packages/safe-js/dist/interp/methods/function.d.ts

@@ -1,5 +1,5 @@
 import { type SandboxCallContext, type SandboxClosure, type SandboxValue } from "../values.js";
-import type { Budget } from "../budget.js";
+import { Budget } from "../budget.js";
 export type FunctionMethodOptions = {
     budget?: Budget;
     callClosure: (closure: SandboxClosure, args: readonly SandboxValue[], stack: readonly string[], thisValue: SandboxValue, construct?: boolean, newTarget?: SandboxClosure) => Promise<SandboxValue> | SandboxValue;

package/packages/safe-js/dist/interp/methods/function.js

@@ -1,8 +1,12 @@
 import { createSandboxClosure, isSandboxClosure } from "../values.js";
-import { getGuestFunctionProperty, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure, setSandboxPrototype } from "../object-model.js";
+import { getGuestFunctionProperty, getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure, setSandboxPrototype } from "../object-model.js";
 import { assertSandboxDataDepth } from "../../graph-depth.js";
+import { Budget } from "../budget.js";
 import { functionString } from "../function-string.js";
-import { runResources } from "../resources.js";
+import { retainValues, runResources } from "../resources.js";
+import { createBoundFunction } from "../bound-function.js";
+import { sandboxNumber } from "../string-coercion.js";
+import { readPropertyDescriptor } from "../accessors.js";
 const functionMethodNames = new Set(["apply", "bind", "call", "toString"]);
 export function getFunctionMember(target, property, options) {
     let current = target;
@@ -58,40 +62,36 @@ export function callFunctionMethod(target, methodName, args, options, stack, con
     const thisValue = args[0];
     if (methodName === "bind") {
         const boundArgs = args.slice(1);
+        const explicitPrototype = hasExplicitSandboxPrototype(target);
+        const prototype = getSandboxPrototype(target, options.budget);
         const bind = (length, name) => {
-            const bound = createSandboxClosure({
-                guest: true,
-                sandbox: true,
-                name: `bound ${name}`,
-                length,
-                boundTarget: target,
-                retainedValues: () => [target, thisValue, ...boundArgs, bound.name],
-                call: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], thisValue),
-                ...(target.construct === undefined
-                    ? {}
-                    : {
-                        construct: (callArgs, context) => options.callClosure(target, [...boundArgs, ...callArgs], context?.stack ?? [], undefined, true, context?.newTarget === bound ? target : context?.newTarget)
-                    })
-            });
-            if (hasExplicitSandboxPrototype(target))
-                setSandboxPrototype(bound, getSandboxPrototype(target, options.budget), options.budget);
+            const bound = createBoundFunction({ target, thisValue, args: boundArgs }, `bound ${name}`, length, options.callClosure);
+            if (explicitPrototype)
+                setSandboxPrototype(bound, prototype, options.budget);
             return bound;
         };
         if (context?.getProperty === undefined)
             return bind(target.length === undefined ? undefined : Math.max(0, target.length - boundArgs.length), target.name ?? "");
         return (async () => {
-            const properties = target.properties;
-            const defaultName = target.name;
-            const hasLength = !isGuestClosure(target) ||
-                target.properties === undefined ||
-                Object.hasOwn(target.properties, "length");
-            const length = hasLength ? await context.getProperty(target, "length") : undefined;
-            const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name")
-                ? defaultName
-                : await context.getProperty(target, "name");
-            return bind(typeof length === "number" && !Number.isNaN(length)
-                ? Math.max(0, Math.trunc(length) - boundArgs.length)
-                : 0, typeof name === "string" ? name : "");
+            const release = options.budget !== undefined && explicitPrototype && prototype !== null
+                ? retainValues(options.budget, () => [prototype]) : undefined;
+            try {
+                const properties = target.properties;
+                const defaultName = target.name;
+                const hasLength = !isGuestClosure(target) ||
+                    target.properties === undefined ||
+                    Object.hasOwn(target.properties, "length");
+                const length = hasLength ? await context.getProperty(target, "length") : undefined;
+                const name = !isGuestClosure(target) && !Object.hasOwn(properties ?? {}, "name")
+                    ? defaultName
+                    : await context.getProperty(target, "name");
+                return bind(typeof length === "number" && !Number.isNaN(length)
+                    ? Math.max(0, Math.trunc(length) - boundArgs.length)
+                    : 0, typeof name === "string" ? name : "");
+            }
+            finally {
+                release?.();
+            }
         })();
     }
     if (methodName === "call") {
@@ -101,26 +101,39 @@ export function callFunctionMethod(target, methodName, args, options, stack, con
     if (applyArgs === null || applyArgs === undefined) {
         return options.callClosure(target, [], stack, thisValue);
     }
-    if (!Array.isArray(applyArgs)) {
-        throw new TypeError("Function#apply requires an array or nullish arguments value.");
+    if (typeof applyArgs !== "object") {
+        throw new TypeError("Function#apply requires an object or nullish arguments value.");
     }
-    if (context?.getProperty === undefined)
+    if (context?.getProperty === undefined && Array.isArray(applyArgs))
         return options.callClosure(target, applyArgs, stack, thisValue);
     return (async () => {
+        const budget = options.budget ?? new Budget();
+        const invocationContext = {
+            ...context,
+            stack,
+            thisValue: context?.thisValue,
+            invokeClosure: context?.invokeClosure ?? ((callee, values, receiver) => Promise.resolve(options.callClosure(callee, values, stack, receiver)))
+        };
+        const read = (value, key) => {
+            if (context?.getProperty !== undefined)
+                return context.getProperty(value, key);
+            const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+            return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, invocationContext);
+        };
         const values = [];
-        const length = applyArgs.length;
-        options.budget?.allocateArrayLength(length);
-        const retained = {};
-        options.budget?.setRetainedValues(retained, () => values);
+        const release = retainValues(budget, () => [applyArgs, ...values]);
         try {
+            const number = await sandboxNumber(await read(applyArgs, "length"), budget, invocationContext);
+            const length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
+            budget.allocateArrayLength(length);
             for (let index = 0; index < length; index++) {
-                options.budget?.visitNode();
-                values.push(await context.getProperty(applyArgs, index));
+                budget.visitNode();
+                values.push(await read(applyArgs, String(index)));
             }
             return await options.callClosure(target, values, stack, thisValue);
         }
         finally {
-            options.budget?.setRetainedValues(retained, undefined);
+            release();
         }
     })();
 }

package/packages/safe-js/dist/interp/methods/generator.d.ts

@@ -1,3 +1,6 @@
-import { type SandboxGenerator, type SandboxValue } from "../values.js";
+import { type SandboxCallContext, type SandboxGenerator, type SandboxValue } from "../values.js";
 import type { Budget } from "../budget.js";
+type GeneratorMethodName = "next" | "return" | "throw";
 export declare function getGeneratorMember(target: SandboxGenerator, property: string | number, budget: Budget): SandboxValue | undefined;
+export declare function callGeneratorMethod(target: SandboxValue, method: GeneratorMethodName, value: SandboxValue, budget: Budget, context: SandboxCallContext | undefined, async: boolean): SandboxValue | Promise<SandboxValue>;
+export {};

package/packages/safe-js/dist/interp/methods/generator.js

@@ -1,5 +1,5 @@
 import { generatorIterator } from "../iteration.js";
-import { allocateProducedSandboxValue, createSandboxClosure, createSandboxPromise } from "../values.js";
+import { allocateProducedSandboxValue, createSandboxClosure, createSandboxPromise, isSandboxGenerator } from "../values.js";
 const generatorMethodNames = new Set(["next", "return", "throw"]);
 export function getGeneratorMember(target, property, budget) {
     if (typeof property !== "string" || !generatorMethodNames.has(property)) {
@@ -8,10 +8,16 @@ export function getGeneratorMember(target, property, budget) {
     return createSandboxClosure({
         sandbox: true,
         name: property,
-        call: ([value], context) => {
-            const iterator = generatorIterator(target, budget, context);
-            const result = Promise.resolve(iterator[property](value)).then(result => allocateProducedSandboxValue({ value: result.value, done: result.done === true }, budget));
-            return target.async ? createSandboxPromise(result) : result;
-        }
+        call: ([value], context) => callGeneratorMethod(target, property, value, budget, context, target.async === true)
     });
 }
+export function callGeneratorMethod(target, method, value, budget, context, async) {
+    const result = (async () => {
+        if (!isSandboxGenerator(target) || (target.async === true) !== async)
+            throw new TypeError(`${async ? "AsyncGenerator" : "Generator"}.${method} requires a matching generator receiver.`);
+        const iterator = generatorIterator(target, budget, context);
+        const result = await iterator[method](value);
+        return allocateProducedSandboxValue({ value: result.value, done: result.done === true }, budget);
+    })();
+    return async ? createSandboxPromise(result) : result;
+}

package/packages/safe-js/dist/interp/object-model.js

@@ -1,5 +1,6 @@
 import { assertSandboxDataDepth } from "../graph-depth.js";
 import { getGeneratorProperties } from "./generator-properties.js";
+import { generatorPrototypes } from "./generator-prototypes.js";
 import { runResources } from "./resources.js";
 import { getIntrinsicIdentity, registerBuiltinIdentities, releaseIntrinsicIdentities } from "./intrinsics.js";
 import { releaseTemplateObjects } from "./template-objects.js";
@@ -271,6 +272,7 @@ export function releaseObjectPrototype(budget) {
     datePrototypes.delete(budget);
     arrayPrototypes.delete(budget);
     functionPrototypes.delete(budget);
+    generatorPrototypes.delete(budget);
     initialRegexDescriptors.delete(budget);
     intrinsicPrototypes.delete(budget);
 }

package/packages/safe-js/dist/snapshot/guest-heap-validation.js

@@ -4,6 +4,7 @@ import { createBuiltinBindings } from "../interp/globals.js";
 import { getIntrinsicIdentity, listIntrinsicIdentities, resolveIntrinsicIdentity } from "../interp/intrinsics.js";
 import { releaseObjectPrototype } from "../interp/object-model.js";
 import { isSandboxClosure } from "../interp/values.js";
+import { assertSnapshotDataDepth } from "../graph-depth.js";
 let intrinsicKinds;
 function intrinsicCatalogue() {
     if (intrinsicKinds !== undefined)
@@ -59,7 +60,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         createRawJson(node.text);
         return true;
     }
-    if (!["intrinsic", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
+    if (!["intrinsic", "bound-function", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
         return false;
     const reference = (value, kinds) => {
         const ref = record(value);
@@ -74,7 +75,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
     const callable = (value) => {
         if (absent(value))
             return;
-        const target = reference(value, ["intrinsic", "guest-function", "guest-class"]);
+        const target = reference(value, ["intrinsic", "bound-function", "guest-function", "guest-class"]);
         if (target.kind === "intrinsic" && intrinsicCatalogue().get(String(target.id)) !== true)
             throw new TypeError("Guest accessor reference is not callable.");
     };
@@ -199,6 +200,27 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
             throw new TypeError("Invalid class prototype descriptor.");
         reference(descriptor.value, ["object", "guest-object"]);
     }
+    else if (node.kind === "bound-function") {
+        fields(node, ["kind", "target", "thisValue", "args", "length", "state"], ["name"]);
+        if (Object.hasOwn(node, "name") && typeof node.name !== "string")
+            throw new TypeError("Invalid bound function name.");
+        if (array(node.args).length > maxArrayLength)
+            throw new TypeError("Bound arguments exceed allocation limit.");
+        if (!absent(node.length) && !(typeof node.length === "number" && node.length >= 0) &&
+            !(record(node.length).kind === "number" && record(node.length).value === "Infinity"))
+            throw new TypeError("Invalid bound function length.");
+        const visited = new Set([raw]);
+        let current = node;
+        while (current.kind === "bound-function") {
+            assertSnapshotDataDepth(visited.size, "<bound-target>");
+            callable(current.target);
+            current = reference(current.target);
+            if (visited.has(current))
+                throw new TypeError("Cyclic bound function target.");
+            visited.add(current);
+        }
+        state(node.state);
+    }
     else if (node.kind === "guest-function") {
         fields(node, ["kind", "astNodeId", "scope", "state"], ["name", "environment"]);
         if (integer(node.astNodeId) < 1)

package/packages/safe-js/dist/snapshot/guest-heap.d.ts

@@ -13,6 +13,14 @@ export type GuestObjectState<T> = {
     prototype?: T;
 };
 export type GuestHeapNode<T> = {
+    kind: "bound-function";
+    target: T;
+    thisValue: T;
+    args: T[];
+    name?: string;
+    length: T;
+    state: GuestObjectState<T>;
+} | {
     kind: "array-iterator";
     source: T;
     index: number;

package/packages/safe-js/dist/snapshot/guest-heap.js

@@ -1,4 +1,5 @@
 import { getClosureOrigin, getGeneratorOrigin } from "../interp/closure-origin.js";
+import { boundFunctionStates } from "../interp/bound-function-state.js";
 import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { getIntrinsicIdentity } from "../interp/intrinsics.js";
 import { getSandboxPrototype, hasExplicitSandboxPrototype, hasGuestObjectState, isGuestClosure, materializeFunctionProperties } from "../interp/object-model.js";
@@ -27,6 +28,12 @@ export function captureGuestHeapNode(value, encode) {
         const state = captureObjectState(value, encode);
         return { kind: "intrinsic", id: intrinsic, ...(state === undefined ? {} : { state }) };
     }
+    const bound = boundFunctionStates.get(value);
+    if (bound !== undefined && isSandboxClosure(value)) {
+        return { kind: "bound-function", target: encode(bound.target), thisValue: encode(bound.thisValue),
+            args: bound.args.map(encode), length: encode(value.length),
+            ...(value.name === undefined ? {} : { name: value.name }), state: captureObjectState(value, encode) };
+    }
     if (isSandboxMap(value))
         return { kind: "map", entries: [...value.entries].map(([key, entry]) => [encode(key), encode(entry)]), ...serializeCollectionProperties(value, encode) };
     if (isSandboxSet(value))

package/packages/safe-js/dist/snapshot/restore.js

@@ -1,4 +1,6 @@
 import { Budget, SandboxError } from "../interp/budget.js";
+import { createBoundFunction } from "../interp/bound-function.js";
+import { invokeBuiltinClosure } from "../interp/builtin-call.js";
 import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { restoreRegexProperties } from "./regexp-properties.js";
 import { classOrigins, createClassConstructor } from "../interp/classes.js";
@@ -376,6 +378,29 @@ function isSerializedRegexValue(value) {
         typeof value.flags === "string" &&
         typeof value.lastIndex === "number");
 }
+function initializeIntrinsicRealm(state) {
+    if (state.intrinsicsInitialized)
+        return;
+    const prototype = Object.values(state.heap).find(node => node.kind === "intrinsic" && node.id === '["%FunctionPrototype%"]');
+    // Older heaps could omit this property or contain a guest-defined hook.
+    // Do not preinstall a nonconfigurable property over their captured state.
+    const functionHasInstance = prototype?.kind !== "intrinsic" || prototype.state === undefined ||
+        prototype.state.properties.properties.some(([key, descriptor]) => {
+            if (key === null || typeof key !== "object" || !("kind" in key) || key.kind !== "ref")
+                return false;
+            const symbol = state.heap[String(key.id)];
+            if (symbol?.kind !== "symbol" || symbol.wellKnown !== "hasInstance" || descriptor.kind !== "data" ||
+                descriptor.writable || descriptor.enumerable || descriptor.configurable)
+                return false;
+            const value = descriptor.value;
+            if (value === null || typeof value !== "object" || !("kind" in value) || value.kind !== "ref")
+                return false;
+            const method = state.heap[String(value.id)];
+            return method?.kind === "intrinsic" && method.id === '["%FunctionPrototype%",{"symbol":"hasInstance"}]';
+        });
+    createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner, functionHasInstance });
+    state.intrinsicsInitialized = true;
+}
 function restoreHeapValue(id, state) {
     const existing = state.heapValueById.get(id);
     if (existing !== undefined) {
@@ -531,13 +556,27 @@ function restoreHeapValue(id, state) {
             });
         return generator;
     }
-    if (serialized.kind === "intrinsic" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
+    if (serialized.kind === "intrinsic" || serialized.kind === "bound-function" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
         let value;
-        if (serialized.kind === "intrinsic") {
-            if (!state.intrinsicsInitialized) {
-                createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner });
-                state.intrinsicsInitialized = true;
-            }
+        if (serialized.kind === "bound-function") {
+            initializeIntrinsicRealm(state);
+            const target = deserializeValue(serialized.target, state);
+            if (!isSandboxClosure(target))
+                throw new TypeError("Invalid bound function target.");
+            const boundState = { target, thisValue: undefined, args: [] };
+            const length = deserializeValue(serialized.length, state);
+            if (length !== undefined && typeof length !== "number")
+                throw new TypeError("Invalid bound function length.");
+            value = createBoundFunction(boundState, serialized.name, length, (callee, args, stack, thisValue, construct, newTarget) => invokeBuiltinClosure(callee, args, state.budget, { stack, thisValue, newTarget }, thisValue, construct));
+            // Allocate every bound identity before decoding arguments and receivers:
+            // either may point back to this function, including through another bind.
+            state.initializeIterators.push(() => {
+                boundState.thisValue = deserializeValue(serialized.thisValue, state);
+                boundState.args = serialized.args.map(entry => deserializeValue(entry, state));
+            });
+        }
+        else if (serialized.kind === "intrinsic") {
+            initializeIntrinsicRealm(state);
             value = resolveIntrinsicIdentity(state.budget, serialized.id);
         }
         else if (serialized.kind === "guest-class") {
@@ -578,12 +617,19 @@ function restoreHeapValue(id, state) {
                 homeObject: serialized.environment.homeObject === undefined ? undefined : deserializeValue(serialized.environment.homeObject, state),
                 newTarget: serialized.environment.newTarget === undefined ? undefined : deserializeValue(serialized.environment.newTarget, state)
             };
+            // Current generator functions need their realm before creation, not only
+            // when a later prototype reference is decoded. Earlier heaps can lack the
+            // native nonconfigurable prototype property and retain that legacy shape.
+            const initializeGeneratorPrototype = node.type !== "ArrowFunctionExpression" && node.generator &&
+                serialized.state.properties.properties.some(([key, descriptor]) => key === "prototype" && descriptor.kind === "data" && !descriptor.configurable);
+            if (initializeGeneratorPrototype)
+                initializeIntrinsicRealm(state);
             value = createInterpretedClosure(node, {
                 scope, budget: state.budget, compilation: state.compilation, rootNode: state.rootNode,
                 signal: state.signal, inferredName: serialized.name, functionEnvironment: environment,
                 callStack: [], activeLoopIterations: new Map(), restoredLoopIterations: new Map(),
                 stats: { currentDataSize: 0, nodeVisits: 0, peakDataSize: 0 }
-            }, evaluateNode, environment?.homeObject);
+            }, evaluateNode, environment?.homeObject, initializeGeneratorPrototype);
         }
         else
             value = serialized.kind === "guest-array" ? [] : Object.create(null);